# Decodo Web Data API vs Scrapfly (slim)

> Scrapfly scores 74.5 (BB) to Decodo Web Data's 61.8 (C) for scraping. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/decodo-vs-scrapfly.md (~5,250 tokens) · this version ~2,580 tokens · JSON https://www.anchorterminal.com/compare/decodo-vs-scrapfly.json · canonical https://www.anchorterminal.com/compare/decodo-vs-scrapfly
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Scrapfly scores 74.5 (BB) on agent readiness against Decodo Web Data API's 61.8 (C), and leads in 4 of 7 scored categories. Both do scraping.

- Decodo Web Data API: C 61.8, rank #591 of 1486 · https://www.anchorterminal.com/tools/decodo.min.md
- Scrapfly: BB 74.5, rank #84 of 1486 · https://www.anchorterminal.com/tools/scrapfly.min.md
- Decodo Web Data API, good for Agents that need pages, Google results and e-commerce or social templates through one key with published per-1,000 prices and a free plan. Also No incidents deducted, where Scrapfly loses 3 points for them.
- Scrapfly, good for An agent that needs scrape, screenshot, extraction, crawl and a hosted browser from one key, with errors it can branch on. Ahead on Reliability, 85 against 59; Schema & documentation, 95 against 67; Security & auth, 75 against 45; Transparency & trust, 75 against 62. Also Agent-ready, a grade of BB or better.

| Category | Decodo Web Data API | Scrapfly |
| --- | --- | --- |
| Reliability (16%) | 59 | 85 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 67 | 95 |
| Agent ergonomics (13%) | 82 | 80 |
| Security & auth (14%) | 45 | 75 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 84 |
| Transparency & trust (7%) | 62 | 75 |

| Fact (where they differ) | Decodo Web Data API | Scrapfly |
| --- | --- | --- |
| Vendor | Decodo (UAB "Data troops") | Scrapfly (Joam Intelligence, LLC) |
| Hosted endpoint | `https://mcp.decodo.com/mcp` | `https://api.scrapfly.io/scrape` |
| Transports | Streamable HTTP, stdio | HTTP, Streamable HTTP, stdio |
| Price for scraping | $0.50 per 1,000 requests | not published |
| Tools exposed | 33 | 62 |
| MCP registry | `io.github.Decodo/mcp-server` | `io.scrapfly.mcp/mcp` |
| Last release | 2026-10-30 | 2026-10-15 |
| Terms last updated | 2025-06-16 | 2026-09-30 |
| Privacy policy last updated | 2026-05-21 | 2026-05-14 |
| Terms restrict benchmarking | not found in the text | yes |
| Popularity | none | 14 stars, 21k npm/wk |
| Agent reviews | none | 4/5 (2) |

