# Which browser automation API should you build an agent on?

> Source: https://agentsindex.ai/blog/browser-automation-api-comparison

Comparison [Agent tools and integrations](https://agentsindex.ai/categories/agent-tools-and-integrations)

Skyvern, Browserbase, Browser Use, Playwright MCP, Hyperbrowser, and TinyFish compared on credential handling, session isolation, and audits, not speed.

[AgentsIndex](https://agentsindex.ai/authors/agentsindex) Published 25 Sep 2026 Updated 15 Oct 2026 8 min read [Editorial policy](https://agentsindex.ai/editorial-policy)

![AgentsIndex card: Which browser automation API should you build an agent on.](https://agentsindex.ai/img/1024/heroes/browser-automation-api-comparison/44c0a59521a6/hero-16x9-800.webp)

On this page

1. [The question changed this year](#the-question-changed-this-year)
2. [Credential handling: three different postures](#credential-handling-three-different-postures)
3. [Isolation and self-hosting: where the DIY option actually helps](#isolation-and-self-hosting-where-the-diy-option-actually-helps)
4. [The decision](#the-decision)
5. [Three tools in this list that aren’t answering this question](#three-tools-in-this-list-that-arent-answering-this-question)

- [This page as Markdown](https://agentsindex.ai/blog/browser-automation-api-comparison.md)

## The question changed this year

Until recently, picking a browser-automation API for an agent was a speed-and-reliability question: which one clicks through a form fastest, which one survives a redesigned checkout page. That’s no longer the whole question. In August 2026, security researchers at Zenity disclosed zero-click prompt-injection attacks against ChatGPT Atlas and the Claude for Chrome extension. A single planted comment on an X thread was enough to hijack an agent’s session across every site the user was logged into, and a crafted email could turn “summarize my inbox” into a full account takeover across Gmail, Slack, and X. Neither vulnerability had an easy patch, because both exploit the thing an agentic browser is built to do: read page content and act on it across authenticated tabs ([SecurityWeek](https://www.securityweek.com/zero-click-ai-browser-hacking-claude-and-chatgpt-atlas-hijacked-via-emails-x-posts/)).

That’s a different product category from the ten tools in our directory. Atlas and Claude in Chrome are end-user agentic browsers, not developer APIs you build your own agent on. But the underlying risk is the same one anyone shipping a browser-driving agent now has to answer for: an agent that reads a poisoned page can be turned against the authenticated session it’s holding. It’s serious enough that browser security has become its own line item: LayerX built a dedicated “AI Browsers Protection” product around exactly this threat, and Akamai paid roughly $205 million to acquire the company in 2026 ([SecurityWeek](https://www.securityweek.com/akamai-to-acquire-ai-and-browser-security-firm-layerx-for-205-million/); [LayerX](https://layerxsecurity.com/use-cases/ai-browsers-protection/)).

So the buyer question for a browser automation API is no longer just “does it complete the task.” It’s “what happens to my credentials and my session when the page it’s reading turns out to be hostile.” Here’s where the vendors actually differ on that, not on marketing copy.

In this article

- [TinyFish](https://agentsindex.ai/tinyfish) One web layer for agents: free search and fetch, plus hosted browsers and goal-driven web automation.

## Credential handling: three different postures

**Skyvern** is the only one built API-first for stored-credential login: `page.agent.login(credential_type, credential_id)` hands the agent a reference to a vaulted credential, not the plaintext value, with 2FA/TOTP support and 1Password integration from the $149/mo Pro tier up, and Bitwarden plus Azure Key Vault reserved for Enterprise. On the two cheaper tiers (Free, $29/mo Hobby) it can store credentials but has no 2FA support at all, so the login-heavy use case this tool is built for is effectively gated behind the $149 tier ([skyvern.com/pricing](https://www.skyvern.com/pricing)). It’s open source under AGPL-3.0 ([GitHub](https://github.com/Skyvern-AI/skyvern)), which matters practically in one specific way: self-hosting and running it unmodified inside your own company carries no AGPL obligation, but if you fork it to build a hosted product on top, the license requires you to publish your modifications.

