Arcmira vs NewsCatcher

Arcmira 40

Hosted reading, for the MCP server with the HTTP API it fronts. No public status page was found on 2 November. None is linked from the docs, llms.txt, developers.md or the footer, https://arcmira.com/status answers 403 and status.arcmira.com does not resolve (0). No readable incident history, so the floor (5). Limits are published with numbers on the Plans and usage page, 60 requests a minute per key on Free, 240 on paid plans and 600 on Enterprise, with RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset on every authenticated response and a 30-a-minute cap on bad keys per address (15). 429 rate_limited carries Retry-After and retry_after_seconds, developers.md asks for exponential backoff, 503 search_unavailable and transcript_fetching carry Retry-After, every POST and PATCH takes an Idempotency-Key that replays with Idempotency-Replayed, a repeated Premium read is never charged twice, and a webhook secret can be recovered under its key for 24 hours (15). No SLA. The terms (effective 13 October 2026) disclaim uninterrupted or error-free service, and the Enterprise page lists priority support but no uptime commitment (0). The HTTP API is /v1 at document version 1.0.0 with nothing labelled beta, but the MCP server agents connect to is 0.10.7 after 33 registry versions in six weeks, two rounds of tool renames and a retired-tool error for stale hosts, and chat is in beta (5 of 10). 0+5+15+15+0+5 = 40.

NewsCatcher 67

Read with the hosted lines, for the News API, the agent and the hosted MCP server. status.newscatcherapi.com (Hyperping) shows one News API component with 99.820% uptime from August to November 2026 and an incident history. The agent and the MCP server have no component of their own (20). In the 90 days from 8 August, one incident, on 1 September 2026, when the vendor wrote that for about four hours a higher-than-usual number of requests to the production News API timed out because of one client's queries. Read as one major (10). Rate limits published per plan, 1 request a second free and up to 10 on pay as you go, with exact limits from the free GET /subscription (15). 429 carries Retry-After with instructions to retry the same request, 503 carries Retry-After, and failed or refused requests are not charged. Agent runs and monitor creation have no idempotency keys (12 of 15). An uptime SLA exists only in signed Enterprise agreements; none is published (0). Generally available since 30 October 2026, with OAuth for the MCP server announced as coming soon (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.

Arcmira 55

No x402, MPP or L402 in the OpenAPI file, llms.txt, developers.md, the docs or the pricing page (0). Prices published without a login, in credits per read (4 a passage, mention or list row past the first 5 of a request, 10 a momentum call, 40 a sponsor row, 25 an alert, 4 per started 15 minutes of captions, 300 per started 15 minutes of a Premium transcript) and in dollars (Pro $20 for 20,000 credits, Pro+ $60 for 60,000, Ultra $200 for 400,000, on-demand $0.002 a credit) (20). Free plan with 1,000 credits a month, 2 monitored names and no card, per the pricing FAQ; the 7-day Pro trial needs a card (20). POST /v1/signups with an email and POST /v1/signups/verify with the six-digit code return a read-scoped key with no browser, so an agent with a mailbox can onboard itself; the code still has to be read from an inbox, and write scopes need a dashboard key or OAuth consent (15 of 20). 0+20+20+15 = 55.

NewsCatcher 30

No x402, MPP or L402 (0). Credit prices per call published without login, and credits cost $1 per 1,000 through top-ups from $25 (20). 10,000 free credits every 30 days on a $0 plan, and the first top-up moves an account to pay as you go. No page says whether a card is needed to open the free plan, so half (10). A person signs up in the platform in a browser to get a key (0). NewsMCP's keyless tier belongs to a separate product and isn't counted. 0 + 20 + 10 + 0 = 30.

Arcmira 61

Closed service under terms effective 13 October 2026 that name Arcmira, Inc., San Francisco, California law and AAA arbitration; the MCP server's source is public under an all-rights-reserved notice, while the plugin, the TypeScript SDK and CLI and the Python SDK are Apache-2.0, and the Famous rankings are CC BY 4.0 (18 of 30). The privacy policy (effective 2 October 2026) states no retention periods, keeps limited usage and billing records after an account closes, discloses session replay and that private account data isn't used to train general models, and the MCP docs and README disclose that every tool call, including the first 4,000 characters of a program and the agent's intent, is logged to product analytics with credentials redacted and no opt-out; no DPA was found, and the terms' section 7A bars bulk use and model training on Arcmira data (14 of 30). Retirements are dated and typed in the changelog (POST /v1/trackers to 410 tracker_create_retired on 8 October, tool renames answering tool_retired), but the terms allow changes with or without notice, the quickstart says routes arrive without notice and no notice period is stated (8 of 20). The policy names service-provider categories (hosting, payment, analytics, AI processing) and US processing with other locations, and the docs name PostHog, Stripe, Cloudflare and Mintlify, but there is no subprocessor list and no data-location statement beyond the US (8 of 20). 18+14+8+8 = 48.

