Crawl4AI vs Oxylabs Web Scraper API

Crawl4AI 35

Graded on the hosted lines, for Crawl4AI Cloud, which the README and llms.txt now lead with and which an agent calls through its MCP server; the library would read on the local lines. No status page is linked, and status.crawl4ai.com fails TLS (0). No incident history readable (5). Per-plan limits are published with numbers in /v1/prices, from 10 requests a minute and 2 at a time on Free to 1,500 and 50 on Scale (15). 429 carries X-RateLimit headers and a message, 503 busy says to resend after a few seconds, and MCP job submissions take an idempotency key, but no Retry-After or backoff guidance (10 of 15). No SLA found in the terms or pricing (0). Prices and the free credit are a soft launch, /serp is beta and /answer experimental, while scrape, extract and search carry no beta label (5 of 10). 0 + 5 + 15 + 10 + 0 + 5 = 35.

Oxylabs Web Scraper API 75

Graded on the Web Scraper API (Classic) surface. Status page at uptime.oxylabs.io on incident.io with separate components for Scraper APIs Push-Pull and Real-Time (20). Its feed lists two incidents since 4 August 2026, a Datacenter Proxies outage on 13 August that doesn't touch this API and, on 26 October, 12 minutes (05:34 to 05:46 on the page's clock) on both Scraper API components and Web Unblocker. The page labels it a full outage, but its own text says users "may experience degraded performance, intermittent errors, or timeouts", so we read it as partial and minor (20 of 30). Job rates per plan are published, from 10 a second on the free trial to 100 on Business and Corporate, with rendered-job limits (15). 429 is not billed, responses carry x-ratelimit limit and remaining headers, and 612 and 613 faults can be retried at no cost. No Retry-After or backoff guidance was found for this API (10 of 15). No SLA is published. The General Conditions promise reasonable efforts (0). Generally available (10).

Crawl4AI 55

No OpenAPI or similar contract for the cloud API, and the MCP tool schemas are only in the live tools/list, which needs a key. /v1/prices is machine-readable but covers prices, not calls (0). llms.txt of 304 lines written for agents (10). Each endpoint says what it is for and when to choose another, such as trying without a proxy first, using browser only when auto misses content and /scrape/jobs for slow lists (16 of 20). Parameters are listed with types, defaults, allowed values (format both, md or html; proxy none, isp or residential) and limits, in prose (10 of 15). Curl examples per endpoint and documented error strings per status with whether each is charged (14 of 15). No changelog for the cloud API, only dated notes such as /serp 'added 8 Oct 2026'. The library has a dated CHANGELOG (5 of 15). 0 + 10 + 16 + 10 + 14 + 5 = 55.

Oxylabs Web Scraper API 68

No OpenAPI document was found. The contract is parameter tables per source plus a Postman collection, and the MCP server types every input (10 of 25). llms.txt indexes the docs and every page is served as Markdown by adding .md (10). Each source page states its parameters and defaults, and the MCP output_format description says when to choose links, Markdown or HTML, though tool descriptions are two lines (13 of 20). MCP inputs use enumerations for rendering, user agent and output format. The REST API takes context as a list of key and value pairs and free-form parsing instructions (10 of 15). Request examples in several languages, sample outputs, and a response code table covering HTTP, parser, storage and session codes (13 of 15). Paths are versioned at /v1 and the public changelog is dated, while the MCP repository's CHANGELOG.md stops at 0.2.2 in May 2025 although v0.10.2 shipped in October 2026 (12 of 15). llms.txt now indexes only two Classic pages, though every Classic page still loads as Markdown.

Crawl4AI 67

16 MCP tools, six of them for billing and support (15 of 25). format md or html, parse opt-in blocks, batch limits and job results paged 500 at a time over HTTP and 50 over MCP (16 of 20). String error codes an agent can branch on (blocked, login-wall, no-answer, busy, no_credit, plan_cap, spend_cap), each with whether it is charged (18 of 20). Failed and cancelled calls aren't charged and jobs_submit takes an idempotency key, but no tool annotations are documented and two tools can charge the saved card (10 of 20). Only url or q is required. There is no official SDK for the cloud API; the docs give curl and standard-library Python and Node examples (8 of 15). 15 + 16 + 18 + 10 + 8 = 67.

Oxylabs Web Scraper API 79

The MCP server lists 10 tools, four for this API and six for AI Studio, and the REST API can return Markdown or parsed JSON in place of HTML (22 of 25). start_page, pages and limit on search sources, custom parsing instructions and a result aggregator (16 of 20). Documented HTTP codes with messages, a parse_status_code per parsed result and job statuses, but errors are prose messages with no stable code field (14 of 20). All tools carry readOnlyHint, faulted jobs are not billed and Push-Pull results can be re-read by job ID for 24 hours. No idempotency key (14 of 20). Only source and a URL or query are required, with official SDKs for Python and Go (13 of 15).

