Crawl4AI vs ScrapingBee

Crawl4AI 35

Graded on the hosted lines, for Crawl4AI Cloud, which the README and llms.txt now lead with and which an agent calls through its MCP server; the library would read on the local lines. No status page is linked, and status.crawl4ai.com fails TLS (0). No incident history readable (5). Per-plan limits are published with numbers in /v1/prices, from 10 requests a minute and 2 at a time on Free to 1,500 and 50 on Scale (15). 429 carries X-RateLimit headers and a message, 503 busy says to resend after a few seconds, and MCP job submissions take an idempotency key, but no Retry-After or backoff guidance (10 of 15). No SLA found in the terms or pricing (0). Prices and the free credit are a soft launch, /serp is beta and /answer experimental, while scrape, extract and search carry no beta label (5 of 10). 0 + 5 + 15 + 10 + 0 + 5 = 35.

ScrapingBee 75

status.scrapingbee.com, now on incident.io, with 9 components (dashboard, two core HTML scraping components and six dedicated APIs) and 90 days of history (20). In the 90 days from 6 August it posted five incidents, each "Degraded performance" on one component with no downtime on the uptime bars. Half of non-JavaScript HTML traffic was rejected for 20 minutes on 18 August, Google API /goto link resolution dropped from 9 to 10 September, Google API success rates fell for about six and a half hours on 22 September, and HTML Scraping with Rendering, the default, was degraded for about 11 hours on 21 October and about 5 hours on 28 October. Each is partial, so minor only (20; 15 before, when the July incidents were in the window). Concurrency per plan is published, 25 on Hobby to 400 on Business+ and 900 on Enterprise 120 (15). 429 means the concurrency limit and isn't billed, target failures are retried server-side for up to 30 seconds on most dedicated APIs, and the MCP notes advise exponential backoff. No Retry-After or safe-write guidance found (10). No SLA found (0). Generally available (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.

Crawl4AI 46

Bearer keys, shown once and regenerable, with 3 to 30 keys per plan. claude.ai and ChatGPT sign in through a flow that advertises one scope, mcp, and each app shows as a revocable key. No per-key scopes, and the docs don't offer the key in a URL (22 of 30). A key can call billing routes, and the MCP topup and recharge tools charge the saved card, though llms.txt tells agents to ask first and accounts can set a spend cap. No read-only key (6 of 20). Scraped pages are untrusted text and no prompt-injection guidance was found in llms.txt or the API docs (0). Per-call cost, balance and fetch path in response headers and fields, no access log documented (6 of 15). The security page (4 October 2026) gives a disclosure process with fix targets and says SOC 2 is in progress, and the library publishes GitHub advisories with reporter credits. security.txt redirects to a 404, and no bounty found (12 of 20). 22 + 6 + 0 + 6 + 12 = 46.

ScrapingBee 37

One API key per account, which the MCP notes say can be revoked (401 on revoked keys). Team management exists. No scopes (20). The api_key query parameter is deprecated but still works, and remote-mcp.txt says the hosted MCP takes the key only as ?api_key= in its URL, "not a Bearer header or OAuth flow", so less 10 (10 of 30). No read-only or scoped key, and the HTML API can send POST requests to target sites. The CLI gates shell post-processing behind an explicit unsafe flag (8 of 20). The official CLI skills and AGENTS.md say scraped output is data, never instructions, and tell the agent to report instruction-like content as a possible prompt injection. The MCP docs say nothing (12 of 15). A Usage API and a local CLI audit log. No per-request log in the docs (7 of 15). www.scrapingbee.com/.well-known/security.txt answers 404, and no bug bounty, disclosure policy or certification found (0 of 20). 10 + 8 + 12 + 7 + 0 = 37.

Crawl4AI 83

Library v0.9.5 on 14 October 2026, 23 days before 6 November, and the cloud added /serp on 8 October (30). v0.9.3 (31 August), v0.9.4 (23 September) and v0.9.5 (14 October) in the 90 days from 8 August (20). 56 open issues on 6 November, the newest triaged with Bug, Needs Triage, In-progress, Root caused or Done labels within days, plus a Discord. Reply authors weren't read (20 of 25). Not in the official MCP registry, and the cloud has no official SDK; the Python library is current on PyPI (8 of 15). The security workflow runs a test suite and a default-posture gate, and releases are built and checked with twine. No general test workflow on push found (5 of 10). 30 + 20 + 20 + 8 + 5 = 83.

