Cloudflare Web Search API vs NewsCatcher

Cloudflare Web Search API 74

Cloudflare API tokens are scoped by permission and revocable, and web search needs only Workers AI Read and AI Gateway Read. Permission is per account, not per gateway or provider. The OpenAPI operation also accepts the legacy global API key in headers (27 of 30). Every call reads. Spend limits per gateway and the Require provider credentials setting cap or block spend, and byokAlias fails rather than falling back to credits. Read permission is enough to spend credits (14 of 20). Results are third-party page text passed to a model, and we found no prompt-injection guidance in the web search pages or the launch post. AI Gateway Guardrails aren't documented for web search (0 of 15). Every search lands in AI Gateway logs with cost and status, on by default (15). security.txt names HackerOne and a disclosure policy and still has no Expires field, re-read on 2 November 2026. Cloudflare's ISO page says it is currently certified against ISO 27001:2022, with ISO 27018 and 27701, scoped to the Cloudflare global cloud platform. 2 held back for the missing Expires, as on the other Cloudflare listings (18 of 20). 27 + 14 + 0 + 15 + 18 = 74.

NewsCatcher 45

API keys in the x-api-key header, several per account, revocable in the platform, with advice to keep one per application. A 403 for 'a key that may not use this API' suggests per-key API access, but no scopes are documented (20). The MCP server documents ?apiKey= on the server URL for Claude.ai custom connectors, with a warning, so less 10 (10 of 30). The MCP repository's SECURITY.md says URL keys are rejected unless the operator enables them, which the hosted server does per the docs. Toolsets let an operator load only the read-only news tools, write tools carry destructiveHint, and the server tells the assistant to confirm large or hourly agent jobs (14 of 20). Results are third-party article text and summaries, and no prompt-injection guidance was found in the docs or the MCP server's instructions (0 of 15). Every response carries a Correlation-ID, GET /subscription shows usage and balance, and runs are listed in the platform. No per-call audit log for the customer was found (7 of 15). The security page and footer claim SOC 2 Type II and link a trust centre on Oneleet, which wasn't read. A vulnerability disclosure policy covers the MCP server. No security.txt (404) and no bug bounty found (14 of 20). 10 + 14 + 0 + 7 + 14 = 45.

Cloudflare Web Search API 63

Results are small by default (URL, title, description), and limit caps them at 1 to 10. The default provider, Ceramic.ai, returns descriptions of up to 8,000 characters a result with no parameter to shorten them (15 of 25). limit is the only control. No pagination, offset, domain, date, country or freshness filters (6 of 20). Errors come back with category (gateway, credential, provider, internal), code, status, retryable and gatewayRequestId. The codes themselves aren't listed (16 of 20). Searches only read, the error body says whether a retry helps, and gateways can retry upstream failures up to five times. No idempotency keys, which a read doesn't need (16 of 20). Only query and the gateway ID are required. The Workers binding is TypeScript, and the Cloudflare TypeScript SDK 7.3.0 of 3 October has no web search method. We didn't check the Python or Go SDKs (10 of 15).

NewsCatcher 84

15 MCP tools in four toolsets, chosen per connection with ?tools=, and tools return compact text rather than the full JSON. 15 for 11 to 30 tools plus 7 for toolsets (22 of 25). limit, search_window, effort, language, country, publisher, coverage and content-type filters, sorting, and paging on /articles; agent tables come back up to 200 rows at a time over MCP (20). Every status is documented with whether to retry; the agent returns stable code values, while the News API body has a status_code and a message meant for people (17 of 20). Every tool carries readOnlyHint and idempotentHint, writes carry destructiveHint, start_research has a free dry_run, and refused or failed calls aren't charged. No idempotency key for starting runs (17 of 20). Only q is required, with medium effort and a 7-day window as defaults. No official SDK for the current API was found; the docs show raw HTTP in three languages (8 of 15). 22 + 20 + 17 + 17 + 8 = 84.

Cloudflare Web Search API 81

Cloudflare's public OpenAPI has /accounts/{account_id}/ai/websearch with a typed body, additionalProperties: false and typed 200, 400, 403 and 502 responses. provider is a free string there where the docs give an enum (22 of 25). llms.txt for the product and Markdown for every page (10). The providers page says which provider suits which job, such as Ceramic.ai for agents that run many searches and Exa for short query-relevant excerpts. Nothing says when not to use the endpoint, and the OpenAPI description is one line (12 of 20). query 1 to 1,024 characters, limit 1 to 10, provider enum in the docs, byokAlias with a pattern (14 of 15). curl and Worker examples, a response example, and a typed error body with category, code and retryable. No catalogue of error codes or messages found (11 of 15). Dated launch entry in the AI Gateway changelog, still the only web search entry on 2 November 2026. The API path carries v4 for the whole Cloudflare API, nothing specific to web search (12 of 15). The OpenAPI operation, re-read from a clone on 2 November, is unchanged.

