Skyvern Review 2026

Vision + LLM Navigation: The Core Bet

The defining design choice in Skyvern is that it does not rely primarily on XPath or CSS selectors to find and interact with page elements. Instead, it renders the page and uses vision-capable LLMs to identify the relevant controls by what they look like and what they mean in context. This is the entire reason Skyvern exists: selector-based automation is brittle because it is tightly coupled to a page's DOM structure, and any redesign can silently break a workflow that ran perfectly the day before. Skyvern's engine re-reads the page on each run, so a moved button or renamed field is usually handled without human intervention.

In our reading of Skyvern's architecture and its published comparisons against Playwright and Selenium, the trade-off is clear. You gain resilience and dramatically lower maintenance overhead, but you accept a higher per-run cost (LLM inference isn't free) and a small amount of non-determinism — an LLM can occasionally misread a page. Skyvern mitigates this by blending LLM reasoning with executable, cacheable code so that once a workflow is understood, it can be replayed more deterministically rather than re-reasoned from scratch every time. For high-volume back-office automation where sites change often, this is a sensible balance.

Authentication: Logins, CAPTCHAs, and 2FA

The feature set that separates Skyvern from prompt-only browser agents is its handling of authentication. Real-world enterprise workflows live behind logins, and Skyvern is built to navigate them. It solves CAPTCHAs natively — no third-party solving service required — and supports 2FA and TOTP, submitting the second-factor code automatically as part of a workflow. Stored, encrypted credentials mean an automation can log into a portal the way a staff member would. This is where a lot of "AI agent" demos fall down, and it's a meaningful differentiator for accounts-payable, insurance, and healthcare teams whose work is almost entirely behind authentication walls.

These capabilities are tiered. Basic CAPTCHA solving and stored credentials appear on the $29 Hobby plan; advanced CAPTCHA solving, residential proxies, 2FA/TOTP, and 1Password integration are gated to the $149 Pro plan. Enterprise adds enterprise secret vaults (Azure Key Vault, Bitwarden). If your workflows require authenticated access to adversarial sites, budget for at least Pro — the Free and Hobby tiers are deliberately constrained on anti-bot features.

Four Ways to Build a Workflow

Skyvern is unusually flexible about how you create automations, which lowers the barrier for non-engineers. The Copilot Chat lets you describe a task in plain English ("log into vendor.acme.com, download all invoices from the last 30 days, save them as PDFs") and turns it into a structured workflow. SOP upload converts existing standard operating procedures — PDFs, Word docs, or screenshots — into executable workflows, turning tribal knowledge into repeatable automation. Browser recording lets you perform a task once and have Skyvern generate a reusable, AI-resilient workflow from your actions. And a visual drag-and-drop builder lets you assemble Navigation, Login, Action, Extraction, Validation, Loop, and Wait blocks step by step.

For developers, there's a code-first path too. Skyvern ships a Python SDK (pip install skyvern) that is Playwright-compatible, adding .act(), .extract(), and .validate() commands directly on top of existing Playwright code, plus a TypeScript SDK (@skyvern/client). The API exposes methods such as act (perform actions via natural language), extract (structured data with an optional JSON schema), validate (check page state), and prompt (arbitrary LLM prompts). This spread — from no-code copilot to typed SDK — is one of Skyvern's strongest points and a reason it appeals to both operations teams and engineers.

Data Extraction and Explainability

Skyvern extracts data in whatever schema you specify, returning results as CSV or JSON piped straight into your systems on a schedule or on demand. This makes it viable for web data extraction — pricing, product catalogs, public records — from sites that don't expose an API. Just as important for regulated buyers is Explainable AI: every run produces built-in summaries detailing each action the agent took and why, giving you a full audit trail. For compliance-heavy industries, that observability is not a nice-to-have — it's a procurement requirement, and it's baked in rather than bolted on.

Deployment, Compliance, and MCP

Skyvern can run entirely on your own infrastructure via Docker Compose, or self-hosted on AWS, GCP, or Azure for full data-residency control, in addition to the managed cloud. It's Model Context Protocol (MCP) ready, meaning you can use Skyvern as a tool inside agents built on Claude, GPT, or Gemini. On the compliance side, Skyvern advertises SOC 2 Type II certification, HIPAA compliance, an end-to-end encrypted credential vault, role-based access control, team workspaces, and full audit logs — though SOC 2 reports and HIPAA are reserved for the Enterprise tier. Buyers in healthcare or fintech should request the relevant documentation from Skyvern's trust center during evaluation rather than taking marketing claims at face value.

The AGPL-3.0 Licensing Question

The single most important thing a procurement or legal team needs to understand about the open-source path is the license. Skyvern's core is released under AGPL-3.0, the strongest of the common copyleft licenses. AGPL closes the so-called "SaaS loophole" in the GPL: if you modify the software and make it available to users over a network — including internal users of a hosted internal tool in some interpretations — you may be obligated to release your modifications under the same license. For a company that simply runs Skyvern unmodified to automate its own back office, this is usually a non-issue. For a company that wants to fork Skyvern, embed it inside a commercial product, or offer it as part of a hosted service, AGPL can be a serious constraint. The clean escape hatch is the commercial cloud, which comes with different terms — but you should confirm the exact commercial licensing arrangement with Skyvern rather than assuming the cloud simply waives AGPL. Do not skip a proper legal review here; it is the most common way open-source adoption goes wrong.

Cost Predictability and the Credit Model

Because a credit is a unit of browser execution whose consumption scales with runtime, page complexity, retries, and anti-bot measures, two runs of the "same" workflow can cost different amounts — a login that hits a CAPTCHA and retries twice burns more credits than one that sails through. This is inherent to how the technology works, but it makes budgeting harder than a flat "$X per completed task" model would. The practical mitigation is to run a representative sample of your real workflows on a paid tier for a full month, measure actual credit burn against the plan's allowance, and extrapolate before you commit at scale. Teams that skip this step and reason from the marketing numbers can be surprised when a fragile target site drives retries — and therefore credits — well above expectation.

Non-Determinism and Human Oversight

An LLM-and-vision agent is, by design, less deterministic than a hard-coded script. Most of the time that is a feature — it is precisely what lets Skyvern adapt to a changed page — but it also means the agent can occasionally interpret a page incorrectly or take an unintended action. Skyvern reduces this risk by caching understood workflows into more deterministic replays and by exposing validation blocks and full run summaries, and Enterprise adds human-in-the-loop workflows for approval gates. Even so, for irreversible or high-stakes actions — anything involving payments, legal submissions, or protected health information — you should keep a human checkpoint in the loop rather than fully trusting autonomous execution. Treat Skyvern as a very capable operator that still benefits from supervision on the workflows that matter most.