GPAL

The tools

GPAL is an automation library that drives a real browser and the Windows desktop from one C# workflow. Playwright, Puppeteer, Selenium and TestCafe are browser testing and automation frameworks. UiPath and Power Automate are RPA platforms. Blueprint MCP puts a real browser in the hands of an AI assistant.

Tool	What it is	Best for	Runs on	Licensing
GPAL	C# automation library; Selenium, Puppeteer and the OttoMagic extension behind one fluent API	Unattended workflows across browser and desktop, on a real profile	Windows	Business Source License 1.1, source on GitHub
Playwright	Browser testing framework (Microsoft)	Cross-browser testing in CI	Windows, macOS, Linux	Open source
Puppeteer	Chromium control library over CDP (Google)	Scripting Chrome from Node	Windows, macOS, Linux	Open source
Selenium	WebDriver standard and bindings	Cross-browser testing, grids	Windows, macOS, Linux	Open source
TestCafe	Browser testing framework (DevExpress)	Web app testing in Node	Windows, macOS, Linux	Open source
UiPath	RPA platform with a visual designer	Enterprise RPA with orchestration	Windows	Commercial, licensed per robot
Power Automate	Microsoft RPA and cloud flows	Microsoft 365 shops	Windows	Commercial, Microsoft plans
Blueprint MCP	MCP server and browser extension (Rails Blueprint)	Letting an AI assistant drive your real browser profile	Chrome, Edge and Firefox, through Node	Open source, with a paid tier

Feature matrix

One row per job.

Yes documented, one call Partial a recipe, or with limits No not documented

Job	GPAL	Playwright	Puppeteer	Selenium	UiPath	Power Automate	TestCafe
Download a file	Yes. One call on all three engines	Yes. Download class	Partial. CDP download behavior, then watch the folder	Partial. Set the profile folder, then poll it	Partial. Configure the browser, check the folder	Partial. Script the Save As dialog with UI automation	No
Upload a file	Yes. Direct or through the OS dialog	Yes	Yes	Yes	Yes. OS dialog	Partial. Script the Upload dialog with UI automation	Yes
Several paths in one selector	Yes. CSS, XPath, text, value, name, class, placeholder, href and image, tried in order declared	No. One locator	No	No	Partial. Fuzzy matching and anchors	Yes. Several selectors per element, tried in order	No. One CSS string or function per Selector
Find an element by its picture when the DOM changes	Yes. An image path in the selector, resolved to the page element; works headless and on hidden desktops	No	No	No	Partial. Third targeting method, after selectors and Computer Vision; needs the desktop, headless not available	Partial. Image fallback searches the screen; needs the desktop, headless not available; not for data extraction	No
Handler for a banner or modal, anywhere in the run	Yes. Persistent selectors	No	No	No	No	No. Pop-up handling is set per action	Partial. Native dialogs only
Wait for an element before acting	Yes. WaitFor in the unit of work	Yes	Partial. waitForSelector	Partial. Explicit waits	Yes. Timeout and Wait for page load on every activity	Yes. Wait for web page content	Yes
Wait for an element to reach a state	Yes. Visible, hidden, enabled, disabled, checked, selected, clickable, editable	Partial. Visible and hidden through waitFor; other states test-runner only	Partial. Visible and hidden through waitForSelector; enabled only before actions	Partial. WebDriverWait with a lambda; .NET dropped ExpectedConditions	Partial. Appear and disappear through Check App State	Partial. Appear and disappear; enabled and disabled for desktop windows only	Partial. Visible through visibilityCheck; other states via retrying assertions
Hardware input for the whole run	Yes. A hardware engine variant, or per selector on any engine	No	No	No	Partial. Chosen per activity	No. Physical or simulated, chosen per action	No. Cannot emulate system events
Call the site's API as the browser	Yes. Fetch runs inside the page on all three engines	Partial. APIRequestContext shares cookies, not the transport	Partial. Hand-written fetch in evaluate	Partial. Hand-written fetch in executeScript	No. HTTP Request has no browser session	Partial. Hand-written fetch in Run JavaScript	Partial. Hand-written fetch in a ClientFunction
Hand the session to a browserless client	Yes. ContinueAsRESTClient	Yes. APIRequestContext	No	No	No	No. HTTP actions keep their own cookies	Partial. t.request with cookies copied by hand
Run script before the page runs	Yes. One call on all three engines, Chromium browsers	Yes. Chromium, Firefox and WebKit	Yes. evaluateOnNewDocument	Partial. Raw CDP, or BiDi on Firefox	No	No. JavaScript runs on the current page only	Yes. Client scripts run before the page loads
Real browser profile with modern automation	Yes. On all three engines	No. Default Chrome profile not supported	Partial. userDataDir or connect; default profile undocumented	Partial. user-data-dir argument; docs use temporary dirs	Partial. Extension mode only; CDP and WebDriver are isolated	Yes. Extension uses the default profile	No. Real profile excludes native automation
Headful browser nobody can see	Yes. Hidden desktops, no admin, runs on Windows Home	No. Headless or on screen	No. Headless or on screen	No. Headless or on screen	Partial. PiP, a child session over RDP	Partial. Child session, or virtual desktop in preview; Pro or Enterprise	No. Headless or on screen
Parallel workflows, each on its own hidden desktop	Yes. Each workflow owns its browser and its desktop	No hidden desktops	No hidden desktops	No hidden desktops	Partial. PiP child session	Partial. PiP session	No hidden desktops
Browser and desktop apps in one workflow	Yes. UIAutomation beside the browser	No. Browser only	No. Browser only	No. Browser only	Yes	Yes	No. Electron apps only
Choice of engine per run	Yes. Nine: Selenium, Selenium JS, Puppeteer over a port or a pipe, and OttoMagic, each but Selenium JS also with hardware input	No. One	No. One	No. One	Partial. Five browser modes, set per activity or project	Yes. Extension or WebDriver per Launch Browser	No. Set by the browser chosen
Linux and containers	No. Windows only	Yes	Yes	Yes	Partial. Linux robot in Docker, cross-platform Chrome only	No	Yes

