Decodo Web Data API vs Scrape.do

Decodo Web Data API 85

Read for a closed service with open clients. The newest releases are MCP server 1.7.0 on 29 October 2026 and @decodo/sdk-ts 3.0.0 on 30 October (30). Since 8 August, MCP server 1.2.5 to 1.7.0 (ten versions in the official registry) and sdk-ts 2.4.0 to 3.0.0 (20). No public API changelog. Support by 24/7 live chat, email and Discord, and the MCP repository had commits by Decodo staff on most days from 6 October to 5 November. GitHub issues couldn't be read, since api.github.com refused us (10 of 25). In the official MCP registry as io.github.Decodo/mcp-server, with current SDKs in three languages (15). The MCP repository lints, builds and tests on Node 22 and 24 for every pull request (10). 30 + 20 + 10 + 15 + 10 = 85.

Scrape.do 45

Last changelog entry on 31 July 2026, a Gemini scraper API (20). Two dated entries since 3 July, 29 and 31 July, against the three the rubric asks for (10 of 20). Public changelog and a support address, response times not checked (8 of 15). The only official SDK, @scrape-do/client, hasn't shipped since 13 November 2024 (5 of 15). No public repository or CI to check (2 of 10).

Decodo Web Data API 45

One Bearer API key per Web Data API subscription with no scopes, and no rotation or revocation steps found in the reviewed docs. The hosted MCP server adds OAuth 2.1 with PKCE and dynamic registration, but its metadata advertises no scopes. No query-string credential is documented (20 of 30). Scraping only reads, and the MCP tools are annotated read-only, but http_method: POST sends requests to target sites and there is no read-only key (8 of 20). No guidance on treating scraped content as untrusted was found in the docs or the MCP README (0 of 15). The dashboard statistics API reports traffic by target, and each response carries an x-task-id. No per-call audit log (7 of 15). ISO/IEC 27001:2022 for proxies and the Scraping API, a SafeBase trust centre and KYC at signup. security.txt answers 404 and no disclosure policy or bug bounty was found (10 of 20). 20 + 8 + 0 + 7 + 10 = 45.

Scrape.do 23

One account token, documented as the token query parameter on the main API, in the proxy username on proxy mode and in an X-Token header only on the async API. We found no scopes or rotation for it. Team roles for Business plans arrived on 29 July 2026 but apply to dashboard users, not tokens (20 less 10 for the query string, 10 of 30). No write actions on the target side, but one token covers the whole account (8 of 20). Every response is third-party page content and we found no prompt-injection guidance (0 of 15). Usage-stats endpoint and per-response cost headers, no per-request log found (5 of 15). No security.txt, security page or disclosure policy found. Proxy mode needs Scrape.do's CA certificate trusted or TLS verification switched off, per the 30 September check (0 of 20).

Decodo Web Data API 82

The hosted MCP server lists 24 tools, with a toolsets parameter to load only web, search, ecommerce, social_media or ai, and tokenLimit caps page text at 45,000 characters by default with a truncation notice (20 of 25). Markdown output, parsing for templates, crawl limit, path filters and cursor paging, search paging, map limits and batch tasks (18 of 20). Documented status codes with a solution for each, status_code and parse_status_code in bodies, but 429 covers both the plan rate and a domain throttled for a low success rate (15 of 20). Every tool carries readOnlyHint true and destructiveHint false, server-side failures aren't billed and async results can be re-read for 24 hours. No idempotency key (16 of 20). Only url or query is required, though the default premium pool costs about twice the standard. Official Python, TypeScript and Go SDKs (13 of 15). 20 + 18 + 15 + 16 + 13 = 82.

Scrape.do 62

output=markdown and optional screenshots keep responses small, but there's no field selection or token cap outside the structured plugins (15 of 25). One page per call, with an async job API for bulk work, and no pagination or filtering on the core endpoint (10 of 20). Status codes documented with billing behaviour (15 of 20). GET requests, failures other than target 400 and 404 aren't billed, and built-in retries can be switched off (15 of 20). Two required parameters, but the only official SDK is the Node client last released on 13 November 2024 (7 of 15).

