fastCRW vs Scrape.do

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

Scrape.do 45

Last changelog entry on 31 July 2026, a Gemini scraper API (20). Two dated entries since 3 July, 29 and 31 July, against the three the rubric asks for (10 of 20). Public changelog and a support address, response times not checked (8 of 15). The only official SDK, @scrape-do/client, hasn't shipped since 13 November 2024 (5 of 15). No public repository or CI to check (2 of 10).

fastCRW 91

OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.

Scrape.do 57

No OpenAPI file found (0 of 25). llms.txt at scrape.do/documentation/llms.txt with Markdown pages (10). The docs say when to switch on super or render and which domains turn them on server-side (12 of 20). Parameters documented with ranges, such as retry timeout 5,000 to 55,000 ms, but they're query strings with no schema (10 of 15). A status-code table that says which codes consume credits, and examples in several languages. The error body format isn't documented (13 of 15). Dated public changelog, no API versioning (12 of 15).

fastCRW 91

11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with truncated: true and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry errorCode values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with success: false (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only url is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.

Scrape.do 62

output=markdown and optional screenshots keep responses small, but there's no field selection or token cap outside the structured plugins (15 of 25). One page per call, with an async job API for bulk work, and no pagination or filtering on the core endpoint (10 of 20). Status codes documented with billing behaviour (15 of 20). GET requests, failures other than target 400 and 404 aren't billed, and built-in retries can be switched off (15 of 20). Two required parameters, but the only official SDK is the Node client last released on 13 November 2024 (7 of 15).

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

Scrape.do 23

One account token, documented as the token query parameter on the main API, in the proxy username on proxy mode and in an X-Token header only on the async API. We found no scopes or rotation for it. Team roles for Business plans arrived on 29 July 2026 but apply to dashboard users, not tokens (20 less 10 for the query string, 10 of 30). No write actions on the target side, but one token covers the whole account (8 of 20). Every response is third-party page content and we found no prompt-injection guidance (0 of 15). Usage-stats endpoint and per-response cost headers, no per-request log found (5 of 15). No security.txt, security page or disclosure policy found. Proxy mode needs Scrape.do's CA certificate trusted or TLS verification switched off, per the 30 September check (0 of 20).

fastCRW 60

The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.

Scrape.do 49

Closed service with published terms of use under PACKEND, LLC (15). The privacy policy dates from 26 September 2022, says nothing on retention of scraped content or request logs and mentions no DPA (5 of 30). Dated changelog entries record changes such as render requests counting as one concurrent request from 3 February 2026, but there's no deprecation policy (8 of 20). Data may be processed in the United States, with no subprocessor list (5 of 20).

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

Scrape.do 40

No public status page. status.scrape.do returned 403 to our fetch again today, as it did on 30 September, and the site doesn't link it (0). No readable incident history, so 5 by the rubric (5). Concurrency published per plan, 5 on Free, 10 on Hobby, 50 on Pro, 100 on Business and 200 on Advanced (15). A 429 means the concurrency limit was hit and isn't billed, a 502 says to try again, and the service retries failed requests itself unless disableRetry=true, but there's no Retry-After or backoff guidance (10 of 15). No SLA on the pricing page, which claims a 99.98 per cent success rate instead (0). GA (10).