Anyone who has pointed a scraper at a modern SaaS pricing page knows the failure mode: the request succeeds, the HTML is enormous, and the number you came for is nowhere in it. The page assembles itself in JavaScript after the response lands, so a plain HTTP client sees the scaffolding and none of the content.
Here is the version of that I measured. Azure's Content Safety pricing page, hit twice inside the same minute: fetch handed back 212kB of markup with zero dollar figures in it, and a real Chrome instance handed back 6kB of rendered text containing both $0.38 and $0.75.
That one gap explains why this whole tool category exists. Two other findings from the same afternoon are worth your attention before you pick anything: the WebVoyager percentages that show up in every comparison post are not measured against the same denominator, and one of the four most-starred open frameworks ships under AGPL-3.0. I checked every license, version and price below against the project's own repo or pricing page in August 2026. The fuller writeup, including the complete test script, is on DevToolLab.
One Label, Three Unrelated Products
"AI browser automation" gets stuck on three things that do not compete with each other.
Consumer AI browsers (Atlas, Comet, Dia) are end-user products, not something you build against. Agent frameworks are libraries that let a model decide what to click. Managed infrastructure runs the browser somewhere else and deals with proxies, fingerprints and concurrency limits, while staying completely indifferent to what your agent does once the page loads.
Most real deployments pair a framework with infrastructure. That pairing is also why Browserbase sells hosting and gives away Stagehand.
First, Prove You Need a Browser
Rendering a page is the slowest and most expensive way to read it, so settle that question before you shop for tooling. You can test it with nothing but Node's built-in fetch and WebSocket against a Chrome started with its debugging port exposed:
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
--remote-debugging-port=9333 --headless=new --no-first-run \
--user-data-dir=/tmp/cdp-demo about:blank
From there you open a tab over http://localhost:9333/json/new?<url>, attach to webSocketDebuggerUrl, call Runtime.enable, then poll Runtime.evaluate on document.body.innerText until a price regex matches instead of sleeping for an arbitrary number of seconds. The full script is in the original article if you want to paste and run it.
Two of the four runs I logged:
plain fetch 12208ms 212kB html prices found: NONE
real browser 2134ms 6kB text prices found: $0.38, $0.75
plain fetch 11040ms 212kB html prices found: NONE
real browser 4087ms 6kB text prices found: $0.38, $0.75
Treat the timings as incidental. A static page would reverse them. The payload sizes are the finding: 212kB of markup containing nothing a person would read off the screen, versus 6kB of text containing all of it. Hand the fetch output to an agent and it will confidently tell you Azure publishes no pricing, which is exactly the wrong answer I got the first time.
The Open Source Field
browser-use is MIT, v0.13.7 as of July 27, 2026, and wants Python 3.11 or newer plus an LLM key. It has the largest community and the most sample code, which makes it the reasonable default. Its docs are also candid about the ceiling: CAPTCHAs push you toward their hosted stealth browsers, memory climbs as soon as you run tasks in parallel, and they steer production workloads to their cloud.
Stagehand is Browserbase's own, MIT, v4.0.0 on August 10, 2026, with SDKs for TypeScript, Python and Go. Instead of dumping a page into a model and hoping for the best, it gives you act, extract and observe as discrete calls. That means each step is something you can log, cache and write an assertion against. If you have ever watched a twelve-step agent quietly do the wrong thing at step seven and had no trace to inspect, this is the design that fixes it.
Skyvern sits at v1.0.48 (August 5, 2026) and is the one to read the LICENSE file on first: it is AGPL-3.0, not MIT and not Apache. Internal use is unproblematic. Shipping or hosting it means a conversation with whoever handles licensing at your company. Most roundups file it next to the permissive projects and never mention the difference. Technically it is the vision-first option, working from the rendered page rather than element IDs, which holds up better when a site's markup churns weekly.
Playwright MCP is Microsoft's, Apache 2.0, v0.0.79 (August 6, 2026). It hands Playwright to any MCP client, so an existing coding agent picks up a browser with no glue code, navigating via structured accessibility snapshots instead of a vision model. The version string is refreshingly honest about how young it is; the underlying lineage is the strongest in the category.
Steel (Apache 2.0) is the outlier: open source browser infrastructure rather than an agent framework, effectively a self-hostable Browserbase. It is where you start when session data is not allowed to leave your own network.
Browserbase, and What "Browser Hours" Bills For
Credit where it is due: Browserbase posts its prices publicly, which is not universal here.
