fastCRW vs Scrapewise

fastCRW 91

11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with truncated: true and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry errorCode values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with success: false (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only url is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.

Scrapewise 72

Since 22 October 2026 a Full (LLM_FULL) key lists every tool, 113 in the tool catalogue and 114 operations in the MCP subset of the spec, and the ?toolsets= address that kept the setup tools out of the default list is no longer documented, so more than 30 tools (5). A Read (LLM_READ) key lists only the read tools, a read-only subset of 48 (5 added back). Cursor pagination with limit up to 1,000, q, sort, from and to filters, and job results in pages of 100 (20). Error codes an agent can branch on, such as WALLET_INSUFFICIENT_BALANCE, scope_rejected, cost_exceeded, SCRAPER_RUN_ACTIVE and MCP_SHOP_LIMIT, with a troubleshooting table, though two envelope shapes are documented (16 of 20). Idempotency keys on paid tools and REST create and run, a same-name retry rule for list runs, and preview tokens before deletes. Annotations are documented but only some appear in the spec, and tools/list was not read (16 of 20). Few required fields and a free quote_only check, but only a Python SDK (10 of 15). 10 + 20 + 16 + 16 + 10 = 72.

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

Scrapewise 56

Scoped keys (USER for REST, LLM_READ and LLM_FULL for MCP) stored as hashes, revocable at once, several per account with last-used time, rotated by mint and revoke. No expiry and no finer scopes (26 of 30). LLM_READ cannot run paid tools or write, and deletes need a preview token committed within 5 minutes. Since 22 October the setup and destructive tools are no longer opt-in for a Full key, and LLM_FULL has no per-tool consent (16 of 20). A documented prompt-injection contract and guidance, but it rests on a type: "scraped" content block that the MCP specification of 25 November 2025 does not define, and the docs' statement that Anthropic's clients honour it by default was not confirmed (8 of 15). Every call is logged with a correlation id and key prefix and the wallet ledger itemises charges, but the operator sees logs only through support (6 of 15). No security.txt, disclosure policy, bug bounty or certification found, security.txt still 404 on 2 November (0 of 20).

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

Scrapewise 79

Read as a closed service. Changelog items dated 18, 20, 21, 22 and 23 October 2026 (30). At least three dated changes in 90 days, the September entry and the October items among them (20). A public changelog, a support address and site chat. Two outside issues on the MCP repository from 11 and 15 October had no reply per the 15 October check; GitHub's issue pages couldn't be read on 2 November (8 of 15). Verified namespace in the official MCP registry, version 0.1.1 still the latest on 2 November (15). The Python SDK has CI and trusted publishing at version 0.1.0, Beta, with no commit since 7 October (6 of 10). 30 + 20 + 8 + 15 + 6 = 79.

fastCRW 91

OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.

Scrapewise 79

Public OpenAPI 3.1 for the whole REST surface (247 operations on 2 November, 224 on 15 October) and an MCP subset (114 operations, 93 on 15 October), and MCP tools are generated from it with JSON Schema inputs (25). llms.txt, agents.md and pricing.md on scrapewise.ai, though docs.scrapewise.ai has no llms.txt (10). The data tools' descriptions say when to use each, what it returns, its price and that it is free or paid. Setup tools carry one-line descriptions (16 of 20). Required fields are marked and there are 55 enums in the MCP subset, but limits such as 1 to 20 results sit in prose, not as constraints, and paid tools wrap arguments in a body object (10 of 15). Request examples throughout, error codes listed with fixes, but the docs show two error envelope shapes and the MCP subset documents only 200, 204, 400 and 402 (10 of 15). A changelog with six entries, the newest items dated by day up to 23 October 2026, one evolving spec with no version prefix, and a one-release deprecation rule (8 of 15).

fastCRW 60

The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.

Scrapewise 54

Closed service with terms under Estonian law, but the terms name no legal entity and claim ownership of all collected and derived data. The MCP manifest and Python SDK are MIT (15 of 30). The 90-day retention agrees across the terms, pricing.md and billing docs. The privacy policy still speaks of subscriptions and plan limits, calls service data confidential while the terms claim ownership of it, and no DPA or retention period for logs was found (10 of 30). The API reference states a one-release deprecation rule and the changelog records changed columns with old rows left as they were (8 of 20). Analytics tools on the website named, chat stored on Hetzner in Germany, Stripe and Firebase named in the docs, but no subprocessor list or data locations for the service (5 of 20).

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

Scrapewise 45

Read with the hosted lines. No status page found on scrapewise.ai, the docs, llms.txt or agents.md on 2 November 2026 (0). No readable incident history (5). Rate limits documented with numbers, per account per second and per day by plan (30 a second and 50,000 a day on STARTER up to 1,000 and 100,000,000 on BUSINESS, 2 a second unauthenticated), and 30 requests a second per key on the MCP gateway, plus an hourly cost ceiling there (15). 429 carries Retry-After and X-RateLimit-Remaining, Idempotency-Key is supported on scraper create and run, and paid MCP tools take an idempotency_key remembered for 24 hours (15). No SLA found (0). The API and MCP server are not marked beta, though AI control is in a test phase (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.