Anchor Browser

# Fix list: Anchor Browser

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/anchor-browser, the October 2026 research run, assessed 8 October 2026. Grade B, 67.3 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Anchor Browser: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Security & auth, 54 out of 100, up to 8.1 more on the total

Why it scored 54: API keys in the `anchor-api-key` header, per project. The MCP servers also accept OAuth through signin.anchorbrowser.io with `mcp:tools` and `mcp:admin` scopes. No key scopes, expiry or rotation guidance were found in the docs (22). The documented CDP connection passes the key as `apiKey` in the `wss://connect.anchorbrowser.io` URL, a secret in a query string (minus 10). No read-only API key. Live view has a read-only mode, volumes mount read-only, secrets can be limited to matching domains, identities sign in without returning credentials, and tasks can pause for a person's input (13). No prompt-injection guidance was found in the docs. Secret values and sensitive data masking keep credentials out of the model's view, which is a partial mitigation (4). Recordings, session history, webhook delivery logs and a billing endpoint give the operator a trail. The audit logs on the security page are restricted to Anchor's staff (11). SOC 2 Type 2, ISO 27001 and HIPAA per the security page and trust portal, with reports behind an access request, and a disclosure contact in the SDK's SECURITY.md. No security.txt or bug bounty was found (14).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 2. Payments & pricing, 60 out of 100, up to 5 more on the total

Why it scored 60: No machine payment protocol was confirmed on Anchor's own endpoints. A blog post dated 29 August 2025 shows x402 on `POST /v1/sessions`, but our unpaid request on 8 October 2026 returned 401 and the docs don't describe it. The session option named `x402` lets a browser pay other sites (0). Per-browser, per-hour, per-GB and per-step prices are published without login (20). The Free plan has $5 of credits a month, and Agent Access grants 1 credit with no account and no card. Whether dashboard signup asks for a card was not read (20). Agent Access issues an API key through two unauthenticated calls and a puzzle. `GET /v1/agent-access` answered with the flow on 8 October 2026. We did not complete it (20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 3. Agent ergonomics, 73 out of 100, up to 4.4 more on the total

Why it scored 73: The main MCP server lists about 24 tools and reaches the other REST routes through `list_endpoints`, `get_endpoint` and two call tools. Browser control and per-site actions are separate servers, and the docs warn that `/v1/mcp/actions` without a domain lists thousands of tools. 15 for the tool count plus 5 for the split servers (20). Session lists take `page`, `limit`, sort, search and filters by status, tag, domain and date, volumes use a cursor, and webhook deliveries take `limit` and `offset` (17). Errors return an integer code and a message, 402 marks exhausted credits, and Agent Access errors name the next call. No stable machine-readable error codes were found (13). No idempotency keys. The MCP server splits `call_endpoint_read` from `call_endpoint_write`, and batch sessions have a retry-failed call. Tool annotations were not read because the server needs a key (8). A session starts from an empty body, and the SDKs cover TypeScript and Python (15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 4. Transparency & trust, 51 out of 100, up to 4.3 more on the total

Made of editorial 40, provenance 61.

Why it scored 51: The service is closed. The SDKs and the self-hosted MCP server are Apache-2.0. The only terms published are a website terms of use dated 16 March 2025, which grants personal, non-commercial use of the site and does not cover the API, so the terms for the paid service are unclear (8). The security page says session data is not stored and each browser's virtual machine is destroyed, the pricing page gives 7 days of data retention, recordings are on by default, and Zero Data Retention is by request. The privacy policy (24 February 2026) covers the website and customer contacts, with one product section on Gmail access. The DPA and data handling policy sit behind an access request (15). The legacy tasks API and the old MCP address are labelled and still work, and the SDK has a migration guide. No deprecation policy or dates (5). The security page names AWS us-east-2 and eu-central-1. The trust portal has a subprocessor section, of which our reader saw only OpenAI and Anthropic (12).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Domain age: anchorbrowser.io, registered 2024-09-18 (2 years) (7 of 15)
- Terms of service: not found (0 of 10)
- Privacy policy: read, states 7 of the 8 things a reader expects (9.3 of 10)
- Changelog: not found (0 of 10)
- security.txt: not found (0 of 10)

## 5. Reliability, 80 out of 100, up to 4 more on the total

Why it scored 80: Graded as a hosted service. status.anchorbrowser.io runs on incident.io with two components, Website and Anchor Application, and a calendar from July to October 2026 (20). Both show 100 per cent, and the incident feed and RSS are empty. The page has no API or browser component and has recorded no incident since it was set up in June 2025, so we award 25 of 30 for a clean record. Limits are published, 5, 25 and 100 session creations a minute and 5, 25 and 200 concurrent browsers by plan, and 2,000 requests a minute on Web Unlocker (15). The OpenAPI document declares 429 on ten operations, with `RateLimit` and `Retry-After` headers on session creation, and the Web Unlocker docs say to retry 429, 500, 503 and 504 with exponential backoff. No idempotency keys were found for writes (10). No SLA was found on the pricing page, the docs or the site (0). The API is version 1.0.0, the SDKs are 1.0 and nothing marks the sessions API as beta (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 6. Maintenance & community, 57 out of 100, up to 3.8 more on the total

