Arcmira vs SpecStream

Arcmira 55

No x402, MPP or L402 in the OpenAPI file, llms.txt, developers.md, the docs or the pricing page (0). Prices published without a login, in credits per read (4 a passage, mention or list row past the first 5 of a request, 10 a momentum call, 40 a sponsor row, 25 an alert, 4 per started 15 minutes of captions, 300 per started 15 minutes of a Premium transcript) and in dollars (Pro $20 for 20,000 credits, Pro+ $60 for 60,000, Ultra $200 for 400,000, on-demand $0.002 a credit) (20). Free plan with 1,000 credits a month, 2 monitored names and no card, per the pricing FAQ; the 7-day Pro trial needs a card (20). POST /v1/signups with an email and POST /v1/signups/verify with the six-digit code return a read-scoped key with no browser, so an agent with a mailbox can onboard itself; the code still has to be read from an inbox, and write scopes need a dashboard key or OAuth consent (15 of 20). 0+20+20+15 = 55.

SpecStream 85

x402 v2 (USDC on Base, Arbitrum or Polygon, Permit2 upto for the quoted maximum, settled for the results cost) and MPP by card on SpecStream's own POST /v1/agent/lists, the route for buying a list of 1 to 500 results without an account; enrichment of imported lists, refreshes, monitors and investigations need an account, and the route was read in the docs and not exercised because api.specstream.ai's robots.txt could not be read, so partial (25). Per-result prices published without a login, 5, 15 or 100 cents a result, 5 cents an email, 15 cents a phone, rechecks at half rate or 1 cent (20). $10 of work for 30 days with no card (20). An agent can buy a list over x402 or MPP with no account, and the A2A endpoint prices a request without a key (20). 25+20+20+20 = 85.

Arcmira 91

MCP reading. Four tools whose definitions are short, but arcmira_describe returns a reference the vendor measures at 23,124 characters, loaded once a session, and the server instructions run to 1,995 characters; the vendor's own measurement for the change to code mode was 1,123 tokens of definitions against 8,163 for the earlier ten tools (18 of 25). limit 1 to 20 on search (default 5), cursors and has_more on lists, after and before windows, about, by, kind, channel and entity filters, start and end on transcripts, and program output capped at 12,000 characters, 3,000 per string and 100 per array, so a program returns only the fields an answer needs (20). One error envelope with a stable code, a message, param, gate, unlock.url, details.limit, retry_after_seconds and request_id, surfaced to the model with isError and the call_id to report (20). Idempotency-Key on every POST and PATCH with a replay header, a Premium read that is never charged twice, writes that pause rather than delete, and all four annotations declared on every tool; arcmira_execute_read is marked not read-only because a Premium read can start a transcription that uses credits, which a strict host may treat as a write (18 of 20). Few required inputs (one search string, ids resolved for free), a 90-day default window, defaults on limit, and official Apache-2.0 SDKs for TypeScript (npm arcmira 0.6.2) and Python (pip arcmira, repository v0.6.2) plus a CLI, with the caveat that the MCP client's argument names differ from the HTTP and SDK names (15). 18+20+20+18+15 = 91.

SpecStream 65

MCP reading. 128 tools at about 143,700 characters of names, descriptions and schemas (more than 30, 5), with no server-side toolsets or dynamic loading; the framework packages for LangChain, LlamaIndex, CrewAI and the Vercel AI SDK and the Open WebUI tool expose two to four tools with the price cap held in code, and results default to short evidence (5 back, 10 of 25). Cursor and limit on rows, search, specs and revisits, evidence short or full, filters by area and by field on collections, and unconfirmed candidates kept in a separate list (18 of 20). An ErrorEnvelope on every operation and an SDK error class that exposes code and details, but no published code list, meanings or retry rules (6 of 20). Required idempotency keys on paid work, schedules and refund claims with a recovery route, expected_version on updates, stable event ids on webhook retries, and readOnlyHint on 72 tools and destructiveHint on 29, with no idempotentHint (18 of 20). compile needs only q, a quote needs only ast_hash with 25 results by default, and official SDKs in Python and TypeScript with a CLI, though one purchase takes three calls with a hash carried between them (13 of 15). 10+18+6+18+13 = 65.

Arcmira 40

Hosted reading, for the MCP server with the HTTP API it fronts. No public status page was found on 2 November. None is linked from the docs, llms.txt, developers.md or the footer, https://arcmira.com/status answers 403 and status.arcmira.com does not resolve (0). No readable incident history, so the floor (5). Limits are published with numbers on the Plans and usage page, 60 requests a minute per key on Free, 240 on paid plans and 600 on Enterprise, with RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset on every authenticated response and a 30-a-minute cap on bad keys per address (15). 429 rate_limited carries Retry-After and retry_after_seconds, developers.md asks for exponential backoff, 503 search_unavailable and transcript_fetching carry Retry-After, every POST and PATCH takes an Idempotency-Key that replays with Idempotency-Replayed, a repeated Premium read is never charged twice, and a webhook secret can be recovered under its key for 24 hours (15). No SLA. The terms (effective 13 October 2026) disclaim uninterrupted or error-free service, and the Enterprise page lists priority support but no uptime commitment (0). The HTTP API is /v1 at document version 1.0.0 with nothing labelled beta, but the MCP server agents connect to is 0.10.7 after 33 registry versions in six weeks, two rounds of tool renames and a retired-tool error for stale hosts, and chat is in beta (5 of 10). 0+5+15+15+0+5 = 40.

