fastCRW vs ZenRows

fastCRW 35

No x402, MPP or L402 (0). Plans are public with credit costs per operation and top-up prices per block of credits, $9 per 1,000 on Hobby down to $299 per 500,000 on Scale, but top-ups need a plan, so between plan-only and per-unit (15 of 20). 500 one-off credits with no card, plus up to 500 from onboarding tasks (20). Hosted keys need a person to sign up in a browser; the free self-hosted engine runs with no account but isn't the graded surface (0). 0 + 15 + 20 + 0 = 35.

ZenRows 80

x402 and MPP through an agent storefront at agents.zenrows.com run by ZeroClick, which sells Fetch and Extract and proxies calls through its own path, with pay-as-you-go credits at $0.50 per 1,000 (10,000 minimum) per the pricing docs. Nothing on api.zenrows.com itself (20 of 40). Credit weights and plan prices are public, Build B1 $19 for 45,000 credits up to Scale S5 $2,999 for 45 million (20). 5,000 free credits a month, no card (20). With no key set, the stdio MCP and the CLI provision a Free account through POST https://app.zenrows.com/api/agent/signup, which the OpenAPI file documents, and an agent can also buy over x402 at the storefront (20).

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

ZenRows 87

Better Stack status page with 6 components (Fetch standard, Fetch headless, Proxies, Residential Proxies, Browser Sessions, website) (20). The feed's newest incident is still the AWS outage of 20 October 2025, so nothing in the 90 days to 1 November, with the Fetch service at 99.998 per cent and the website at 100 on 1 November (30). Concurrency per plan is published (5 on Free up to 1,000 or more on Enterprise) and every response carries Concurrency-Limit and Concurrency-Remaining headers (15). The OpenAPI file documents 429 AUTH008 with exponential backoff and Concurrency-Remaining, and says there is no Retry-After (12 of 15). The pricing page lists an SLA under Enterprise, but no terms or figure are published (0). Fetch is generally available. Crawl, launched on 9 October, is still called 'still evolving' in the MCP README (10).

fastCRW 60

The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.

ZenRows 79

Closed service, with ZENROWS, S.L. named in full (Getxo, Spain, tax ID B10660298). The MCP is MIT (15 of 30). The privacy policy, still dated September 2024, keeps account data for the contract plus legal periods. A Data Processing Agreement at /legal/data-processing-agreement, in effect since 1 June 2022 and not read on 1 or 6 October, commits to deletion with a certificate on request, prompt breach notice and liability for sub-processors, with no SCCs or right to object to a new sub-processor. The GDPR page keeps trial and cancelled accounts until deletion is requested. Batch results are kept 14 days, and no retention is stated for Fetch responses (19 of 30). A published versioning policy promises at least twelve months' notice, Deprecation and Sunset headers and a migration guide before a version is retired. The 2026 renames carried no dated notices (15 of 20). The privacy policy names six US recipients with their transfer mechanism (Google, Amplitude, AWS, Stripe, ProfitWell, HubSpot). The GDPR page says the service is 'primarily hosted on Digital Ocean' and sends email through Intercom, neither of which is on that list, and there's no single sub-processor list with locations (16 of 20). 15+19+15+16 = 65.

fastCRW 91

11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with truncated: true and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry errorCode values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with success: false (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only url is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.

ZenRows 79

63 MCP tools on 1 November, up from 52 on 17 October, after v2.15.0 to v2.18.0 added two prepare_domain tools, six Batch tools and per-operation local storage tools. 38 are browser actions, and there are no toolsets. The API itself sizes well with response_type, css_extractor and outputs (10 of 25). Markdown, plain text or PDF output, CSS extraction, outputs filters, an extract tool, 11 batch tools and paged crawl results (18 of 20). Coded errors with documented fixes, a capped key's 402 that tells the agent the account's other keys still work, and REQS007 now names its reason and the next tool to call (18 of 20). Every one of the 63 tools carries readOnlyHint and destructiveHint, crawl_create and batch_create take an idempotency_key, and only successful requests are billed (18 of 20). mode=auto picks the setup and url is the only required field. Official Python and Node SDKs (15).

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

ZenRows 50

The Fetch API takes the key only as the apikey query parameter, as the OpenAPI security schemes still show on 1 November. Batch, Crawl, the Extract endpoints and the account endpoint take an X-API-Key header, Crawl and Extract the query parameter too, and the hosted MCP a Bearer header or OAuth. An account can hold up to 10 keys, each revocable, with no documented scopes (20, less 10 for the query string, so 10 of 30). Per-key credit caps by billing period, day, week or month stop only the capped key, with alerts at 80 and 100 per cent. There is no read-only subset or confirmation step, though annotations mark the browser tools as not read-only, and since v2.15.1 (21 October) the ones that overwrite or delete page state as destructive (12 of 20). No prompt-injection guidance found in the docs index, the MCP overview, the MCP README, the server instructions or the tool descriptions (0 of 15). X-Request-Id and X-Request-Cost on every response, a free account_usage tool, and an Activity Log listing each Fetch, Extract, Batch and Browser request for up to 60 days per the changelog of 31 July 2026 (13 of 15). security.txt on www.zenrows.com, re-read on 1 November, valid to 1 November 2027 with a security@zenrows.com contact and a linked information security policy. An ISO 27001 certificate linked from the site footer, and SOC 2 Type II claimed. No bug bounty found (15 of 20).