Crawl4AI vs ScraperAPI

Crawl4AI 83

Library v0.9.5 on 14 October 2026, 23 days before 6 November, and the cloud added /serp on 8 October (30). v0.9.3 (31 August), v0.9.4 (23 September) and v0.9.5 (14 October) in the 90 days from 8 August (20). 56 open issues on 6 November, the newest triaged with Bug, Needs Triage, In-progress, Root caused or Done labels within days, plus a Discord. Reply authors weren't read (20 of 25). Not in the official MCP registry, and the cloud has no official SDK; the Python library is current on PyPI (8 of 15). The security workflow runs a test suite and a default-posture gate, and releases are built and checked with twine. No general test workflow on push found (5 of 10). 30 + 20 + 20 + 8 + 5 = 83.

ScraperAPI 41

The newest dated entry is the October 2026 release note on automatic Akamai unblocking, dated by month only. Counted from its month, October lies 4 to 34 days back, so it is inside 90 days but not shown within 30, as crustdata's October entries. The skills plugin's 1.1.0 of 7 August is an untagged version bump, and the MCP server's v1.1.1 is from 17 July 2026 (20). Since 6 August only the October note and the 7 August plugin bump are dated, fewer than three (0 of 20). The npm and PyPI pages of the SDKs and CLI couldn't be read on 4 November. Monthly release notes and support through the dashboard and email. We did not read the repository's issues (8 of 15). SDKs are documented for five languages, but we could not check their release dates, and the Node.js SDK repository's last commit is from 12 January 2024 (8 of 15). The MCP repository has unit tests and a lock file but no public CI workflow (5 of 10). 20 + 0 + 8 + 8 + 5 = 41.

Crawl4AI 46

Bearer keys, shown once and regenerable, with 3 to 30 keys per plan. claude.ai and ChatGPT sign in through a flow that advertises one scope, mcp, and each app shows as a revocable key. No per-key scopes, and the docs don't offer the key in a URL (22 of 30). A key can call billing routes, and the MCP topup and recharge tools charge the saved card, though llms.txt tells agents to ask first and accounts can set a spend cap. No read-only key (6 of 20). Scraped pages are untrusted text and no prompt-injection guidance was found in llms.txt or the API docs (0). Per-call cost, balance and fetch path in response headers and fields, no access log documented (6 of 15). The security page (4 October 2026) gives a disclosure process with fix targets and says SOC 2 is in progress, and the library publishes GitHub advisories with reporter credits. security.txt redirects to a 404, and no bounty found (12 of 20). 22 + 6 + 0 + 6 + 12 = 46.

ScraperAPI 29

One API key per account, regenerated from the dashboard at most once every 24 hours. No scopes (20). The documented default puts the key in the URL query string, so less 10, although an x-sapi-api_key header and a Bearer header on the remote MCP server exist (10 of 30). No read-only or restricted keys. max_cost, a monthly pay-as-you-go spending cap and destructive hints on the two MCP delete tools limit damage (6 of 20). The API returns untrusted web content and no prompt-injection guidance was found in the docs, the MCP README or the skills (2 of 15). The dashboard has analytics with error logs, each response carries sa-credit-cost, and the privacy policy says activity logs are deleted after 7 days (9 of 15). /.well-known/security.txt returned 404 on 9 October and 4 November, and no disclosure policy, bug bounty or certification was found. The home page claims CCPA and GDPR compliance (2 of 20). 10 + 6 + 2 + 9 + 2 = 29.

Crawl4AI 70

The library is Apache-2.0 and the cloud is closed under terms that name CONTEXT4AI PTE LTD (22 of 30). The privacy policy gives retention periods (account plus 90 days, usage records 13 months, logs 90 days), but none for crawled content, and llms.txt says repeated URLs are served from a shared archive while the security page says fetched pages are used only to answer the request (18 of 30). The legacy cloud API closed on 6 November 2026 with a migration guide but no dated notice found, and the terms promise notice of material changes only 'where reasonable' (8 of 20). Subprocessors named with their locations on the security page, with EU storage of account records (18 of 20). 22 + 18 + 8 + 18 = 66.

ScraperAPI 54

Closed service. The MCP server and skills are MIT. Terms of Use exist at /terms/, but robots.txt disallows that path, so we could not confirm what they say (10 of 30). The privacy policy says activity logs are deleted after 7 days and account data within 60 days of a request, async results are kept up to 72 hours and DataPipeline results 30 days. The policy is undated, names Saas.group Inc. while a November 2025 release note says the service operates as ScraperAPI LLC, and no DPA was found (14 of 30). The terms and billing change was announced with effective dates of 4 November 2025 and 5 January 2026. No standing deprecation policy (8 of 20). No sub-processor list or hosting location found, only a general statement on transfers outside the EEA (3 of 20). 10 + 14 + 8 + 3 = 35.