Anti-bot protection

Every row is a real run: the page itself loading through the protection, filled in only from what we ran. Nothing here is inferred from a vendor name.

Protection	Page load	Run
Akamai	Passed. Selenium, Puppeteer and OttoMagic	2026-09-28, Chrome, Edge and Firefox
DataDome	Passed. Selenium, Puppeteer and OttoMagic	2026-09-28, Chrome, Edge and Firefox
Cloudflare	Passed. Selenium, Puppeteer and OttoMagic	2026-09-28, Chrome, Edge and Firefox
Kasada	Passed. Selenium, Puppeteer and OttoMagic	2026-09-28, Chrome, Edge and Firefox
Imperva	Passed. Selenium, Puppeteer and OttoMagic	2026-09-28, Chrome, Edge and Firefox
PerimeterX (HUMAN)	Passed. Selenium, Puppeteer and OttoMagic	2026-10-16, Chrome, Edge and Firefox

Fetch, the browser calling the site's own API from inside the page, works every time. The call goes out from the page itself, with its cookies, its connection and its fingerprint, so it gets whatever the page got. The one limit is CORS: calls to the page's own domain always go through, and calls to other domains are up to their CORS rules. That is where Handoff comes in.

Handoff, ContinueAsRESTClient, takes the session out of the browser but not the browser's connection. It carries the browser's cookies, so it reaches what CORS keeps Fetch from. It's faster than going through the browser.

How we know

Every feature has a tester program behind it that drives the real thing and checks the result, and every check has passed.

Each browser feature is run on every engine and browser combination it supports, windowed and headless: Selenium on Chrome, Edge and Firefox, Puppeteer on Chrome and Edge, and OttoMagic on Chrome, Edge and Firefox. Script injection has no Firefox path yet, and application image matching on hidden desktops is coming Q1 2027.

