Crawl4AI vs Scrapeless

Crawl4AI 35

Graded on the hosted lines, for Crawl4AI Cloud, which the README and llms.txt now lead with and which an agent calls through its MCP server; the library would read on the local lines. No status page is linked, and status.crawl4ai.com fails TLS (0). No incident history readable (5). Per-plan limits are published with numbers in /v1/prices, from 10 requests a minute and 2 at a time on Free to 1,500 and 50 on Scale (15). 429 carries X-RateLimit headers and a message, 503 busy says to resend after a few seconds, and MCP job submissions take an idempotency key, but no Retry-After or backoff guidance (10 of 15). No SLA found in the terms or pricing (0). Prices and the free credit are a soft launch, /serp is beta and /answer experimental, while scrape, extract and search carry no beta label (5 of 10). 0 + 5 + 15 + 10 + 0 + 5 = 35.

Scrapeless 70

Better Stack status page at status.scrapeless.com with four groups, Scrapeless API, Scraping Browser, website and dashboard, and residential proxies (20). Every monitor shows 100 per cent uptime over 90 days and the incident list reports none for September, October or November 2026. The list doesn't page back to August, so the earlier clean reading for August is kept (30). No rate-limit numbers found in the docs. The 30 September concurrency figures came from a script-loaded price file and are struck (0). The Results and Polling page documents 429 as rate limit exceeded with reduce-frequency guidance and a one-minute wait for 500s, with no idempotency keys (10). The pricing page names an Enterprise-level SLA but no SLA document is published (0). The APIs are generally available (10). 20 + 30 + 0 + 10 + 0 + 10 = 70.

Crawl4AI 67

16 MCP tools, six of them for billing and support (15 of 25). format md or html, parse opt-in blocks, batch limits and job results paged 500 at a time over HTTP and 50 over MCP (16 of 20). String error codes an agent can branch on (blocked, login-wall, no-answer, busy, no_credit, plan_cap, spend_cap), each with whether it is charged (18 of 20). Failed and cancelled calls aren't charged and jobs_submit takes an idempotency key, but no tool annotations are documented and two tools can charge the saved card (10 of 20). Only url or q is required. There is no official SDK for the cloud API; the docs give curl and standard-library Python and Node examples (8 of 15). 15 + 16 + 18 + 10 + 8 = 67.

Scrapeless 50

25 MCP tools, 16 of them browser actions, with no toolsets or read-only subset (15 of 25). crawl_start takes limit and maxDepth, but scrape_markdown and scrape_html take only a URL, with no size or selector control (10 of 20). The MCP returns status_code, a code of rate_limited or api_error, and the upstream message. No API error catalogue found (10 of 20). No readOnlyHint or destructiveHint annotations and no idempotency guidance (0). Most tools need only a URL, and official SDKs exist for Node and Python (15).

Crawl4AI 70

The library is Apache-2.0 and the cloud is closed under terms that name CONTEXT4AI PTE LTD (22 of 30). The privacy policy gives retention periods (account plus 90 days, usage records 13 months, logs 90 days), but none for crawled content, and llms.txt says repeated URLs are served from a shared archive while the security page says fetched pages are used only to answer the request (18 of 30). The legacy cloud API closed on 6 November 2026 with a migration guide but no dated notice found, and the terms promise notice of material changes only 'where reasonable' (8 of 20). Subprocessors named with their locations on the security page, with EU storage of account records (18 of 20). 22 + 18 + 8 + 18 = 66.

Scrapeless 58

The MCP server is open source but the LICENSE file says MIT while package.json says ISC. The API is closed, and the terms name NST LABS TECH LTD. with no address or governing law (15 of 30). The privacy policy gives no retention periods beyond tokens kept 24 hours. The Data Processing Agreement (v1.0, effective 7 August 2026, linked from the terms) covers sub-processor notice, SCCs for EEA transfers and deletion on termination, with no retention periods for scraped data (14 of 30). No deprecation policy or dated notices found (0). The DPA's Exhibit 2 names two sub-processors, Airwallex and Intercom, both in the United States, and no hosting location (10 of 20). 15 + 14 + 0 + 10 = 39.

