Kane CLI vs Puppeteer (archived MCP reference server)

Kane CLI 77

0.10.0 on npm on 28 October 2026, 4 days ago (30). 28 releases from 3 August to 1 November 2026, 0.8.4 to 0.10.0, each in the changelog (20). The repository has 337 commits, pull requests up to #222 merged within days by LambdaTest staff, a Discord and an issue tracker. GitHub's API wasn't reachable from this session, so open issues and reply times weren't counted (12 of 25). Not an MCP server. The CLI and skill are current on npm and a Homebrew tap, with no SDK (10 of 15). CI runs the skill installer's tests on Linux, macOS and Windows with Node 18 and 22. The CLI's own source and tests aren't public, and the main package carries no npm provenance attestation while the skill package does (5 of 10). Kane CLI is six and a half months old by its first npm release.

Puppeteer (archived MCP reference server) 0

Last release 2025.5.12 on 12 May 2025 (0). No releases in the last 90 days (0). Archived on 29 May 2025 and read-only (0). Not in the official MCP registry (0). Pinned to MCP SDK 1.0.1 and an unsupported Puppeteer major (0).

Kane CLI 20

No x402, MPP or L402 (0). Plan prices are public per the listing check of 1 November 2026 (Starter $17 a month billed annually, Pro $89), and run_end reports credits per run, but the credit price per run isn't published, so plan-only pricing (10). The release says "free to start" and the check found a 10,000-credit, 30-day trial; whether it needs a card couldn't be read today. Judgement call (10 of 20). A person signs up and approves OAuth in a browser, or copies an access key from the dashboard, before any run (0).

Puppeteer (archived MCP reference server) 60

Free, self-hosted, nothing to buy, so 20 + 20 + 20. No payment protocol (0). The rubric is mechanical here and says nothing in favour of installing it.

Kane CLI 38

The editorial half. The wrapper, skill and docs are Apache-2.0. The runner, assurance and pinned Node binaries are labelled Apache-2.0 on npm with no source in the linked repository, and the service terms couldn't be read (12 of 30). The repository says what leaves the machine. Every run uploads to Test Manager with screenshots and an evidence pack recording the user's name and email, secrets are masked, credentials are stored with mode 0600, and the evidence viewer reads packs locally. The privacy policy, DPA and retention periods are on testmuai.com and weren't read (10 of 30). The changelog calls out breaking changes, such as the removal of the bare-objective shortcut in 0.4.1, but there's no deprecation policy or dated notice period (5 of 20). The changelog describes telemetry (a remote log, support ids, errors spooled and sent at exit) and a daily npm update check. The opt-out KANE_TELEMETRY=0 appears only in a skill reference, not the user guide (8 of 20).

Puppeteer (archived MCP reference server) 77

MIT, an OSI licence (30). Local software that keeps screenshots and console logs in memory and talks only to the pages it opens (20). The GitHub banner dates the archive to 29 May 2025 and the archive README says no security updates will follow. Neither the archive, the main repository's Archived list nor the npm deprecation message names a successor, where the Brave and Slack entries do (10). No telemetry (20).

Kane CLI 50

Graded with the hosted lines, because every run, exploration and design job goes through TestMu AI's service and spends credits, and Exploration runs on HyperExecute. status.lambdatest.io (Statusfy) lists Kane CLI and KaneAI as their own components with incident history and an Atom feed (20). From 3 August to 1 November 2026 no incident names Kane CLI or KaneAI. The platform under it had test creation timeouts from 09:00 to 13:30 UTC on 28 September with slow Automation and HyperExecute starts, six hours of partial macOS HyperExecute degradation on 25 September, and real-device partial outages on 21 August and 22 October (57 minutes). Judgement call, 10 for multi-hour degradation of the service runs depend on. No request rate limit is published; the only numbers are Exploration's built-in limits (an hour, 400 actions or 800 model calls), 20 cloud browsers and a 15-minute real-device queue (5 of 15). No 429 or Retry-After guidance. maintain reconcile is documented as idempotent, Exploration refuses a second run with RUN_ACTIVE, and the skill says never to rerun a paid command just to get a support id (5 of 15). No SLA found; the terms weren't readable (0). Nothing in the repository labels Kane CLI or Exploration beta or preview (10).