Decodo Web Data API 59

Graded on the hosted lines. Instatus page at status.decodo.com with Web Data API and each legacy scraping API as components, with RSS history (20). In the 90 days to 6 November, every scraping API was out for 2 hours 51 minutes on 30 October, the main outage, with outages of 13 minutes on 26 October and 21 minutes on 15 October across the same components. The rest of the incidents hit proxies, payments or the website. One major (10). Per-plan request rates are published, 10 to 200 a second, though the same page's FAQ says paid plans support 10 to 50 (12 of 15). The response code table tells the agent to wait a couple of minutes on 429 and to retry 500, 524 and 613, which aren't billed, and the MCP client backs off exponentially. No Retry-After or idempotency guidance (7 of 15). No SLA; the License Agreement disclaims uninterrupted service (0). Web Data API is the current, unflagged product (10). 20 + 10 + 12 + 7 + 0 + 10 = 59.

Scrape.do 40

No public status page. status.scrape.do returned 403 to our fetch again today, as it did on 30 September, and the site doesn't link it (0). No readable incident history, so 5 by the rubric (5). Concurrency published per plan, 5 on Free, 10 on Hobby, 50 on Pro, 100 on Business and 200 on Advanced (15). A 429 means the concurrency limit was hit and isn't billed, a 502 says to try again, and the service retries failed requests itself unless disableRetry=true, but there's no Retry-After or backoff guidance (10 of 15). No SLA on the pricing page, which claims a 99.98 per cent success rate instead (0). GA (10).

Decodo Web Data API 62

Closed service under a public License Agreement naming UAB "Data troops", with MIT clients (15 of 30). The privacy policy (21 May 2026) gives retention periods by category, says Decodo is processor for scraping and doesn't log proxy traffic content, and a DPA is published. Its general two-year rule sits beside longer specific periods without saying which wins, and no retention for scraped results beyond the 24-hour async window was found (18 of 30). The migration guide says legacy APIs keep working with no end date, and the License Agreement allows discontinuing the service without notice or refunds (6 of 20). The privacy policy names Stripe, DeepL and Paddle, but no subprocessor list or data locations were found in it or the trust centre (6 of 20). 15 + 18 + 6 + 6 = 45.

Scrape.do 49

Closed service with published terms of use under PACKEND, LLC (15). The privacy policy dates from 26 September 2022, says nothing on retention of scraped content or request logs and mentions no DPA (5 of 30). Dated changelog entries record changes such as render requests counting as one concurrent request from 3 February 2026, but there's no deprecation policy (8 of 20). Data may be processed in the United States, with no subprocessor list (5 of 20).

Decodo Web Data API 67

No OpenAPI or similar contract for the Web Data API; the two published specs cover the proxy account API and dashboard statistics. The MCP server types every input with zod (12 of 25). llms.txt indexes 401 guide pages, each served as Markdown (10). Tool descriptions state purpose and when to use a tool, such as scrape_as_markdown 'when no site-specific tool fits', and link the docs page (14 of 20). Parameters are tabled with defaults, with enumerated proxy_pool, headless and device_type, but headers is a free object and POST bodies are base64 strings (10 of 15). Curl examples on every page, a response code table with fixes and billing, and parser status codes (14 of 15). Paths are versioned at /v1 and the MCP server's releases are tagged by semantic-release, but no API changelog was found (7 of 15). 12 + 10 + 14 + 10 + 14 + 7 = 67.

Scrape.do 57

No OpenAPI file found (0 of 25). llms.txt at scrape.do/documentation/llms.txt with Markdown pages (10). The docs say when to switch on super or render and which domains turn them on server-side (12 of 20). Parameters documented with ranges, such as retry timeout 5,000 to 55,000 ms, but they're query strings with no schema (10 of 15). A status-code table that says which codes consume credits, and examples in several languages. The error body format isn't documented (13 of 15). Dated public changelog, no API versioning (12 of 15).