Browser

Navigation, tabs and windows
Every kind of click, hover, focus and drag and drop
Typing, key presses and modifier keys
Select lists, sliders and ranges
Finding elements, reading and writing their attributes, and page state
Frames and shadow roots
Alerts, confirms and prompts
Scrolling of the window and of elements, and end-of-page detection
Cookies, localStorage, sessionStorage, Cache and IndexedDB
Downloads to a named file and uploads of one or many files
Files from a url carrying the session, with web auth
The site's own API called from inside the page, and the session handed to a REST client
Script injected before the page runs
Persistent selectors that fire wherever they match
Image matching, including inside shadow DOM and iframes
Hardware input as well as simulated
Every REST endpoint and client workflow paging
Parallel workflows, each with its own browser, on the screen or on hidden desktops

Desktop

Applications through UIAutomation: typing, menus, every click kind, scrolling and grids
File dialogs: open, save, and folder pickers
The clipboard
Windows Explorer: grid reads, selection, and drag and drop of files
Programs running on hidden desktops

Data

SQL Server: CRUD, twelve parameter types, stored procedures, table-valued parameters and transactions
Excel, Google Sheets and Google Drive
Converters across CSV, YAML, Excel, database and file, with round trips
Cryptography: AES-GCM, salted hashes and RSA signing
Logging to file, CSV, database and email

Where we lose

A comparison with no losses in it does not get believed. These are ours.

No Linux, no containers. GPAL runs on Windows because desktop automation, hardware input and real profiles are Windows work. It cannot sit in a Linux CI pipeline.
No hosted service. GPAL currently runs on your machine.
No IP rotation or proxy pool.
No SOC 2.
No prebuilt scrapers and no no-code builder. Workflows are written in C#. GPAL Studio is still in preview.
No test runner or trace viewer. GPAL is an RPA and automation library, built to do the work on a site rather than to test it.

Roadmap

What is coming to GPAL, and roughly when.

Feature	What it does	Target
Bot of the Week	A new GPAL bot with its full source and a walkthrough. Ideas in the queue: a GitHub release watcher, a daily news digest, a batch file processor, a log viewer, and a test runner for your own workflows	Every week
Two-factor sign-in	TOTP codes from a stored secret, and QR codes read off a page, so a workflow signs in past 2FA unattended	Q4 2026
OttoMagic update	Types into the focused element	Q4 2026
Notifications	Posts to Slack, Teams or any webhook when a workflow finishes or fails	Q4 2026
Archives	Zip and unzip in the fluent chain: download, unpack, convert	Q4 2026
Clipboard in and out	Copy from an application or a page to the clipboard, and fill a field from it	Q4 2026
SFTP and SSH	Picks up from and drops files on the servers enterprises still use	Q1 2027
Steadier automation	Scrolling finds the element that really scrolls, and actions wait for a slow application to catch up	Q1 2027
Application image matching on hidden desktops	Captures the application's own window and clicks the control under the match, so image selectors work where the mouse cannot reach; browser image matching already works headless and on hidden desktops	Q1 2027
MySQL and PostgreSQL	The database support SQL Server has today, on both	Q2 2027
Richer database calls	Stored procedure OUTPUT and RETURN values, and update and delete built from a table name and its key	Q2 2027
GPAL.OCR	Reads text from images and the screen, as its own package	Q2 2027
Forms polish	Wrapped cells in list views, and tree views filled before the form opens	Q2 2027
UIAutomation engine choice	Pick the managed or COM UIAutomation engine per run, so Outlook, Word and native Win32 apps answer properly	Q2 2027
GPAL Studio	The visual workflow builder out of preview, with a new look built on the parts it has today	Q2 2027
PDF	Reads text and tables out of PDFs, the statement you just downloaded	Q3 2027
Presentation output	Renders data to PDF, PNG, Word or a styled HTML report	Q3 2027
Secure remote control	GPAL on one machine, the browser on another, across the LAN or the internet, behind secure authentication	Q3 2027
Workflows as AI tools	Your compiled workflows become tools an AI assistant can run, the same way every time	Q3 2027
OttoPilot	Runs workflows on a schedule, watches them, restarts them and keeps their history	Q4 2027
Bot fleet templates	Locked VMs that log themselves in and start their agents: one turns dropped files into jobs, the rest pull jobs from a queue and run the workflow	Q4 2027
Hosted GPAL	GPAL as a service, built on secure remote control	Later
Macros in OttoMagic	Build and play step-by-step macros from the extension itself	Later

GPAL Compared