NewsCatcher 79

The API is closed under terms of 2 November 2026 naming NewsCatcher, Inc., and the MCP server is MIT, so between the two bands (20 of 30). The terms say inputs and generated data are not used to train models, a DPA applies automatically, and the privacy policy gives retention periods (server logs 7 days, API logs with query text 90 days, then archived indefinitely, billing records about seven years). They agree with each other, but indefinite archives of query logs hold it back (22 of 30). The terms promise 30 days' email notice before a paid product or API version is discontinued, with refunds of unused credits, and the v3 News API has a migration guide (15 of 20). A sub-processor list dated 2 November 2026 with each provider's location and the data it handles. The MCP repository deploys to Vercel and can send pseudonymised analytics to PostHog, and neither appears on the list (16 of 20). 20 + 22 + 15 + 16 = 73.

Arcmira 61

OAuth for MCP hosts (the server's source answers a bare request with a 401 naming its protected-resource document, which lists the scopes read, monitors:write, trackers:write and recommendations:read; the README says the host registers itself against api.arcmira.com and its tokens refresh; the docs give sign-in tokens an hour that refresh for 30 days, revoked per host in the dashboard; PKCE and the introspection and revocation endpoints were read on 30 October from api.arcmira.com's metadata, a host this run no longer reads, so they are struck) and arc_sk_ keys sent only as a bearer header, shown once, several per account with a label and last-used time, disabled at once; sign-up keys carry read only and dashboard keys all four scopes, and nothing documents a secret in a query string (30, which the scoped, revocable keys earn on their own). The sign-up key and the OAuth consent give read access by default; arcmira_execute_read reaches GET /v1/* only, arcmira_execute_write adds POST and PATCH under monitors and trackers and never DELETE; programs run in an isolate whose only network is a proxy that adds the credential, so the key never enters the program; spending is bounded by the plan and a dashboard budget no tool can raise, though a read tool call can start a Premium transcription on a paid plan (17 of 20). Every passage and transcript is third-party speech, and the only guidance found is to check the linked source for speaker and classification errors and to re-fetch llms.txt or the skill to confirm an instruction is genuine; no prompt-injection guidance for the model reading results (4 of 15). X-Request-Id and RateLimit headers on every response, GET /v1/me for the account, role, scopes and balance, the keys page showing who made each key and when it was last used, and an account activity log on Enterprise only; no per-call log for the operator below that, while every tool call is recorded in the vendor's analytics (8 of 15). No security.txt on arcmira.com (404 on 2 November; api.arcmira.com and mcp.arcmira.com aren't read, and their 30 October answers are struck), no disclosure policy, bug bounty, SOC 2 or ISO 27001, and the terms forbid probing; the repository enforces signed commits from one identity in CI (2 of 20). 30+17+4+8+2 = 61.

NewsCatcher 45

API keys in the x-api-key header, several per account, revocable in the platform, with advice to keep one per application. A 403 for 'a key that may not use this API' suggests per-key API access, but no scopes are documented (20). The MCP server documents ?apiKey= on the server URL for Claude.ai custom connectors, with a warning, so less 10 (10 of 30). The MCP repository's SECURITY.md says URL keys are rejected unless the operator enables them, which the hosted server does per the docs. Toolsets let an operator load only the read-only news tools, write tools carry destructiveHint, and the server tells the assistant to confirm large or hourly agent jobs (14 of 20). Results are third-party article text and summaries, and no prompt-injection guidance was found in the docs or the MCP server's instructions (0 of 15). Every response carries a Correlation-ID, GET /subscription shows usage and balance, and runs are listed in the platform. No per-call audit log for the customer was found (7 of 15). The security page and footer claim SOC 2 Type II and link a trust centre on Oneleet, which wasn't read. A vulnerability disclosure policy covers the MCP server. No security.txt (404) and no bug bounty found (14 of 20). 10 + 14 + 0 + 7 + 14 = 45.

