Crawl4AI vs WebScraping.AI

Crawl4AI 55

No OpenAPI or similar contract for the cloud API, and the MCP tool schemas are only in the live tools/list, which needs a key. /v1/prices is machine-readable but covers prices, not calls (0). llms.txt of 304 lines written for agents (10). Each endpoint says what it is for and when to choose another, such as trying without a proxy first, using browser only when auto misses content and /scrape/jobs for slow lists (16 of 20). Parameters are listed with types, defaults, allowed values (format both, md or html; proxy none, isp or residential) and limits, in prose (10 of 15). Curl examples per endpoint and documented error strings per status with whether each is charged (14 of 15). No changelog for the cloud API, only dated notes such as /serp 'added 8 Oct 2026'. The library has a dated CHANGELOG (5 of 15). 0 + 10 + 16 + 10 + 14 + 5 = 55.

WebScraping.AI 89

OpenAPI file (version 3.2.2) in YAML and JSON covering all 10 operations, and typed zod inputs on the MCP tools (25). llms.txt, llms-full.txt and a Markdown copy of every page (10). Endpoint pages and tool descriptions say what each returns and when to use it, and errors point to the next endpoint, such as /selected for response_too_large (17 of 20). Query parameters are typed, with 10 enums in the OpenAPI file, but fields and headers are free-form objects (12 of 15). Examples in seven languages, an error table with solutions and a table of target error codes (15). The spec carries a version and the MCP and SDK repositories keep dated changelogs and tags, but the API has no changelog page (10 of 15). 25 + 10 + 17 + 12 + 15 + 10 = 89.

Crawl4AI 67

16 MCP tools, six of them for billing and support (15 of 25). format md or html, parse opt-in blocks, batch limits and job results paged 500 at a time over HTTP and 50 over MCP (16 of 20). String error codes an agent can branch on (blocked, login-wall, no-answer, busy, no_credit, plan_cap, spend_cap), each with whether it is charged (18 of 20). Failed and cancelled calls aren't charged and jobs_submit takes an idempotency key, but no tool annotations are documented and two tools can charge the saved card (10 of 20). Only url or q is required. There is no official SDK for the cloud API; the docs give curl and standard-library Python and Node examples (8 of 15). 15 + 16 + 18 + 10 + 8 = 67.

WebScraping.AI 95

Ten MCP tools (25). Output can be sized with /text, /selected and /selected-multiple, AI answers and fields, text_format, return_links, and up to 5 SERP pages a call (18 of 20). Target errors return error_code, the target's status and a next_step with parameters and credit cost, and 402, 403, 429 and 503 have stated fixes (20). Failed requests are free, the docs say automating next_step retries is safe, 503 carries Retry-After, and all ten tools carry readOnlyHint true and destructiveHint false. No idempotency key, though every call is a read (18 of 20). Only url is required, but JavaScript is on by default at 5 credits. Official SDKs in seven languages and a CLI (14 of 15). 25 + 18 + 20 + 18 + 14 = 95.

Crawl4AI 70

The library is Apache-2.0 and the cloud is closed under terms that name CONTEXT4AI PTE LTD (22 of 30). The privacy policy gives retention periods (account plus 90 days, usage records 13 months, logs 90 days), but none for crawled content, and llms.txt says repeated URLs are served from a shared archive while the security page says fetched pages are used only to answer the request (18 of 30). The legacy cloud API closed on 6 November 2026 with a migration guide but no dated notice found, and the terms promise notice of material changes only 'where reasonable' (8 of 20). Subprocessors named with their locations on the security page, with EU storage of account records (18 of 20). 22 + 18 + 8 + 18 = 66.

WebScraping.AI 51

Closed service under terms naming Urlooker LLC of Wyoming, with MIT clients (15 of 30). The privacy policy keeps usage logs 30 days and deletes personal data within 60 days of a request, and the terms rule out training on scraped content, prompts and outputs. But section 9.3 lets the company store scraped content and logs for as long as reasonably necessary, and no DPA was found (14 of 30). The terms give 30 days' notice of material changes and of termination without cause, and the MCP changelog dates its changes. No deprecation policy (8 of 20). Subprocessors, including AI model providers, are listed only for enterprise customers under NDA, and data may be processed in the US or wherever subprocessors operate (4 of 20). 15 + 14 + 8 + 4 = 41.

