# fastCRW vs Diffbot (slim)

> fastCRW scores 64.3 (B) to Diffbot's 56.1 (C) for scraping. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/crw-vs-diffbot.md (~6,250 tokens) · this version ~3,580 tokens · JSON https://www.anchorterminal.com/compare/crw-vs-diffbot.json · canonical https://www.anchorterminal.com/compare/crw-vs-diffbot
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

fastCRW scores 64.3 (B) on agent readiness against Diffbot's 56.1 (C), and leads in 4 of 7 scored categories. Diffbot leads on reliability, payments & pricing and transparency & trust. Both do scraping.

- fastCRW: B 64.3, rank #478 of 1486 · https://www.anchorterminal.com/tools/crw.min.md
- Diffbot: C 56.1, rank #840 of 1486 · https://www.anchorterminal.com/tools/diffbot.min.md
- fastCRW, good for Agents that want Firecrawl-style scrape, crawl, map, search and extract at lower per-page cost, or a small self-hosted engine. Ahead on Schema & documentation, 91 against 83; Agent ergonomics, 91 against 63; Security & auth, 40 against 21; Maintenance & community, 93 against 77. Also Runs on your own machine; Open source.
- Diffbot, good for Agents that want typed article, product or discussion data from arbitrary pages without writing selectors, and teams that also want the Knowledge Graph. Ahead on Reliability, 55 against 50; Payments & pricing, 40 against 35; Transparency & trust, 68 against 60.

| Category | fastCRW | Diffbot |
| --- | --- | --- |
| Reliability (16%) | 50 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 91 | 83 |
| Agent ergonomics (13%) | 91 | 63 |
| Security & auth (14%) | 40 | 21 |
| Payments & pricing (10%) | 35 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 93 | 77 |
| Transparency & trust (7%) | 60 | 68 |

| Fact (where they differ) | fastCRW | Diffbot |
| --- | --- | --- |
| Vendor | Nanofy OÜ | Diffbot Technologies Corp. |
| Hosted endpoint | `https://fastcrw.com/mcp` | `https://api.diffbot.com/v3` |
| Transports | stdio, Streamable HTTP | HTTP |
| Auth | OAuth or key | API key |
| Licence | AGPL-3.0 | Proprietary service under Diffbot's Terms of Use. The Python client, the TypeScript client and the agent skills are MIT |
| Tools exposed | 11 | none |
| MCP registry | `io.github.fastcrw/crw` | not listed |
| Last release | 2026-11-04 | 2026-10-29 |
| Terms last updated | 2026-04-04 | no date given |
| Privacy policy last updated | no date given | 2025-08-29 |
| Terms restrict benchmarking | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 1.2k stars, 881 npm/wk | 9 npm/wk |

