fastCRW vs Oxylabs Web Scraper API

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

Oxylabs Web Scraper API 75

Graded on the Web Scraper API (Classic) surface. Status page at uptime.oxylabs.io on incident.io with separate components for Scraper APIs Push-Pull and Real-Time (20). Its feed lists two incidents since 4 August 2026, a Datacenter Proxies outage on 13 August that doesn't touch this API and, on 26 October, 12 minutes (05:34 to 05:46 on the page's clock) on both Scraper API components and Web Unblocker. The page labels it a full outage, but its own text says users "may experience degraded performance, intermittent errors, or timeouts", so we read it as partial and minor (20 of 30). Job rates per plan are published, from 10 a second on the free trial to 100 on Business and Corporate, with rendered-job limits (15). 429 is not billed, responses carry x-ratelimit limit and remaining headers, and 612 and 613 faults can be retried at no cost. No Retry-After or backoff guidance was found for this API (10 of 15). No SLA is published. The General Conditions promise reasonable efforts (0). Generally available (10).

fastCRW 91

OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.

Oxylabs Web Scraper API 68

No OpenAPI document was found. The contract is parameter tables per source plus a Postman collection, and the MCP server types every input (10 of 25). llms.txt indexes the docs and every page is served as Markdown by adding .md (10). Each source page states its parameters and defaults, and the MCP output_format description says when to choose links, Markdown or HTML, though tool descriptions are two lines (13 of 20). MCP inputs use enumerations for rendering, user agent and output format. The REST API takes context as a list of key and value pairs and free-form parsing instructions (10 of 15). Request examples in several languages, sample outputs, and a response code table covering HTTP, parser, storage and session codes (13 of 15). Paths are versioned at /v1 and the public changelog is dated, while the MCP repository's CHANGELOG.md stops at 0.2.2 in May 2025 although v0.10.2 shipped in October 2026 (12 of 15). llms.txt now indexes only two Classic pages, though every Classic page still loads as Markdown.

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

Oxylabs Web Scraper API 53

A username and password per product instance over HTTP Basic, with an editable password, optional IP whitelisting and several instances per account. The MCP server's v0.10.0 (15 October 2026) adds Web Scraper API tokens sent as a Bearer header, but the API docs still describe only the username and password, and no scopes were found (20 of 30). The Proxy Endpoint puts the pair in the proxy URL and needs TLS verification switched off, which we note without the query-string deduction. Scraping is read-only apart from POST requests to targets, callbacks and uploads to the customer's bucket, each instance can take a spending limit that disables it, and every MCP tool is marked read-only (10 of 20). No guidance on untrusted page content was found in the Web Scraper API docs, the MCP README or the agent skill (2 of 15). GET /v2/stats and the dashboard report usage by day and source, and jobs accept client notes. No per-request access log was found (7 of 15). ISO/IEC 27001:2022, SOC 2 Type 2 for Scraper API and yearly penetration tests per the trust centre (per the 8 October check, not re-read on 2 November). The disclosure programme is still paused except for critical issues sent to security@oxylabs.io, security.txt returns 404 and no bug bounty was found. That is above the 12 given for certification claims with no disclosure route (fireworks-inference, people-data-labs), because a route for critical issues and penetration tests are published (14 of 20).

fastCRW 91

11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with truncated: true and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry errorCode values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with success: false (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only url is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.

Oxylabs Web Scraper API 79

The MCP server lists 10 tools, four for this API and six for AI Studio, and the REST API can return Markdown or parsed JSON in place of HTML (22 of 25). start_page, pages and limit on search sources, custom parsing instructions and a result aggregator (16 of 20). Documented HTTP codes with messages, a parse_status_code per parsed result and job statuses, but errors are prose messages with no stable code field (14 of 20). All tools carry readOnlyHint, faulted jobs are not billed and Push-Pull results can be re-read by job ID for 24 hours. No idempotency key (14 of 20). Only source and a URL or query are required, with official SDKs for Python and Go (13 of 15).

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

Oxylabs Web Scraper API 82

The newest release is MCP server v0.10.2 on 29 October 2026, which changes how the client is reported in request headers, after v0.10.0 on 15 October added API-token sign-in (30). In the 90 days from 4 August, MCP releases v0.9.0 and v0.9.1 (10 August), v0.9.2 (14 August), v0.9.3 (7 September), v0.10.0 and v0.10.2, with v0.10.1 (28 October, dependency caps only) counted half, and four changelog entries tagged for this API (11, 17, 20 and 24 August) (20). Dated public changelog, support by email and round-the-clock live chat per the docs. GitHub issues were unread because github.com refused us (10 of 15). The MCP server is in the official registry as io.oxylabs/oxylabs-mcp, now at 0.10.2 (published 29 October), and official Python and Go SDKs exist (15). The MCP repository runs lint and test workflows. The Python SDK's last release is still 3.0.0 on 9 March 2026 and the Go SDK's 1.0.0 on 6 September 2024 (7 of 10).

fastCRW 35

No x402, MPP or L402 (0). Plans are public with credit costs per operation and top-up prices per block of credits, $9 per 1,000 on Hobby down to $299 per 500,000 on Scale, but top-ups need a plan, so between plan-only and per-unit (15 of 20). 500 one-off credits with no card, plus up to 500 from onboarding tasks (20). Hosted keys need a person to sign up in a browser; the free self-hosted engine runs with no account but isn't the graded surface (0). 0 + 15 + 20 + 0 = 35.

Oxylabs Web Scraper API 40

No x402, MPP or L402 (0). Per-1,000-result prices by target and plan are public, now on the Web API /Scrape pricing page that the old Web Scraper API pricing URL redirects to, at the same Starter rates (20). A one-time $5 welcome credit needs no payment details (20). A person registers in the dashboard and creates the product instance (0). The Classic overview page still says to contact the team for credentials, so the trial route for this surface is unconfirmed.