**[Anchor](https://anchorbrowser.io)** is closest to Skyvern’s posture, with the login run by the platform rather than the agent. You pass credentials as secret values and Anchor types them into the page itself. Its docs say the real values are never logged and never shown to the model, and each secret can be limited to one domain so it can’t be typed into the wrong site ([Anchor docs](https://docs.anchorbrowser.io/agentic-browser-control/secret-values)). For accounts that have to stay signed in, an identity holds the credentials and the MFA method (email codes, an authenticator app, 1Password or your own system), and Anchor logs in again when the saved session expires ([Identities](https://docs.anchorbrowser.io/essentials/authenticated-applications)). If your product acts for its own users, they sign in on Anchor’s hosted page and your app gets back an identity ID, not a password ([end-user sign-in](https://docs.anchorbrowser.io/essentials/omniconnect)). Every browser runs in its own virtual machine, erased when the session ends ([Trust & Security](https://docs.anchorbrowser.io/security)). The trust portal lists SOC 2 Type 2, ISO 27001, HIPAA and GDPR. The SOC 2 report is shared on request and the auditor isn’t named publicly ([trust.anchorbrowser.io](https://trust.anchorbrowser.io/)). On its price list the compliance line starts at the $2,000/month Growth plan, and a HIPAA BAA, bring-your-own-cloud and on-premise deployment are Enterprise items.

**Browser Use** doesn’t sell credential vaulting as a feature; it sells an audited security program instead. It’s SOC 2 Type II compliant, with the auditor (Accorp Partners) and the exact observation window (July 17–October 17, 2025) published rather than just claimed, and Enterprise customers can turn on zero data retention ([browser-use.com/security/soc2](https://www.browser-use.com/security/soc2)). It’s also MIT-licensed and the single most-starred repo in this category at 116,000+ stars, with commits landing the same day this was checked, which makes it the fastest-moving codebase here if a new prompt-injection vector needs a patch ([GitHub](https://github.com/browser-use/browser-use)).

**Browserbase** takes a third approach: instead of vaulting credentials or auditing its own practices, it tries to make the agent’s traffic indistinguishable from a legitimate one. Verified sessions use real (not synthetic) browser fingerprints that its bot-detection partners recognize, and it partners with Cloudflare’s Signed Agents program so an agent can cryptographically prove a human authorized it, rather than relying on browser behavior alone to pass as human ([Browserbase docs](https://docs.browserbase.com/features/stealth-mode)). That’s a meaningfully different security model from “hide the agent”: it’s “identify the agent honestly and let the site decide.”

**Hyperbrowser** publishes a security-practices page that reads like a SOC 2 report’s outline (encryption at rest and in transit, quarterly access reviews, annual penetration testing) but says it is “aligned with” SOC 2 criteria and undergoes third-party assessments without naming an auditor or a certification date ([hyperbrowser.ai/security](https://www.hyperbrowser.ai/security)). That’s a real gap next to Browser Use’s dated, named Type II report and Skyvern’s SOC-2 report at Enterprise tier: it’s the same list of good practices everyone claims, without the one thing that lets a buyer verify it happened.

## Isolation and self-hosting: where the DIY option actually helps

**Playwright MCP**, Microsoft’s official MCP server for Playwright, ships no managed cloud, no stealth mode, and no hosted proxy. It’s Apache-2.0 and self-hosted only ([GitHub](https://github.com/microsoft/playwright-mcp)). That sounds like a gap until you apply the session-hijacking framing: there’s no vendor-run browser fleet holding your cookies, because there’s no vendor infrastructure at all. The isolation model is whatever you build (separate browser contexts, your own proxy, your own credential store), which is more work but also the only option here with zero third-party attack surface on the browser layer itself.

