fastCRW vs jevcrawl

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

jevcrawl 68

v0.2.0 on 15 October 2026, 18 days before 2 November (30). Three releases between 13 and 15 October 2026 (20). One later change, the merged audit-fixes pull request of 26 October (redirect scope, per-step time limits, a 50 MB cap on gzip sitemaps), is in no release yet. No outside issues or pull requests were found on 15 October, and GitHub's issue pages couldn't be read on 2 November (8 of 25). Not in the official MCP registry, which returned no server for jevcrawl on 2 November (0). Current dependencies, a uv.lock, CI and PyPI trusted publishing in the workflows (10). 30 + 20 + 8 + 0 + 10 = 68.

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

jevcrawl 59

Read with the API and MCP lines, since the server runs locally but sends data to a hosted API. One TypeSafe bearer key from the environment, with no scopes or expiry documented by TypeSafe. The README says the key is never written to disk or logs (20). Every tool only reads, a crawl stays on the start host, and robots.txt is followed by default. There is still no check against private, loopback or link-local addresses in the source on 2 November, so an agent can be steered to internal hosts. The unreleased 26 October change skips redirects off the crawl's hosts (12). Pages are untrusted content. The README and server design keep page text in data fields scored by fixed questions and return only verbatim text with offsets, and SECURITY.md names a change in fetch behaviour through page content as in scope. These are the author's claims, untested by us (12). Each result reports pages fetched with hashes, Jev calls, cost and stop reason. No persistent call log (7). SECURITY.md with GitHub private reporting and a one-week answer. No bounty, no advisories yet, and TypeSafe publishes no security.txt (8).

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

jevcrawl 68

Read as local software, though crawl and map also depend on TypeSafe's hosted Jev API. Installs from PyPI with Python 3.11 or later stated (20). CI runs ruff, mypy strict and the offline tests on Python 3.11 and 3.13, and every CI run on main from 11 to 15 October 2026 passed, per the 15 October check; the workflow is unchanged, and run results couldn't be read on 2 November (25). Eight issues, all opened by the maintainer as a roadmap, two closed, per the 15 October check. No outside bug reports were found then, and the project is three weeks old, so there is little record to read (15). Semver tags with GitHub release notes, no CHANGELOG file, v0.1.0's notes only a commit link, and breaking changes not marked (8). Version 0.2.0, still classified Development Status 3 Alpha (0). 20 + 25 + 15 + 8 + 0 = 68.

fastCRW 91

11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with truncated: true and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry errorCode values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with success: false (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only url is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.

jevcrawl 80

Three compact tools (25). max_pages, max_seconds, return_tokens and limit bound every call, and scrape can return a whole page or only the passages for a goal. No pagination is needed (18). Expected failures come back as {error, message} with a message that says what to do, and stopped_because, degraded and needs_js_urls tell the agent why a result is thin (19). All tools read only and repeats are answered from a local cache at no cost, but there are no readOnlyHint or idempotentHint annotations (10). Only goal and start_url are required, with measured defaults. The Python library is usable but undocumented (an open issue), and there is one language (8).

fastCRW 91

OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.

jevcrawl 81

Typed JSON Schema inputs on all three tools, generated from the Python signatures, with required parameters marked (25). No llms.txt. The repository ships an agent skill, skills/jevcrawl/SKILL.md, as Markdown for agents (5). Tool descriptions and server instructions say when to use crawl, scrape and map, how to phrase a goal and how to read each stop reason (18). Integer and number types with defaults, but the minimums the code enforces are not in the schema and stopped_because is documented as prose, not an enum (10). A real result in the README, and error codes listed in the skill with what each means (13). Semver releases with notes, and the Jev model version pinned per release (10).

fastCRW 60

The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.

jevcrawl 51

Apache-2.0 in LICENSE, pyproject.toml and as detected by GitHub (30). The README says plainly that page text, link labels and URLs go to TypeSafe and that answers are cached locally. TypeSafe's policies agree on no training but give no retention period, and jevcrawl has no privacy statement of its own (15). No deprecation policy. The model version is pinned and changes are in release notes (3). No telemetry or analytics found in the source. Outbound traffic is the target site and api.typesafe.ai, both stated in the README, so there is nothing hidden to opt out of, though no explicit telemetry statement exists (15).