# Decodo Web Data API vs Diffbot (slim)

> Decodo Web Data scores 61.8 (C) to Diffbot's 56.1 (C) for scraping. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/decodo-vs-diffbot.md (~5,900 tokens) · this version ~3,180 tokens · JSON https://www.anchorterminal.com/compare/decodo-vs-diffbot.json · canonical https://www.anchorterminal.com/compare/decodo-vs-diffbot
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Decodo Web Data API scores 61.8 (C) on agent readiness against Diffbot's 56.1 (C), and leads in 4 of 7 scored categories. Diffbot leads on schema & documentation and transparency & trust. Both do scraping.

- Decodo Web Data API: C 61.8, rank #591 of 1486 · https://www.anchorterminal.com/tools/decodo.min.md
- Diffbot: C 56.1, rank #840 of 1486 · https://www.anchorterminal.com/tools/diffbot.min.md
- Decodo Web Data API, good for Agents that need pages, Google results and e-commerce or social templates through one key with published per-1,000 prices and a free plan. Ahead on Agent ergonomics, 82 against 63; Security & auth, 45 against 21; Maintenance & community, 85 against 77. Also Runs on your own machine.
- Diffbot, good for Agents that want typed article, product or discussion data from arbitrary pages without writing selectors, and teams that also want the Knowledge Graph. Ahead on Schema & documentation, 83 against 67; Transparency & trust, 68 against 62.

| Category | Decodo Web Data API | Diffbot |
| --- | --- | --- |
| Reliability (16%) | 59 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 67 | 83 |
| Agent ergonomics (13%) | 82 | 63 |
| Security & auth (14%) | 45 | 21 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 77 |
| Transparency & trust (7%) | 62 | 68 |

| Fact (where they differ) | Decodo Web Data API | Diffbot |
| --- | --- | --- |
| Vendor | Decodo (UAB "Data troops") | Diffbot Technologies Corp. |
| Hosted endpoint | `https://mcp.decodo.com/mcp` | `https://api.diffbot.com/v3` |
| Transports | Streamable HTTP, stdio | HTTP |
| Auth | OAuth or key | API key |
| Price for scraping | $0.50 per 1,000 requests | not published |
| Licence | none | Proprietary service under Diffbot's Terms of Use. The Python client, the TypeScript client and the agent skills are MIT |
| Tools exposed | 33 | none |
| MCP registry | `io.github.Decodo/mcp-server` | not listed |
| Last release | 2026-10-30 | 2026-10-29 |
| Terms last updated | 2025-06-16 | no date given |
| Privacy policy last updated | 2026-05-21 | 2025-08-29 |
| Terms restrict automated access | not found in the text | yes |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | none | 9 npm/wk |

