Dievio vs Explorium AgentSource

Dievio 27

Closed service. The terms (last updated 31 October 2026) cover use, credits, connected agents, a 30-day refund and availability in about 300 words but name no legal entity, address, governing law or jurisdiction, so the contracting party is unknown (8 of 30). The privacy policy (31 October 2026) lists the categories processed, the purposes, recipients by category, the agent connection data, and the access periods (authorization requests 10 minutes, codes 5, access tokens an hour, refresh 30 days, export links 15 minutes), says lead search uses Dievio's own contact database without saying where records are collected from, lets people in the database ask for access, correction, deletion or suppression by email, keeps records for as long as needed with no periods, and agrees with the terms and the docs on credits, revocation and link expiry; no DPA was found (14 of 30). No deprecation policy or notices; the terms allow the service to change at any time, and plan allowances and API prices changed between the 20 May and 31 October 2026 copies of the pricing pages with no dated notice (0 of 20). Service providers are named by category only (hosting, databases, authentication, contact processing, analytics, email delivery, payments), with no names, locations or transfer basis (4 of 20). 8+14+0+4 = 26.

Explorium AgentSource 60

Closed service. The Explorium Terms of Use (updated 14 June 2026) cover the Platform, API and data, and let Explorium change or end the service without notice (14 of 30). The privacy policy (updated 28 June 2026) sets out controller and processor roles, publishes 2025 request counts and links an opt-out page. Retention has no periods, and no DPA was found on the pages read (16 of 30). The v1 timeline gives about six and twelve months from 2 September 2026, marked indicative. Website traffic enrichment is slated for removal with no date (13 of 20). Processing in Israel, the United States and the EU is stated. No sub-processor list was found (6 of 20). Total 49.

Dievio 50

API reading, with the MCP server described. No OpenAPI or other machine-readable contract for the REST API; the MCP tool reference says clients discover exact input schemas through tools/list, that unknown fields and unlisted arguments are rejected, and the server publishes a dievio://schema/search-filters JSON resource, but no session was opened to read them (10 of 25). llms.txt and llms-full.txt on docs.dievio.com, generated on each build, plus llms.txt, pricing.md and product.md on dievio.com (10). The MCP reference says what each tool does, which tools are free, which scope each needs, when to prefer export_list_file over export_list and how to retry; the REST pages say what each endpoint returns and little about when to use search against lookup, and the MCP page says a preview does not unlock contacts and a count is not a guaranteed result (12 of 20). Filters are typed as strings, string arrays, booleans and integers with enumerations listed for seniority, department, employee size, business model, salary and email_status, bounds on page, limit, max_results and array length, and UUID ids; industries and locations are examples only, the funding dates are a year over REST and an ISO date over MCP, and the contact object for add_leads_to_list carries a free JSON lead_data field (10 of 15). curl examples with example responses for both REST endpoints, a pagination loop and six MCP worked prompts; errors are four status codes with one line each and no documented body, and the MCP error shape is not shown (8 of 15). No version in the path (/api/public), no changelog or release notes on either host, and plan allowances and API prices changed between the May and October 2026 copies of the pricing pages with no dated notice (0 of 15). 10+10+12+10+8+0 = 50.

Explorium AgentSource 76

Public OpenAPI 3.1 file with 74 v2 and 67 v1 operations (25). llms.txt and a Markdown twin of every docs page (10). The spec's v2 operations have summaries and no descriptions. The docs pages and the 11 MCP tool descriptions say what each call is for and what to call first (12 of 20). Typed request schemas with enums and item limits, but 225 of 1,472 schema properties carry a description, and Research takes a free-form output_schema (11 of 15). Docs pages have request and response examples. The spec documents only 422 as an error, and the error guide lists Partner ID header messages that don't match the api_key scheme (10 of 15). Versions live in the path with a migration guide and a full v2 change list. No dated changelog was found (8 of 15). Total 76.

