Bright Data vs ScrapeOps Proxy API Aggregator

Bright Data 69

API keys carry one of five roles (Admin, Finance, Ops, Limit, User), can be given an expiry, and are revoked or refreshed in the control panel, and the hosted MCP also takes OAuth 2.1 with PKCE and one mcp scope (30). The README's default hosted setup still puts the key in the URL as ?token=, a documented option, so less 10 (20). User-role keys can't change configuration, tools load by group, and tools carry readOnlyHint and destructiveHint, but browser tools can fill forms and click with no confirmation step from the server (14 of 20). Since 3.1.0 results from search, scrape, scraper, dataset and browser tools are wrapped as untrusted web content with a per-call marker, and since 2.12.0 a content gate, documented in the README and on by default, asks the user through MCP elicitation before returning page text that looks like instructions to change the MCP configuration (12 of 15). The MCP session_stats tool reports calls in a session. We didn't find a per-request log for operators (5 of 15). ISO 27001, 27017 and 27018, SOC 2 Type II under NDA, a public SOC 3, a managed private bug bounty and security fixes in the MCP changelog per the 1 October check. No security.txt (404 on 4 November). OSV holds no advisory for @brightdata/mcp (18 of 20). 20+14+12+5+18 = 69.

ScrapeOps Proxy API Aggregator 28

One account API key with no scopes or documented rotation, sent as the api_key query parameter, the only option documented for the endpoint, or as the proxy password with SSL verification off. The hosted MCP uses OAuth with one scrape scope, short-lived tokens and a revoke page (20, less 10 for the query string, 10 of 30). Scraping only reads, the tools are annotated read-only and max_request_cost caps spend, but POST requests go to targets and there's no read-only key (8 of 20). No prompt-injection guidance for returned pages was found (0 of 15). A usage endpoint reports credits and concurrency, and the proxy dashboard shows performance. No per-call audit log for customers (7 of 15). security.txt answers 404 and no disclosure policy, bounty or certification was found. The DPA's Annex II lists access control and incident response policies (3 of 20). 10 + 8 + 0 + 7 + 3 = 28.

Bright Data 87

MCP v4.3.0 on 2 November 2026 (30). Ten MCP releases since 6 August, 2.11.2 (11 September), 2.11.3 (15 September), 2.12.0 (8 October), 3.0.0 (11 October), 3.1.0 (15 October), 4.0.0 (18 October), 4.1.0 (20 October), 4.1.1 (29 October), 4.2.0 (1 November) and 4.3.0, and product release notes dated 19, 24 and 27 October (20). Issues not read (GitHub's pages refuse our reader); outside pull requests such as #200 were merged within a week, and the 1 October count of 13 open issues stands (12 of 25). io.github.brightdata/brightdata-mcp in the official registry under a GitHub-verified namespace, now at 4.3.0, the latest release (15). Tests run in CI on every push, and the release workflow runs the tests and npm audit signatures before publishing with provenance (10). 30+20+12+15+10 = 87.

ScrapeOps Proxy API Aggregator 46

Read for a closed service. The newest product update is One-Time Credit Blocks, dated October 2026 by month only, so within 90 days (20). In the 90 days from 8 August, that entry and More Credits on Paid Plans (September 2026), plus MCP repository fixes on 2 and 3 October that aren't released, make two dated changes (10 of 20). Public changelog by product and support by email. GitHub issues weren't read (8 of 25). The MCP server's server.json names io.github.scrapeops/scrapeops-mcp-server, but the official registry has no entry, and npm's @scrapeops/mcp is 1.0.1 of 1 January 2026 while the repository says 1.1.0 (5 of 15). The MCP repository has tests but no CI workflow (3 of 10). 20 + 10 + 8 + 5 + 3 = 46.

Bright Data 74

No OpenAPI file found for the API. The MCP server has zod schemas on every tool, so partial credit (15 of 25). llms.txt at docs.brightdata.com with Markdown pages (10). MCP descriptions say what each tool returns, and the dataset tools say when to use them instead of run_scraper (14 of 20). Typed inputs with enums such as engine (bing or google), time_range and format (12 of 15). Per-product error catalogues for Web Unlocker, Browser API and scrapers, and curl examples (13 of 15). Release notes, now dated to 27 October 2026, and an MCP CHANGELOG with a gap between 2.6.0 and 2.10.0, per the 1 October reading (10 of 15).

ScrapeOps Proxy API Aggregator 67

No OpenAPI or similar spec. The MCP server's three tools have typed inputs in its source (10 of 25). llms.txt and llms-full.txt index the docs for models (10). Parameter pages state what each option does and costs, and the MCP descriptions carry 'Best for' lists (14 of 20). Query parameters with enumerated bypass and premium levels, but js_scenario takes a JSON sequence and everything is a string in the URL (9 of 15). Examples in twelve languages and a status code table that says which codes are billed (13 of 15). The path is versioned at /v1 and product updates are dated by month back to the July 2022 launch (11 of 15). 10 + 10 + 14 + 9 + 13 + 11 = 67.