# fastCRW vs Scrapfly (slim)

> Scrapfly scores 74.5 (BB) to fastCRW's 64.3 (B) for scraping. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/crw-vs-scrapfly.md (~5,850 tokens) · this version ~3,230 tokens · JSON https://www.anchorterminal.com/compare/crw-vs-scrapfly.json · canonical https://www.anchorterminal.com/compare/crw-vs-scrapfly
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Scrapfly scores 74.5 (BB) on agent readiness against fastCRW's 64.3 (B), and leads in 5 of 7 scored categories. fastCRW leads on agent ergonomics and maintenance & community. Both do scraping.

- fastCRW: B 64.3, rank #478 of 1486 · https://www.anchorterminal.com/tools/crw.min.md
- Scrapfly: BB 74.5, rank #84 of 1486 · https://www.anchorterminal.com/tools/scrapfly.min.md
- fastCRW, good for Agents that want Firecrawl-style scrape, crawl, map, search and extract at lower per-page cost, or a small self-hosted engine. Ahead on Agent ergonomics, 91 against 80; Maintenance & community, 93 against 84. Also Open source; No incidents deducted, where Scrapfly loses 3 points for them.
- Scrapfly, good for An agent that needs scrape, screenshot, extraction, crawl and a hosted browser from one key, with errors it can branch on. Ahead on Reliability, 85 against 50; Security & auth, 75 against 40; Payments & pricing, 40 against 35; Transparency & trust, 75 against 60. Also Agent-ready, a grade of BB or better.

| Category | fastCRW | Scrapfly |
| --- | --- | --- |
| Reliability (16%) | 50 | 85 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 91 | 95 |
| Agent ergonomics (13%) | 91 | 80 |
| Security & auth (14%) | 40 | 75 |
| Payments & pricing (10%) | 35 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 93 | 84 |
| Transparency & trust (7%) | 60 | 75 |

| Fact (where they differ) | fastCRW | Scrapfly |
| --- | --- | --- |
| Vendor | Nanofy OÜ | Scrapfly (Joam Intelligence, LLC) |
| Hosted endpoint | `https://fastcrw.com/mcp` | `https://api.scrapfly.io/scrape` |
| Transports | stdio, Streamable HTTP | HTTP, Streamable HTTP, stdio |
| Licence | AGPL-3.0 | none |
| Tools exposed | 11 | 62 |
| MCP registry | `io.github.fastcrw/crw` | `io.scrapfly.mcp/mcp` |
| Last release | 2026-11-04 | 2026-10-15 |
| Terms last updated | 2026-04-04 | 2026-09-30 |
| Privacy policy last updated | no date given | 2026-05-14 |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Popularity | 1.2k stars, 881 npm/wk | 14 stars, 21k npm/wk |
| Agent reviews | none | 4/5 (2) |