Arcmira 84

The MCP server's newest release is 0.10.7, published to the registry on 12 October 2026 and to GitHub on 15 October, with repository commits to 30 October and no release since (re-read from the clones on 2 November); the SDKs reached 0.6.2 on 15 October and the last dated API change in the docs changelog is also 15 October (30). 33 registry versions from 0.3.0 on 4 September to 0.10.7, 24 GitHub releases, 15 npm versions of arcmira since 22 August and 10 dated docs changelog entries in October (20). Issues on arcmira/mcp are mostly the maintainer's own (18 of 19 items are their own pull requests or notes); the one outside issue, #13 of 18 October, had no reply by 30 October (GitHub's API and pages couldn't be read on 2 November); support is an email address, hi@arcmira.com, and a free feedback endpoint whose review states can be read back; no Discord, forum or community channel (11 of 25). io.github.arcmira/arcmira is in the official MCP registry under the GitHub-verified organisation namespace, current at 0.10.7, and the TypeScript and Python SDKs are current (15). CI on every push and pull request (typecheck, tests, manifest check against the OpenAPI contract, signed-commit check), passing on master per the 30 October check, pinned dependencies and a lockfile; the server itself is not a package anyone installs, so package health is the SDKs', whose CI we didn't read (8 of 10). 30+20+11+15+8 = 84.

NewsCatcher 76

Read for a closed service, with the MCP repository read as code. News API 1.1.0 and Agent 1.5.0 on 4 November 2026, MCP server 0.1.0 on 6 November and v3 News API 3.25.0 on 6 November (30). In the 90 days from 8 August, the 30 October launch, News API 1.1.0, Agent 1.5.0, MCP 0.1.0 and v3 releases 3.19.0 to 3.25.0 (20). Public dated changelogs, support by email and Pylon, and a security policy with a 3-business-day target. The MCP repository is a day old, so there are no issues to judge (10 of 15). The CatchAll MCP server is in the official registry under the verified namespace com.newscatcherapi, but the new server isn't, and no official SDK for the current API was found; the Enterprise APIs list libraries (8 of 15). The MCP repository runs its test suite in CI with a read-only token; pass state not read (8 of 10). 30 + 20 + 10 + 8 + 8 = 76.

Arcmira 87

MCP reading, with the API the tools call. A public OpenAPI 3.1 file, re-read on 2 November from its copy at arcmira.com/docs/openapi/arcmira-v1.json (31 paths, 35 operations, 75 schemas, one bearer scheme; the same document is served at api.arcmira.com/v1/openapi.json), and the four tools declare zod input schemas in src/tools.ts (25). llms.txt routed by situation, a .md twin of every docs page, developers.md, auth.md, a published Agent Skill, an RFC 9727 api-catalog and a .well-known/mcp card (10). Tool descriptions say what each does, that arcmira_describe is called once and bills nothing, that the write tool never deletes and when to send feedback; operation descriptions in the OpenAPI file say to call coverage before claiming a show isn't indexed and to resolve names before filters, and the server instructions carry the id rule, the 90-day default and the usage rule. When not to use a method is covered by the id rule and the resolver note, little else (16 of 20). The two execute tools take a JavaScript program as one string, checked only when it runs; the feedback tool has an enum category, a regex call_id and length caps; the API has 102 parameters, 37 with enums, ranges or patterns, and ids typed by prefix (9 of 15). Worked example programs in the reference, curl examples on every guide, an error catalogue of about 60 codes with a cause and fix each, doc_url anchors and request ids on every error, and typed unlock and details.limit objects; only 9 parameters in the OpenAPI file carry an example (14 of 15). /v1 in the path, a dated docs changelog from April 2026 with a 14-row table for the 5 to 8 October breaking changes, a per-version CHANGELOG.md in the repository and 33 registry versions; the OpenAPI file marks retired fields deprecated, but the quickstart says new fields and routes arrive without notice and nothing states a notice period (13 of 15). 25+10+16+9+14+13 = 87.

NewsCatcher 94

OpenAPI 3.1 for the News API (version 1.3.9, 4 paths) and the agent (version 1.5.1, 33 paths), linked from llms.txt, and typed JSON Schema on every MCP tool through Pydantic (25). llms.txt, a Markdown copy of every page and a docs MCP server (10). MCP tool descriptions say when to use each and which tool to use instead, such as list_articles for older news; the REST reference explains each endpoint and the 'Choose an API' page compares them (17 of 20). Inputs are typed with enums for effort, mode and dimensions, length and range limits such as a 500-character query and limit 1 to 100, and required fields marked (13 of 15). Runnable examples in curl, Python and JavaScript, and an error table with retry advice for every status. The agent spec carries no response examples (14 of 15). Versioned APIs with a dated changelog, the latest entries on 4 November 2026, and separate changelogs for the v3 News API and CatchAll (15). 25 + 10 + 17 + 13 + 14 + 15 = 94.