Crawl4AI 55

No OpenAPI or similar contract for the cloud API, and the MCP tool schemas are only in the live tools/list, which needs a key. /v1/prices is machine-readable but covers prices, not calls (0). llms.txt of 304 lines written for agents (10). Each endpoint says what it is for and when to choose another, such as trying without a proxy first, using browser only when auto misses content and /scrape/jobs for slow lists (16 of 20). Parameters are listed with types, defaults, allowed values (format both, md or html; proxy none, isp or residential) and limits, in prose (10 of 15). Curl examples per endpoint and documented error strings per status with whether each is charged (14 of 15). No changelog for the cloud API, only dated notes such as /serp 'added 8 Oct 2026'. The library has a dated CHANGELOG (5 of 15). 0 + 10 + 16 + 10 + 14 + 5 = 55.

ScraperAPI 67

No OpenAPI file found. The MCP server's source defines typed pydantic inputs for all 28 tools (12 of 25). The docs publish llms.txt, llms-full.txt and a Markdown twin of every page (10). MCP tool descriptions state when to use a tool and when not to, and the API reference describes each parameter with its credit cost (15 of 20). MCP inputs use enums for device type and output format. The HTTP API's parameters are query strings described in prose tables (10 of 15). Examples in cURL, Python, Node.js, PHP, Ruby and Java, a status code table that says which codes are billed, and an error table for the AI parser (12 of 15). Release notes are grouped by month without day dates, the HTTP API has no version, and the MCP server uses semver tags (8 of 15). 12 + 10 + 15 + 10 + 12 + 8 = 67.

Crawl4AI 35

Graded on the hosted lines, for Crawl4AI Cloud, which the README and llms.txt now lead with and which an agent calls through its MCP server; the library would read on the local lines. No status page is linked, and status.crawl4ai.com fails TLS (0). No incident history readable (5). Per-plan limits are published with numbers in /v1/prices, from 10 requests a minute and 2 at a time on Free to 1,500 and 50 on Scale (15). 429 carries X-RateLimit headers and a message, 503 busy says to resend after a few seconds, and MCP job submissions take an idempotency key, but no Retry-After or backoff guidance (10 of 15). No SLA found in the terms or pricing (0). Prices and the free credit are a soft launch, /serp is beta and /answer experimental, while scrape, extract and search carry no beta label (5 of 10). 0 + 5 + 15 + 10 + 0 + 5 = 35.

ScraperAPI 42

No status page is linked from the home, pricing, support or docs pages we read on 9 October or 4 November (0). No readable incident history (5). Concurrency limits are published per plan, 5 threads on Free, 20 on Hobby, 50, 100, 200, 300 and 500 above it, and the local MCP server limits itself to 10 calls in 60 seconds (15). 429 is documented as a concurrency rejection with no charge, the API retries a target for up to 70 seconds before returning 500, failed requests aren't charged, and the docs tell clients to retry failed requests. That is safe-retry guidance with no idempotency keys on the async job writes and no Retry-After header (12 of 15). The pricing page lists a 99.9% uptime guarantee on every plan, but no SLA document or credit terms were found and the Terms of Use are closed to us (0 of 10). The API, async service and crawler are generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.

Crawl4AI 67

16 MCP tools, six of them for billing and support (15 of 25). format md or html, parse opt-in blocks, batch limits and job results paged 500 at a time over HTTP and 50 over MCP (16 of 20). String error codes an agent can branch on (blocked, login-wall, no-answer, busy, no_credit, plan_cap, spend_cap), each with whether it is charged (18 of 20). Failed and cancelled calls aren't charged and jobs_submit takes an idempotency key, but no tool annotations are documented and two tools can charge the saved card (10 of 20). Only url or q is required. There is no official SDK for the cloud API; the docs give curl and standard-library Python and Node examples (8 of 15). 15 + 16 + 18 + 10 + 8 = 67.

ScraperAPI 74

28 MCP tools with no toolsets or dynamic loading (15 of 25). output_format returns Markdown or text, autoparse returns JSON on supported domains, structured endpoints page their results, and max_cost, crawl_budget and max_depth cap a job (15 of 20). Errors are HTTP status codes with plain-text messages. No machine-readable error codes (13 of 20). All 28 MCP tools carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint, failed requests are not charged, and async jobs return a status URL to poll (16 of 20). Only api_key and url are required, rendering is off by default, and SDKs are documented for Python, Node.js, PHP, Ruby and Java (15). 15 + 15 + 13 + 16 + 15 = 74.