fastCRW vs Olostep

fastCRW 35

No x402, MPP or L402 (0). Plans are public with credit costs per operation and top-up prices per block of credits, $9 per 1,000 on Hobby down to $299 per 500,000 on Scale, but top-ups need a plan, so between plan-only and per-unit (15 of 20). 500 one-off credits with no card, plus up to 500 from onboarding tasks (20). Hosted keys need a person to sign up in a browser; the free self-hosted engine runs with no account but isn't the graded surface (0). 0 + 15 + 20 + 0 = 35.

Olostep 65

x402 documented on POST /v1/scrapes and /v1/maps at $0.01, /v1/answers at $0.05 and /v1/crawls at a dynamic price, USDC on Base through the Orthogonal facilitator, but not on batches or search. Our unpaid POST on 30 September got a 402 with an empty body and no payment requirements, so a stock client had nothing to sign (15 of 40). Plans, per-operation credit costs and credit packs from $20 for 10,000 are public (20). Trial of 500 successful requests with no card (20). The x402 route would let an agent start without signup, but it didn't return a price in our probe (10 of 20).

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

Olostep 60

Better Stack status page at status.olostep.com monitoring /scrapes, /batches, /crawls and /answers (20). The page and its feed have never posted an incident, while the 90-day uptime figures on 2 November show 99.935 to 99.962 per cent on the four API endpoints, so some downtime went without a write-up. A page that has never posted an incident scores 20 in this run (20 of 30). Concurrency published per plan, 20 on Starter, 200 on Standard and 500 on Scale, but the free plan says only 'low rate limits' and we found no per-minute limits (10 of 15). The scrapes OpenAPI documents 400, 402, 404, 500, 502 and 504 but no 429, Retry-After or backoff guidance (0). No SLA found (0). GA (10). 20 + 20 + 10 + 0 + 0 + 10 = 60.

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

Olostep 83

MCP server 1.0.19 published to the official registry on 28 October 2026, after 1.0.18 on 25 October, which added the hosted OAuth endpoint (30). Four dated releases or changelog entries since 4 August, the two changelog entries of 26 October (POST /v1/feedbacks and singular path aliases) and the two MCP releases (20). The Node SDK's 2026-07-15 release and Python SDK 1.2.2 (22 June) are unchanged. MCP repository issue replies not read (8 of 25). Official Python and Node SDKs and a CLI (15). MCP pull requests run contract and golden-description checks (10). 30 + 20 + 8 + 15 + 10 = 83.

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

Olostep 33

Bearer API keys. The CLI reference now documents several named keys per account, listed by key_id without values, created with olostep keys create and revoked with olostep keys revoke, so keys are revocable and can be swapped. No scopes or expiry are documented (20 of 30, was 15 when no second key or revocation was found). The hosted MCP server also takes OAuth sign-in with the Olostep account. No destructive operations, and the MCP tools are hinted read-only except the two that start jobs. No way to limit a key found (10 of 20). Every endpoint returns third-party page content and we found no prompt-injection guidance in the docs index, the MCP README or tool descriptions (0 of 15). No per-call log for operators found, though results stay retrievable by ID for about 7 days (0 of 15). security.txt answers 404 and the docs index has no security or compliance page. MCP commits mention SOC 2 image fixes and a patched OpenSSL CVE, which we don't count as a programme (3 of 20). 20 + 10 + 0 + 0 + 3 = 33.