Context.dev vs Decodo Web Data API

Context.dev 83

Restricted keys scoped to data calls, logs, monitors, batches and, since 28 October, access policies on every plan, revocable, with a documented rotation process, and OAuth with PKCE on the MCP server. The docs say never to put a key in a URL and no query-string option was found (30). Read-only scopes for logs, monitors and batches, and the MCP guide, re-read on 1 November, asks clients to keep approvals on for tools that start work or change state. Access policies (28 October) can limit which domains requests reach, per key or account, but are enabled per organisation on request. MCP tool annotations couldn't be checked (15 of 20). The MCP guide, agent quickstart and agent-context guide say to treat page content as untrusted data that can't authorise tool calls. No filter or classifier found (10 of 15). Request logs with retained input and response for up to a year, a Logs API, per-key usage and X-Credits-Used (15). SOC 2 Type II since 18 September 2026 per the changelog, and the trust centre on 1 November shows SOC 2 Type 2 and Type 1 as compliant, and a valid security.txt to 26 September 2027 that points to the support address. No disclosure policy or bug bounty found (13 of 20). 30 + 15 + 10 + 15 + 13 = 83.

Decodo Web Data API 45

One Bearer API key per Web Data API subscription with no scopes, and no rotation or revocation steps found in the reviewed docs. The hosted MCP server adds OAuth 2.1 with PKCE and dynamic registration, but its metadata advertises no scopes. No query-string credential is documented (20 of 30). Scraping only reads, and the MCP tools are annotated read-only, but http_method: POST sends requests to target sites and there is no read-only key (8 of 20). No guidance on treating scraped content as untrusted was found in the docs or the MCP README (0 of 15). The dashboard statistics API reports traffic by target, and each response carries an x-task-id. No per-call audit log (7 of 15). ISO/IEC 27001:2022 for proxies and the Scraping API, a SafeBase trust centre and KYC at signup. security.txt answers 404 and no disclosure policy or bug bounty was found (10 of 20). 20 + 8 + 0 + 7 + 10 = 45.

Context.dev 96

Public OpenAPI 3.1 at www.context.dev/openapi.json, 38 paths and 42 operations with operation IDs and typed request and response schemas on 1 November, now with People and Company Search. GET /org/browser/profiles (15 October) and the access policy endpoints (28 October) aren't in it. The MCP tool definitions are behind OAuth and weren't read (25). llms.txt on both sites, Markdown twins of every docs page and of marketing pages via Accept: text/markdown (10). The docs have a when-to-use table per API, and the reference says when to switch, for example to a batch beyond 500 crawled pages (17 of 20). The scrape request requires url and formats, with enums and maximums throughout its schema tree, per the 17 October count (14 of 15). Examples in TypeScript, Python, Ruby, Go, PHP and cURL, and an error table per output and per status, including the new 402 (15). /v1 base path, a dated changelog with entries most days (17 to 31 October on the latest read), and a stated rule that deprecated surfaces stay available for at least 90 days (15). 25 + 10 + 17 + 14 + 15 + 15 = 96.

Decodo Web Data API 67

No OpenAPI or similar contract for the Web Data API; the two published specs cover the proxy account API and dashboard statistics. The MCP server types every input with zod (12 of 25). llms.txt indexes 401 guide pages, each served as Markdown (10). Tool descriptions state purpose and when to use a tool, such as scrape_as_markdown 'when no site-specific tool fits', and link the docs page (14 of 20). Parameters are tabled with defaults, with enumerated proxy_pool, headless and device_type, but headers is a free object and POST bodies are base64 strings (10 of 15). Curl examples on every page, a response code table with fixes and billing, and parser status codes (14 of 15). Paths are versioned at /v1 and the MCP server's releases are tagged by semantic-release, but no API changelog was found (7 of 15). 12 + 10 + 14 + 10 + 14 + 7 = 67.

Context.dev 78

Closed service. SDKs and CLI are Apache-2.0, the MCP server is closed. Terms last updated 26 October 2026 under Delaware law now say automated access is expected, that software calling the API is never by itself a violation, and that benchmarking is allowed, so the bar on bots and scripts that cost 2 points on 17 October is gone (15 of 30, up from 13). Privacy policy (31 October 2026) and terms agree that requests and results may be used to train models unless a request uses zero data retention or another agreement applies. The docs keep request logs up to a year and batch results 180 days, the DPA (29 October 2026) returns or deletes data within 10 business days of the end of service, but the privacy policy keeps API request logs as long as needed and gives no fixed periods (18 of 30). A stated 90-day minimum for deprecated surfaces and dated changelog notices (20). The website sub-processor list, last updated 31 October 2026, names 15 with each location and purpose and promises 14 days' notice of changes, and it now agrees with the trust centre, which also lists 15 and names Cloudflare among them, where on 17 October the two lists disagreed (20, up from 14). 15 + 18 + 20 + 20 = 73.

