Apify MCP Server vs Microlink

Apify MCP Server 95

x402 on Apify's own domains. agi.apify.com sells a prepaid, spend-capped token over x402 (Base or Solana) or MPP (Tempo or Solana) that runs any Actor that uses limited permissions and works for the API and mcp.apify.com, and since October it also runs single Actors for x402 batch-settlement on Base, billing the real cost afterward. The direct ?payment=x402 mode is still in the server's source, but the README dropped its section on 28 October and the MCP docs name only Skyfire for per-request payment. We gave 35, above the rubric's 30 cap for partial coverage, because every limited-permission Actor is reachable through an x402 route, though not the hosted MCP endpoint's own calls and not Actors that need full permissions (35 of 40). Compute units at $0.20, $0.16 and $0.13 by plan, published without a login and re-read on 1 November (20). Free plan with $5 of usage a month, "No credit card is required" (20). An agent with a wallet gets a token with no signup (20).

Microlink 47

No x402, MPP or L402 (0). Plans are public and the Pro price is stated per 1,000 requests ($1.07), but Business and Enterprise are on request (15 of 20). Free key with 25 requests a day, no card (20). The free endpoint and hosted MCP server answer 5 requests a day with no key or signup, and the MCP checkout tools let an agent start a purchase that a person completes (12 of 20). 0 + 15 + 20 + 12 = 47.

Apify MCP Server 75

Atlassian Statuspage at status.apify.com, history read from its RSS feed on 1 November (20). No incident since 22 September. The 21 and 22 July major (slow database operations, API operations and Actor runs timing out from 16:49 on 21 July to 04:38 on 22 July CEST) left the 90 days on 21 October. Five incidents in the 90 days from 3 August, none read as major. 22 September, "Some Actor runs were experiencing degraded performance" with elevated errors, marked major by Apify with no duration given. 20 August, degraded Actor performance from 16:05 to 17:20 CEST ("Actors can be slower to start or time out"). 13 and 14 August, the SHADER datacenter proxy group. 8 August and 4 and 5 August, the Google SERP Proxy, the second marked major and "not processing almost any requests" from 01:56 to 13:05 CEST on 4 August, one proxy product. Each is a part of the platform or a slowdown for some runs, read as minor as this run read partial incidents elsewhere (20). Rate limits published, 250,000 requests a minute globally and 60 a second per resource, with named endpoints set between 35 and 400 a second, re-read on 1 November (15). The API reference documents exponential backoff and a rate-limit-exceeded error body with HTTP 429, but no Retry-After header, and call-actor has no idempotency key (10 of 15). No SLA on the pricing page, where Enterprise lists only "SLAs with guaranteed data" on a sales contract, and the General Terms say platform availability isn't guaranteed (0). The hosted server is in production use, not labelled beta (10). 20+20+15+10+0+10 = 75.

Microlink 52

Graded on the hosted lines. microlink.io/status exists but is drawn by script, showing only 'Please wait' to our reader, and status.microlink.io failed through our proxy, so components and history are unchecked and scored absent (0). No readable history (5). Free and keyed quotas are published, 5 and 25 requests a day and 2 at a time, with paid quotas from 46,000 a month and x-rate-limit headers on every response (15). 429 with ECONCURRENCY says to wait a second and retry, a quota 429 gives the reset time, and every call only reads, but there is no Retry-After header documented (12 of 15). The terms commit to 99.9% uptime on paid plans, with service credits only under an Enterprise agreement (10). Generally available (10). 0 + 5 + 15 + 12 + 10 + 10 = 52.

Apify MCP Server 62

OAuth on mcp.apify.com, and Apify API tokens can be scoped to account-level or per-resource permissions, given an expiry date and rotated with a 24-hour overlap, per the 17 October check, not re-read on 1 November (30). The API reference, re-read on 1 November, still accepts the token as a ?token= query parameter, which it calls less secure, so less 10 (20). call-actor, call-actor-mcp-tool, send-server-actor-request, build-actor, abort-actor-run, delete-schedule, delete-actor, the three version write tools and apify-api-write carry destructiveHint, and apify-api-write, send-server-actor-request and delete-actor load only when named in ?tools=. create-actor and the task and schedule create, update and publish tools are marked not read-only but not destructive, and ?tools= can limit a session to read tools. There's no server-side confirmation step (15 of 20). Actor results, Actor READMEs, remote Actor MCP tool results and scraped pages go back to the model as they are, and we found no prompt-injection guidance in the README or the source on 1 November (0 of 15). Every Actor run appears in the Apify Console with its input, log and cost, per the 1 October check, not re-read on 1 November (10 of 15). SOC 2 Type II with the report on request through trust.apify.com, a disclosure policy through security@apify.com, GitHub private vulnerability reporting, and a security.txt re-read on 1 November that is valid until 1 January 2035. Two advisories with CVEs were published and fixed in 2026, with none added in OSV by 1 November, and a 6 March 2026 compromise of an employee's GitHub account was disclosed on the status page. 0.20.0 (29 October) fixed a privately reported flaw where ?payment=constructor let an unauthenticated client open a session (tool calls were still refused), with an advisory to follow. No bug bounty found (17 of 20).

