Decodo Web Data API vs ScraperAPI

Decodo Web Data API 85

Read for a closed service with open clients. The newest releases are MCP server 1.7.0 on 29 October 2026 and @decodo/sdk-ts 3.0.0 on 30 October (30). Since 8 August, MCP server 1.2.5 to 1.7.0 (ten versions in the official registry) and sdk-ts 2.4.0 to 3.0.0 (20). No public API changelog. Support by 24/7 live chat, email and Discord, and the MCP repository had commits by Decodo staff on most days from 6 October to 5 November. GitHub issues couldn't be read, since api.github.com refused us (10 of 25). In the official MCP registry as io.github.Decodo/mcp-server, with current SDKs in three languages (15). The MCP repository lints, builds and tests on Node 22 and 24 for every pull request (10). 30 + 20 + 10 + 15 + 10 = 85.

ScraperAPI 41

The newest dated entry is the October 2026 release note on automatic Akamai unblocking, dated by month only. Counted from its month, October lies 4 to 34 days back, so it is inside 90 days but not shown within 30, as crustdata's October entries. The skills plugin's 1.1.0 of 7 August is an untagged version bump, and the MCP server's v1.1.1 is from 17 July 2026 (20). Since 6 August only the October note and the 7 August plugin bump are dated, fewer than three (0 of 20). The npm and PyPI pages of the SDKs and CLI couldn't be read on 4 November. Monthly release notes and support through the dashboard and email. We did not read the repository's issues (8 of 15). SDKs are documented for five languages, but we could not check their release dates, and the Node.js SDK repository's last commit is from 12 January 2024 (8 of 15). The MCP repository has unit tests and a lock file but no public CI workflow (5 of 10). 20 + 0 + 8 + 8 + 5 = 41.

Decodo Web Data API 59

Graded on the hosted lines. Instatus page at status.decodo.com with Web Data API and each legacy scraping API as components, with RSS history (20). In the 90 days to 6 November, every scraping API was out for 2 hours 51 minutes on 30 October, the main outage, with outages of 13 minutes on 26 October and 21 minutes on 15 October across the same components. The rest of the incidents hit proxies, payments or the website. One major (10). Per-plan request rates are published, 10 to 200 a second, though the same page's FAQ says paid plans support 10 to 50 (12 of 15). The response code table tells the agent to wait a couple of minutes on 429 and to retry 500, 524 and 613, which aren't billed, and the MCP client backs off exponentially. No Retry-After or idempotency guidance (7 of 15). No SLA; the License Agreement disclaims uninterrupted service (0). Web Data API is the current, unflagged product (10). 20 + 10 + 12 + 7 + 0 + 10 = 59.

ScraperAPI 42

No status page is linked from the home, pricing, support or docs pages we read on 9 October or 4 November (0). No readable incident history (5). Concurrency limits are published per plan, 5 threads on Free, 20 on Hobby, 50, 100, 200, 300 and 500 above it, and the local MCP server limits itself to 10 calls in 60 seconds (15). 429 is documented as a concurrency rejection with no charge, the API retries a target for up to 70 seconds before returning 500, failed requests aren't charged, and the docs tell clients to retry failed requests. That is safe-retry guidance with no idempotency keys on the async job writes and no Retry-After header (12 of 15). The pricing page lists a 99.9% uptime guarantee on every plan, but no SLA document or credit terms were found and the Terms of Use are closed to us (0 of 10). The API, async service and crawler are generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.

Decodo Web Data API 45

One Bearer API key per Web Data API subscription with no scopes, and no rotation or revocation steps found in the reviewed docs. The hosted MCP server adds OAuth 2.1 with PKCE and dynamic registration, but its metadata advertises no scopes. No query-string credential is documented (20 of 30). Scraping only reads, and the MCP tools are annotated read-only, but http_method: POST sends requests to target sites and there is no read-only key (8 of 20). No guidance on treating scraped content as untrusted was found in the docs or the MCP README (0 of 15). The dashboard statistics API reports traffic by target, and each response carries an x-task-id. No per-call audit log (7 of 15). ISO/IEC 27001:2022 for proxies and the Scraping API, a SafeBase trust centre and KYC at signup. security.txt answers 404 and no disclosure policy or bug bounty was found (10 of 20). 20 + 8 + 0 + 7 + 10 = 45.