Why the edge:
- Security & auth, Decodo Web Data API +24: Decodo Web Data API 45 (One Bearer API key per Web Data API subscription with no scopes, and no rotation or revocation steps found in the reviewed docs. The hosted MCP server adds OAuth 2.1 with PKCE and dynamic registration, but its metadata advertises no scopes. No query-string credential is documented (20 of 30). Scraping only reads, and the MCP tools are annotated read-only, but `http_method: POST` sends requests to target sites and there is no read-only key (8 of 20). No guidance on treating scraped content as untrusted was found in the docs or the MCP README (0 of 15). The dashboard statistics API reports traffic by target, and each response carries an `x-task-id`. No per-call audit log (7 of 15). ISO/IEC 27001:2022 for proxies and the Scraping API, a SafeBase trust centre and KYC at signup. security.txt answers 404 and no disclosure policy or bug bounty was found (10 of 20). 20 + 8 + 0 + 7 + 10 = 45.); Diffbot 21 (One token per account, sent in the URL query string as the documented and only scheme in the OpenAPI file. Tokens are revocable in the dashboard per a June 2025 changelog title, and child tokens exist on Plus and above (20 of 30, less 10 for the secret in the URL, so 10). Child tokens have the same rights as the primary one and there is no read-only mode. The skills limit the agent to the `db` binary through `allowed-tools` (5 of 20). The API returns untrusted web content and no guidance on prompt injection was found (0 of 15). The token details page shows usage activity and an Account API reports usage. No per-call log was found (6 of 15). No security.txt, security page, certification or bug bounty was found on the pages read, and the privacy policy says some API calls rely on HTTP without encryption (0 of 20). Site pages per the 9 October check, not re-read on 4 November. OSV lists no advisory for `diffbot` on PyPI or `@diffbot/typescript` on npm on 4 November. 10 + 5 + 0 + 6 + 0 = 21.)
- Agent ergonomics, Decodo Web Data API +19: Decodo Web Data API 82 (The hosted MCP server lists 24 tools, with a `toolsets` parameter to load only web, search, ecommerce, social_media or ai, and `tokenLimit` caps page text at 45,000 characters by default with a truncation notice (20 of 25). Markdown output, parsing for templates, crawl `limit`, path filters and cursor paging, search paging, map limits and batch tasks (18 of 20). Documented status codes with a solution for each, `status_code` and `parse_status_code` in bodies, but 429 covers both the plan rate and a domain throttled for a low success rate (15 of 20). Every tool carries readOnlyHint true and destructiveHint false, server-side failures aren't billed and async results can be re-read for 24 hours. No idempotency key (16 of 20). Only `url` or `query` is required, though the default premium pool costs about twice the standard. Official Python, TypeScript and Go SDKs (13 of 15). 20 + 18 + 15 + 16 + 13 = 82.); Diffbot 63 (Graded on the REST API, with the skills noted. `mode` limits extraction to one page type, `fields` adds optional fields and `discussion=false` drops comments, but an article response carries both `html` and `text` with no way found to drop either. The skills return Markdown by default (14 of 25). A single-URL call has no pagination. Web Search takes `size` and `maxTokens` and DQL takes `size` per the client. Crawl result paging was not read (10 of 20). Errors are JSON with `errorCode` and `error` and six docs pages. A failed extraction can arrive in a 200, and the 429 text says the site received too many requests when the cause is the caller's plan limit (12 of 20). Extract calls are GET reads and safe to retry. Whether a failed call uses a credit was not found, and there is no idempotency key for creating crawl jobs or custom APIs (12 of 20). Only `url` and `token` are required, with official Python and TypeScript clients and a CLI (15). Docs per the 9 October check, not re-read on 4 November. The Python client 3.1.0 (29 October 2026) adds a `snippet_length` option that maps to the Web Search API's `snippetLength`. 14 + 10 + 12 + 12 + 15 = 63.)
- Schema & documentation, Diffbot +16: Decodo Web Data API 67 (No OpenAPI or similar contract for the Web Data API; the two published specs cover the proxy account API and dashboard statistics. The MCP server types every input with zod (12 of 25). llms.txt indexes 401 guide pages, each served as Markdown (10). Tool descriptions state purpose and when to use a tool, such as scrape_as_markdown 'when no site-specific tool fits', and link the docs page (14 of 20). Parameters are tabled with defaults, with enumerated proxy_pool, headless and device_type, but `headers` is a free object and POST bodies are base64 strings (10 of 15). Curl examples on every page, a response code table with fixes and billing, and parser status codes (14 of 15). Paths are versioned at /v1 and the MCP server's releases are tagged by semantic-release, but no API changelog was found (7 of 15). 