Bright Data vs fastCRW

Bright Data 69

API keys carry one of five roles (Admin, Finance, Ops, Limit, User), can be given an expiry, and are revoked or refreshed in the control panel, and the hosted MCP also takes OAuth 2.1 with PKCE and one mcp scope (30). The README's default hosted setup still puts the key in the URL as ?token=, a documented option, so less 10 (20). User-role keys can't change configuration, tools load by group, and tools carry readOnlyHint and destructiveHint, but browser tools can fill forms and click with no confirmation step from the server (14 of 20). Since 3.1.0 results from search, scrape, scraper, dataset and browser tools are wrapped as untrusted web content with a per-call marker, and since 2.12.0 a content gate, documented in the README and on by default, asks the user through MCP elicitation before returning page text that looks like instructions to change the MCP configuration (12 of 15). The MCP session_stats tool reports calls in a session. We didn't find a per-request log for operators (5 of 15). ISO 27001, 27017 and 27018, SOC 2 Type II under NDA, a public SOC 3, a managed private bug bounty and security fixes in the MCP changelog per the 1 October check. No security.txt (404 on 4 November). OSV holds no advisory for @brightdata/mcp (18 of 20). 20+14+12+5+18 = 69.

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

Bright Data 74

No OpenAPI file found for the API. The MCP server has zod schemas on every tool, so partial credit (15 of 25). llms.txt at docs.brightdata.com with Markdown pages (10). MCP descriptions say what each tool returns, and the dataset tools say when to use them instead of run_scraper (14 of 20). Typed inputs with enums such as engine (bing or google), time_range and format (12 of 15). Per-product error catalogues for Web Unlocker, Browser API and scrapers, and curl examples (13 of 15). Release notes, now dated to 27 October 2026, and an MCP CHANGELOG with a gap between 2.6.0 and 2.10.0, per the 1 October reading (10 of 15).

fastCRW 91

OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.

Bright Data 79

Since MCP 3.1.0 (15 October 2026) all 32 tools are on by default, with groups= and tools= on the hosted URL or GROUPS and TOOLS locally to narrow them (5 for more than 30, plus 10 for the filters, 15). Markdown, text, HTML or JSON-LD output from the scrape tools, content cut at 200,000 characters, batch tools of up to 5 searches or 5 URLs and filterable dataset search, but no general field selection (15 of 20). Error codes with a retry-or-fix classification, and since 4.3.0 the local server uses the hosted server's codes (rate_limited, invalid_input, quota_exceeded) (17 of 20). Since 4.1.0 every tool sets readOnlyHint, destructiveHint and openWorldHint, with browser click and type marked destructive. Billing counts successful requests, and there are no idempotency keys (17 of 20, as firecrawl-mcp and apify-mcp). One required secret and auto-created zones, and official Python (brightdata-sdk) and JavaScript SDKs in the docs index (15). 15+15+17+17+15 = 79.

fastCRW 91

11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with truncated: true and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry errorCode values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with success: false (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only url is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.

Bright Data 40

No public status page found. status.brightdata.com doesn't resolve and the docs index and security overview link none (0). No readable incident history, so 5 by the rubric (5). The SERP API fair-use page gives 1,000 requests a minute for unfunded accounts with HTTP 429 above it and a header that reads the account's limit, paid Web Unlocker plans state unlimited concurrency, and the free tier is 5,000 requests a month (15). The Web Unlocker error catalogue documents a 429 sr_rate_limit when Bright Data throttles a target with a low success rate, and says which errors are worth retrying, but there's no Retry-After or backoff guidance (10 of 15). The pricing page names a Premium SLA for Enterprise and claims 99.99 per cent uptime, with no SLA terms published (0). GA (10). 0+5+15+10+0+10 = 40.

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

Bright Data 87

MCP v4.3.0 on 2 November 2026 (30). Ten MCP releases since 6 August, 2.11.2 (11 September), 2.11.3 (15 September), 2.12.0 (8 October), 3.0.0 (11 October), 3.1.0 (15 October), 4.0.0 (18 October), 4.1.0 (20 October), 4.1.1 (29 October), 4.2.0 (1 November) and 4.3.0, and product release notes dated 19, 24 and 27 October (20). Issues not read (GitHub's pages refuse our reader); outside pull requests such as #200 were merged within a week, and the 1 October count of 13 open issues stands (12 of 25). io.github.brightdata/brightdata-mcp in the official registry under a GitHub-verified namespace, now at 4.3.0, the latest release (15). Tests run in CI on every push, and the release workflow runs the tests and npm audit signatures before publishing with provenance (10). 30+20+12+15+10 = 87.

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

Bright Data 40

No x402, MPP or L402. Issue #126 asks for x402 and is open (0). Web Unlocker and SERP at $1.50 per 1,000 successful requests, $1.30 on Scale, published without a login (20). 5,000 requests a month, 'No credit card required' (20). A person has to sign up and create a key in the control panel (0).

fastCRW 35

No x402, MPP or L402 (0). Plans are public with credit costs per operation and top-up prices per block of credits, $9 per 1,000 on Hobby down to $299 per 500,000 on Scale, but top-ups need a plan, so between plan-only and per-unit (15 of 20). 500 one-off credits with no card, plus up to 500 from onboarding tasks (20). Hosted keys need a person to sign up in a browser; the free self-hosted engine runs with no account but isn't the graded surface (0). 0 + 15 + 20 + 0 = 35.