Context.dev vs Outcrawl

Context.dev 96

Public OpenAPI 3.1 at www.context.dev/openapi.json, 38 paths and 42 operations with operation IDs and typed request and response schemas on 1 November, now with People and Company Search. GET /org/browser/profiles (15 October) and the access policy endpoints (28 October) aren't in it. The MCP tool definitions are behind OAuth and weren't read (25). llms.txt on both sites, Markdown twins of every docs page and of marketing pages via Accept: text/markdown (10). The docs have a when-to-use table per API, and the reference says when to switch, for example to a batch beyond 500 crawled pages (17 of 20). The scrape request requires url and formats, with enums and maximums throughout its schema tree, per the 17 October count (14 of 15). Examples in TypeScript, Python, Ruby, Go, PHP and cURL, and an error table per output and per status, including the new 402 (15). /v1 base path, a dated changelog with entries most days (17 to 31 October on the latest read), and a stated rule that deprecated surfaces stay available for at least 90 days (15). 25 + 10 + 17 + 14 + 15 + 15 = 96.

Outcrawl 71

API reading, with the MCP server described. An OpenAPI 3.1 document at https://outcrawl.ai/docs/api-reference/openapi.json lists 62 operations over 51 paths with a summary each and the same 11 status codes, generated from the vendor's capability registry, but every request body is an untyped object marked additionalProperties: true with a pointer to the docs, every 200 response is an untyped object, and Error is the only schema; the typed shapes live in the SDK declarations and in the MCP server's zod schemas, which were read in the 0.4.3 npm package rather than from the hosted server (15 of 25). llms.txt and a 525 KB llms-full.txt on the docs, a Markdown twin of every page and an llms.txt on the site (10). The MCP descriptions each end with a Not for: clause naming the better tool and most with a Cost: clause, the OpenAPI summaries say when not to use a route, and the capability pages say which neighbour to use instead (18 of 20). Scrape formats are an enum of eight, event levels and record kinds are enums, caps.budget is required, and the SDK types bound every option, while the OpenAPI bodies carry none of it (10 of 15). curl, TypeScript and Python examples on every page, 20 worked programs, a 31-row error table with meanings and a retryable list, and MCP errors with a recovery string, though the closed union is sized 24, 31, 45 and 22 on different pages (13 of 15). /v1 in the path and 1.0.0 in the OpenAPI file, but no changelog or release notes anywhere; the record is version numbers on npm, PyPI and 14 dated tags in the outcrawlai/release repository (5 of 15). 15+10+18+10+13+5 = 71.

Context.dev 67

Better Stack status page at status.context.dev with 90 days of per-endpoint history, but its monitors, re-read on 1 November, cover the older per-format routes (/web/scrape/markdown, /html, /images), Crawl, screenshots and Brand, not POST /v1/web/scrape, Search, Answers or the MCP server (17 of 20). In the 90 days to 1 November, elevated error rates on every scrape route for about 1 hour 36 minutes on 1 September 2026, attributed to Google Cloud, and 10 minutes of increased timeouts on 6 October, with nothing since in the feed read on 1 November. One major (10). Concurrency per plan from 2 on Free to 500 on Scale and Scale 2.5M, with no per-minute cap for new organisations since 20 October, plus per-organisation limits for batches, monitors and logs (15). 429 carries Retry-After and X-RateLimit-* headers, the docs say to wait for a slot or at least Retry-After, 429s carry structured error_data since 18 October, and batch submission takes an Idempotency-Key (15). A 99.9% uptime SLA is listed only for Enterprise, with no terms published (0). The API is generally available (10). 17 + 10 + 15 + 15 + 0 + 10 = 67.

Outcrawl 45

Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers quota_exceeded with ceiling: requests_per_minute and retryAfterSeconds, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and concurrency_limit tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.

Context.dev 78

Closed service. SDKs and CLI are Apache-2.0, the MCP server is closed. Terms last updated 26 October 2026 under Delaware law now say automated access is expected, that software calling the API is never by itself a violation, and that benchmarking is allowed, so the bar on bots and scripts that cost 2 points on 17 October is gone (15 of 30, up from 13). Privacy policy (31 October 2026) and terms agree that requests and results may be used to train models unless a request uses zero data retention or another agreement applies. The docs keep request logs up to a year and batch results 180 days, the DPA (29 October 2026) returns or deletes data within 10 business days of the end of service, but the privacy policy keeps API request logs as long as needed and gives no fixed periods (18 of 30). A stated 90-day minimum for deprecated surfaces and dated changelog notices (20). The website sub-processor list, last updated 31 October 2026, names 15 with each location and purpose and promises 14 days' notice of changes, and it now agrees with the trust centre, which also lists 15 and names Cloudflare among them, where on 17 October the two lists disagreed (20, up from 14). 15 + 18 + 20 + 20 = 73.

