Brave Search API + MCP vs SERPHouse

Brave Search API + MCP 77

MCP server v2.1.4 on 17 September 2026, 45 days before 1 November. Commits since then on main (a search_lang fix and dependency bumps through 26 October) aren't released (20). Four tagged releases since 3 August, v2.1.1 to v2.1.3 on 20 August and v2.1.4 (20). Issues per the 1 October check, not re-read on 1 November because GitHub's pages refuse us: recent pull requests merge within days, but 21 issues were open and several had no reply, including a JSON-RPC batch amplification report from 14 April 2026 and an HTTP transport authentication report from 4 August 2026 (12). Listed in the official MCP registry as io.github.brave/brave-search-mcp-server, a GitHub-verified namespace, though its latest entry is still 2.1.3 (15). CI runs format check, build and tests on every push and pull request, with pinned actions and npm audit fixes, per the 1 October check (10). 20+20+12+15+10 = 77.

SERPHouse 23

Read for a closed service, with its repositories read as code. No changelog or dated API change was found. The newest release is MCP server 1.1.0 on 6 July 2026, 123 days before 6 November, and the last commit in its repository was on 22 July (10). No release or dated change in the 90 days from 8 August; the about page's 2026 entry (Forums, Place Details and Scraper APIs) is undated (0). No changelog; support by email. Issues weren't read, since the GitHub API refused us for its rate limit (5 of 25). Not in the official MCP registry, though the repository's server.json names io.github.SERPHouse/serphouse-mcp. Node.js SDK last changed 24 June 2026, PHP SDK 10 May 2024, and no Python SDK repository was found under the SERPHouse organisation (5 of 15). The MCP repository has an npm publish workflow and no tests (3 of 10). 10 + 0 + 5 + 5 + 3 = 23.

Brave Search API + MCP 58

Plain API keys in the X-Subscription-Token header. Several keys per account, revocable from the dashboard, with rotation advice, but no scopes (20). Read-only by nature, with tool allow and deny lists in the MCP server. The HTTP transport binds to 127.0.0.1 and checks Origin (18). Results are untrusted web text and LLM Context returns page content, and we found no prompt-injection guidance in the API docs or the MCP README (0). No per-call audit log found. Rate-limit headers show quota use only (0). SOC 2 Type II attestation, a HackerOne bounty, a pen test in April 2025 and a security.txt at brave.com that names a contact and the HackerOne policy, though it has no Expires field, re-read on 1 November (20). 20+18+0+0+20 = 58.

SERPHouse 11

One key per account, one account per user, no scopes or rotation found (10). The REST API documents api_token in the query string and the hosted MCP server takes the key only in its URL path, less 10 (0 of 30). Searches only read, with no read-only or restricted key (8 of 20). Results are third-party snippets and AI Overview text, with no prompt-injection guidance (0). An account tool shows plan and credit usage; no per-call log was found (3 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). 0 + 8 + 0 + 3 + 0 = 11.

Brave Search API + MCP 80

status.brave.app (Better Stack) lists a Brave Search API component monitoring api.search.brave.com, showing 100% uptime with every two-day mark from 6 May to 1 November 2026 operational, and a Search API Dashboard monitor at 99.996%. The 1 October note read the page as unmonitored, but its marks go back to May (20). No incident in the 90 days from 3 August on the page or its feed, and the docs' own status log still ends on 27 March 2025, so a clean record on a readable page (20). Rate limits published per plan, 50 QPS Search, 2 QPS Answers, 100 QPS Spellcheck and Autosuggest, in a 1-second sliding window, per the 1 October check (15). 429 on overrun, X-RateLimit-Reset in seconds and exponential backoff guidance. Searches are reads, so no idempotency keys are needed (15). No SLA on any self-serve plan (0). GA (10). 20+20+15+15+0+10 = 80.

SERPHouse 40

Read with the hosted lines. No status page is linked from the site or docs, and status.serphouse.com did not answer on 6 November 2026 (0). No readable incident history (5). Rate limits published, 60 requests a minute and 60 concurrent on every self-serve plan (15). 429 is documented as 'slow down', and a 200 can carry "status": "error" with 'Please try again', with no Retry-After or backoff guidance. Failed requests aren't charged (5 of 15). The pricing page lists a 99.99% uptime SLA on Basic and Regular and the docs a 99.95% one, but no SLA terms or credits were found in the terms (5 of 10). Generally available (10). 0 + 5 + 15 + 5 + 5 + 10 = 40.

Brave Search API + MCP 81

The MCP server is MIT. The API is closed with published terms, so between the two bands (20). Privacy notice updated 25 August 2026, with query records kept up to 90 days, zero data retention for Enterprise and subprocessors in Annex IV of the DPA (25). Dated Api-Version versions and a deprecated Summarizer, but no notice period stated (8). Brave Software Inc. in the US is named, and subprocessors sit in the DPA annex. We found no data-location statement (10). 20+25+8+10 = 63.

SERPHouse 50

Closed service under terms naming Patoliya Infotech LLP in India, and the MCP server is MIT (18 of 30). The terms give retention periods (JSON results up to 6 months, HTML up to 1 month, search history indefinitely) and say personal data sits on DigitalOcean in India, and they advise EEA users not to use the service. The privacy policy is generic and neither document carries a date (15 of 30). No deprecation policy, and the terms allow products to be discontinued without notice (0 of 20). DigitalOcean in India named for account data; no sub-processor list (6 of 20). 18 + 15 + 0 + 6 = 39.

Brave Search API + MCP 20

No machine payment on 1 November. The x402 proxy at search.agent.s.brave.app answers 404 on its root, llms.txt, OpenAPI file and the web search and LLM Context paths it sold on 1 October, the agent payments guide answers 404, and neither llms.txt nor brave.com/search/api mentions x402 (0). $5 per 1,000 searches and $4 per 1,000 Answers requests plus tokens, published without login (20). The $5 monthly credit needs a card on file, which brave.com says is to prevent abuse (0). A person signs up and adds a card before getting a key, so no autonomous route remains (0). 0+20+0+0 = 20.

SERPHouse 40

No x402, MPP or L402 (0). Per-1,000 prices for SERP, autocomplete and top-100 requests published without login (20). Free trial of 4,000 credits for 7 days, 'No Credit Card Required' (20). A person signs up in a browser and confirms an email (0). 0 + 20 + 20 + 0 = 40.

Brave Search API + MCP 72

Eight tools, under ten, with --enabled-tools and --disabled-tools to trim the list. Country and language enums make the web search schema long (22). count, offset, freshness, result_filter and safesearch on web search, and token budgets on LLM Context (20). 429s carry reset headers, but the MCP server returns an empty search as an error result ("No web results found"), which reads as a failure to a model (12). Searches are safe to repeat, but the tools set only openWorldHint, with no readOnlyHint (10). Only query is required. No official SDK in any language (8). 22+20+12+10+8 = 72.

SERPHouse 64

23 MCP tools with no toolsets or filtering (15 of 25). num_result, max_pages, paging, device, location, language, date and video filters (16 of 20). Status codes are tabulated, but a 200 can also mean an error and the body carries only 'Please try again' (10 of 20). Searches only read and failed requests aren't charged, but the MCP tools carry no readOnlyHint or other annotations (10 of 20). serphouse_search needs only q and defaults to the US; most other tools need loc or loc_id. Official Node.js, PHP and Python SDKs are documented (13 of 15). 15 + 16 + 10 + 10 + 13 = 64.