fastCRW vs Zyte API

fastCRW 50

Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.

Zyte API 85

Graded as a hosted API. status.zyte.com runs on Atlassian Statuspage with ten components and incident history (20). In the 90 days to 1 November 2026 its history feed lists two Zyte API incidents, both degraded browser rendering with higher latency and 520 errors, on 10 to 11 September and 13 September, neither marked as an outage, and three incidents outside the API, Scrapy Cloud periodic jobs on 17 August and the web dashboard and Scrapy Cloud periodic jobs down from 28 to 30 October, which Zyte says affected no other product. All partial, so minor (20 of 30). Rate limits are published as 3,000 requests a minute per key on standard plans and a custom limit on Enterprise, though per-site limits aren't (15). 429, 503 and 520 carry Retry-After, and the docs give a backoff table and say which responses to retry, per the 9 October check (15). Enterprise plans list service level agreements for support response times. No uptime SLA is published (5 of 10). Zyte API is generally available, and Zyte MCP carries no beta label on 1 November (10).

fastCRW 91

11 compact MCP tools, two of them the data-source tools added in 0.41.0. Content is capped near 15,000 characters with truncated: true and a resume offset, and map returns at most 100 URLs by default (20 of 25). Formats, main-content filtering, include and exclude selectors, maxLength, startIndex, limit and crawl depth and page caps (20). Errors carry errorCode values such as anti_bot, insufficient_credits and llm_not_available with a retry table, though an anti-bot wall answers HTTP 200 with success: false (19 of 20). Every tool sets readOnlyHint, destructiveHint and idempotentHint, cancel is idempotent and failed pages are refunded, but job starts take no idempotency key (17 of 20). Only url is required, with official Python and TypeScript SDKs (15). 20 + 20 + 19 + 17 + 15 = 91.

Zyte API 72

Graded on the REST API, with the MCP server noted. A request names the outputs it wants, so an agent can ask for extracted fields or pageContent in place of full HTML, but HTML and bodies come whole, up to 10 MB. Zyte MCP lists 34 tools at once, 26 of them for Scrapy Cloud, recounted from its docs on 1 November (15 of 25). No pagination applies to a single-URL call. Search takes maxResults from 10 to 100, and the Stats API pages and filters (14 of 20). Errors are problem+json with a stable type path, and the docs say which to retry and which to fix (20). Calls are reads, failed and rate-limited requests are free, and retries are safe. We could not read the MCP tool annotations, which need a sign-in (14 of 20). A call needs only url and one output flag. The only official client is Python, with a Scrapy plugin (9 of 15).

fastCRW 93

v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.

Zyte API 77

The Agentic Web Data plugin (zytedata/skills) released 0.4.1 on 26 October 2026, 6 days before 1 November (30). Every dated source counted. In the 90 days from 3 August the plugin released 0.3.0, 0.3.1, 0.4.0 and 0.4.1 (17 and 22 September, 5 and 26 October) and scrapy-zyte-api 0.36.0 on 20 August. python-zyte-api 0.11.0 of 23 July has left the window, and its main branch holds unreleased work since (a CVE floor for brotli, Python 3.15 support), with no release by 1 November (20). There is no public API changelog. Support runs through tickets and a Discord server, and we did not read GitHub issues (8 of 15 for a closed service). python-zyte-api 0.11.0 is current, with Python 3.10 or later, and covers one language. The official MCP registry lists only a third-party Zyte entry (io.github.pipeworx-io/zyte), none from Zyte (12 of 15). The client repository has test and publish workflows and merged dependency updates on 20 and 26 October 2026. We did not see CI results (7 of 10).

fastCRW 40

The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, mcp:tools, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports creditsUsed; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.

Zyte API 55

API keys are revocable, an organisation can hold several, and none travels in a URL. Keys carry no permission scopes. Zyte MCP signs in over OAuth and works through its own key, mcp_access_key (22 of 30). An owner can set a blocking spending limit per key. We found no read-only mode, and the MCP docs warn that the agent can delete schedules and collections with no undo, leaving approval to the MCP client (8 of 20). The API returns untrusted web content, and the only guidance found is to review what the agent asks to do (2 of 15). The Stats API and dashboard break usage down by key, domain and request type, requests can be tagged, and each response has a request-id. No per-request log for the operator was found (10 of 15). ISO 27001 certification per the trust centre, a responsible disclosure programme with a hall of fame and no rewards, penetration test reports under NDA, and no security.txt (www.zyte.com/.well-known/security.txt answered 404 on 1 November) (13 of 20).

fastCRW 60

The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.

Zyte API 67

A closed service with terms last updated on 22 September 2026 (unchanged on 1 November) that name Zyte Group Limited and contain a Zyte API section. The Python client is BSD 3-Clause (15 of 30). The privacy policy (30 August 2024), a DPA and a sub-processor list are public, with retention stated for support tickets (4 years) and invoices (7 years). Retention of request data and scraped content isn't stated, and the terms let Zyte use Service Data for product development and product training (17 of 30). Site tier changes get two weeks' notice and the Smart Proxy Manager retirement was announced with a date, but there is no standing API deprecation policy and the terms allow changes with or without notice (10 of 20). The sub-processor list names 36 companies with addresses and purposes, and the privacy policy names the United States and Ireland as processing locations (16 of 20).

fastCRW 91

OpenAPI 3.1 for 11 paths at version 0.41.0 in docs/openapi.json, checked against the server in CI, and typed JSON Schema inputs on every MCP tool (25). llms.txt (86 lines), llms-full.txt and Markdown sources for every docs page (10). Tool descriptions state purpose and how to chain them (crawl returns a job id to poll, map returns URLs only, extract needs an LLM), and the docs have a choose-an-endpoint page, but few descriptions say when not to use a tool (14 of 20). Inputs are typed with required fields and a renderer enum, though crawl and extract take a free-form JSON Schema object (12 of 15). Examples on every page and an errors page with each HTTP status, errorCode and next step (15). Semver releases with a dated CHANGELOG that flags breaking changes (15). 25 + 10 + 14 + 12 + 15 + 15 = 91.

Zyte API 85

The reference prints an OpenAPI 3.0.3 document for POST /v1/extract, though the Search API's /v1/search is documented in tables outside it (25). docs.zyte.com has an llms.txt and Markdown twins of its pages (10). The operation description states which output fields can be combined and which can't, and field descriptions give defaults (17 of 20). Inputs are typed, with 51 enums and required fields marked. customAttributes takes a free-form schema (13 of 15). The spec has a dozen request examples, and each error status has a problem+json example (15). The path is versioned /v1 and the spec says 1.0.0, but we found no dated changelog for the API in the docs sitemap of 150 pages (5 of 15).