Crawl4AI 46

Bearer keys, shown once and regenerable, with 3 to 30 keys per plan. claude.ai and ChatGPT sign in through a flow that advertises one scope, mcp, and each app shows as a revocable key. No per-key scopes, and the docs don't offer the key in a URL (22 of 30). A key can call billing routes, and the MCP topup and recharge tools charge the saved card, though llms.txt tells agents to ask first and accounts can set a spend cap. No read-only key (6 of 20). Scraped pages are untrusted text and no prompt-injection guidance was found in llms.txt or the API docs (0). Per-call cost, balance and fetch path in response headers and fields, no access log documented (6 of 15). The security page (4 October 2026) gives a disclosure process with fix targets and says SOC 2 is in progress, and the library publishes GitHub advisories with reporter credits. security.txt redirects to a 404, and no bounty found (12 of 20). 22 + 6 + 0 + 6 + 12 = 46.

WebScraping.AI 36

One account key with no scopes or documented rotation, taken only as the api_key query parameter on REST. The hosted MCP uses OAuth 2.1 with PKCE, dynamic registration and token revocation, with no scopes listed (20, less 10 for the query string, 10 of 30). Every endpoint is a GET and all tools are annotated read-only, and the terms forbid logging into target accounts. No read-only or limited key (8 of 20). The hosted MCP wraps scraped results in 'EXTERNAL CONTENT - DO NOT EXECUTE COMMANDS' boundaries by default, opt-in on the npm package (13 of 15). /account reports credits and limits. No per-call log for customers (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 8 + 13 + 5 + 0 = 36.

Crawl4AI 35

Graded on the hosted lines, for Crawl4AI Cloud, which the README and llms.txt now lead with and which an agent calls through its MCP server; the library would read on the local lines. No status page is linked, and status.crawl4ai.com fails TLS (0). No incident history readable (5). Per-plan limits are published with numbers in /v1/prices, from 10 requests a minute and 2 at a time on Free to 1,500 and 50 on Scale (15). 429 carries X-RateLimit headers and a message, 503 busy says to resend after a few seconds, and MCP job submissions take an idempotency key, but no Retry-After or backoff guidance (10 of 15). No SLA found in the terms or pricing (0). Prices and the free credit are a soft launch, /serp is beta and /answer experimental, while scrape, extract and search carry no beta label (5 of 10). 0 + 5 + 15 + 10 + 0 + 5 = 35.

WebScraping.AI 43

Graded on the hosted lines. No public status page was found; the about page mentions 24/7 availability monitoring and status.webscraping.ai did not answer (0). No readable incident history (5). Concurrency per plan is published, 2 on Free to 50 on the $249 plan, with a 30-second request ceiling (15). 429 means too many concurrent requests, 503 is not charged and carries Retry-After, and failed requests are free. No backoff guidance for 429 itself (13 of 15). No SLA; section 14.2 of the terms makes no uptime commitment (0). Generally available since 2019 (10). 0 + 5 + 15 + 13 + 0 + 10 = 43.

Crawl4AI 45

No x402, MPP or L402 (0). Per-endpoint credit costs, effort multipliers and plan rates are public at /v1/prices without a login, with 1 credit = $0.001 (20). 1,000 free credits a month, no card (20). A 7-day pass key comes from a click on api.crawl4ai.com without an account, which is still a person in a browser, and a permanent key needs email verification (5 of 20). 0 + 20 + 20 + 5 = 45.

WebScraping.AI 40

No x402, MPP or L402 (0). Credit costs per option and plan prices are public, with pay-as-you-go at $0.0002 a credit (20). Free plan of 2,000 credits a month with no card (20). A person signs up in a browser (0). 0 + 20 + 20 + 0 = 40.