Decodo Web Data API vs Scrapeless

Decodo Web Data API 82

The hosted MCP server lists 24 tools, with a toolsets parameter to load only web, search, ecommerce, social_media or ai, and tokenLimit caps page text at 45,000 characters by default with a truncation notice (20 of 25). Markdown output, parsing for templates, crawl limit, path filters and cursor paging, search paging, map limits and batch tasks (18 of 20). Documented status codes with a solution for each, status_code and parse_status_code in bodies, but 429 covers both the plan rate and a domain throttled for a low success rate (15 of 20). Every tool carries readOnlyHint true and destructiveHint false, server-side failures aren't billed and async results can be re-read for 24 hours. No idempotency key (16 of 20). Only url or query is required, though the default premium pool costs about twice the standard. Official Python, TypeScript and Go SDKs (13 of 15). 20 + 18 + 15 + 16 + 13 = 82.

Scrapeless 50

25 MCP tools, 16 of them browser actions, with no toolsets or read-only subset (15 of 25). crawl_start takes limit and maxDepth, but scrape_markdown and scrape_html take only a URL, with no size or selector control (10 of 20). The MCP returns status_code, a code of rate_limited or api_error, and the upstream message. No API error catalogue found (10 of 20). No readOnlyHint or destructiveHint annotations and no idempotency guidance (0). Most tools need only a URL, and official SDKs exist for Node and Python (15).

Decodo Web Data API 59

Graded on the hosted lines. Instatus page at status.decodo.com with Web Data API and each legacy scraping API as components, with RSS history (20). In the 90 days to 6 November, every scraping API was out for 2 hours 51 minutes on 30 October, the main outage, with outages of 13 minutes on 26 October and 21 minutes on 15 October across the same components. The rest of the incidents hit proxies, payments or the website. One major (10). Per-plan request rates are published, 10 to 200 a second, though the same page's FAQ says paid plans support 10 to 50 (12 of 15). The response code table tells the agent to wait a couple of minutes on 429 and to retry 500, 524 and 613, which aren't billed, and the MCP client backs off exponentially. No Retry-After or idempotency guidance (7 of 15). No SLA; the License Agreement disclaims uninterrupted service (0). Web Data API is the current, unflagged product (10). 20 + 10 + 12 + 7 + 0 + 10 = 59.

Scrapeless 70

Better Stack status page at status.scrapeless.com with four groups, Scrapeless API, Scraping Browser, website and dashboard, and residential proxies (20). Every monitor shows 100 per cent uptime over 90 days and the incident list reports none for September, October or November 2026. The list doesn't page back to August, so the earlier clean reading for August is kept (30). No rate-limit numbers found in the docs. The 30 September concurrency figures came from a script-loaded price file and are struck (0). The Results and Polling page documents 429 as rate limit exceeded with reduce-frequency guidance and a one-minute wait for 500s, with no idempotency keys (10). The pricing page names an Enterprise-level SLA but no SLA document is published (0). The APIs are generally available (10). 20 + 30 + 0 + 10 + 0 + 10 = 70.

Decodo Web Data API 45

One Bearer API key per Web Data API subscription with no scopes, and no rotation or revocation steps found in the reviewed docs. The hosted MCP server adds OAuth 2.1 with PKCE and dynamic registration, but its metadata advertises no scopes. No query-string credential is documented (20 of 30). Scraping only reads, and the MCP tools are annotated read-only, but http_method: POST sends requests to target sites and there is no read-only key (8 of 20). No guidance on treating scraped content as untrusted was found in the docs or the MCP README (0 of 15). The dashboard statistics API reports traffic by target, and each response carries an x-task-id. No per-call audit log (7 of 15). ISO/IEC 27001:2022 for proxies and the Scraping API, a SafeBase trust centre and KYC at signup. security.txt answers 404 and no disclosure policy or bug bounty was found (10 of 20). 20 + 8 + 0 + 7 + 10 = 45.

Scrapeless 37

One API token per account, sent in the x-api-token header, which the docs say can be replaced and invalidated from the dashboard or through support. No scopes (20). Agent Browser WebSocket connections pass the token as a URL parameter, a documented option, so less 10 (10 of 30). No read-only mode, and the browser tools can click and type on third-party sites without any confirmation step (5 of 20). The MCP README has a security section that calls web data untrusted by default and warns against passing raw scraped content into prompts, with no in-tool mitigation (10 of 15). Browser sessions are recorded, and we found no request log for the other APIs (5 of 15). security.txt is valid (contact system@scrapeless.com, expires 2030), with no disclosure policy or acknowledgement time, and no bug bounty, SOC 2 or ISO 27001 found (7 of 20). 10 + 5 + 10 + 5 + 7 = 37.

Decodo Web Data API 40

No x402, MPP or L402 (0). Per-1,000 rates for every endpoint, pool and plan are public in the billing docs (20). Free plan of 10,000 requests a month with no card (20). A person signs up in the dashboard; the MCP OAuth flow also needs a dashboard approval (0). 0 + 20 + 20 + 0 = 40.

Scrapeless 35

No x402, MPP or L402. Crypto top-ups exist but aren't a machine payment protocol (0). The pricing page draws its rate tables by script. The docs publish per-unit rates, Crawl from $1.8 a GB plus $0.09 a browser hour and Web Unlocker from $0.20 per 1,000 URLs, and the Google Search API page gives volume rates below $0.50 per 1,000 on qualifying plans, but no full rate card is readable without script (15 of 20, a partial kept under the in-between rule). The Google Search API page says no credit card is required to start (20). A person signs up in a browser (0). 0 + 15 + 20 + 0 = 35.