Grounding with Bing Search vs TinyFish Search

Grounding with Bing Search 20

No x402, MPP or L402 (0). $14 per 1,000 transactions for Grounding with Bing Search and Custom Search, published on microsoft.com without a login (20). No free tier for Grounding with Bing, and an Azure subscription needs a card, as on the Azure Translator listing (0). A person signs up for Azure, creates a Foundry project and, for bing_grounding, a Bing resource (0).

TinyFish Search 45

The Machine Payments Protocol is documented on POST /v1/wallet/top-up only. It funds a prepaid wallet for an existing account, needs the API key and is rolling out gradually. An unauthenticated Search request returned 401, not a payment challenge (10). The pricing page states $0.00 a request without login, re-read on 2 November, but the docs say requests past 12,000 a day need a wallet balance and no rate for them is published (15). Free with no card (20). A person has to sign up in a browser to create a key (0). 10 + 15 + 20 + 0 = 45.

Grounding with Bing Search 79

Callers authenticate to the Foundry project with Microsoft Entra ID tokens and RBAC roles (Foundry User to run agents, Foundry Project Manager to add connections), with just-in-time Contributor through Entra PIM for provisioning. The Bing resource key sits in a project connection and the agent never holds it. No key in a URL (28 of 30). The tools only read. Custom Search confines grounding to configured public domains, and an admin can turn web search off for a whole subscription. There is no per-agent read-only toggle to set, since the tools have no write path (15 of 20). The web search page tells developers to treat web search results as untrusted input and to keep secrets and personal data out of prompts, and the tool best practices page says the same of all tool outputs. Raw results are not passed back to the caller (10 of 15). Run steps show each tool call and the Bing query sent, and Azure's activity log covers resource changes. No per-query audit log for Bing was found (10 of 15). Microsoft runs a coordinated vulnerability disclosure policy and bounty programmes through MSRC. microsoft.com's security.txt passed its Expires date on 23 September 2026 and still carries it on 6 November, and the Azure compliance attestations are not shown to cover a service whose data leaves the compliance boundary (16 of 20). 28 + 15 + 10 + 10 + 16 = 79.

TinyFish Search 57

Revocable API keys shown once, with several keys allowed per account, sent in the X-API-Key header. No scopes were found, and one key covers every TinyFish API including the ones that spend wallet funds. The MCP server uses OAuth 2.1 (20). Search is read-only, but a key or MCP connection cannot be limited to Search (8). Search snippets are untrusted. TinyFish's Fireworks integration guide says search snippets "can contain prompt injection" and its sample system prompt says never to follow instructions found in them, but the Search reference and overview carry no such guidance. Guidance in one guide reads 6, as the TinyFish platform listing, openai-realtime and gusto read it (6). GET /usage lists each search with its status, and responses carry X-Request-ID. Audit logs are listed under Enterprise (10). Valid security.txt (expires 1 September 2027), a disclosure policy of 15 September 2026 with safe harbour and discretionary rewards (not a bounty), and ISO 27001 cited in the terms and on the pricing page. The trust centre could not be read. Read as the TinyFish platform listing reads the same programme (13). 20 + 8 + 6 + 10 + 13 = 57.

Grounding with Bing Search 61

Read as a server-side search tool inside an agent run. The tools return a model's answer with citations rather than raw results, and search_context_size sets how much context web search uses. A caller can't size or inspect the result set itself, since the Bing tools never return their output. Custom Search confines grounding to chosen domains without code (18 of 25). count, freshness, market and language filters, and domain restriction through Custom Search. No pagination or offset (13 of 20). Troubleshooting tables give causes and fixes for connection ID, RBAC and 429 problems, but the tools document no error codes (8 of 20). Searches only read, so a retry is safe apart from the per-transaction charge. No MCP annotations are documented for the toolbox's web search tool (10 of 20). The web_search route needs only a project, a model deployment and the Foundry User role. bing_grounding also needs a paid Bing resource and a project connection. SDKs in Python, C#, JavaScript and Java (12 of 15). Prompt caching gets no hits with the Bing tools, because they add a timestamp to every request. 18 + 13 + 8 + 10 + 12 = 61.

