Cloudflare Web Search API vs SpecStream

Cloudflare Web Search API 20

No x402, MPP or L402 on /ai/websearch. AI Gateway Machine Payments covers only /ai/run for four open models (0, Machine Payments page unchanged since 30 September and still limited to /ai/run). Per-search prices published without a login, $0.25, $5.00 and $7.00 per 1,000 by provider. The 5 per cent fee on credit purchases sits on the Unified Billing page, not the providers page (20). No free allowance found. Credits need a payment method, and the BYOK route needs an account with the provider (0). A person signs up for Cloudflare in a browser and buys credits or stores a provider key (0). 0 + 20 + 0 + 0 = 20.

SpecStream 85

x402 v2 (USDC on Base, Arbitrum or Polygon, Permit2 upto for the quoted maximum, settled for the results cost) and MPP by card on SpecStream's own POST /v1/agent/lists, the route for buying a list of 1 to 500 results without an account; enrichment of imported lists, refreshes, monitors and investigations need an account, and the route was read in the docs and not exercised because api.specstream.ai's robots.txt could not be read, so partial (25). Per-result prices published without a login, 5, 15 or 100 cents a result, 5 cents an email, 15 cents a phone, rechecks at half rate or 1 cent (20). $10 of work for 30 days with no card (20). An agent can buy a list over x402 or MPP with no account, and the A2A endpoint prices a request without a key (20). 25+20+20+20 = 85.

Cloudflare Web Search API 77

Scored as a hosted API. www.cloudflarestatus.com lists AI Gateway, Workers AI and AI Search among its services, each with 30-day and 90-day incident bars (20). Web search has no component of its own and runs through AI Gateway. On 2 November 2026 the services page showed AI Gateway with no days with incidents in 90 days. The five Workers AI incident days (13 and 19 August, 9 September, 15 and 27 October) name model errors, a model outage and AI Security for Apps, not AI Gateway or web search, so a clean record (30). The 5 October reading from the status page's JSON feed is struck. 200 requests per 60 seconds per gateway on Unified Billing credentials, and 1,200 requests per five minutes per Cloudflare API token (15). The Cloudflare API returns 429 with retry-after and Ratelimit headers, and the error body carries a retryable flag. Searches have no side effects, but 429 isn't among the responses the OpenAPI operation lists (12 of 15). No SLA for AI Gateway found (0). The docs still label it open beta on 2 November, although the OpenAPI operation is tagged generally-available. We scored from the docs (0). 20 + 30 + 15 + 12 + 0 + 0 = 77.

SpecStream 23

Hosted reading, for the MCP server and REST API on api.specstream.ai. No public status page was found. None is linked from the site, llms.txt or the docs, llms-full.txt mentions none, and https://specstream.ai/status returned an error (0). No readable incident history, so the floor (5). No rate limit with numbers is published in the docs, llms.txt, llms-full.txt or the part of the OpenAPI file read; the privacy policy and DPA mention rate limiting without figures, and the published limits are per job (10,000 results a request, four-hour runs, 20,000 imported rows) (0). Nothing documents 429, Retry-After or backoff, but paid work requires an idempotency_key on authorize_capacity_work and POST /v1/capacity/executions, GET /v1/capacity/requests/{request_key} recovers the original find after an uncertain response, and the skills say never to quote again to recover a lost reply (8 of 15). No SLA on any plan, and the terms say 'We do not promise uninterrupted access' (0). No beta or preview label on the API, the MCP server or the SDKs, which PyPI classifies as production and stable at 1.2 (10). 0+5+0+8+0+10 = 23.

Cloudflare Web Search API 71

Read for a closed service. The web search launch entry is dated 2 October 2026, 31 days ago. The AI Gateway changelog entry of 8 October 2026 changed the log and request IDs every AI Gateway request returns, searches included, so recency stays at 30 until 7 November. Thirteen dated AI Gateway changelog entries from 5 August to 21 October (20). A public changelog with RSS and a developer Discord. We didn't check support response times (8 of 15). The Workers binding has the method. The Cloudflare TypeScript SDK's newest tag is still 7.3.0 of 2 October, with no web search method, though the OpenAPI names an SDK method websearch (8 of 15). The OpenAPI spec carries the path. Nothing else to measure for a hosted endpoint (5 of 10). 30 + 20 + 8 + 8 + 5 = 71.

SpecStream 81

specstream-mcp-stdio 1.2.3 on PyPI on 3 November 2026, the Python SDK 1.2.0 committed the same day and @specstream/sdk 1.2.0 on npm on 31 October (30). Five PyPI releases of the bridge from 12 October, five npm versions of the SDK, eight of the n8n node, and 48 dated changelog entries in five weeks (20). A closed service with a dated changelog, support@specstream.ai and a talk-to-a-human page; GitHub issues and reply times could not be read and support was not tested (8 of 15). server.json under the reverse-DNS namespace ai.specstream/specstream 1.3.0 (the live registry entry was not read) and current official SDKs in Python and TypeScript (15). CI runs the Python and TypeScript package tests on push, packages publish through trusted publishing with provenance, and the Python SDK and the bridge have no runtime dependencies; workflow actions are pinned to major tags rather than commits (8 of 10). 30+20+8+15+8 = 81.

Cloudflare Web Search API 73

Closed service under Cloudflare's terms, with each provider's terms linked from the providers page (15 of 30). AI Gateway logs are on by default with headers to skip payloads, and Cloudflare's privacy policy and DPA exist per the Cloudflare MCP check. The providers page gives Zero Data Retention for Ceramic.ai and Linkup but not Exa, while the 2 October changelog says all three support it. No retention period for web search logs on the pages we read (15 of 30). No deprecation policy found. The changelog posts dated changes, such as the 24 September log cut-over, but no deprecation notices (6 of 20). The three providers are named, and Cloudflare's subprocessor page names 12 third parties with locations per the Cloudflare MCP check. Where searches are processed isn't stated (14 of 20). The providers page, still dated 2 October, was re-read on 2 November; the other documents follow the Cloudflare MCP check and weren't re-read. 15 + 15 + 6 + 14 = 50.

SpecStream 66

Closed hosted service under terms of 3 November 2026 naming SpecStream SAS, French law and a liability cap of the greater of 12 months' fees or 100 euros; the client code is MIT (20 of 30). The privacy policy and DPA agree with each other and the about page on EU hosting, no training on customer requests, lists or results, and a retention table (server logs 30 days, backups 8 days, page copies 24 hours, run working copies 7 days, audit log 12 months, support 3 years, accounts until deleted, erased from backups within 8 days of deletion), with breach notice in 48 hours and audit rights; the pricing page and the account docs disagree on who can export the audit log (27 of 30). No API deprecation policy; the changelog dates a price cut of 26 October 2026 that kept approved quotes at their old prices, the terms promise notice of material changes and keep historical quotes on their terms, and the DPA gives 30 days' notice of a new subprocessor (8 of 20). Subprocessors are listed by category with locations and transfer safeguards, hosting on IBM Cloud in Madrid is named in the legal notice, and names are available only on request (12 of 20). 20+27+8+12 = 67.