Context.dev vs fastCRW

Context.dev 83

Restricted keys scoped to data calls, logs, monitors, batches and, since 28 October, access policies on every plan, revocable, with a documented rotation process, and OAuth with PKCE on the MCP server. The docs say never to put a key in a URL and no query-string option was found (30). Read-only scopes for logs, monitors and batches, and the MCP guide, re-read on 1 November, asks clients to keep approvals on for tools that start work or change state. Access policies (28 October) can limit which domains requests reach, per key or account, but are enabled per organisation on request. MCP tool annotations couldn't be checked (15 of 20). The MCP guide, agent quickstart and agent-context guide say to treat page content as untrusted data that can't authorise tool calls. No filter or classifier found (10 of 15). Request logs with retained input and response for up to a year, a Logs API, per-key usage and X-Credits-Used (15). SOC 2 Type II since 18 September 2026 per the changelog, and the trust centre on 1 November shows SOC 2 Type 2 and Type 1 as compliant, and a valid security.txt to 26 September 2027 that points to the support address. No disclosure policy or bug bounty found (13 of 20). 30 + 15 + 10 + 15 + 13 = 83.

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

Context.dev 78

Closed service. SDKs and CLI are Apache-2.0, the MCP server is closed. Terms last updated 26 October 2026 under Delaware law now say automated access is expected, that software calling the API is never by itself a violation, and that benchmarking is allowed, so the bar on bots and scripts that cost 2 points on 17 October is gone (15 of 30, up from 13). Privacy policy (31 October 2026) and terms agree that requests and results may be used to train models unless a request uses zero data retention or another agreement applies. The docs keep request logs up to a year and batch results 180 days, the DPA (29 October 2026) returns or deletes data within 10 business days of the end of service, but the privacy policy keeps API request logs as long as needed and gives no fixed periods (18 of 30). A stated 90-day minimum for deprecated surfaces and dated changelog notices (20). The website sub-processor list, last updated 31 October 2026, names 15 with each location and purpose and promises 14 days' notice of changes, and it now agrees with the trust centre, which also lists 15 and names Cloudflare among them, where on 17 October the two lists disagreed (20, up from 14). 15 + 18 + 20 + 20 = 73.

fastCRW 60

The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.

Context.dev 67

Better Stack status page at status.context.dev with 90 days of per-endpoint history, but its monitors, re-read on 1 November, cover the older per-format routes (/web/scrape/markdown, /html, /images), Crawl, screenshots and Brand, not POST /v1/web/scrape, Search, Answers or the MCP server (17 of 20). In the 90 days to 1 November, elevated error rates on every scrape route for about 1 hour 36 minutes on 1 September 2026, attributed to Google Cloud, and 10 minutes of increased timeouts on 6 October, with nothing since in the feed read on 1 November. One major (10). Concurrency per plan from 2 on Free to 500 on Scale and Scale 2.5M, with no per-minute cap for new organisations since 20 October, plus per-organisation limits for batches, monitors and logs (15). 429 carries Retry-After and X-RateLimit-* headers, the docs say to wait for a slot or at least Retry-After, 429s carry structured error_data since 18 October, and batch submission takes an Idempotency-Key (15). A 99.9% uptime SLA is listed only for Enterprise, with no terms published (0). The API is generally available (10). 17 + 10 + 15 + 15 + 0 + 10 = 67.

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

Context.dev 50

No x402, MPP or L402 in llms.txt, the pricing page or the OpenAPI file on 1 November (0). Credit costs per operation and overage per 1,000 credits are public (20). Free plan of 1,000 credits a month, "no credit card required" (20). auth.md, re-read on 1 November, lets an agent start registration and poll for a key, but the person completes the claim in a browser, and the docs MCP route also needs a browser sign-in (10 of 20). 0 + 20 + 20 + 10 = 50.

fastCRW 35

No x402, MPP or L402 (0). Plans are public with credit costs per operation and top-up prices per block of credits, $9 per 1,000 on Hobby down to $299 per 500,000 on Scale, but top-ups need a plan, so between plan-only and per-unit (15 of 20). 500 one-off credits with no card, plus up to 500 from onboarding tasks (20). Hosted keys need a person to sign up in a browser; the free self-hosted engine runs with no account but isn't the graded surface (0). 0 + 15 + 20 + 0 = 35.

Context.dev 85

TypeScript SDK 3.21.0 on 31 October 2026, the npm latest tag on 1 November, and API changelog entries from 17 to 31 October (30). 19 TypeScript SDK releases from 3.9.0 on 18 October to 3.21.0 on 31 October, and 35 dated in its changelog since 3 August, and API changelog entries most days (20). Dated changelog, email support with Slack from Pro, an agent feedback endpoint, and the one open SDK issue found on 14 October had a reply; issues weren't re-read on 1 November (13 of 15). Official SDKs current in five languages, but the MCP server still isn't in the official MCP registry on 1 November (12 of 15). SDK repositories run CI and release-please (10). 30 + 20 + 13 + 12 + 10 = 85.

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

Context.dev 96

Public OpenAPI 3.1 at www.context.dev/openapi.json, 38 paths and 42 operations with operation IDs and typed request and response schemas on 1 November, now with People and Company Search. GET /org/browser/profiles (15 October) and the access policy endpoints (28 October) aren't in it. The MCP tool definitions are behind OAuth and weren't read (25). llms.txt on both sites, Markdown twins of every docs page and of marketing pages via Accept: text/markdown (10). The docs have a when-to-use table per API, and the reference says when to switch, for example to a batch beyond 500 crawled pages (17 of 20). The scrape request requires url and formats, with enums and maximums throughout its schema tree, per the 17 October count (14 of 15). Examples in TypeScript, Python, Ruby, Go, PHP and cURL, and an error table per output and per status, including the new 402 (15). /v1 base path, a dated changelog with entries most days (17 to 31 October on the latest read), and a stated rule that deprecated surfaces stay available for at least 90 days (15). 25 + 10 + 17 + 14 + 15 + 15 = 96.

fastCRW 91

OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.