Dievio 56

MCP uses OAuth with the authorization code flow, PKCE S256, dynamic registration of public clients, refresh tokens of 30 days, a revocation endpoint and six scopes, revoked per connection on the dashboard; REST uses a plain API key from the dashboard as a bearer or X-API-Key header, with no documented scopes, rotation, expiry or revocation, and nothing documents a secret in a query string (25 of 30). mcp:read is the required baseline and cannot spend credits, leads:search, lists:write, leads:export and team:manage are separate consents, team:manage works for the owner only, the permissions page asks agents to confirm before deleting saved data and to invite or remove people only when asked, and the terms ask users to review filters and the maximum result count before authorising a paid operation; nothing asks for confirmation inside the server and REST keys have no least-privilege mode (16 of 20). Returned records are third-party contact data, and the permissions page says to treat names, descriptions, URLs and other field values as data rather than instructions, with no further mitigation (8 of 15). get_account reports the selected account, permissions and balances, list_search_jobs lists recent jobs, the dashboard lists and revokes each connection, and the privacy policy says operation results are kept to prevent duplicate actions; no audit log or per-call record is exposed to the operator (7 of 15). No security.txt on either host (404), no disclosure policy, bug bounty, SOC 2 or ISO 27001 (0 of 20). 25+16+8+7+0 = 56.

Explorium AgentSource 37

The docs say each company gets a single API key shared by all its users, sent in a header. The site's auth.md says a key can be deleted in the console, and the key page says to ask an administrator for a reset. No scopes (12 of 30). No read-only mode or per-key limits. The API mostly reads, writes are limited to webhooks and event enrolments, and auto-refill has an optional cap (5 of 20). Research scrapes web pages and the LinkedIn post enrichments return third-party text. No prompt-injection guidance was found in the docs (2 of 15). Balance and aggregation endpoints, per-call credit reporting, correlation IDs and last-active times for users. No per-call log was found (8 of 15). The privacy policy states SOC 2, ISO 27001 and ISO 27701. No security.txt, disclosure policy or bug bounty was found, and the security FAQ PDF went unread (10 of 20). Total 37.

Dievio 28

Hosted reading, for the REST API with the MCP server it shares a database with. No public status page was found. None is linked from the docs or the footer, https://dievio.com/status answers 404 and status.dievio.com does not resolve (0). No readable incident history, so the floor (5). No rate limit is published for the REST API or the MCP tools. The only numbers are the export cap of 10 download starts a minute per connection and 100,000 contacts a file, the OAuth timers and input bounds such as 500 LinkedIn URLs a call, and the privacy policy mentions hashed rate-limit keys without a figure (5 of 15). No 429 or Retry-After is documented, and the REST errors are 401, 402, 500 and 502 with no retry guidance; every MCP mutation takes a request_id UUID replayed when retried with identical arguments, the workflows page says never to repeat a paid lookup with a new ID and to reconcile against the job list first, and a low balance returns fewer rows rather than failing, while a retried REST search has no idempotency key and is charged again (8 of 15). No SLA. The terms (last updated 31 October 2026) say uptime is not guaranteed and the service may change at any time (0). The REST API and the 30-tool MCP server carry no beta label, though the search response documents search_id as currently null and counting as currently false, and the server is unversioned (10). 0+5+5+8+0+10 = 28.

Explorium AgentSource 42

Hosted lines. No status page found. The docs tell users to subscribe to status updates and link no page, and status.explorium.ai did not answer (0). No readable incident history (5). Rate limit published, 200 queries a minute per key over a 60-second sliding window, with each batch entity counted as a query (15). 429s carry Retry-After and X-RateLimit-* headers and the docs ask for exponential backoff. No idempotency keys were found for the webhook and enrolment writes (12 of 15). No SLA is published. The migration guide implies one exists by saying v1 loses its SLA at end of support (0). v2 reached general availability on 2 September 2026, though the conventions page still says request and response schemas are being finalised (10). Total 42.

Dievio 35

No x402, MPP or L402 in the docs, the pricing pages or the terms (0). Prices published without a login as dollars per 1,000 API credits ($4.50 at 5,000 down to $2.92 at 60,000), per plan ($29.99, $79.99 and $149.99 a month for 10,000, 50,000 and 150,000 credits, 20 per cent less annually) and in a machine-readable pricing.md, with one credit per returned lead and previews, counts and exports free (20). Free plan of 100 one-time credits with no card, usable from the dashboard and over MCP; the REST API's separate balance starts empty on every plan, so the first API call needs a $22.50 top-up (15 of 20). A person signs up in a browser, and the OAuth consent and API key creation both need the dashboard (0). 0+20+15+0 = 35.

Explorium AgentSource 40

No x402, MPP or L402 (0). Credit pack prices and per-operation credit costs are public without a login (20). The pricing page and the site's own pricing.md disagree on two packs, which is recorded as a deduction and not here. Free trial of 100 credits for 90 days. No page read asks for a card at sign-up, and the auto-refill guide treats a payment method as something added later (20). The vendor's auth.md says registration needs a person and there is no client-registration endpoint (0). Total 40.