**TinyFish** sits at the other end: one API key covers Search, Fetch, a web agent, and cloud browser sessions, with residential proxies and anti-bot handling built in and billed per step ($0.016) or per browser-minute ($0.002). There are no monthly tiers: it’s a prepaid-wallet model with Search and Fetch free at any balance, and ISO 27001 plus enterprise SSO arrive only at the Enterprise tier ([tinyfish.ai/pricing](https://tinyfish.ai/pricing)).

## The decision

- **Building a compliance-sensitive agent you’ll self-host and want full control over the credential vault**: [Skyvern](https://agentsindex.ai/skyvern). It’s the only one here with 2FA/TOTP and password-manager integration built into the agent loop, not bolted on, and it’s the option where “self-hosted” actually means the credentials never leave your infrastructure. Budget for the $149/mo Pro tier (the free and $29 tiers don’t include 2FA at all) and read the AGPL terms before you build a product on top rather than just running it.
- **Building on someone else’s audited infrastructure with the biggest community backing you if something breaks**: [Browser Use](https://agentsindex.ai/browser-use). The named, dated SOC 2 Type II report is the most concrete compliance artifact of any tool here, it’s MIT so there’s no copyleft complication, and at $0.02/browser-hour it’s also the cheapest hosted option at real volume.
- **Sites that actively fight bots (bank portals, airline sites, anything behind Cloudflare or Akamai bot management)**: [Browserbase](https://agentsindex.ai/browserbase). The Signed Agents partnership is a genuinely different answer to “how do I not get blocked” than fingerprint spoofing, and Stealth Mode plus HIPAA BAA support scale up through its paid tiers.
- **Agents that log in as real users, where the password must never reach the model**: [Anchor](https://anchorbrowser.io). The platform types the credentials in and keeps them from the model, saved identities sign back in when a session expires, and each session gets its own disposable VM. Its Action Index lets an agent finish a known step on a supported site, such as a filtered search, in one call instead of clicking through the page ([Anchor docs](https://docs.anchorbrowser.io/advanced/action-index)). Plans cap concurrent browsers from 5 on the free tier to 200 on Growth, with 500+ on Enterprise.
- **You’d rather own the whole security boundary yourself**: [Playwright MCP](https://agentsindex.ai/playwright-mcp). No managed layer means no managed-layer risk; you inherit all the isolation work but also all the control.
- **A general-purpose cloud browser without a strong opinion on any of the above**: [Hyperbrowser](https://agentsindex.ai/hyperbrowser) and [TinyFish](https://agentsindex.ai/tinyfish) are credible, but neither publishes a third-party audit report the way Browser Use and Skyvern’s Enterprise tier do (TinyFish’s trust center shows an ISO 27001:2022 certificate rather than a report); treat their security pages as a starting point for your own due diligence, not a substitute for it.

## Three tools in this list that aren’t answering this question

Not everything filed under browser automation here is competing for the same job. [BrowserAct](https://agentsindex.ai/browseract) is a no-code scraper builder: you describe the data you want and it builds a reusable “Bot,” which bundles stealth and proxy handling but isn’t an SDK a developer drops into their own agent loop the way the five above are. [Manus AI](https://agentsindex.ai/manus-ai) is a consumer/team action-engine where browser control is one feature among slide decks and website builders, not a browser-automation API in its own right. And Hronaut is a local desktop browser that keeps a coding agent’s login sessions alive between tasks on your own machine. It’s useful for testing an app you’re building, but its own FAQ points you elsewhere for anything that needs to run without your desktop on, which is the whole premise of the other five. None of the three are worse tools; they’re just not the answer to “which API do I build a production agent on.”

If you’re evaluating any of these for a login-heavy workflow, the SecurityWeek and Zenity research is worth reading directly before you start: the attacks that mattered in 2026 didn’t come from a weak password or a missing WAF rule, they came from an agent trusting content on a page it was never supposed to trust that much.

About the author

[Team AgentsIndex](https://agentsindex.ai/authors/agentsindex)

Editorial team

The AgentsIndex research desk publishes source-linked product research and original market analysis.