TinyFish Search 78

Results are compact (position, site name, title, snippet, URL) and thumbnails are opt-in, but no parameter sets how many results come back. The hosted MCP server's docs page lists 35 tools on 2 November (the repository reference still lists 28), with no documented search-only subset (15). page from 0 to 10, domain include and exclude lists, date and recency windows, country, language and domain_type, with no result-count control (16). Stable error codes with messages, a details object on account rate limits and a request_id on every error (19). Search is a GET that is safe to repeat and the docs give retry guidance. No read-only annotations appear in the published MCP tool reference (13). Only query is required, and there are official Python and TypeScript SDKs (15). 15 + 16 + 19 + 13 + 15 = 78.

Grounding with Bing Search 68

The tools are typed in the official SDKs (BingGroundingTool, BingCustomSearchPreviewTool, WebSearchTool) in Python, C#, JavaScript and Java, and the toolbox exposes web search as an MCP tool. No public OpenAPI description of the Responses tool types was confirmed from the pages read (10 of 25). Microsoft Learn serves each page as Markdown with accept=text/markdown, though learn.microsoft.com/llms.txt answers 404 (10). The pages say what each of four web grounding routes is for and when to choose it, when to use Custom Search instead, and not to ask the model to summarise a whole page (17 of 20). Parameters are typed with defaults and limits in prose, count 1 to 50 with default 5, freshness values and a date-range form, market and language formats, search_context_size low, medium or high (11 of 15). Examples in Python, C#, TypeScript, Java and REST with expected output, and troubleshooting tables for connection ID, authentication and 429 problems, but no error codes or bodies for the tools (10 of 15). Requests carry api-version=v1 on the toolbox, SDK changelogs are dated and a monthly What's New page lists new articles, the latest for August 2026 (10 of 15). 10 + 10 + 17 + 11 + 10 + 10 = 68.

TinyFish Search 82

A public OpenAPI 3.0 document for Search at agent.tinyfish.ai/v1/openapi/search, with two operations, per the 8 October check, not re-read on 2 November because that host now redirects robots.txt to sign-in (25). llms.txt, llms-full.txt and a Markdown twin of each docs page (10). The docs say when to use Search and when to use Fetch, Agent or Browser, and the MCP search description says when to skip it. That description also tells the model to prefer it over native search tools (17). domain_type is an enum and integers have bounds, but dates, country and language are plain strings, domain lists are comma-separated strings and fetch is a JSON-encoded string (10). An examples page, and an error reference with a JSON body for each code (14). The OpenAPI document is version 1.0.0 and the Search host has no version in its path. The Pulse changelog's newest entry is the week of 22 June 2026 and docs.tinyfish.ai/changelog returns 404 (6). 25 + 10 + 17 + 10 + 14 + 6 = 82.

Grounding with Bing Search 66

Closed service. The terms of use, updated November 2025, are separate from the Online Services terms and sit under the customer's Microsoft agreement (15 of 30). The docs and the terms agree that the Data Protection Addendum and the Product Terms' privacy and security terms don't apply, that Microsoft and the customer are independent controllers, and that the query and parameters leave the Azure compliance and geographic boundary. The terms defer storage and use of query data to the general Microsoft Privacy Statement and state no retention period (15 of 30). The Bing Search APIs retirement was announced on 16 May 2025 for 11 August 2025, under three months' notice, and the web search page marks the Deep Research tool deprecated with a replacement. Microsoft's lifecycle policy covers Azure services, but no deprecation terms for Grounding with Bing were found (10 of 20). Data location for Bing processing isn't stated, and no sub-processor list for it was found (5 of 20). 15 + 15 + 10 + 5 = 45.

TinyFish Search 60

The service is closed with published terms effective 17 August 2026. The MCP proxy is MIT and the SDK packages carry no licence metadata (15). The terms allow customer data to be used to train TinyFish's AI models. The privacy policy, effective 14 December 2025, gives no retention period and says data is kept as long as necessary. No DPA was found on the pages we read (10). No deprecation policy was found. The terms give 30 days' notice of changes to the terms and 14 days for rate increases, and the reference marks site: operators as deprecated with no date (5, as the TinyFish platform listing reads the same terms). No sub-processor list or hosting location was found on readable pages. The enterprise page says data residency is agreed in the contract, and the trust centre is drawn by script and was not read (3, as the platform listing). 15 + 10 + 5 + 3 = 33.