Decodo Web Data API vs Scrapingdog

Decodo Web Data API 45

One Bearer API key per Web Data API subscription with no scopes, and no rotation or revocation steps found in the reviewed docs. The hosted MCP server adds OAuth 2.1 with PKCE and dynamic registration, but its metadata advertises no scopes. No query-string credential is documented (20 of 30). Scraping only reads, and the MCP tools are annotated read-only, but http_method: POST sends requests to target sites and there is no read-only key (8 of 20). No guidance on treating scraped content as untrusted was found in the docs or the MCP README (0 of 15). The dashboard statistics API reports traffic by target, and each response carries an x-task-id. No per-call audit log (7 of 15). ISO/IEC 27001:2022 for proxies and the Scraping API, a SafeBase trust centre and KYC at signup. security.txt answers 404 and no disclosure policy or bug bounty was found (10 of 20). 20 + 8 + 0 + 7 + 10 = 45.

Scrapingdog 5

One account key with no scopes, and we found no rotation or revocation docs (10). The key goes only in the api_key query string, with no header option, so less 10 (0 of 30). No read-only mode or least-privilege key. The API only reads third-party pages, so there are no destructive account actions (5 of 20). No prompt-injection guidance in the docs or the MCP README (0 of 15). No request log or per-call audit found (0 of 15). No security.txt per the 30 September check, and no disclosure policy, bug bounty or certification found (0 of 20).

Decodo Web Data API 85

Read for a closed service with open clients. The newest releases are MCP server 1.7.0 on 29 October 2026 and @decodo/sdk-ts 3.0.0 on 30 October (30). Since 8 August, MCP server 1.2.5 to 1.7.0 (ten versions in the official registry) and sdk-ts 2.4.0 to 3.0.0 (20). No public API changelog. Support by 24/7 live chat, email and Discord, and the MCP repository had commits by Decodo staff on most days from 6 October to 5 November. GitHub issues couldn't be read, since api.github.com refused us (10 of 25). In the official MCP registry as io.github.Decodo/mcp-server, with current SDKs in three languages (15). The MCP repository lints, builds and tests on Node 22 and 24 for every pull request (10). 30 + 20 + 10 + 15 + 10 = 85.

Scrapingdog 45

The SDKs and MCP server were first published on 31 July and 1 August 2026, 61 days ago. No API changelog or later release found (20). Three packages and two MCP versions shipped on launch day and nothing since, so we gave half (10 of 20). We couldn't read GitHub issues. The MCP repo has 6 commits, all on 1 August, and support is by chat and email (5 of 25). The MCP is in the official registry under the personal namespace io.github.Darshan972, though the vendor's SDK page links it as its own. SDKs are current (8 of 15). No CI, tests or tags in the MCP repo (2 of 10).

Decodo Web Data API 82

The hosted MCP server lists 24 tools, with a toolsets parameter to load only web, search, ecommerce, social_media or ai, and tokenLimit caps page text at 45,000 characters by default with a truncation notice (20 of 25). Markdown output, parsing for templates, crawl limit, path filters and cursor paging, search paging, map limits and batch tasks (18 of 20). Documented status codes with a solution for each, status_code and parse_status_code in bodies, but 429 covers both the plan rate and a domain throttled for a low success rate (15 of 20). Every tool carries readOnlyHint true and destructiveHint false, server-side failures aren't billed and async results can be re-read for 24 hours. No idempotency key (16 of 20). Only url or query is required, though the default premium pool costs about twice the standard. Official Python, TypeScript and Go SDKs (13 of 15). 20 + 18 + 15 + 16 + 13 = 82.

Scrapingdog 44

35 MCP tools with no toolsets or subsets (5 of 25). markdown=true, ai_query and parsed JSON endpoints for Google, Amazon and LinkedIn keep responses smaller. No documented pagination or size limits on the raw scrape (12 of 20). 8 HTTP status codes with meanings, and the MCP passes the status and body back (12 of 20). Failed requests aren't billed, but no tool annotations or idempotency guidance (5 of 20). Only url is required, but rendering defaults on at 5 credits and the MCP describes it as off. Node and Python SDKs (10 of 15).

Decodo Web Data API 67

No OpenAPI or similar contract for the Web Data API; the two published specs cover the proxy account API and dashboard statistics. The MCP server types every input with zod (12 of 25). llms.txt indexes 401 guide pages, each served as Markdown (10). Tool descriptions state purpose and when to use a tool, such as scrape_as_markdown 'when no site-specific tool fits', and link the docs page (14 of 20). Parameters are tabled with defaults, with enumerated proxy_pool, headless and device_type, but headers is a free object and POST bodies are base64 strings (10 of 15). Curl examples on every page, a response code table with fixes and billing, and parser status codes (14 of 15). Paths are versioned at /v1 and the MCP server's releases are tagged by semantic-release, but no API changelog was found (7 of 15). 12 + 10 + 14 + 10 + 14 + 7 = 67.

Scrapingdog 43

No OpenAPI spec found. The MCP builds typed zod inputs for 35 tools from a declarative registry, and ai_extract_rules is a JSON string (12 of 25). llms.txt per the 30 September check (10). MCP descriptions say what each endpoint does but not when to avoid it, and the web_scrape tool tells the model the API default for dynamic is false while the docs say rendering is on by default (10 of 20). Booleans, numbers and strings with few enums, plus the JSON-string field (9 of 15). Code examples on each docs page and 8 documented status codes (12 of 15). No changelog and no versioned API paths found (0).

Decodo Web Data API 62

Closed service under a public License Agreement naming UAB "Data troops", with MIT clients (15 of 30). The privacy policy (21 May 2026) gives retention periods by category, says Decodo is processor for scraping and doesn't log proxy traffic content, and a DPA is published. Its general two-year rule sits beside longer specific periods without saying which wins, and no retention for scraped results beyond the 24-hour async window was found (18 of 30). The migration guide says legacy APIs keep working with no end date, and the License Agreement allows discontinuing the service without notice or refunds (6 of 20). The privacy policy names Stripe, DeepL and Paddle, but no subprocessor list or data locations were found in it or the trust centre (6 of 20). 15 + 18 + 6 + 6 = 45.

Scrapingdog 56

Closed service with terms revised 13 January 2026, naming OpenData Labs Private Limited under the laws of Rajasthan, India, with no postal address. The MCP is MIT (15 of 30). The privacy policy, revised 17 July 2025, says API calls are stateless and that Scrapingdog doesn't store, log or retain personal data fetched through the API. A DPA is published. No retention periods for account data (22 of 30). No deprecation policy or dated notices found (0). No processors or data locations named (0 of 20).