Cloudflare Web Search API vs SERPHouse

Cloudflare Web Search API 74

Cloudflare API tokens are scoped by permission and revocable, and web search needs only Workers AI Read and AI Gateway Read. Permission is per account, not per gateway or provider. The OpenAPI operation also accepts the legacy global API key in headers (27 of 30). Every call reads. Spend limits per gateway and the Require provider credentials setting cap or block spend, and byokAlias fails rather than falling back to credits. Read permission is enough to spend credits (14 of 20). Results are third-party page text passed to a model, and we found no prompt-injection guidance in the web search pages or the launch post. AI Gateway Guardrails aren't documented for web search (0 of 15). Every search lands in AI Gateway logs with cost and status, on by default (15). security.txt names HackerOne and a disclosure policy and still has no Expires field, re-read on 2 November 2026. Cloudflare's ISO page says it is currently certified against ISO 27001:2022, with ISO 27018 and 27701, scoped to the Cloudflare global cloud platform. 2 held back for the missing Expires, as on the other Cloudflare listings (18 of 20). 27 + 14 + 0 + 15 + 18 = 74.

SERPHouse 11

One key per account, one account per user, no scopes or rotation found (10). The REST API documents api_token in the query string and the hosted MCP server takes the key only in its URL path, less 10 (0 of 30). Searches only read, with no read-only or restricted key (8 of 20). Results are third-party snippets and AI Overview text, with no prompt-injection guidance (0). An account tool shows plan and credit usage; no per-call log was found (3 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). 0 + 8 + 0 + 3 + 0 = 11.

Cloudflare Web Search API 71

Read for a closed service. The web search launch entry is dated 2 October 2026, 31 days ago. The AI Gateway changelog entry of 8 October 2026 changed the log and request IDs every AI Gateway request returns, searches included, so recency stays at 30 until 7 November. Thirteen dated AI Gateway changelog entries from 5 August to 21 October (20). A public changelog with RSS and a developer Discord. We didn't check support response times (8 of 15). The Workers binding has the method. The Cloudflare TypeScript SDK's newest tag is still 7.3.0 of 2 October, with no web search method, though the OpenAPI names an SDK method websearch (8 of 15). The OpenAPI spec carries the path. Nothing else to measure for a hosted endpoint (5 of 10). 30 + 20 + 8 + 8 + 5 = 71.

SERPHouse 23

Read for a closed service, with its repositories read as code. No changelog or dated API change was found. The newest release is MCP server 1.1.0 on 6 July 2026, 123 days before 6 November, and the last commit in its repository was on 22 July (10). No release or dated change in the 90 days from 8 August; the about page's 2026 entry (Forums, Place Details and Scraper APIs) is undated (0). No changelog; support by email. Issues weren't read, since the GitHub API refused us for its rate limit (5 of 25). Not in the official MCP registry, though the repository's server.json names io.github.SERPHouse/serphouse-mcp. Node.js SDK last changed 24 June 2026, PHP SDK 10 May 2024, and no Python SDK repository was found under the SERPHouse organisation (5 of 15). The MCP repository has an npm publish workflow and no tests (3 of 10). 10 + 0 + 5 + 5 + 3 = 23.

Cloudflare Web Search API 77

Scored as a hosted API. www.cloudflarestatus.com lists AI Gateway, Workers AI and AI Search among its services, each with 30-day and 90-day incident bars (20). Web search has no component of its own and runs through AI Gateway. On 2 November 2026 the services page showed AI Gateway with no days with incidents in 90 days. The five Workers AI incident days (13 and 19 August, 9 September, 15 and 27 October) name model errors, a model outage and AI Security for Apps, not AI Gateway or web search, so a clean record (30). The 5 October reading from the status page's JSON feed is struck. 200 requests per 60 seconds per gateway on Unified Billing credentials, and 1,200 requests per five minutes per Cloudflare API token (15). The Cloudflare API returns 429 with retry-after and Ratelimit headers, and the error body carries a retryable flag. Searches have no side effects, but 429 isn't among the responses the OpenAPI operation lists (12 of 15). No SLA for AI Gateway found (0). The docs still label it open beta on 2 November, although the OpenAPI operation is tagged generally-available. We scored from the docs (0). 20 + 30 + 15 + 12 + 0 + 0 = 77.