Outcrawl 56

Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.

Context.dev 83

Restricted keys scoped to data calls, logs, monitors, batches and, since 28 October, access policies on every plan, revocable, with a documented rotation process, and OAuth with PKCE on the MCP server. The docs say never to put a key in a URL and no query-string option was found (30). Read-only scopes for logs, monitors and batches, and the MCP guide, re-read on 1 November, asks clients to keep approvals on for tools that start work or change state. Access policies (28 October) can limit which domains requests reach, per key or account, but are enabled per organisation on request. MCP tool annotations couldn't be checked (15 of 20). The MCP guide, agent quickstart and agent-context guide say to treat page content as untrusted data that can't authorise tool calls. No filter or classifier found (10 of 15). Request logs with retained input and response for up to a year, a Logs API, per-key usage and X-Credits-Used (15). SOC 2 Type II since 18 September 2026 per the changelog, and the trust centre on 1 November shows SOC 2 Type 2 and Type 1 as compliant, and a valid security.txt to 26 September 2027 that points to the support address. No disclosure policy or bug bounty found (13 of 20). 30 + 15 + 10 + 15 + 13 = 83.

Outcrawl 66

OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, api; API keys shaped ock_<keyId>.<secret> are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above approvalAbove pause for a person's yes, and control hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries usage, /v1/usage groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.

Context.dev 50

No x402, MPP or L402 in llms.txt, the pricing page or the OpenAPI file on 1 November (0). Credit costs per operation and overage per 1,000 credits are public (20). Free plan of 1,000 credits a month, "no credit card required" (20). auth.md, re-read on 1 November, lets an agent start registration and poll for a key, but the person completes the claim in a browser, and the docs MCP route also needs a browser sign-in (10 of 20). 0 + 20 + 20 + 10 = 50.

Outcrawl 40

No x402, MPP or L402 in the OpenAPI file, the docs, the pricing pages or the terms (0). Per-unit rates published without a login, 1 credit a page, 5 credits per 10 search results, 1 credit a browser minute, 2,000 credits a GB and 1 credit a monitor check, with the dollar rate per plan ($4.90 per 1,000 credits on Builder down to about $3.20 on Scale), top-up prices per 10,000 and an estimate of about 15 credits a minute for agent runs (20). Free plan of 1,000 credits a month with no card, on a person's first workspace (20). A person signs in with Google, GitHub, an email code or a magic link behind reCAPTCHA, and MCP's OAuth consent needs that browser sign-in; no keyless route, no programmatic key creation (0). 0+20+20+0 = 40.

Context.dev 90

formats selects outputs, and mainContentOnly, include and exclude selectors and Highlights with maxCharacters shrink responses. The MCP server registers 42 tools by the vendor's count with no toolsets found, and caps responses at 40,000 characters with a truncation flag, re-read on 1 November (20 of 25). Map and Crawl filter by path, subdomain, count and, since 19 October, an exclude pattern, crawls take page, depth and time limits, and logs, batches, news and People Search paginate (20). Every failed output returns an error_code and a message with the next step, 403 names the missing permission, and since 18 October credit exhaustion returns 402 with error_data saying how to refill (20). Batch submission is idempotent, reads are safe to retry and unbilled on 408, 429 and 5xx. MCP readOnly and destructive hints couldn't be checked (15 of 20). Two required fields, and SDKs in five languages (15). 20 + 20 + 20 + 15 + 15 = 90.

Outcrawl 83

API reading. Scrape returns main content only by default with formats picking markdown, html, rawHtml, links, screenshots or schema JSON, search renders page bodies only on request, agent events take a level and an after cursor, the MCP server shows request bodies up to a character limit and says when it truncated, and the MCP surface is 29 tools with no toolsets (20 of 25). Cursor pagination on crawl results, agent results and downloads, limit, depth and path filters on crawl, status, outcome, task and age filters on sessions, and usage grouped by hour, day, month or capability (20). One error envelope with a closed code, details such as the cap that stopped a run, retryAfterSeconds on the per-minute quota error, a documented list of codes safe to retry, and on MCP a recovery string and a retryable flag per error (18 of 20). No idempotency key on any route, a repeated agent, crawl or monitor submit runs twice, and concurrency_limit carries no retry hint; cancel is idempotent, integration_changed (409) guards updates, and the npm MCP package sets readOnlyHint on GET tools, destructiveHint on DELETE tools and idempotentHint on either, which the hosted server was not read to confirm (10 of 20). Scrape needs a URL alone, agent runs need caps.budget on the API and SDKs with the MCP server defaulting it, and official SDKs exist in TypeScript and Python beside a CLI (15). 20+20+18+10+15 = 83.