Bright Data vs Microlink

Bright Data 69

API keys carry one of five roles (Admin, Finance, Ops, Limit, User), can be given an expiry, and are revoked or refreshed in the control panel, and the hosted MCP also takes OAuth 2.1 with PKCE and one mcp scope (30). The README's default hosted setup still puts the key in the URL as ?token=, a documented option, so less 10 (20). User-role keys can't change configuration, tools load by group, and tools carry readOnlyHint and destructiveHint, but browser tools can fill forms and click with no confirmation step from the server (14 of 20). Since 3.1.0 results from search, scrape, scraper, dataset and browser tools are wrapped as untrusted web content with a per-call marker, and since 2.12.0 a content gate, documented in the README and on by default, asks the user through MCP elicitation before returning page text that looks like instructions to change the MCP configuration (12 of 15). The MCP session_stats tool reports calls in a session. We didn't find a per-request log for operators (5 of 15). ISO 27001, 27017 and 27018, SOC 2 Type II under NDA, a public SOC 3, a managed private bug bounty and security fixes in the MCP changelog per the 1 October check. No security.txt (404 on 4 November). OSV holds no advisory for @brightdata/mcp (18 of 20). 20+14+12+5+18 = 69.

Microlink 44

One API key per account in the x-api-key header, with no scopes, rotation or expiry documented. auth.md says to keep it out of URLs and no query option is documented (20 of 30). Tools are reads apart from microlink_function, which runs caller-supplied code against the page in Microlink's browser, and the checkout tools never return a key (10 of 20). Pages come back as Markdown and text, and no prompt-injection guidance was found in the docs, auth.md or the MCP README (0). A request id on every response, with no per-call log for the customer documented (4 of 15). security.txt is valid to 28 July 2027 and links a responsible-disclosure policy and acknowledgements. No bug bounty or certification found (10 of 20). 20 + 10 + 0 + 4 + 10 = 44.

Bright Data 74

No OpenAPI file found for the API. The MCP server has zod schemas on every tool, so partial credit (15 of 25). llms.txt at docs.brightdata.com with Markdown pages (10). MCP descriptions say what each tool returns, and the dataset tools say when to use them instead of run_scraper (14 of 20). Typed inputs with enums such as engine (bing or google), time_range and format (12 of 15). Per-product error catalogues for Web Unlocker, Browser API and scrapers, and curl examples (13 of 15). Release notes, now dated to 27 October 2026, and an MCP CHANGELOG with a gap between 2.6.0 and 2.10.0, per the 1 October reading (10 of 15).

Microlink 89

OpenAPI 3.1 at microlink.io/openapi.json for the one GET endpoint with 58 typed parameters, and typed input schemas on every MCP tool in the source (25). llms.txt of 527 lines, auth.md, an API catalogue and Markdown copies of every docs page (10). Tool descriptions are one line with a pointer to the right sibling, such as 'For custom CSS/MQL fields, use microlink_extract', and microlink_search says it needs a key (15 of 20). Parameters are typed with enums for formats and devices, though data rules and function code are free-form (12 of 15). Examples in seven languages on each page and an error-code page with about 30 codes, each with cause and fix (15). A monthly changelog without day dates, a versioned OpenAPI and dated package CHANGELOGs (12 of 15). 25 + 10 + 15 + 12 + 15 + 12 = 89.

Bright Data 61

The API is closed under the Bright Data licence, and the MCP server is MIT, so we gave 20 between the closed and open bands (20 of 30). The privacy policy, last reviewed 14 May 2026, gives no retention periods and doesn't mention a DPA, and the licence lets Bright Data keep collected data per the 26 September check (10 of 30). Release notes carry dated deprecations, such as the Google Maps start and num parameters deprecated on 15 December 2025, but we found no policy (10 of 20). No subprocessor list. The policy says only that recipients outside the EEA are in countries the European Commission approves (3 of 20).

Microlink 75

The API is closed under terms naming Microlink Labs, S.L. with its registry details, and the SDK, MCP server and the libraries behind it are MIT (20 of 30). The DPA, updated 30 October 2026, gives cache retention of 24 hours by default up to 31 days, logs 15 days and deletion within 15 days, but the privacy policy is undated, names no controller and gives no periods (20 of 30). The terms promise advance notice before a paid feature is materially reduced, and the changelog records changes by month, with no notice period (10 of 20). Subprocessors list updated 16 October 2026, with services, data types and locations (18 of 20). 20 + 20 + 10 + 18 = 68.

Bright Data 40

No public status page found. status.brightdata.com doesn't resolve and the docs index and security overview link none (0). No readable incident history, so 5 by the rubric (5). The SERP API fair-use page gives 1,000 requests a minute for unfunded accounts with HTTP 429 above it and a header that reads the account's limit, paid Web Unlocker plans state unlimited concurrency, and the free tier is 5,000 requests a month (15). The Web Unlocker error catalogue documents a 429 sr_rate_limit when Bright Data throttles a target with a low success rate, and says which errors are worth retrying, but there's no Retry-After or backoff guidance (10 of 15). The pricing page names a Premium SLA for Enterprise and claims 99.99 per cent uptime, with no SLA terms published (0). GA (10). 0+5+15+10+0+10 = 40.

Microlink 52

Graded on the hosted lines. microlink.io/status exists but is drawn by script, showing only 'Please wait' to our reader, and status.microlink.io failed through our proxy, so components and history are unchecked and scored absent (0). No readable history (5). Free and keyed quotas are published, 5 and 25 requests a day and 2 at a time, with paid quotas from 46,000 a month and x-rate-limit headers on every response (15). 429 with ECONCURRENCY says to wait a second and retry, a quota 429 gives the reset time, and every call only reads, but there is no Retry-After header documented (12 of 15). The terms commit to 99.9% uptime on paid plans, with service credits only under an Enterprise agreement (10). Generally available (10). 0 + 5 + 15 + 12 + 10 + 10 = 52.

Bright Data 40

No x402, MPP or L402. Issue #126 asks for x402 and is open (0). Web Unlocker and SERP at $1.50 per 1,000 successful requests, $1.30 on Scale, published without a login (20). 5,000 requests a month, 'No credit card required' (20). A person has to sign up and create a key in the control panel (0).

Microlink 47

No x402, MPP or L402 (0). Plans are public and the Pro price is stated per 1,000 requests ($1.07), but Business and Enterprise are on request (15 of 20). Free key with 25 requests a day, no card (20). The free endpoint and hosted MCP server answer 5 requests a day with no key or signup, and the MCP checkout tools let an agent start a purchase that a person completes (12 of 20). 0 + 15 + 20 + 12 = 47.