Decodo Web Data API 62

Closed service under a public License Agreement naming UAB "Data troops", with MIT clients (15 of 30). The privacy policy (21 May 2026) gives retention periods by category, says Decodo is processor for scraping and doesn't log proxy traffic content, and a DPA is published. Its general two-year rule sits beside longer specific periods without saying which wins, and no retention for scraped results beyond the 24-hour async window was found (18 of 30). The migration guide says legacy APIs keep working with no end date, and the License Agreement allows discontinuing the service without notice or refunds (6 of 20). The privacy policy names Stripe, DeepL and Paddle, but no subprocessor list or data locations were found in it or the trust centre (6 of 20). 15 + 18 + 6 + 6 = 45.

Context.dev 50

No x402, MPP or L402 in llms.txt, the pricing page or the OpenAPI file on 1 November (0). Credit costs per operation and overage per 1,000 credits are public (20). Free plan of 1,000 credits a month, "no credit card required" (20). auth.md, re-read on 1 November, lets an agent start registration and poll for a key, but the person completes the claim in a browser, and the docs MCP route also needs a browser sign-in (10 of 20). 0 + 20 + 20 + 10 = 50.

Decodo Web Data API 40

No x402, MPP or L402 (0). Per-1,000 rates for every endpoint, pool and plan are public in the billing docs (20). Free plan of 10,000 requests a month with no card (20). A person signs up in the dashboard; the MCP OAuth flow also needs a dashboard approval (0). 0 + 20 + 20 + 0 = 40.

Context.dev 67

Better Stack status page at status.context.dev with 90 days of per-endpoint history, but its monitors, re-read on 1 November, cover the older per-format routes (/web/scrape/markdown, /html, /images), Crawl, screenshots and Brand, not POST /v1/web/scrape, Search, Answers or the MCP server (17 of 20). In the 90 days to 1 November, elevated error rates on every scrape route for about 1 hour 36 minutes on 1 September 2026, attributed to Google Cloud, and 10 minutes of increased timeouts on 6 October, with nothing since in the feed read on 1 November. One major (10). Concurrency per plan from 2 on Free to 500 on Scale and Scale 2.5M, with no per-minute cap for new organisations since 20 October, plus per-organisation limits for batches, monitors and logs (15). 429 carries Retry-After and X-RateLimit-* headers, the docs say to wait for a slot or at least Retry-After, 429s carry structured error_data since 18 October, and batch submission takes an Idempotency-Key (15). A 99.9% uptime SLA is listed only for Enterprise, with no terms published (0). The API is generally available (10). 17 + 10 + 15 + 15 + 0 + 10 = 67.

Decodo Web Data API 59

Graded on the hosted lines. Instatus page at status.decodo.com with Web Data API and each legacy scraping API as components, with RSS history (20). In the 90 days to 6 November, every scraping API was out for 2 hours 51 minutes on 30 October, the main outage, with outages of 13 minutes on 26 October and 21 minutes on 15 October across the same components. The rest of the incidents hit proxies, payments or the website. One major (10). Per-plan request rates are published, 10 to 200 a second, though the same page's FAQ says paid plans support 10 to 50 (12 of 15). The response code table tells the agent to wait a couple of minutes on 429 and to retry 500, 524 and 613, which aren't billed, and the MCP client backs off exponentially. No Retry-After or idempotency guidance (7 of 15). No SLA; the License Agreement disclaims uninterrupted service (0). Web Data API is the current, unflagged product (10). 20 + 10 + 12 + 7 + 0 + 10 = 59.

Context.dev 90

formats selects outputs, and mainContentOnly, include and exclude selectors and Highlights with maxCharacters shrink responses. The MCP server registers 42 tools by the vendor's count with no toolsets found, and caps responses at 40,000 characters with a truncation flag, re-read on 1 November (20 of 25). Map and Crawl filter by path, subdomain, count and, since 19 October, an exclude pattern, crawls take page, depth and time limits, and logs, batches, news and People Search paginate (20). Every failed output returns an error_code and a message with the next step, 403 names the missing permission, and since 18 October credit exhaustion returns 402 with error_data saying how to refill (20). Batch submission is idempotent, reads are safe to retry and unbilled on 408, 429 and 5xx. MCP readOnly and destructive hints couldn't be checked (15 of 20). Two required fields, and SDKs in five languages (15). 20 + 20 + 20 + 15 + 15 = 90.

Decodo Web Data API 82

The hosted MCP server lists 24 tools, with a toolsets parameter to load only web, search, ecommerce, social_media or ai, and tokenLimit caps page text at 45,000 characters by default with a truncation notice (20 of 25). Markdown output, parsing for templates, crawl limit, path filters and cursor paging, search paging, map limits and batch tasks (18 of 20). Documented status codes with a solution for each, status_code and parse_status_code in bodies, but 429 covers both the plan rate and a domain throttled for a low success rate (15 of 20). Every tool carries readOnlyHint true and destructiveHint false, server-side failures aren't billed and async results can be re-read for 24 hours. No idempotency key (16 of 20). Only url or query is required, though the default premium pool costs about twice the standard. Official Python, TypeScript and Go SDKs (13 of 15). 20 + 18 + 15 + 16 + 13 = 82.