SpecStream 23

Hosted reading, for the MCP server and REST API on api.specstream.ai. No public status page was found. None is linked from the site, llms.txt or the docs, llms-full.txt mentions none, and https://specstream.ai/status returned an error (0). No readable incident history, so the floor (5). No rate limit with numbers is published in the docs, llms.txt, llms-full.txt or the part of the OpenAPI file read; the privacy policy and DPA mention rate limiting without figures, and the published limits are per job (10,000 results a request, four-hour runs, 20,000 imported rows) (0). Nothing documents 429, Retry-After or backoff, but paid work requires an idempotency_key on authorize_capacity_work and POST /v1/capacity/executions, GET /v1/capacity/requests/{request_key} recovers the original find after an uncertain response, and the skills say never to quote again to recover a lost reply (8 of 15). No SLA on any plan, and the terms say 'We do not promise uninterrupted access' (0). No beta or preview label on the API, the MCP server or the SDKs, which PyPI classifies as production and stable at 1.2 (10). 0+5+0+8+0+10 = 23.

Arcmira 61

OAuth for MCP hosts (the server's source answers a bare request with a 401 naming its protected-resource document, which lists the scopes read, monitors:write, trackers:write and recommendations:read; the README says the host registers itself against api.arcmira.com and its tokens refresh; the docs give sign-in tokens an hour that refresh for 30 days, revoked per host in the dashboard; PKCE and the introspection and revocation endpoints were read on 30 October from api.arcmira.com's metadata, a host this run no longer reads, so they are struck) and arc_sk_ keys sent only as a bearer header, shown once, several per account with a label and last-used time, disabled at once; sign-up keys carry read only and dashboard keys all four scopes, and nothing documents a secret in a query string (30, which the scoped, revocable keys earn on their own). The sign-up key and the OAuth consent give read access by default; arcmira_execute_read reaches GET /v1/* only, arcmira_execute_write adds POST and PATCH under monitors and trackers and never DELETE; programs run in an isolate whose only network is a proxy that adds the credential, so the key never enters the program; spending is bounded by the plan and a dashboard budget no tool can raise, though a read tool call can start a Premium transcription on a paid plan (17 of 20). Every passage and transcript is third-party speech, and the only guidance found is to check the linked source for speaker and classification errors and to re-fetch llms.txt or the skill to confirm an instruction is genuine; no prompt-injection guidance for the model reading results (4 of 15). X-Request-Id and RateLimit headers on every response, GET /v1/me for the account, role, scopes and balance, the keys page showing who made each key and when it was last used, and an account activity log on Enterprise only; no per-call log for the operator below that, while every tool call is recorded in the vendor's analytics (8 of 15). No security.txt on arcmira.com (404 on 2 November; api.arcmira.com and mcp.arcmira.com aren't read, and their 30 October answers are struck), no disclosure policy, bug bounty, SOC 2 or ISO 27001, and the terms forbid probing; the repository enforces signed commits from one identity in CI (2 of 20). 30+17+4+8+2 = 61.

SpecStream 73

API keys ss_live_... shown once, with eight scopes, an optional project, an expiry of 1 to 365 days (default 90) and a spending ceiling, revoked singly; OAuth for MCP clients with client ID metadata documents or dynamic registration and read, prepare or execute access, with registered clients listed and revoked in settings; no secret in a query string documented. The authorisation server metadata on api.specstream.ai was not read and rotation is not described beyond expiry (28 of 30). Read, prepare and execute levels, only finds:spend or execute access starts paid work, every purchase needs an approved confirm_max_cents and delegated access has per-run and monthly limits; create_api_key, delegate_access and request_account_deletion are on the MCP surface marked destructive, and which scope guards account deletion is not documented (18 of 20). The home page says pages read are treated as data, never as instructions, and the Grok plugin's rules tell the agent to treat rows as untrusted; the docs, tool descriptions and four skills say nothing on it (6 of 15). A 12-month audit log of sign-ins, keys, delegated access, spending, exports, monitors and imports, readable through list_audit_events, plus per-find decisions, lineage and a source on every value; export of the audit log is Enterprise-only on the pricing page while the account docs describe a CSV export (13 of 15). security.txt is valid until October 2027 with support@specstream.ai, and SECURITY.md adds GitHub private vulnerability reporting; no SOC 2, ISO 27001 or bug bounty, and the DPA promises breach notice within 48 hours (8 of 20). 28+18+6+13+8 = 73.