ScraperAPI 29

One API key per account, regenerated from the dashboard at most once every 24 hours. No scopes (20). The documented default puts the key in the URL query string, so less 10, although an x-sapi-api_key header and a Bearer header on the remote MCP server exist (10 of 30). No read-only or restricted keys. max_cost, a monthly pay-as-you-go spending cap and destructive hints on the two MCP delete tools limit damage (6 of 20). The API returns untrusted web content and no prompt-injection guidance was found in the docs, the MCP README or the skills (2 of 15). The dashboard has analytics with error logs, each response carries sa-credit-cost, and the privacy policy says activity logs are deleted after 7 days (9 of 15). /.well-known/security.txt returned 404 on 9 October and 4 November, and no disclosure policy, bug bounty or certification was found. The home page claims CCPA and GDPR compliance (2 of 20). 10 + 6 + 2 + 9 + 2 = 29.

Decodo Web Data API 82

The hosted MCP server lists 24 tools, with a toolsets parameter to load only web, search, ecommerce, social_media or ai, and tokenLimit caps page text at 45,000 characters by default with a truncation notice (20 of 25). Markdown output, parsing for templates, crawl limit, path filters and cursor paging, search paging, map limits and batch tasks (18 of 20). Documented status codes with a solution for each, status_code and parse_status_code in bodies, but 429 covers both the plan rate and a domain throttled for a low success rate (15 of 20). Every tool carries readOnlyHint true and destructiveHint false, server-side failures aren't billed and async results can be re-read for 24 hours. No idempotency key (16 of 20). Only url or query is required, though the default premium pool costs about twice the standard. Official Python, TypeScript and Go SDKs (13 of 15). 20 + 18 + 15 + 16 + 13 = 82.

ScraperAPI 74

28 MCP tools with no toolsets or dynamic loading (15 of 25). output_format returns Markdown or text, autoparse returns JSON on supported domains, structured endpoints page their results, and max_cost, crawl_budget and max_depth cap a job (15 of 20). Errors are HTTP status codes with plain-text messages. No machine-readable error codes (13 of 20). All 28 MCP tools carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint, failed requests are not charged, and async jobs return a status URL to poll (16 of 20). Only api_key and url are required, rendering is off by default, and SDKs are documented for Python, Node.js, PHP, Ruby and Java (15). 15 + 15 + 13 + 16 + 15 = 74.

Decodo Web Data API 62

Closed service under a public License Agreement naming UAB "Data troops", with MIT clients (15 of 30). The privacy policy (21 May 2026) gives retention periods by category, says Decodo is processor for scraping and doesn't log proxy traffic content, and a DPA is published. Its general two-year rule sits beside longer specific periods without saying which wins, and no retention for scraped results beyond the 24-hour async window was found (18 of 30). The migration guide says legacy APIs keep working with no end date, and the License Agreement allows discontinuing the service without notice or refunds (6 of 20). The privacy policy names Stripe, DeepL and Paddle, but no subprocessor list or data locations were found in it or the trust centre (6 of 20). 15 + 18 + 6 + 6 = 45.

ScraperAPI 54

Closed service. The MCP server and skills are MIT. Terms of Use exist at /terms/, but robots.txt disallows that path, so we could not confirm what they say (10 of 30). The privacy policy says activity logs are deleted after 7 days and account data within 60 days of a request, async results are kept up to 72 hours and DataPipeline results 30 days. The policy is undated, names Saas.group Inc. while a November 2025 release note says the service operates as ScraperAPI LLC, and no DPA was found (14 of 30). The terms and billing change was announced with effective dates of 4 November 2025 and 5 January 2026. No standing deprecation policy (8 of 20). No sub-processor list or hosting location found, only a general statement on transfers outside the EEA (3 of 20). 10 + 14 + 8 + 3 = 35.