ScrapingBee 75

CLI v1.6.0 on 11 September 2026 is the newest release, 54 days before 4 November, so within 90 days (20; 30 before, cause time). The CLI's later commits (plugin manifests for Cursor, Codex, Copilot CLI, Kiro and Antigravity, 6 to 30 October) sit under its changelog's Unreleased heading, the plugins still carry version 1.6.0, and the mcp-server repository holds only a README. In the 90 days from 6 August, Python SDK v2.1.1 (6 August, a documentation release) and v2.2.0 and Node SDK v2.0.0 (1 September) at half as SDK tags, CLI v1.6.0 in full as the vendor's own CLI with new commands and options, and the Employee Search API launch (blog post of 14 August) make 3.5 (20). We couldn't read GitHub issues. Dated SDK changelogs and email support (10 of 25). Current official Python and Node SDKs and a CLI. The MCP isn't in the official registry (15). Test workflows run in CI on all three repositories (10). 20 + 20 + 10 + 15 + 10 = 75.

Crawl4AI 55

No OpenAPI or similar contract for the cloud API, and the MCP tool schemas are only in the live tools/list, which needs a key. /v1/prices is machine-readable but covers prices, not calls (0). llms.txt of 304 lines written for agents (10). Each endpoint says what it is for and when to choose another, such as trying without a proxy first, using browser only when auto misses content and /scrape/jobs for slow lists (16 of 20). Parameters are listed with types, defaults, allowed values (format both, md or html; proxy none, isp or residential) and limits, in prose (10 of 15). Curl examples per endpoint and documented error strings per status with whether each is charged (14 of 15). No changelog for the cloud API, only dated notes such as /serp 'added 8 Oct 2026'. The library has a dated CHANGELOG (5 of 15). 0 + 10 + 16 + 10 + 14 + 5 = 55.

ScrapingBee 60

No OpenAPI spec found. Per-endpoint llms files list parameters with types and defaults, and the hosted MCP's schemas are only in its live tools/list (8 of 25). llms.txt indexes 26 per-endpoint and integration text files written for models (10). The API files explain each parameter's purpose and cost, and the reference-notes file tabulates 12 source discrepancies and coverage notes from its own pages. MCP tool descriptions aren't published beyond a tool table (10 of 20). Parameters are typed with defaults, and mode, proxies and render_js are documented as enumerated options (10 of 15). Status code table with whether each code is billed, plus examples per endpoint (14 of 15). The SDKs and CLI keep dated CHANGELOGs. The API has no changelog (8 of 15). 8 + 10 + 10 + 10 + 14 + 8 = 60.

Crawl4AI 45

No x402, MPP or L402 (0). Per-endpoint credit costs, effort multipliers and plan rates are public at /v1/prices without a login, with 1 credit = $0.001 (20). 1,000 free credits a month, no card (20). A 7-day pass key comes from a click on api.crawl4ai.com without an account, which is still a person in a browser, and a permanent key needs email verification (5 of 20). 0 + 20 + 20 + 5 = 45.

ScrapingBee 40

No x402, MPP or L402 (0). Credit costs per request type (1, 5, 10, 25, 75, plus 5 for AI extraction) and plan prices are public, though the reference notes admit some endpoint costs conflict between pages (20). 1,000-credit trial, no card (20). A person signs up in a browser (0).

Crawl4AI 70

The library is Apache-2.0 and the cloud is closed under terms that name CONTEXT4AI PTE LTD (22 of 30). The privacy policy gives retention periods (account plus 90 days, usage records 13 months, logs 90 days), but none for crawled content, and llms.txt says repeated URLs are served from a shared archive while the security page says fetched pages are used only to answer the request (18 of 30). The legacy cloud API closed on 6 November 2026 with a migration guide but no dated notice found, and the terms promise notice of material changes only 'where reasonable' (8 of 20). Subprocessors named with their locations on the security page, with EU storage of account records (18 of 20). 22 + 18 + 8 + 18 = 66.

ScrapingBee 65

Closed service with terms naming VostokInc SAS, Paris, registration 843 352 683 (15 of 30). The privacy policy, effective 15 July 2024, keeps prospect and customer data up to 3 years and links a DPA. It doesn't mention the Oxylabs group or say whether scraped content is stored (18 of 30). The Node SDK changelog dates removals, for example youtubeTranscript() dropped in v2.0.0 on 2026-09-01, and the api_key query parameter is marked deprecated. No standing deprecation policy (10 of 20). Processors described by category, located in the US or EU. No named list (8 of 20).