Crawl4AI 46

Bearer keys, shown once and regenerable, with 3 to 30 keys per plan. claude.ai and ChatGPT sign in through a flow that advertises one scope, mcp, and each app shows as a revocable key. No per-key scopes, and the docs don't offer the key in a URL (22 of 30). A key can call billing routes, and the MCP topup and recharge tools charge the saved card, though llms.txt tells agents to ask first and accounts can set a spend cap. No read-only key (6 of 20). Scraped pages are untrusted text and no prompt-injection guidance was found in llms.txt or the API docs (0). Per-call cost, balance and fetch path in response headers and fields, no access log documented (6 of 15). The security page (4 October 2026) gives a disclosure process with fix targets and says SOC 2 is in progress, and the library publishes GitHub advisories with reporter credits. security.txt redirects to a 404, and no bounty found (12 of 20). 22 + 6 + 0 + 6 + 12 = 46.

Oxylabs Web Scraper API 53

A username and password per product instance over HTTP Basic, with an editable password, optional IP whitelisting and several instances per account. The MCP server's v0.10.0 (15 October 2026) adds Web Scraper API tokens sent as a Bearer header, but the API docs still describe only the username and password, and no scopes were found (20 of 30). The Proxy Endpoint puts the pair in the proxy URL and needs TLS verification switched off, which we note without the query-string deduction. Scraping is read-only apart from POST requests to targets, callbacks and uploads to the customer's bucket, each instance can take a spending limit that disables it, and every MCP tool is marked read-only (10 of 20). No guidance on untrusted page content was found in the Web Scraper API docs, the MCP README or the agent skill (2 of 15). GET /v2/stats and the dashboard report usage by day and source, and jobs accept client notes. No per-request access log was found (7 of 15). ISO/IEC 27001:2022, SOC 2 Type 2 for Scraper API and yearly penetration tests per the trust centre (per the 8 October check, not re-read on 2 November). The disclosure programme is still paused except for critical issues sent to security@oxylabs.io, security.txt returns 404 and no bug bounty was found. That is above the 12 given for certification claims with no disclosure route (fireworks-inference, people-data-labs), because a route for critical issues and penetration tests are published (14 of 20).

Crawl4AI 70

The library is Apache-2.0 and the cloud is closed under terms that name CONTEXT4AI PTE LTD (22 of 30). The privacy policy gives retention periods (account plus 90 days, usage records 13 months, logs 90 days), but none for crawled content, and llms.txt says repeated URLs are served from a shared archive while the security page says fetched pages are used only to answer the request (18 of 30). The legacy cloud API closed on 6 November 2026 with a migration guide but no dated notice found, and the terms promise notice of material changes only 'where reasonable' (8 of 20). Subprocessors named with their locations on the security page, with EU storage of account records (18 of 20). 22 + 18 + 8 + 18 = 66.

Oxylabs Web Scraper API 64

Closed service under public General Conditions naming oxylabs, UAB of Vilnius, still last updated 5 October 2026, with MIT clients (15 of 30). The privacy policy was last reviewed on 22 October 2026 and still doesn't name the controller or say anything about scraped content. Clause 4.3.9 of the General Conditions lets Oxylabs keep data gathered through Web API and Web Unblocker and use it at its discretion, and it is unclear whether Web API there includes this Classic API. A DPA is published and Push-Pull results are kept for at least 24 hours (14 of 30). No deprecation policy. Removals appear in the changelog on the day they take effect, and the General Conditions give 14 days' notice of contract changes (6 of 20). The DPA says the sub-processor list is available on request. The privacy policy names some vendors, and data locations are given only as the EEA and the US (7 of 20).

Crawl4AI 45

No x402, MPP or L402 (0). Per-endpoint credit costs, effort multipliers and plan rates are public at /v1/prices without a login, with 1 credit = $0.001 (20). 1,000 free credits a month, no card (20). A 7-day pass key comes from a click on api.crawl4ai.com without an account, which is still a person in a browser, and a permanent key needs email verification (5 of 20). 0 + 20 + 20 + 5 = 45.

Oxylabs Web Scraper API 40

No x402, MPP or L402 (0). Per-1,000-result prices by target and plan are public, now on the Web API /Scrape pricing page that the old Web Scraper API pricing URL redirects to, at the same Starter rates (20). A one-time $5 welcome credit needs no payment details (20). A person registers in the dashboard and creates the product instance (0). The Classic overview page still says to contact the team for credentials, so the trial route for this surface is unconfirmed.