fastCRW vs ScraperAPI

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

ScraperAPI 41

The newest dated entry is the October 2026 release note on automatic Akamai unblocking, dated by month only. Counted from its month, October lies 4 to 34 days back, so it is inside 90 days but not shown within 30, as crustdata's October entries. The skills plugin's 1.1.0 of 7 August is an untagged version bump, and the MCP server's v1.1.1 is from 17 July 2026 (20). Since 6 August only the October note and the 7 August plugin bump are dated, fewer than three (0 of 20). The npm and PyPI pages of the SDKs and CLI couldn't be read on 4 November. Monthly release notes and support through the dashboard and email. We did not read the repository's issues (8 of 15). SDKs are documented for five languages, but we could not check their release dates, and the Node.js SDK repository's last commit is from 12 January 2024 (8 of 15). The MCP repository has unit tests and a lock file but no public CI workflow (5 of 10). 20 + 0 + 8 + 8 + 5 = 41.

fastCRW 91

OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.

ScraperAPI 67

No OpenAPI file found. The MCP server's source defines typed pydantic inputs for all 28 tools (12 of 25). The docs publish llms.txt, llms-full.txt and a Markdown twin of every page (10). MCP tool descriptions state when to use a tool and when not to, and the API reference describes each parameter with its credit cost (15 of 20). MCP inputs use enums for device type and output format. The HTTP API's parameters are query strings described in prose tables (10 of 15). Examples in cURL, Python, Node.js, PHP, Ruby and Java, a status code table that says which codes are billed, and an error table for the AI parser (12 of 15). Release notes are grouped by month without day dates, the HTTP API has no version, and the MCP server uses semver tags (8 of 15). 12 + 10 + 15 + 10 + 12 + 8 = 67.

fastCRW 91

11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with truncated: true and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry errorCode values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with success: false (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only url is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.

ScraperAPI 74

28 MCP tools with no toolsets or dynamic loading (15 of 25). output_format returns Markdown or text, autoparse returns JSON on supported domains, structured endpoints page their results, and max_cost, crawl_budget and max_depth cap a job (15 of 20). Errors are HTTP status codes with plain-text messages. No machine-readable error codes (13 of 20). All 28 MCP tools carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint, failed requests are not charged, and async jobs return a status URL to poll (16 of 20). Only api_key and url are required, rendering is off by default, and SDKs are documented for Python, Node.js, PHP, Ruby and Java (15). 15 + 15 + 13 + 16 + 15 = 74.

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

ScraperAPI 29

One API key per account, regenerated from the dashboard at most once every 24 hours. No scopes (20). The documented default puts the key in the URL query string, so less 10, although an x-sapi-api_key header and a Bearer header on the remote MCP server exist (10 of 30). No read-only or restricted keys. max_cost, a monthly pay-as-you-go spending cap and destructive hints on the two MCP delete tools limit damage (6 of 20). The API returns untrusted web content and no prompt-injection guidance was found in the docs, the MCP README or the skills (2 of 15). The dashboard has analytics with error logs, each response carries sa-credit-cost, and the privacy policy says activity logs are deleted after 7 days (9 of 15). /.well-known/security.txt returned 404 on 9 October and 4 November, and no disclosure policy, bug bounty or certification was found. The home page claims CCPA and GDPR compliance (2 of 20). 10 + 6 + 2 + 9 + 2 = 29.

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

ScraperAPI 42

No status page is linked from the home, pricing, support or docs pages we read on 9 October or 4 November (0). No readable incident history (5). Concurrency limits are published per plan, 5 threads on Free, 20 on Hobby, 50, 100, 200, 300 and 500 above it, and the local MCP server limits itself to 10 calls in 60 seconds (15). 429 is documented as a concurrency rejection with no charge, the API retries a target for up to 70 seconds before returning 500, failed requests aren't charged, and the docs tell clients to retry failed requests. That is safe-retry guidance with no idempotency keys on the async job writes and no Retry-After header (12 of 15). The pricing page lists a 99.9% uptime guarantee on every plan, but no SLA document or credit terms were found and the Terms of Use are closed to us (0 of 10). The API, async service and crawler are generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.

fastCRW 60

The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.

ScraperAPI 54

Closed service. The MCP server and skills are MIT. Terms of Use exist at /terms/, but robots.txt disallows that path, so we could not confirm what they say (10 of 30). The privacy policy says activity logs are deleted after 7 days and account data within 60 days of a request, async results are kept up to 72 hours and DataPipeline results 30 days. The policy is undated, names Saas.group Inc. while a November 2025 release note says the service operates as ScraperAPI LLC, and no DPA was found (14 of 30). The terms and billing change was announced with effective dates of 4 November 2025 and 5 January 2026. No standing deprecation policy (8 of 20). No sub-processor list or hosting location found, only a general statement on transfers outside the EEA (3 of 20). 10 + 14 + 8 + 3 = 35.