Why it scored 57: The newest dated releases are the TypeScript SDK 1.0.0 on npm on 26 July 2026 and the Python SDK 1.0.1 on PyPI on 28 July, 72 days before the check. The pricing page dates its AI step prices from 21 August 2026 (20). In the last 90 days we found one release, published as three packages over two days, and blog announcements without a readable year. No dated changelog (10). No public changelog. Support is by email, with Slack on Growth and above. GitHub issues were not read because the API refused us for its rate limit (5). Official SDKs for TypeScript and Python are current at 1.0. The MCP servers were not found in the MCP registry (15). The SDK repository has CI and publish workflows whose results we did not read, and the self-hosted MCP server's last commit is 24 July 2025 (7).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 7. Schema & documentation, 80 out of 100, up to 3.3 more on the total

Why it scored 80: OpenAPI 3.1.0 at docs.anchorbrowser.io/openapi.yaml with 101 paths and 136 operations and the `anchor-api-key` header scheme (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). All 136 operations carry a description, the spec's introduction says which resource suits which job, and a docs page compares the task types. Few descriptions say when not to use an endpoint (16). Inputs are typed with 90 enum declarations and named request schemas. We did not audit every field for bounds (11). The spec holds 121 examples and declares 400, 401, 404 and 500 widely, with one shared error schema of `code` and `message` (12). Paths are versioned under /v1 and a legacy spec is kept. No API changelog was found, docs.anchorbrowser.io/changelog returns 404, and the SDK changelog stops at 1.0.0-dev.4 (6).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- No service agreement, API terms, SLA or public DPA was found on anchorbrowser.io or in the docs, so `provenance.terms` is left out. The pages /terms-of-service, /msa, /dpa, /sla and /legal return 404
- Whether x402 payment works on `POST /v1/sessions`. The blog post of 29 August 2025 says so, our unpaid request returned 401, and the post says x402 must be enabled per project
- unchecked: the Agent Access flow end to end. We read the guide endpoint and did not request a challenge or a key
- unchecked: the hosted MCP servers' tool list, schemas and annotations, which need a key or sign-in. The count of about 24 tools comes from the docs table
- unchecked: the trust portal's documents and full subprocessor list, which load by script or need an access request
- unchecked: GitHub stars, issues and CI results, because the GitHub API refused us for its rate limit
- unchecked: the anchorbrowser/anchor-mcp-plugin repository named in the MCP docs, which asked for credentials when cloned
- unchecked: how API keys are created, rotated and revoked in the dashboard, and whether signup for the Free plan asks for a card
- The MCP registry search returned no entry for anchorbrowser. The response body was empty, so this is weaker than a confirmed absence
- The security page says Anchor does not store customer data from sessions, while recordings are on by default and the pricing page lists 7 days of data retention
- Blog index dates carry no year, so launch dates for Agent Access (8 September) and the Bedrock AgentCore payments integration (24 August) are not confirmed as 2026
- The lead named the vendor as Anchor Browser. The terms and privacy policy name Anchor Forge Inc.

## Weaknesses

- No service agreement or API terms found. anchorbrowser.io/terms is a website terms of use dated 16 March 2025
- The documented CDP connection passes the API key as `apiKey` in the `wss://connect.anchorbrowser.io` URL
- No changelog, deprecation policy or published SLA found, and docs.anchorbrowser.io/changelog returns 404
- The status page lists two components, Website and Anchor Application, and its incident feed has never held an entry
- A 2025 blog post describes x402 payment on `POST /v1/sessions`, but an unpaid request on 8 October 2026 returned 401, not 402

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Send the key in the `anchor-api-key` header. For CDP, build `wss://connect.anchorbrowser.io?apiKey=<key>&sessionId=<id>` and keep that URL out of logs
- Set `session.timeout.idle_timeout` and `max_duration` and end sessions with DELETE. The default maximum is 180 minutes, and browser time bills by the minute
- Session creation is capped at 5 a minute on Free, 25 on Starter and 100 on Growth. On 429, wait for the `Retry-After` seconds
- Connect the `Anchor` MCP server or `Anchor (all)`, not both, because the docs say the pair duplicates tool names
- Authenticated browsers, CAPTCHA solving and proxies by country need the Starter plan or higher. The Free plan and Agent Access keys run plain sessions and web tasks

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.