fastCRW vs Decodo Web Data API

fastCRW 91

OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.

Decodo Web Data API 67

No OpenAPI or similar contract for the Web Data API; the two published specs cover the proxy account API and dashboard statistics. The MCP server types every input with zod (12 of 25). llms.txt indexes 401 guide pages, each served as Markdown (10). Tool descriptions state purpose and when to use a tool, such as scrape_as_markdown 'when no site-specific tool fits', and link the docs page (14 of 20). Parameters are tabled with defaults, with enumerated proxy_pool, headless and device_type, but headers is a free object and POST bodies are base64 strings (10 of 15). Curl examples on every page, a response code table with fixes and billing, and parser status codes (14 of 15). Paths are versioned at /v1 and the MCP server's releases are tagged by semantic-release, but no API changelog was found (7 of 15). 12 + 10 + 14 + 10 + 14 + 7 = 67.

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

Decodo Web Data API 59

Graded on the hosted lines. Instatus page at status.decodo.com with Web Data API and each legacy scraping API as components, with RSS history (20). In the 90 days to 6 November, every scraping API was out for 2 hours 51 minutes on 30 October, the main outage, with outages of 13 minutes on 26 October and 21 minutes on 15 October across the same components. The rest of the incidents hit proxies, payments or the website. One major (10). Per-plan request rates are published, 10 to 200 a second, though the same page's FAQ says paid plans support 10 to 50 (12 of 15). The response code table tells the agent to wait a couple of minutes on 429 and to retry 500, 524 and 613, which aren't billed, and the MCP client backs off exponentially. No Retry-After or idempotency guidance (7 of 15). No SLA; the License Agreement disclaims uninterrupted service (0). Web Data API is the current, unflagged product (10). 20 + 10 + 12 + 7 + 0 + 10 = 59.

fastCRW 91

11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with truncated: true and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry errorCode values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with success: false (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only url is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.

Decodo Web Data API 82

The hosted MCP server lists 24 tools, with a toolsets parameter to load only web, search, ecommerce, social_media or ai, and tokenLimit caps page text at 45,000 characters by default with a truncation notice (20 of 25). Markdown output, parsing for templates, crawl limit, path filters and cursor paging, search paging, map limits and batch tasks (18 of 20). Documented status codes with a solution for each, status_code and parse_status_code in bodies, but 429 covers both the plan rate and a domain throttled for a low success rate (15 of 20). Every tool carries readOnlyHint true and destructiveHint false, server-side failures aren't billed and async results can be re-read for 24 hours. No idempotency key (16 of 20). Only url or query is required, though the default premium pool costs about twice the standard. Official Python, TypeScript and Go SDKs (13 of 15). 20 + 18 + 15 + 16 + 13 = 82.

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

Decodo Web Data API 85

Read for a closed service with open clients. The newest releases are MCP server 1.7.0 on 29 October 2026 and @decodo/sdk-ts 3.0.0 on 30 October (30). Since 8 August, MCP server 1.2.5 to 1.7.0 (ten versions in the official registry) and sdk-ts 2.4.0 to 3.0.0 (20). No public API changelog. Support by 24/7 live chat, email and Discord, and the MCP repository had commits by Decodo staff on most days from 6 October to 5 November. GitHub issues couldn't be read, since api.github.com refused us (10 of 25). In the official MCP registry as io.github.Decodo/mcp-server, with current SDKs in three languages (15). The MCP repository lints, builds and tests on Node 22 and 24 for every pull request (10). 30 + 20 + 10 + 15 + 10 = 85.

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

Decodo Web Data API 45

One Bearer API key per Web Data API subscription with no scopes, and no rotation or revocation steps found in the reviewed docs. The hosted MCP server adds OAuth 2.1 with PKCE and dynamic registration, but its metadata advertises no scopes. No query-string credential is documented (20 of 30). Scraping only reads, and the MCP tools are annotated read-only, but http_method: POST sends requests to target sites and there is no read-only key (8 of 20). No guidance on treating scraped content as untrusted was found in the docs or the MCP README (0 of 15). The dashboard statistics API reports traffic by target, and each response carries an x-task-id. No per-call audit log (7 of 15). ISO/IEC 27001:2022 for proxies and the Scraping API, a SafeBase trust centre and KYC at signup. security.txt answers 404 and no disclosure policy or bug bounty was found (10 of 20). 20 + 8 + 0 + 7 + 10 = 45.

fastCRW 35

No x402, MPP or L402 (0). Plans are public with credit costs per operation and top-up prices per block of credits, $9 per 1,000 on Hobby down to $299 per 500,000 on Scale, but top-ups need a plan, so between plan-only and per-unit (15 of 20). 500 one-off credits with no card, plus up to 500 from onboarding tasks (20). Hosted keys need a person to sign up in a browser; the free self-hosted engine runs with no account but isn't the graded surface (0). 0 + 15 + 20 + 0 = 35.

Decodo Web Data API 40

No x402, MPP or L402 (0). Per-1,000 rates for every endpoint, pool and plan are public in the billing docs (20). Free plan of 10,000 requests a month with no card (20). A person signs up in the dashboard; the MCP OAuth flow also needs a dashboard approval (0). 0 + 20 + 20 + 0 = 40.