Last checked 11 November 2026

## Top of agent tools and integrations

[The category page](https://agentsindex.ai/categories/agent-tools-and-integrations)

- [Base2026](https://agentsindex.ai/base2026) · The team behind Base2026 runs this listing · Free SEO research MCP server, public API and browser SEO checks with original sources attached. · Free Checked 26 Oct · [Visit](https://agentsindex.ai/go/base2026)
  - MCP server
  - API
  - Open source
  - Self-host
- [ERIUS PHONE](https://agentsindex.ai/eriusphone) · The team behind ERIUS PHONE runs this listing · A dedicated virtual Android phone per AI agent, with Google Play apps and sign-ins that persist between sessions. · From about $45 a month Checked 11 Nov · Free trial · [Visit](https://agentsindex.ai/go/eriusphone)
  - MCP server
  - API
  - Open source
  - Self-host
- [UI Discovery](https://agentsindex.ai/uidiscovery) · The team behind UI Discovery runs this listing · Library of real website and app UI sections, queryable by AI assistants over MCP and a REST API. · Free, then $15 a month Checked 20 Oct · Freemium · [Visit](https://agentsindex.ai/go/uidiscovery)
  - MCP server
  - API
  - Open source
  - Self-host
- [TinyFish](https://agentsindex.ai/tinyfish) · The team behind TinyFish runs this listing · One web layer for agents: free search and fetch, plus hosted browsers and goal-driven web automation. · Free, then $0.002 per minute Checked 11 Nov · ISO 27001 · [Visit](https://agentsindex.ai/go/tinyfish)
  - MCP server
  - API
  - Open source
  - Self-host
- [ClineFlow](https://agentsindex.ai/clineflow) · The team behind ClineFlow runs this listing · Git-native project memory and handoffs for coding agents. · Free Checked 10 Nov · [Visit](https://agentsindex.ai/go/clineflow)
  - MCP server
  - API
  - Open source
  - Self-host
- [AgentMail](https://agentsindex.ai/agentmail) · Email inbox API that gives each AI agent its own address, threads, webhooks and MCP server. · Free, then $20 a month Checked 20 Oct · EU-hosted Freemium SOC 2 · [Visit](https://agentsindex.ai/go/agentmail)
  - MCP server
  - API
  - Open source
  - Self-host
- All 93 AI agent tools and integrations · First paid plans from $3 to $650 a month. · [See all 93](https://agentsindex.ai/categories/agent-tools-and-integrations)
  - 66 free to start
  - 43 publish a monthly price
  - 37 open source
  - Checked 30 July–12 November 2026

[Show the whole category](https://agentsindex.ai/categories/agent-tools-and-integrations)

## More of our research

Comparison 16 October 2026

### [Daytona vs E2B vs Modal: which sandbox for agent code?](https://agentsindex.ai/blog/daytona-vs-e2b-vs-modal)

Daytona, E2B and Modal compared on sandbox pricing, concurrency, GPU support and open-source status, plus why Daytona's flagship repo is now archived.

Comparison 28 September 2026

### [Beam AI, Stack AI, Gumloop and more: which can you buy?](https://agentsindex.ai/blog/agent-automation-platforms-which-can-you-actually-buy)

We checked all six pricing pages today. Only BuildShip has a real self-serve ladder. The other five gate you behind a sales call or a $500+/month floor.

Comparison 15 August 2026

### [Workflow automation for AI agents: where free tiers end](https://agentsindex.ai/blog/workflow-automation-where-each-platform-stops-being-free)

Zapier, Make, n8n, Activepieces, Pipedream and Trigger.dev meter in six different units. Which free tier survives real agent work, which runs out first.

Comparison 14 August 2026

### [AI coding agents compared: what each one is actually good at](https://agentsindex.ai/blog/ai-coding-agents-what-each-is-good-at)

Every major coding agent now costs $20. We compare what that money actually buys, which projects are still maintained, and which tool fits which job.