Decodo Web Data API vs Outcrawl

Decodo Web Data API 45

One Bearer API key per Web Data API subscription with no scopes, and no rotation or revocation steps found in the reviewed docs. The hosted MCP server adds OAuth 2.1 with PKCE and dynamic registration, but its metadata advertises no scopes. No query-string credential is documented (20 of 30). Scraping only reads, and the MCP tools are annotated read-only, but http_method: POST sends requests to target sites and there is no read-only key (8 of 20). No guidance on treating scraped content as untrusted was found in the docs or the MCP README (0 of 15). The dashboard statistics API reports traffic by target, and each response carries an x-task-id. No per-call audit log (7 of 15). ISO/IEC 27001:2022 for proxies and the Scraping API, a SafeBase trust centre and KYC at signup. security.txt answers 404 and no disclosure policy or bug bounty was found (10 of 20). 20 + 8 + 0 + 7 + 10 = 45.

Outcrawl 66

OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, api; API keys shaped ock_<keyId>.<secret> are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above approvalAbove pause for a person's yes, and control hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries usage, /v1/usage groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.

Decodo Web Data API 59

Graded on the hosted lines. Instatus page at status.decodo.com with Web Data API and each legacy scraping API as components, with RSS history (20). In the 90 days to 6 November, every scraping API was out for 2 hours 51 minutes on 30 October, the main outage, with outages of 13 minutes on 26 October and 21 minutes on 15 October across the same components. The rest of the incidents hit proxies, payments or the website. One major (10). Per-plan request rates are published, 10 to 200 a second, though the same page's FAQ says paid plans support 10 to 50 (12 of 15). The response code table tells the agent to wait a couple of minutes on 429 and to retry 500, 524 and 613, which aren't billed, and the MCP client backs off exponentially. No Retry-After or idempotency guidance (7 of 15). No SLA; the License Agreement disclaims uninterrupted service (0). Web Data API is the current, unflagged product (10). 20 + 10 + 12 + 7 + 0 + 10 = 59.

Outcrawl 45

Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers quota_exceeded with ceiling: requests_per_minute and retryAfterSeconds, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and concurrency_limit tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.

Decodo Web Data API 85

Read for a closed service with open clients. The newest releases are MCP server 1.7.0 on 29 October 2026 and @decodo/sdk-ts 3.0.0 on 30 October (30). Since 8 August, MCP server 1.2.5 to 1.7.0 (ten versions in the official registry) and sdk-ts 2.4.0 to 3.0.0 (20). No public API changelog. Support by 24/7 live chat, email and Discord, and the MCP repository had commits by Decodo staff on most days from 6 October to 5 November. GitHub issues couldn't be read, since api.github.com refused us (10 of 25). In the official MCP registry as io.github.Decodo/mcp-server, with current SDKs in three languages (15). The MCP repository lints, builds and tests on Node 22 and 24 for every pull request (10). 30 + 20 + 10 + 15 + 10 = 85.

Outcrawl 79

@outcrawl/sdk and the PyPI package outcrawl both reached 0.4.15 on 20 October 2026, 13 days before the check, and the Scout mirror was synced on 1 November (30). 21 npm versions since 8 September and 17 PyPI releases since 22 September 2026, with 14 dated tags in outcrawlai/release (20). Scout's pull request #1 of 13 October was answered the same day with an import note and closed, while three pull requests and one issue opened on 18 October had no reply after 15 days; the service has no changelog, support is one email address, and no community channel exists (8 of 25). Not in the official MCP registry; official SDKs in TypeScript and Python current at 0.4.15, with a CLI (15). The three npm packages are published from GitHub Actions with trusted publishing, the TypeScript SDK has zero runtime dependencies and the Python SDK one, and Scout has tests per package, but the mirror has no CI workflows and @outcrawl/mcp has sat at 0.4.3 since 29 September with a tool list that differs from the hosted docs (6 of 10). 30+20+8+15+6 = 79.

Decodo Web Data API 62

Closed service under a public License Agreement naming UAB "Data troops", with MIT clients (15 of 30). The privacy policy (21 May 2026) gives retention periods by category, says Decodo is processor for scraping and doesn't log proxy traffic content, and a DPA is published. Its general two-year rule sits beside longer specific periods without saying which wins, and no retention for scraped results beyond the 24-hour async window was found (18 of 30). The migration guide says legacy APIs keep working with no end date, and the License Agreement allows discontinuing the service without notice or refunds (6 of 20). The privacy policy names Stripe, DeepL and Paddle, but no subprocessor list or data locations were found in it or the trust centre (6 of 20). 15 + 18 + 6 + 6 = 45.

Outcrawl 56

Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.