Why the edge:
- Agent ergonomics, fastCRW +28: fastCRW 91 (11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with `truncated: true` and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry `errorCode` values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with `success: false` (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only `url` is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.); Diffbot 63 (Graded on the REST API, with the skills noted. `mode` limits extraction to one page type, `fields` adds optional fields and `discussion=false` drops comments, but an article response carries both `html` and `text` with no way found to drop either. The skills return Markdown by default (14 of 25). A single-URL call has no pagination. Web Search takes `size` and `maxTokens` and DQL takes `size` per the client. Crawl result paging was not read (10 of 20). Errors are JSON with `errorCode` and `error` and six docs pages. A failed extraction can arrive in a 200, and the 429 text says the site received too many requests when the cause is the caller's plan limit (12 of 20). Extract calls are GET reads and safe to retry. Whether a failed call uses a credit was not found, and there is no idempotency key for creating crawl jobs or custom APIs (12 of 20). Only `url` and `token` are required, with official Python and TypeScript clients and a CLI (15). Docs per the 9 October check, not re-read on 4 November. The Python client 3.1.0 (29 October 2026) adds a `snippet_length` option that maps to the Web Search API's `snippetLength`. 14 + 10 + 12 + 12 + 15 = 63.)
- Security & auth, fastCRW +19: fastCRW 40 (The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, `mcp:tools`, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports `creditsUsed`; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.); Diffbot 21 (One token per account, sent in the URL query string as the documented and only scheme in the OpenAPI file. Tokens are revocable in the dashboard per a June 2025 changelog title, and child tokens exist on Plus and above (20 of 30, less 10 for the secret in the URL, so 10). Child tokens have the same rights as the primary one and there is no read-only mode. The skills limit the agent to the `db` binary through `allowed-tools` (5 of 20). The API returns untrusted web content and no guidance on prompt injection was found (0 of 15). The token details page shows usage activity and an Account API reports usage. No per-call log was found (6 of 15). No security.txt, security page, certification or bug bounty was found on the pages read, and the privacy policy says some API calls rely on HTTP without encryption (0 of 20). Site pages per the 9 October check, not re-read on 4 November. OSV lists no advisory for `diffbot` on PyPI or `@diffbot/typescript` on npm on 4 November. 10 + 5 + 0 + 6 + 0 = 21.)
- Maintenance & community, fastCRW +16: fastCRW 93 (v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.); Diffbot 77 (Every dated source of the vendor's own was looked for in its GitHub repositories, since its site wasn't re-read. The official Python client, `diffbot` in the listing's packages, was tagged v3.1.0 on 29 October 2026, adding a Web Search `snippet_length` option, and the agent skills were tagged v1.2.0 the same day with rewritten skill content, 6 days before this check (30; was 10 on the API changelog's 15 June 2026 entry, which is per the 9 October check, not re-read on 4 November). In the 90 days from 6 August, the skills were tagged v1.1.0 (12 August, five new skills), v1.1.1 (13 August, a plugin marketplace manifest, counted half) and v1.2.0, and the Python client v3.0.0 (28 September) and v3.1.0, counted half as SDK tags, 3.5 in all (20). A public changelog with RSS and a support address exist. GitHub issues were not read (8 of 15 for a closed service). Python and TypeScript clients exist, but the docs named the packages `diffbot-python` and `diffbot-typescript` on 9 October while the repositories publish `diffbot` and `@diffbot/typescript`, and the TypeScript repository has no tag and no commit since 17 August 2026 (12 of 15). The Python repository tests on Python 3.9 to 3.13. We did not see CI results (7 of 10). 30 + 20 + 8 + 12 + 7 = 77.)
- Schema & documentation, fastCRW +8: fastCRW 91 (OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.); Diffbot 83 (The Extract APIs have a public OpenAPI 3.1.0 file, version 1.1.0, with 13 operations, and the reference pages are generated from it. We read that file and one rendered page. The descriptions for Crawl, Knowledge Graph and Web Search were not read (25). llms.txt exists but is a short index with no Markdown twins of the docs pages found (5 of 10). The Analyze API page has sections on when to use it and when not to (17 of 20). Parameters are typed, `url` is the one required field and the file has 15 enums, but `fields` is a comma-separated string and the file defines no shared response schemas (10 of 15). The file carries 24 examples. It documents only 200 and 500, with separate docs pages for 401, 404, 429 and 457 (11 of 15). The path is versioned `/v3` and a dated changelog with RSS runs from 2015 to 15 June 2026 (15). All per the 9 October check, not re-read on 4 November (terms bar automated access to the site). 25 + 5 + 17 + 10 + 11 + 15 = 83.)
- Transparency & trust, Diffbot +8: fastCRW 60 (The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.); Diffbot 68 (A closed service under undated Terms of Use that cover the Site and the Service, cap liability at $10 and grant Diffbot a perpetual licence to process submitted queries. The clients and skills are MIT (13 of 30). The privacy policy of 29 August 2025 says query history and API calls are stored against the API key and kept no longer than necessary, with no retention period given. The GDPR and data rights page was not read (14 of 30). There is no deprecation policy. The changelog carries dated notices, such as a May 2024 entry announcing a field removal for 30 August 2024, and the terms give 14 days' notice of fee changes (8 of 20). The privacy policy names its service providers one by one, among them AWS, Stripe, Intercom, Salesforce, Slack and Amplitude, and says all are in the United States (14 of 20). All per the 9 October check, not re-read on 4 November. 13 + 14 + 8 + 14 = 49.)
- Reliability, Diffbot +5: fastCRW 50 (Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.); Diffbot 55 (Graded as a hosted API. status.diffbot.com is a Pingdom public report with 13 checks, among them Analyze API, Article API, Crawlbot and Websearch, with daily uptime for seven days and no incident notes (15 of 20). No 90-day record can be read. In the week to 9 October 2026 Analyze API shows 99.69 per cent, with 2, 11 and 17 minutes down on 4, 5 and 6 October, and Article API 5, 9 and 2 minutes on 5 to 7 October (5 of 30, the line for no readable history). Rate limits are published per plan, 5 calls a minute on Free, 5 a second on Startup and 25 a second on Plus (15). The 429 page says to pause one second and back off. No `Retry-After` header is documented, though the official client reads one (10 of 15). No SLA was found (0). The Extract APIs are at `/v3` with no beta label (10). All per the 9 October check, not re-read on 4 November: Diffbot's terms bar software that scrapes or crawls the Site or Service, so its site and status report weren't fetched. 15 + 5 + 15 + 10 + 0 + 10 = 55.)