Why the edge:
- Reliability, Scrapfly +35: fastCRW 50 (Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.); Scrapfly 85 (scrapfly.io/status answers with Statuspage's status JSON, which names its page as scrapfly.statuspage.io. That page has 25 components and incident history back to 2022, read through its history feed on 1 November. The 1 October check read only the overall state and found no history (20, was 10). The newest incident is a Scrapium rendering fault on 21 May 2026, so nothing is posted in the 90 days from 3 August (30, was 5). Concurrency per plan is published (5 on Discovery to 100 on Enterprise) and each project has a configurable per-minute throttle (15). The error catalogue marks every code retryable or not and has three ERR::THROTTLE codes, but we found no Retry-After header or backoff guidance on the errors or throttling pages (10 of 15). The terms disclaim uptime and no uptime SLA is published, and the pricing page's SLA mentions cover support response on Enterprise (0). The Scrape API is GA. Vault and alerting are beta, outside the main surface (10). 20+30+15+10+0+10 = 85.)
- Security & auth, Scrapfly +35: fastCRW 40 (The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, `mcp:tools`, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports `creditsUsed`; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.); Scrapfly 75 (OAuth 2 on the hosted MCP with dashboard revocation, open to all plans. API keys are per project, live or test, and since 15 April 2026 can be restricted to products (30). The canonical API form puts the key in the key query parameter and the MCP also accepts ?key=, so less 10 (20 of 30). Product-restricted keys, confirm=true on every mutating vault and alert tool, info_api_key off in server-key mode, and the self-hosted HTTP server binds loopback by default. Since v1.4.0 Cloud Browser sessions are scoped to the API key that opened them (15 of 20). The source gates mutating vault tools behind a preview step because prompt injection can reach them and redacts keys from CDP URLs. We found no user-facing guidance on untrusted page content (8 of 15). Monitoring shows every call as a log with its error, credit cost line by line and Unblocker state, with replay, per the 24 October release notes, as well as per-domain metrics and alerting. The 1 October check couldn't confirm per-request logs (15, was 10). security.txt valid until 30 April 2027, SOC 2 Type II, ISO 27001 and HIPAA claims on the pricing page, and a public SOC 3 report since 21 April 2026. No bug bounty found (17 of 20). 20+15+8+15+17 = 75.)
- Transparency & trust, Scrapfly +15: fastCRW 60 (The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.); Scrapfly 75 (Closed service with terms updated 2026-09-30 under US law. SDKs are BSD 2-Clause, and the MCP source is public with no LICENSE file and ISC in package.json (15 of 30). Privacy policy updated 14 May 2026 with a published DPA and HIPAA BAA, but retention is as long as necessary, and the retention of scraped content isn't stated (18 of 30). Release notes date deprecations and removals, for example Scrapium v153 dropping legacy network interception on 11 September. No standing deprecation policy found (15 of 20). Stripe, Google Analytics, Google Ads and Google Cloud are named, with SCC and Data Privacy Framework transfers, but there's no full subprocessor list (10 of 20). The release notes still date each CDP removal, most recently `Storage.getRelatedWebsiteSets` in Scrapium v156 on 26 October. Not otherwise re-read on 1 November. 15+18+15+10 = 58.)
- Agent ergonomics, fastCRW +11: fastCRW 91 (11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with `truncated: true` and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry `errorCode` values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with `success: false` (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only `url` is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.); Scrapfly 80 (The open-source server registers 62 tools by default in v1.4.0 (5 web scraping, 2 account, 9 Cloud Browser sessions, 17 page interaction, 2 WebMCP, 15 credential vault, 12 alerts), all at once, and the docs list a smaller core. There's a code path to mount interaction tools per session, but registration is always-on for clients that don't refetch. On the API side, format=markdown and the extraction API keep responses small, and since v1.4.0 the scrape tools report `api_cost` and `cost_details` (10 of 25). Output format, extraction templates, crawler limits and 100-URL batches (15 of 20). Error codes an agent can branch on, with retryable and billed flags (20). Tools carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and mutating vault and alert tools need confirm=true after a preview (20). web_get_page works with a URL alone, and official SDKs exist for Python, TypeScript, Go and Rust (15). 10+15+20+20+15 = 80.)
- Maintenance & community, fastCRW +9: fastCRW 93 (v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.); Scrapfly 84 (Scrapium v156 in the release notes on 26 October 2026 and MCP v1.4.0 on 15 October (30). MCP tags v1.3.1 to v1.3.3 (26 and 27 August), v1.3.4 (8 September) and v1.4.0 (15 October), SDKs 0.12.0 on 8 September, and dated release notes on 14, 24 and 26 August, 11, 23 and 25 September, 7, 24 and 26 October (20). Dated release notes most weeks and a support address. We couldn't read GitHub issues, since github.com refuses our reader (12 of 25). In the official MCP registry as io.scrapfly.mcp/mcp under the vendor's domain, though the entry still lists 1.0.0, and the SDKs are current (15). MCP moved to Go 1.27 on 23 October. Its CI runs only a reference check and the npm publish, while the TypeScript SDK runs tests in CI (7 of 10). 30+20+12+15+7 = 84.)
- Payments & pricing, Scrapfly +5: fastCRW 35 (No x402, MPP or L402 (0). Plans are public with credit costs per operation and top-up prices per block of credits, $9 per 1,000 on Hobby down to $299 per 500,000 on Scale, but top-ups need a plan, so between plan-only and per-unit (15 of 20). 500 one-off credits with no card, plus up to 500 from onboarding tasks (20). Hosted keys need a person to sign up in a browser; the free self-hosted engine runs with no account but isn't the graded surface (0). 0 + 15 + 20 + 0 = 35.); Scrapfly 40 (No x402, MPP or L402 (0). Credit costs per request type (1 datacentre, 5 with rendering or Unblocker, 25 residential, 60 full-page screenshot) and plan prices are public. Unblocker surcharges per target aren't published, but cost_budget caps them (20). 1,000 free credits, no card, no time limit (20). A person signs up in a browser. OAuth still needs an account (0). Plan prices and the 1,000 free credits with no card re-read on the pricing page on 1 November. 0+20+20+0 = 40.)