Lilith-Zero vs OpenAI Operator API (Enterprise)

“The Kani formal verification and cargo-fuzz integration tell me this isn't just a vanity security project—it's been engineered to actually be correct. Sub-millisecond overhead means there's no reason not to run this in front of every MCP agent deployment. 15 stars seems like an embarrassing undercount given what this does.”

“The primitive here is clean: a constrained-action web agent you define via JSON schema rather than prompts alone, which is actually the right DX bet — putting the complexity in schema definition rather than natural-language wrangling. The moment of truth is whether custom action schemas are expressive enough to cover real enterprise workflows without becoming a second job to maintain; the fact that they ship with schema validation and perimeter deployment suggests someone thought about production use, not just the demo. What earns the ship is the honest constraint model — rather than 'do anything on the web,' you define the action surface, which is exactly how you'd design this if you were building it yourself and cared about reliability.”

“The claims are impressive but 15 GitHub stars and one maintainer is not a security tool I'd deploy in production. Security tools require adversarial testing by the community over time—not just formal verification. The fail-closed design is correct philosophically, but I'd want to see 6 months of battle-testing and independent security audits before trusting it with real agent deployments.”

“The direct competitor here is every RPA vendor — UiPath, Automation Anywhere — plus Anthropic's Computer Use API and every browser-automation wrapper that's been rebuilt on top of Playwright in the last 18 months, and none of those have actually solved the brittleness problem at enterprise scale. This breaks the moment a website updates its DOM structure, a CAPTCHA variant appears, or a multi-step workflow has an ambiguous intermediate state — and no custom action schema saves you there. The thing that kills this in 12 months is OpenAI either baking this into their main API products at a fraction of the cost, or enterprises discovering that maintaining action schemas for 40 internal tools is itself a full-time engineering job that defeats the automation value prop.”

“This is the tool that enterprise security teams will demand before they let any AI agent touch production systems. The taint tracking model is particularly elegant—once data is tagged as sensitive, it can't flow to untrusted destinations regardless of what the LLM decides to do. This is the kind of principled security primitive the agentic ecosystem desperately needs.”

“The thesis here is falsifiable: within 3 years, enterprises will manage fleets of web agents the way they manage microservices today — with schemas, permissions, and audit logs rather than RPA scripts and macros. The dependency is that web interfaces remain the dominant enterprise integration surface long enough for schema-defined agents to become the standard abstraction, which holds as long as legacy SaaS vendors don't all ship proper APIs (they won't, at least not fast enough). The second-order effect that matters isn't task automation — it's that custom action schemas become the new enterprise integration contract, shifting power from IT middleware vendors toward whoever controls the agent runtime, which right now is OpenAI. This is early on the enterprise-agent-fleet trend line, not on-time, which makes the risk real but the upside asymmetric.”

“Way too deep in the Rust/MCP security weeds for me to evaluate or use. This is infrastructure for enterprise AI security teams—not something a content creator or indie builder will interact with directly. Worth knowing it exists; not something I'll try this week.”

“The buyer is clear — enterprise IT and automation teams pulling from RPA or integration budgets — but the pricing architecture is the problem: 'contact sales' with no public tier means OpenAI is betting enterprises will absorb unknown per-task costs before they've validated reliability, and that bet historically fails for automation tools where ROI is measured in runs-per-day at scale. The moat question is uncomfortable: the defensible position is supposed to be the model quality, but Anthropic ships Computer Use with comparable capability, and the action schema format is not proprietary enough to create switching costs once a team has invested in defining them. What needs to change for this to work as a business is transparent consumption pricing that lets an ops team model their unit economics before signing a contract — without that, sales cycles will be long and churn will be brutal once the first production incident hits.”