SERPHouse 40

Read with the hosted lines. No status page is linked from the site or docs, and status.serphouse.com did not answer on 6 November 2026 (0). No readable incident history (5). Rate limits published, 60 requests a minute and 60 concurrent on every self-serve plan (15). 429 is documented as 'slow down', and a 200 can carry "status": "error" with 'Please try again', with no Retry-After or backoff guidance. Failed requests aren't charged (5 of 15). The pricing page lists a 99.99% uptime SLA on Basic and Regular and the docs a 99.95% one, but no SLA terms or credits were found in the terms (5 of 10). Generally available (10). 0 + 5 + 15 + 5 + 5 + 10 = 40.

Cloudflare Web Search API 73

Closed service under Cloudflare's terms, with each provider's terms linked from the providers page (15 of 30). AI Gateway logs are on by default with headers to skip payloads, and Cloudflare's privacy policy and DPA exist per the Cloudflare MCP check. The providers page gives Zero Data Retention for Ceramic.ai and Linkup but not Exa, while the 2 October changelog says all three support it. No retention period for web search logs on the pages we read (15 of 30). No deprecation policy found. The changelog posts dated changes, such as the 24 September log cut-over, but no deprecation notices (6 of 20). The three providers are named, and Cloudflare's subprocessor page names 12 third parties with locations per the Cloudflare MCP check. Where searches are processed isn't stated (14 of 20). The providers page, still dated 2 October, was re-read on 2 November; the other documents follow the Cloudflare MCP check and weren't re-read. 15 + 15 + 6 + 14 = 50.

SERPHouse 50

Closed service under terms naming Patoliya Infotech LLP in India, and the MCP server is MIT (18 of 30). The terms give retention periods (JSON results up to 6 months, HTML up to 1 month, search history indefinitely) and say personal data sits on DigitalOcean in India, and they advise EEA users not to use the service. The privacy policy is generic and neither document carries a date (15 of 30). No deprecation policy, and the terms allow products to be discontinued without notice (0 of 20). DigitalOcean in India named for account data; no sub-processor list (6 of 20). 18 + 15 + 0 + 6 = 39.

Cloudflare Web Search API 20

No x402, MPP or L402 on /ai/websearch. AI Gateway Machine Payments covers only /ai/run for four open models (0, Machine Payments page unchanged since 30 September and still limited to /ai/run). Per-search prices published without a login, $0.25, $5.00 and $7.00 per 1,000 by provider. The 5 per cent fee on credit purchases sits on the Unified Billing page, not the providers page (20). No free allowance found. Credits need a payment method, and the BYOK route needs an account with the provider (0). A person signs up for Cloudflare in a browser and buys credits or stores a provider key (0). 0 + 20 + 0 + 0 = 20.

SERPHouse 40

No x402, MPP or L402 (0). Per-1,000 prices for SERP, autocomplete and top-100 requests published without login (20). Free trial of 4,000 credits for 7 days, 'No Credit Card Required' (20). A person signs up in a browser and confirms an email (0). 0 + 20 + 20 + 0 = 40.

Cloudflare Web Search API 81

Cloudflare's public OpenAPI has /accounts/{account_id}/ai/websearch with a typed body, additionalProperties: false and typed 200, 400, 403 and 502 responses. provider is a free string there where the docs give an enum (22 of 25). llms.txt for the product and Markdown for every page (10). The providers page says which provider suits which job, such as Ceramic.ai for agents that run many searches and Exa for short query-relevant excerpts. Nothing says when not to use the endpoint, and the OpenAPI description is one line (12 of 20). query 1 to 1,024 characters, limit 1 to 10, provider enum in the docs, byokAlias with a pattern (14 of 15). curl and Worker examples, a response example, and a typed error body with category, code and retryable. No catalogue of error codes or messages found (11 of 15). Dated launch entry in the AI Gateway changelog, still the only web search entry on 2 November 2026. The API path carries v4 for the whole Cloudflare API, nothing specific to web search (12 of 15). The OpenAPI operation, re-read from a clone on 2 November, is unchanged.

SERPHouse 66

No OpenAPI or similar contract for the REST API. The MCP server's tools carry typed Zod schemas, published in the source and a static server card (18 of 25). llms.txt at the site and the docs, and every docs page as Markdown (10). MCP tool descriptions say which tool to use for what, such as serphouse_google_web when device or num_result is needed, while the docs pages lead with marketing lines such as 'Unlock captivating Google video content' (12 of 20). Enums for device, SERP type, engine and video duration, defaults and 37 described parameters (11 of 15). A status code table and request examples per engine, with a generic error body (12 of 15). No changelog or API versioning; only the MCP server has tags (3 of 15). 18 + 10 + 12 + 11 + 12 + 3 = 66.