Puppeteer (archived MCP reference server) 12

Archived and superseded, so we scored what's left as a local stdio package. @modelcontextprotocol/server-puppeteer 2025.5.12 still installs from npm, deprecated there with a generic message, and no runtime is stated (10). No tests and no CI for it in the archive (0). The repository has been read-only since 29 May 2025, so nobody can file or fix a crash, and console logs collect in an array that never empties (0). A date version and no changelog (2). Never 1.0 and never declared stable (0).

Kane CLI 77

No OpenAPI or JSON Schema file. The NDJSON events are documented in typed Markdown tables, run_end is declared stable across versions, and each command family has its event list (10 of 25). Markdown docs in the repository, an agent skill and a context7.json for agents. The agents.md guide on testmuai.com wasn't readable and no llms.txt was checked (10). The user guide and skill say when to use run, testmd, testrun, assurance or Exploration, and when not (Exploration when there are no written requirements, read_only for data you care about) (17 of 20). Flag tables give defaults and allowed values for --mode, --target, --policy and --bug-detection; --variables and --session-context take free-form JSON (12 of 15). Examples throughout, exit-code tables and troubleshooting tables with named failures such as failed:setup_failed and RUN_ACTIVE. The README's run_end example names credits while the skill names credits_consumed (13 of 15). Semantic versions with a dated Keep a Changelog file and git tags (15).

Puppeteer (archived MCP reference server) 41

Seven tools with JSON Schema inputs and required lists on every one, but launchOptions is a free-form object (20). The README is Markdown on GitHub, no llms.txt (5). Descriptions are three to nine words, "Navigate to a URL", "Execute JavaScript in the browser console", with no when-to-use guidance (4). No enums or constraints. Selectors and scripts are free strings (6). The README shows launchOptions examples, and failures come back as isError text such as "Script execution failed" (6). No versioning or changelog beyond the date version (0).

Kane CLI 55

Two credential routes. OAuth with browser consent and token revocation on logout, scopes not documented; or the account's username and access key, which the docs say lets anyone holding it run tests on the account, passed as a command-line flag in CI. Not in a URL. 20 of 30 for revocable credentials without documented scopes. Exploration's read_only policy blocks write requests to any host and never presses Delete, Sign out or Pay, with --deny, --allow-domain and --allow-post, and the first mutating run in a project asks once on a terminal. The default is mutating, with no confirmation in agent mode (12 of 20). Results include text from the page under test. The 0.10.0 content fence masks secrets before they leave the worker, but no prompt-injection guidance was found (2 of 15). Every run lands in Test Manager with screenshots, evidence packs record steps and logs, and Exploration findings keep a history naming who changed what (13 of 15). SECURITY.md with security@testmuai.com, signed and notarised binaries per the README, npm registry signatures. No bug bounty, certification or security.txt could be checked, since testmuai.com wasn't readable, and SECURITY.md's supported versions list only 0.1.x (8 of 20).

Puppeteer (archived MCP reference server) 22

No credentials to leak and nothing to scope, so the middle band (20). The guard against dangerous Chrome flags such as --no-sandbox is switched off by allowDangerous: true in the puppeteer_navigate arguments, so the model or a page that steers it can lift it. The Docker mode always launches with --no-sandbox --single-process --no-zygote, and puppeteer_evaluate runs any script (2). Page content and console output reach the model unmarked, with no injection guidance. The README's only caution is that the browser can reach local files and internal addresses (0). No call log (0). The archive README says "NO SECURITY GUARANTEES", and the pinned Puppeteer ^23.4.0 is itself deprecated on npm as "< 24.15.0 is no longer supported" (0).