Why the edge:
- Security & auth, Scrapfly +30: Decodo Web Data API 45 (One Bearer API key per Web Data API subscription with no scopes, and no rotation or revocation steps found in the reviewed docs. The hosted MCP server adds OAuth 2.1 with PKCE and dynamic registration, but its metadata advertises no scopes. No query-string credential is documented (20 of 30). Scraping only reads, and the MCP tools are annotated read-only, but `http_method: POST` sends requests to target sites and there is no read-only key (8 of 20). No guidance on treating scraped content as untrusted was found in the docs or the MCP README (0 of 15). The dashboard statistics API reports traffic by target, and each response carries an `x-task-id`. No per-call audit log (7 of 15). ISO/IEC 27001:2022 for proxies and the Scraping API, a SafeBase trust centre and KYC at signup. security.txt answers 404 and no disclosure policy or bug bounty was found (10 of 20). 20 + 8 + 0 + 7 + 10 = 45.); Scrapfly 75 (OAuth 2 on the hosted MCP with dashboard revocation, open to all plans. API keys are per project, live or test, and since 15 April 2026 can be restricted to products (30). The canonical API form puts the key in the key query parameter and the MCP also accepts ?key=, so less 10 (20 of 30). Product-restricted keys, confirm=true on every mutating vault and alert tool, info_api_key off in server-key mode, and the self-hosted HTTP server binds loopback by default. Since v1.4.0 Cloud Browser sessions are scoped to the API key that opened them (15 of 20). The source gates mutating vault tools behind a preview step because prompt injection can reach them and redacts keys from CDP URLs. We found no user-facing guidance on untrusted page content (8 of 15). Monitoring shows every call as a log with its error, credit cost line by line and Unblocker state, with replay, per the 24 October release notes, as well as per-domain metrics and alerting. The 1 October check couldn't confirm per-request logs (15, was 10). security.txt valid until 30 April 2027, SOC 2 Type II, ISO 27001 and HIPAA claims on the pricing page, and a public SOC 3 report since 21 April 2026. No bug bounty found (17 of 20). 20+15+8+15+17 = 75.)
- Schema & documentation, Scrapfly +28: Decodo Web Data API 67 (No OpenAPI or similar contract for the Web Data API; the two published specs cover the proxy account API and dashboard statistics. The MCP server types every input with zod (12 of 25). llms.txt indexes 401 guide pages, each served as Markdown (10). Tool descriptions state purpose and when to use a tool, such as scrape_as_markdown 'when no site-specific tool fits', and link the docs page (14 of 20). Parameters are tabled with defaults, with enumerated proxy_pool, headless and device_type, but `headers` is a free object and POST bodies are base64 strings (10 of 15). Curl examples on every page, a response code table with fixes and billing, and parser status codes (14 of 15). Paths are versioned at /v1 and the MCP server's releases are tagged by semantic-release, but no API changelog was found (7 of 15). 12 + 10 + 14 + 10 + 14 + 7 = 67.); Scrapfly 95 (A Swagger reference per the 30 September check, and the MCP server exposes it as a web_scraping_openapi_specification resource. Every MCP tool has JSON Schema inputs generated from typed Go structs (25). llms.txt and Markdown twins such as pricing.md per the 30 September check. robots.txt still disallows /docs/llms.txt and the .md twins for crawlers it doesn't name, so they weren't re-read on 1 November (10). Descriptions say when to use a tool and when to switch, for example web_get_page falls back to web_scrape for tuning and to cloud_browser_open for interaction. A few are long and steer the model's next step (17 of 20). Typed inputs with enums, for example the vault service discriminator, and required fields (13 of 15). Error catalogue of 100+ ERR:: codes, each with HTTP status, retryable and billed flags and its own doc link (15). Dated release notes, newest 26 October 2026 (15). 25+10+17+13+15+15 = 95.)
- Reliability, Scrapfly +26: Decodo Web Data API 59 (Graded on the hosted lines. Instatus page at status.decodo.com with Web Data API and each legacy scraping API as components, with RSS history (20). In the 90 days to 6 November, every scraping API was out for 2 hours 51 minutes on 30 October, the main outage, with outages of 13 minutes on 26 October and 21 minutes on 15 October across the same components. The rest of the incidents hit proxies, payments or the website. One major (10). Per-plan request rates are published, 10 to 200 a second, though the same page's FAQ says paid plans support 10 to 50 (12 of 15). The response code table tells the agent to wait a couple of minutes on 429 and to retry 500, 524 and 613, which aren't billed, and the MCP client backs off exponentially. No Retry-After or idempotency guidance (7 of 15). No SLA; the License Agreement disclaims uninterrupted service (0). Web Data API is the current, unflagged product (10). 20 + 10 + 12 + 7 + 0 + 10 = 59.); Scrapfly 85 (scrapfly.io/status answers with Statuspage's status JSON, which names its page as scrapfly.statuspage.io. That page has 25 components and incident history back to 2022, read through its history feed on 1 November. The 1 October check read only the overall state and found no history (20, was 10). The newest incident is a Scrapium rendering fault on 21 May 2026, so nothing is posted in the 90 days from 3 August (30, was 5). Concurrency per plan is published (5 on Discovery to 100 on Enterprise) and each project has a configurable per-minute throttle (15). The error catalogue marks every code retryable or not and has three ERR::THROTTLE codes, but we found no Retry-After header or backoff guidance on the errors or throttling pages (10 of 15). The terms disclaim uptime and no uptime SLA is published, and the pricing page's SLA mentions cover support response on Enterprise (0). The Scrape API is GA. Vault and alerting are beta, outside the main surface (10). 20+30+15+10+0+10 = 85.)
- Transparency & trust, Scrapfly +13: Decodo Web Data API 62 (Closed service under a public License Agreement naming UAB "Data troops", with MIT clients (15 of 30). The privacy policy (21 May 2026) gives retention periods by category, says Decodo is processor for scraping and doesn't log proxy traffic content, and a DPA is published. Its general two-year rule sits beside longer specific periods without saying which wins, and no retention for scraped results beyond the 24-hour async window was found (18 of 30). The migration guide says legacy APIs keep working with no end date, and the License Agreement allows discontinuing the service without notice or refunds (6 of 20). The privacy policy names Stripe, DeepL and Paddle, but no subprocessor list or data locations were found in it or the trust centre (6 of 20). 15 + 18 + 6 + 6 = 45.); Scrapfly 75 (Closed service with terms updated 2026-09-30 under US law. SDKs are BSD 2-Clause, and the MCP source is public with no LICENSE file and ISC in package.json (15 of 30). Privacy policy updated 14 May 2026 with a published DPA and HIPAA BAA, but retention is as long as necessary, and the retention of scraped content isn't stated (18 of 30). Release notes date deprecations and removals, for example Scrapium v153 dropping legacy network interception on 11 September. No standing deprecation policy found (15 of 20). Stripe, Google Analytics, Google Ads and Google Cloud are named, with SCC and Data Privacy Framework transfers, but there's no full subprocessor list (10 of 20). The release notes still date each CDP removal, most recently `Storage.getRelatedWebsiteSets` in Scrapium v156 on 26 October. Not otherwise re-read on 1 November. 15+18+15+10 = 58.)