NewsCatcher 94

OpenAPI 3.1 for the News API (version 1.3.9, 4 paths) and the agent (version 1.5.1, 33 paths), linked from llms.txt, and typed JSON Schema on every MCP tool through Pydantic (25). llms.txt, a Markdown copy of every page and a docs MCP server (10). MCP tool descriptions say when to use each and which tool to use instead, such as list_articles for older news; the REST reference explains each endpoint and the 'Choose an API' page compares them (17 of 20). Inputs are typed with enums for effort, mode and dimensions, length and range limits such as a 500-character query and limit 1 to 100, and required fields marked (13 of 15). Runnable examples in curl, Python and JavaScript, and an error table with retry advice for every status. The agent spec carries no response examples (14 of 15). Versioned APIs with a dated changelog, the latest entries on 4 November 2026, and separate changelogs for the v3 News API and CatchAll (15). 25 + 10 + 17 + 13 + 14 + 15 = 94.

Cloudflare Web Search API 77

Scored as a hosted API. www.cloudflarestatus.com lists AI Gateway, Workers AI and AI Search among its services, each with 30-day and 90-day incident bars (20). Web search has no component of its own and runs through AI Gateway. On 2 November 2026 the services page showed AI Gateway with no days with incidents in 90 days. The five Workers AI incident days (13 and 19 August, 9 September, 15 and 27 October) name model errors, a model outage and AI Security for Apps, not AI Gateway or web search, so a clean record (30). The 5 October reading from the status page's JSON feed is struck. 200 requests per 60 seconds per gateway on Unified Billing credentials, and 1,200 requests per five minutes per Cloudflare API token (15). The Cloudflare API returns 429 with retry-after and Ratelimit headers, and the error body carries a retryable flag. Searches have no side effects, but 429 isn't among the responses the OpenAPI operation lists (12 of 15). No SLA for AI Gateway found (0). The docs still label it open beta on 2 November, although the OpenAPI operation is tagged generally-available. We scored from the docs (0). 20 + 30 + 15 + 12 + 0 + 0 = 77.

NewsCatcher 67

Read with the hosted lines, for the News API, the agent and the hosted MCP server. status.newscatcherapi.com (Hyperping) shows one News API component with 99.820% uptime from August to November 2026 and an incident history. The agent and the MCP server have no component of their own (20). In the 90 days from 8 August, one incident, on 1 September 2026, when the vendor wrote that for about four hours a higher-than-usual number of requests to the production News API timed out because of one client's queries. Read as one major (10). Rate limits published per plan, 1 request a second free and up to 10 on pay as you go, with exact limits from the free GET /subscription (15). 429 carries Retry-After with instructions to retry the same request, 503 carries Retry-After, and failed or refused requests are not charged. Agent runs and monitor creation have no idempotency keys (12 of 15). An uptime SLA exists only in signed Enterprise agreements; none is published (0). Generally available since 30 October 2026, with OAuth for the MCP server announced as coming soon (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.

Cloudflare Web Search API 20

No x402, MPP or L402 on /ai/websearch. AI Gateway Machine Payments covers only /ai/run for four open models (0, Machine Payments page unchanged since 30 September and still limited to /ai/run). Per-search prices published without a login, $0.25, $5.00 and $7.00 per 1,000 by provider. The 5 per cent fee on credit purchases sits on the Unified Billing page, not the providers page (20). No free allowance found. Credits need a payment method, and the BYOK route needs an account with the provider (0). A person signs up for Cloudflare in a browser and buys credits or stores a provider key (0). 0 + 20 + 0 + 0 = 20.

NewsCatcher 30

No x402, MPP or L402 (0). Credit prices per call published without login, and credits cost $1 per 1,000 through top-ups from $25 (20). 10,000 free credits every 30 days on a $0 plan, and the first top-up moves an account to pay as you go. No page says whether a card is needed to open the free plan, so half (10). A person signs up in the platform in a browser to get a key (0). NewsMCP's keyless tier belongs to a separate product and isn't counted. 0 + 20 + 10 + 0 = 30.

Cloudflare Web Search API 73

Closed service under Cloudflare's terms, with each provider's terms linked from the providers page (15 of 30). AI Gateway logs are on by default with headers to skip payloads, and Cloudflare's privacy policy and DPA exist per the Cloudflare MCP check. The providers page gives Zero Data Retention for Ceramic.ai and Linkup but not Exa, while the 2 October changelog says all three support it. No retention period for web search logs on the pages we read (15 of 30). No deprecation policy found. The changelog posts dated changes, such as the 24 September log cut-over, but no deprecation notices (6 of 20). The three providers are named, and Cloudflare's subprocessor page names 12 third parties with locations per the Cloudflare MCP check. Where searches are processed isn't stated (14 of 20). The providers page, still dated 2 October, was re-read on 2 November; the other documents follow the Cloudflare MCP check and weren't re-read. 15 + 15 + 6 + 14 = 50.

NewsCatcher 79

The API is closed under terms of 2 November 2026 naming NewsCatcher, Inc., and the MCP server is MIT, so between the two bands (20 of 30). The terms say inputs and generated data are not used to train models, a DPA applies automatically, and the privacy policy gives retention periods (server logs 7 days, API logs with query text 90 days, then archived indefinitely, billing records about seven years). They agree with each other, but indefinite archives of query logs hold it back (22 of 30). The terms promise 30 days' email notice before a paid product or API version is discontinued, with refunds of unused credits, and the v3 News API has a migration guide (15 of 20). A sub-processor list dated 2 November 2026 with each provider's location and the data it handles. The MCP repository deploys to Vercel and can send pseudonymised analytics to PostHog, and neither appears on the list (16 of 20). 20 + 22 + 15 + 16 = 73.