Microlink 44

One API key per account in the x-api-key header, with no scopes, rotation or expiry documented. auth.md says to keep it out of URLs and no query option is documented (20 of 30). Tools are reads apart from microlink_function, which runs caller-supplied code against the page in Microlink's browser, and the checkout tools never return a key (10 of 20). Pages come back as Markdown and text, and no prompt-injection guidance was found in the docs, auth.md or the MCP README (0). A request id on every response, with no per-call log for the customer documented (4 of 15). security.txt is valid to 28 July 2027 and links a responsible-disclosure policy and acknowledgements. No bug bounty or certification found (10 of 20). 20 + 10 + 0 + 4 + 10 = 44.

Apify MCP Server 86

MIT (30). Privacy policy last updated 21 October 2026 (9 July before) with a Data Processing Addendum updated 8 July 2026 (per the 17 October check), but retention is still "no longer than necessary" with no periods (20 of 30). Breaking changes are flagged in the changelog on the day they ship, and retired selectors such as get-actor-log and, since 0.19.0, source are ignored without an error. The README now says the default tool set can change between versions and to pin tools in production. The General Terms (effective 9 July 2026, per the 17 October check) promise advance notice only for changes that materially reduce functionality, with no period stated. No deprecation policy found (10 of 20). Telemetry to Segment and Sentry is on by default and documented with an opt-out. Since 0.19.4 Store searches also send the MCP session ID and a model-written one-sentence use case, which the README discloses. The policy names the EU and US as the main data locations. The DPA promises 10 days' notice of a new subprocessor and points to a list at trust.apify.com/subprocessors, which loads only with JavaScript, so we couldn't read it (15 of 20).

Microlink 75

The API is closed under terms naming Microlink Labs, S.L. with its registry details, and the SDK, MCP server and the libraries behind it are MIT (20 of 30). The DPA, updated 30 October 2026, gives cache retention of 24 hours by default up to 31 days, logs 15 days and deletion within 15 days, but the privacy policy is undated, names no controller and gives no periods (20 of 30). The terms promise advance notice before a paid feature is materially reduced, and the changelog records changes by month, with no notice period (10 of 20). Subprocessors list updated 16 October 2026, with services, data types and locations (18 of 20). 20 + 20 + 10 + 18 = 68.

Apify MCP Server 92

14 tools by default and 47 in the README table on 1 November. 0.19.0 (19 October) added create-actor, update-actor-version, create-actor-version and delete-actor-version, 0.19.4 send-server-actor-request (by name only), and 0.20.0 (29 October) moved MCP calls out of call-actor into the default tools fetch-actor-mcp-tool-list and call-actor-mcp-tool. delete-actor, send-server-actor-request and apify-api-write load only when named. ?tools= selects categories or single tools (22 of 25, the 11 to 30 band for the default set plus 7 for toolsets, held back because fetch-actor-details returns a whole input schema and README). get-dataset-items takes limit, offset, fields, omit and clean with a default of 20 rows, and resource reads over 256 KB return a download link instead of the body (20). Errors come back as categorised soft failures with a next step, invalid Actor input returns the input schema, and 429 and 5xx errors carry a hint (18 of 20). Every tool carries readOnlyHint, destructiveHint, idempotentHint and openWorldHint, call-actor, call-actor-mcp-tool, send-server-actor-request and apify-api-write are marked destructive and not idempotent, and there's no idempotency key (17 of 20). Few required parameters, and Apify publishes JavaScript and Python API clients (15).

Microlink 82

24 MCP tools in @microlink/mcp 2.8.17 with no toolset filter found (15 of 25). filter selects fields, embed returns one field as the body, and Markdown and text tools return only page content (18 of 20). Error codes such as EAUTH, ERATE, ECONCURRENCY, EPRO and EPROXYNEEDED with documented fixes (19 of 20). Every tool but microlink_function sets readOnlyHint true and destructiveHint false, and calls are reads with a cache and force to refresh. No idempotentHint (18 of 20). Only url is required; official JavaScript SDK (@microlink/mql) and CLI, with examples in seven languages but no other official SDK found (12 of 15). 15 + 18 + 19 + 18 + 12 = 82.

Apify MCP Server 95

v0.20.0 on 2026-10-29 is the newest tag, and the official registry lists com.apify/apify-mcp-server 0.20.0 as latest, published 29 October (30). 28 tagged releases between 3 August (v0.14.2 on 5 August) and 29 October, seven of them since 17 October (20). 71 commits since 17 October, with the latest on 30 October. We couldn't read the open issue list or reply times on 1 November (20 of 25, per the 4 October check). Registry entry under a DNS-verified namespace (15). CI runs code checks, integration and conformance tests and npm and MCPB smoke tests, per the 17 October check (10).

Microlink 86

@microlink/mcp 2.8.17 and microlink.io 1.1.4 on 31 October 2026, and October changelog entries for the API (30). 31 MCP releases tagged since 17 September and the October changelog's API changes (20). No open issues on microlinkhq/microlink, a monthly changelog, and email and feedback-form support (18 of 25). Not in the official MCP registry under its own namespace, though the server card names io.microlink/mcp; the JavaScript SDK is current (8 of 15). Lint, tests and coverage run on pull requests (10). 30 + 20 + 18 + 8 + 10 = 86.