Arcmira 87

MCP reading, with the API the tools call. A public OpenAPI 3.1 file, re-read on 2 November from its copy at arcmira.com/docs/openapi/arcmira-v1.json (31 paths, 35 operations, 75 schemas, one bearer scheme; the same document is served at api.arcmira.com/v1/openapi.json), and the four tools declare zod input schemas in src/tools.ts (25). llms.txt routed by situation, a .md twin of every docs page, developers.md, auth.md, a published Agent Skill, an RFC 9727 api-catalog and a .well-known/mcp card (10). Tool descriptions say what each does, that arcmira_describe is called once and bills nothing, that the write tool never deletes and when to send feedback; operation descriptions in the OpenAPI file say to call coverage before claiming a show isn't indexed and to resolve names before filters, and the server instructions carry the id rule, the 90-day default and the usage rule. When not to use a method is covered by the id rule and the resolver note, little else (16 of 20). The two execute tools take a JavaScript program as one string, checked only when it runs; the feedback tool has an enum category, a regex call_id and length caps; the API has 102 parameters, 37 with enums, ranges or patterns, and ids typed by prefix (9 of 15). Worked example programs in the reference, curl examples on every guide, an error catalogue of about 60 codes with a cause and fix each, doc_url anchors and request ids on every error, and typed unlock and details.limit objects; only 9 parameters in the OpenAPI file carry an example (14 of 15). /v1 in the path, a dated docs changelog from April 2026 with a 14-row table for the 5 to 8 October breaking changes, a per-version CHANGELOG.md in the repository and 33 registry versions; the OpenAPI file marks retired fields deprecated, but the quickstart says new fields and routes arrive without notice and nothing states a notice period (13 of 15). 25+10+16+9+14+13 = 87.

SpecStream 80

MCP reading, with the REST API described. The tool list shipped in specstream-mcp-stdio 1.2.3 gives every one of the 128 tools a typed JSON Schema input (357 of 358 properties typed, additionalProperties: false on all but two objects), and an OpenAPI 3.1 file at https://specstream.ai/openapi.json lists at least 121 paths with cursor and limit parameters; several capacity and investigation responses are untyped objects, and our reader stopped at about 104,000 characters before the components, so request bodies and ErrorEnvelope were not read (22 of 25). llms.txt, llms-full.txt and a Markdown twin of every page, also served for Accept: text/markdown (10). Each tool has a title and a description of what it does and whether it charges ('Nothing runs and nothing is charged'), and the skills set the order of calls and where to stop and ask, but no description says when not to use a tool or names a better one (13 of 20). 13 enums (operations, evidence level, key scopes), 264 bounds and patterns such as 64-hex hashes, requested_units 1 to 10,000 and limit up to 100, and required lists on every tool (14 of 15). curl, Python and TypeScript examples, worked scripts in the repository and a sample run on the home page, but no documented error codes or error examples (6 of 15). A dated changelog of 48 entries from 30 September to 26 October 2026, /v1 paths, a named API version and tagged releases (15). 22+10+13+14+6+15 = 80.

Arcmira 61

Closed service under terms effective 13 October 2026 that name Arcmira, Inc., San Francisco, California law and AAA arbitration; the MCP server's source is public under an all-rights-reserved notice, while the plugin, the TypeScript SDK and CLI and the Python SDK are Apache-2.0, and the Famous rankings are CC BY 4.0 (18 of 30). The privacy policy (effective 2 October 2026) states no retention periods, keeps limited usage and billing records after an account closes, discloses session replay and that private account data isn't used to train general models, and the MCP docs and README disclose that every tool call, including the first 4,000 characters of a program and the agent's intent, is logged to product analytics with credentials redacted and no opt-out; no DPA was found, and the terms' section 7A bars bulk use and model training on Arcmira data (14 of 30). Retirements are dated and typed in the changelog (POST /v1/trackers to 410 tracker_create_retired on 8 October, tool renames answering tool_retired), but the terms allow changes with or without notice, the quickstart says routes arrive without notice and no notice period is stated (8 of 20). The policy names service-provider categories (hosting, payment, analytics, AI processing) and US processing with other locations, and the docs name PostHog, Stripe, Cloudflare and Mintlify, but there is no subprocessor list and no data-location statement beyond the US (8 of 20). 18+14+8+8 = 48.

SpecStream 66

Closed hosted service under terms of 3 November 2026 naming SpecStream SAS, French law and a liability cap of the greater of 12 months' fees or 100 euros; the client code is MIT (20 of 30). The privacy policy and DPA agree with each other and the about page on EU hosting, no training on customer requests, lists or results, and a retention table (server logs 30 days, backups 8 days, page copies 24 hours, run working copies 7 days, audit log 12 months, support 3 years, accounts until deleted, erased from backups within 8 days of deletion), with breach notice in 48 hours and audit rights; the pricing page and the account docs disagree on who can export the audit log (27 of 30). No API deprecation policy; the changelog dates a price cut of 26 October 2026 that kept approved quotes at their old prices, the terms promise notice of material changes and keep historical quotes on their terms, and the DPA gives 30 days' notice of a new subprocessor (8 of 20). Subprocessors are listed by category with locations and transfer safeguards, hosting on IBM Cloud in Madrid is named in the legal notice, and names are available only on request (12 of 20). 20+27+8+12 = 67.