Crawl4AI 55

No OpenAPI or similar contract for the cloud API, and the MCP tool schemas are only in the live tools/list, which needs a key. /v1/prices is machine-readable but covers prices, not calls (0). llms.txt of 304 lines written for agents (10). Each endpoint says what it is for and when to choose another, such as trying without a proxy first, using browser only when auto misses content and /scrape/jobs for slow lists (16 of 20). Parameters are listed with types, defaults, allowed values (format both, md or html; proxy none, isp or residential) and limits, in prose (10 of 15). Curl examples per endpoint and documented error strings per status with whether each is charged (14 of 15). No changelog for the cloud API, only dated notes such as /serp 'added 8 Oct 2026'. The library has a dated CHANGELOG (5 of 15). 0 + 10 + 16 + 10 + 14 + 5 = 55.

Scrapeless 66

No OpenAPI spec found. The API reference at apidocs.scrapeless.com lists about 30 schema definitions in its llms.txt, and the 25 MCP tools have typed zod inputs, one of which (crawl_start scrapeOptions) takes a free-form record (15 of 25). llms.txt with Markdown pages for every endpoint (10). MCP descriptions carry Restrictions, Valid and Invalid lines for most tools, though google_search's description is a run-on fragment (15 of 20). Inputs are typed with URL validation and some enums, plus the one free-form record (11 of 15). Request examples on each reference page, but no documented error responses or error code list found (7 of 15). Versioned API paths (v1, v2) and a CHANGELOG.md in the MCP repo, but no product changelog (8 of 15).

Crawl4AI 45

No x402, MPP or L402 (0). Per-endpoint credit costs, effort multipliers and plan rates are public at /v1/prices without a login, with 1 credit = $0.001 (20). 1,000 free credits a month, no card (20). A 7-day pass key comes from a click on api.crawl4ai.com without an account, which is still a person in a browser, and a permanent key needs email verification (5 of 20). 0 + 20 + 20 + 5 = 45.

Scrapeless 35

No x402, MPP or L402. Crypto top-ups exist but aren't a machine payment protocol (0). The pricing page draws its rate tables by script. The docs publish per-unit rates, Crawl from $1.8 a GB plus $0.09 a browser hour and Web Unlocker from $0.20 per 1,000 URLs, and the Google Search API page gives volume rates below $0.50 per 1,000 on qualifying plans, but no full rate card is readable without script (15 of 20, a partial kept under the in-between rule). The Google Search API page says no credit card is required to start (20). A person signs up in a browser (0). 0 + 15 + 20 + 0 = 35.

Crawl4AI 46

Bearer keys, shown once and regenerable, with 3 to 30 keys per plan. claude.ai and ChatGPT sign in through a flow that advertises one scope, mcp, and each app shows as a revocable key. No per-key scopes, and the docs don't offer the key in a URL (22 of 30). A key can call billing routes, and the MCP topup and recharge tools charge the saved card, though llms.txt tells agents to ask first and accounts can set a spend cap. No read-only key (6 of 20). Scraped pages are untrusted text and no prompt-injection guidance was found in llms.txt or the API docs (0). Per-call cost, balance and fetch path in response headers and fields, no access log documented (6 of 15). The security page (4 October 2026) gives a disclosure process with fix targets and says SOC 2 is in progress, and the library publishes GitHub advisories with reporter credits. security.txt redirects to a 404, and no bounty found (12 of 20). 22 + 6 + 0 + 6 + 12 = 46.

Scrapeless 37

One API token per account, sent in the x-api-token header, which the docs say can be replaced and invalidated from the dashboard or through support. No scopes (20). Agent Browser WebSocket connections pass the token as a URL parameter, a documented option, so less 10 (10 of 30). No read-only mode, and the browser tools can click and type on third-party sites without any confirmation step (5 of 20). The MCP README has a security section that calls web data untrusted by default and warns against passing raw scraped content into prompts, with no in-tool mitigation (10 of 15). Browser sessions are recorded, and we found no request log for the other APIs (5 of 15). security.txt is valid (contact system@scrapeless.com, expires 2030), with no disclosure policy or acknowledgement time, and no bug bounty, SOC 2 or ISO 27001 found (7 of 20). 10 + 5 + 10 + 5 + 7 = 37.