Free: $0, 1 browser hour, 3 concurrent, 15-minute session cap, 3 agent runs · Developer: $20/month, 100 hours, 25 concurrent, $0.12 per additional hour · Startup: $99/month, 500 hours, 100 concurrent, $0.10 per additional hour · Scale: custom
A single browser hour with a 15-minute ceiling per session is a trial, not a tier, so plan on Developer the moment anything runs on a cron. The pricing detail with real consequences: a browser hour is wall-clock time the session stays open, not compute consumed. An agent blocked on a slow network request bills identically to one doing work, which makes aggressive session teardown your main cost control. On the will-they-still-exist question, they raised a $40 million Series B in June 2025 at a $300 million valuation.
Side by Side
| Tool | License | Type | Self-hosted | Status |
|---|---|---|---|---|
| browser-use | MIT | Agent framework, Python | Yes | v0.13.7, ~109.1k stars |
| Stagehand | MIT | Agent framework, TS/Python/Go | Yes | v4.0.0, ~23.9k stars |
| Skyvern | AGPL-3.0 | Vision-first agent framework | Yes | v1.0.48, ~22.7k stars |
| Playwright MCP | Apache 2.0 | MCP server over Playwright | Yes | v0.0.79, ~36k stars |
| Steel | Apache 2.0 | Self-hostable browser infra | Yes | ~7.5k stars |
| Browserbase | Commercial | Managed browser infra | No | Free, then $20 or $99/month |
WebVoyager Is Not a Leaderboard
You will see 89.1 percent for browser-use next to 85.85 for Skyvern, laid out like standings. Both figures are honestly reported. Putting them side by side is still meaningless.
The task counts do not match: browser-use scored over 586 tasks, Skyvern over 635, Agent-E over 643. The conditions diverge in the direction that flatters whoever is on top, since browser-use ran locally on clean IPs with no bot detection in the way while Skyvern ran in the cloud against live bot protection. In other words the lower number came out of the harder environment. Everything is self-reported, and the benchmark itself covers 643 tasks across 15 sites skewed toward reading, with logins, 2FA, form submission and downloads barely represented.
That is not a criticism of either project. It just means 89 percent tells you nothing about how either behaves on a Cloudflare-protected target, and the only benchmark that predicts your results is your own task list.
The Security Model Is Broken by Design, Not by Bug
Stand back and look at what a browser agent is: private data reachable through your authenticated sessions, untrusted input because it is reading the open web, and outbound communication because filling in forms is the entire point. That is all three legs of the lethal trifecta, aimed at your own logged-in accounts.
This is not theoretical. Brave published indirect prompt injection against Perplexity Comet, planting instructions in page elements no human would ever see and getting the agent to perform cross-site actions, one-time passcodes lifted out of email included. LayerX showed injected instructions can be persisted into an agent's long-term memory over CSRF and survive into later sessions.
OpenAI's own security writeup calls prompt injection "one of the most significant risks we actively defend against," and as of late December 2025 their stated position is that it may never be fully solved for browser agents. The UK's National Cyber Security Centre reached the same conclusion. Practical upshot: give the agent a dedicated, narrowly scoped account that cannot move money, rotate credentials or reach a password reset inbox, and treat every page it visits as hostile input.
Picking One, and the First Five Steps
Python codebase, take browser-use. Want per-step traces you can assert on, Stagehand. Form-heavy work on unstable markup and the AGPL question already answered, Skyvern. Already running MCP, Playwright MCP. Data cannot leave the building, Steel. Do not want to operate browsers at all, Browserbase starting at $20.
Then, in this order:
- Verify a browser is necessary. Run the fetch-versus-browser comparison against your actual target. If plain HTTP already has your data, walk away from this category.
- Check you are permitted to automate the path. DevToolLab's Robots.txt Tester tells you whether a specific URL is allowed for a given user agent.
- Lock down whatever is deterministic. Confirm selectors in the XPath Tester and reserve the model for the steps that genuinely need judgment. A selector costs nothing; an LLM call costs every time.
- Shrink pages before they eat your context. Raw HTML spends tokens on markup, and the HTML to Markdown converter makes the size difference obvious.
- Least-privilege account plus a hard session timeout. Both in place before the first scheduled run, not after.
Conclusion
The open source layer here is genuinely good and the marketing around it is not. browser-use owns the community and the MIT license, Stagehand has the most inspectable structure, Playwright MCP has the best pedigree, Steel answers data residency, and Skyvern is an AGPL-3.0 decision that deserves more than a footnote. Skip the WebVoyager table entirely, spend an afternoon running your own tasks, and design the security posture in from the start rather than bolting it on.
Licenses, versions and prices in this category move fast. Confirm each one against the project's own repo before you commit to anything.
Top comments (0)