12 + 10 + 14 + 10 + 14 + 7 = 67.); Diffbot 83 (The Extract APIs have a public OpenAPI 3.1.0 file, version 1.1.0, with 13 operations, and the reference pages are generated from it. We read that file and one rendered page. The descriptions for Crawl, Knowledge Graph and Web Search were not read (25). llms.txt exists but is a short index with no Markdown twins of the docs pages found (5 of 10). The Analyze API page has sections on when to use it and when not to (17 of 20). Parameters are typed, `url` is the one required field and the file has 15 enums, but `fields` is a comma-separated string and the file defines no shared response schemas (10 of 15). The file carries 24 examples. It documents only 200 and 500, with separate docs pages for 401, 404, 429 and 457 (11 of 15). The path is versioned `/v3` and a dated changelog with RSS runs from 2015 to 15 June 2026 (15). All per the 9 October check, not re-read on 4 November (terms bar automated access to the site). 25 + 5 + 17 + 10 + 11 + 15 = 83.)
- Maintenance & community, Decodo Web Data API +8: Decodo Web Data API 85 (Read for a closed service with open clients. The newest releases are MCP server 1.7.0 on 29 October 2026 and @decodo/sdk-ts 3.0.0 on 30 October (30). Since 8 August, MCP server 1.2.5 to 1.7.0 (ten versions in the official registry) and sdk-ts 2.4.0 to 3.0.0 (20). No public API changelog. Support by 24/7 live chat, email and Discord, and the MCP repository had commits by Decodo staff on most days from 6 October to 5 November. GitHub issues couldn't be read, since api.github.com refused us (10 of 25). In the official MCP registry as io.github.Decodo/mcp-server, with current SDKs in three languages (15). The MCP repository lints, builds and tests on Node 22 and 24 for every pull request (10). 30 + 20 + 10 + 15 + 10 = 85.); Diffbot 77 (Every dated source of the vendor's own was looked for in its GitHub repositories, since its site wasn't re-read. The official Python client, `diffbot` in the listing's packages, was tagged v3.1.0 on 29 October 2026, adding a Web Search `snippet_length` option, and the agent skills were tagged v1.2.0 the same day with rewritten skill content, 6 days before this check (30; was 10 on the API changelog's 15 June 2026 entry, which is per the 9 October check, not re-read on 4 November). In the 90 days from 6 August, the skills were tagged v1.1.0 (12 August, five new skills), v1.1.1 (13 August, a plugin marketplace manifest, counted half) and v1.2.0, and the Python client v3.0.0 (28 September) and v3.1.0, counted half as SDK tags, 3.5 in all (20). A public changelog with RSS and a support address exist. GitHub issues were not read (8 of 15 for a closed service). Python and TypeScript clients exist, but the docs named the packages `diffbot-python` and `diffbot-typescript` on 9 October while the repositories publish `diffbot` and `@diffbot/typescript`, and the TypeScript repository has no tag and no commit since 17 August 2026 (12 of 15). The Python repository tests on Python 3.9 to 3.13. We did not see CI results (7 of 10). 30 + 20 + 8 + 12 + 7 = 77.)
- Transparency & trust, Diffbot +6: Decodo Web Data API 62 (Closed service under a public License Agreement naming UAB "Data troops", with MIT clients (15 of 30). The privacy policy (21 May 2026) gives retention periods by category, says Decodo is processor for scraping and doesn't log proxy traffic content, and a DPA is published. Its general two-year rule sits beside longer specific periods without saying which wins, and no retention for scraped results beyond the 24-hour async window was found (18 of 30). The migration guide says legacy APIs keep working with no end date, and the License Agreement allows discontinuing the service without notice or refunds (6 of 20). The privacy policy names Stripe, DeepL and Paddle, but no subprocessor list or data locations were found in it or the trust centre (6 of 20). 15 + 18 + 6 + 6 = 45.); Diffbot 68 (A closed service under undated Terms of Use that cover the Site and the Service, cap liability at $10 and grant Diffbot a perpetual licence to process submitted queries. The clients and skills are MIT (13 of 30). The privacy policy of 29 August 2025 says query history and API calls are stored against the API key and kept no longer than necessary, with no retention period given. The GDPR and data rights page was not read (14 of 30). There is no deprecation policy. The changelog carries dated notices, such as a May 2024 entry announcing a field removal for 30 August 2024, and the terms give 14 days' notice of fee changes (8 of 20). The privacy policy names its service providers one by one, among them AWS, Stripe, Intercom, Salesforce, Slack and Amplitude, and says all are in the United States (14 of 20). All per the 9 October check, not re-read on 4 November. 13 + 14 + 8 + 14 = 49.)