Dievio vs RocketReach API

Dievio 28

Hosted reading, for the REST API with the MCP server it shares a database with. No public status page was found. None is linked from the docs or the footer, https://dievio.com/status answers 404 and status.dievio.com does not resolve (0). No readable incident history, so the floor (5). No rate limit is published for the REST API or the MCP tools. The only numbers are the export cap of 10 download starts a minute per connection and 100,000 contacts a file, the OAuth timers and input bounds such as 500 LinkedIn URLs a call, and the privacy policy mentions hashed rate-limit keys without a figure (5 of 15). No 429 or Retry-After is documented, and the REST errors are 401, 402, 500 and 502 with no retry guidance; every MCP mutation takes a request_id UUID replayed when retried with identical arguments, the workflows page says never to repeat a paid lookup with a new ID and to reconcile against the job list first, and a low balance returns fewer rows rather than failing, while a retried REST search has no idempotency key and is charged again (8 of 15). No SLA. The terms (last updated 31 October 2026) say uptime is not guaranteed and the service may change at any time (0). The REST API and the 30-tool MCP server carry no beta label, though the search response documents search_id as currently null and counting as currently false, and the server is unversioned (10). 0+5+5+8+0+10 = 28.

RocketReach API 64

Hosted lines. Status page on incident.io at status.rocketreach.co with five components, among them API and MCP (20). In the last 90 days it lists eight entries. On 20 August 2026 degraded performance ran from 12:00 AM to 10:00 AM across the site, extension, API and MCP, with a second hour that afternoon, delayed webhooks and a 29-minute outage in the evening. On 27 August elevated errors lasted 61 minutes. A 71-minute maintenance window on 27 September, in which the notice said API and MCP calls would be unresponsive or throttled, was announced on 15 September. Read as one major day and a second incident of about an hour (7 of 30). Rate limits published per plan and endpoint, plus a global 10 requests a second (15). 429 carries Retry-After and the docs show a retry example. No idempotency keys, though repeat lookups are free (12 of 15). No SLA found in the terms, the subscription agreement or the docs (0). The API and MCP server are not marked beta (10). Total 64.

Dievio 27

Closed service. The terms (last updated 31 October 2026) cover use, credits, connected agents, a 30-day refund and availability in about 300 words but name no legal entity, address, governing law or jurisdiction, so the contracting party is unknown (8 of 30). The privacy policy (31 October 2026) lists the categories processed, the purposes, recipients by category, the agent connection data, and the access periods (authorization requests 10 minutes, codes 5, access tokens an hour, refresh 30 days, export links 15 minutes), says lead search uses Dievio's own contact database without saying where records are collected from, lets people in the database ask for access, correction, deletion or suppression by email, keeps records for as long as needed with no periods, and agrees with the terms and the docs on credits, revocation and link expiry; no DPA was found (14 of 30). No deprecation policy or notices; the terms allow the service to change at any time, and plan allowances and API prices changed between the 20 May and 31 October 2026 copies of the pricing pages with no dated notice (0 of 20). Service providers are named by category only (hosting, databases, authentication, contact processing, analytics, email delivery, payments), with no names, locations or transfer basis (4 of 20). 8+14+0+4 = 26.

RocketReach API 59

Closed service with terms that name RocketReach, LLC and cover the API (15 of 30). The privacy policy, updated 30 September 2026, covers people in the database as well as customers. It names sources (public web pages, data brokers, and customers' connected email accounts by opt-in), a removal form, a DPO, EU and UK representatives, a Texas data broker notice and 2025 request counts. A DPA is public. Retention has no stated period (20 of 30). The API definitions mark deprecated fields with no dates, and no deprecation policy was found (4 of 20). The policy says data is collected and held in the US. The DPA says a sub-processor list is in a Trust Centre, which we did not find linked and did not read (6 of 20). Total 45.

Dievio 35

No x402, MPP or L402 in the docs, the pricing pages or the terms (0). Prices published without a login as dollars per 1,000 API credits ($4.50 at 5,000 down to $2.92 at 60,000), per plan ($29.99, $79.99 and $149.99 a month for 10,000, 50,000 and 150,000 credits, 20 per cent less annually) and in a machine-readable pricing.md, with one credit per returned lead and previews, counts and exports free (20). Free plan of 100 one-time credits with no card, usable from the dashboard and over MCP; the REST API's separate balance starts empty on every plan, so the first API call needs a $22.50 top-up (15 of 20). A person signs up in a browser, and the OAuth consent and API key creation both need the dashboard (0). 0+20+15+0 = 35.

RocketReach API 10

No x402, MPP or L402 in the docs or terms (0). The docs publish credit costs per action for Universal Credits, such as 2 credits for a professional email and 6 for a phone. The pricing page is drawn by script and showed our reader only its title, so no price in dollars was read, and the docs tell users without a paid plan to email for an API plan (5 of 20). The site's description says to try for free, and the rate-limit page implies an unpaid account can call the API until throttled. What a free account gets through the API was not established (5 of 20). A person signs up in a browser, the terms say account holders warrant they are human, and MCP authorisation needs a browser login (0). Total 10. The pricing lines are scored on what could be read.

Dievio 50

API reading, with the MCP server described. No OpenAPI or other machine-readable contract for the REST API; the MCP tool reference says clients discover exact input schemas through tools/list, that unknown fields and unlisted arguments are rejected, and the server publishes a dievio://schema/search-filters JSON resource, but no session was opened to read them (10 of 25). llms.txt and llms-full.txt on docs.dievio.com, generated on each build, plus llms.txt, pricing.md and product.md on dievio.com (10). The MCP reference says what each tool does, which tools are free, which scope each needs, when to prefer export_list_file over export_list and how to retry; the REST pages say what each endpoint returns and little about when to use search against lookup, and the MCP page says a preview does not unlock contacts and a count is not a guaranteed result (12 of 20). Filters are typed as strings, string arrays, booleans and integers with enumerations listed for seniority, department, employee size, business model, salary and email_status, bounds on page, limit, max_results and array length, and UUID ids; industries and locations are examples only, the funding dates are a year over REST and an ISO date over MCP, and the contact object for add_leads_to_list carries a free JSON lead_data field (10 of 15). curl examples with example responses for both REST endpoints, a pagination loop and six MCP worked prompts; errors are four status codes with one line each and no documented body, and the MCP error shape is not shown (8 of 15). No version in the path (/api/public), no changelog or release notes on either host, and plan allowances and API prices changed between the May and October 2026 copies of the pricing pages with no dated notice (0 of 15). 10+10+12+10+8+0 = 50.

RocketReach API 72

Each reference page's Markdown twin carries an OpenAPI 3.1 definition for its operation, 17 operations in all. No single downloadable file was found (22 of 25). llms.txt and Markdown twins on the docs host (10). The MCP tools page states what each tool returns, what it costs and which tool to call next. REST operation descriptions are thin, and Company Lookup carries the Company Search subtitle (14 of 20). Query parameters are typed, with enums on lookup_type and order_by. No lookup parameter is marked required although one identifier is needed, and metadata is a free object (10 of 15). Error table, a worked 402 body, an MCP error catalogue and response examples. Every operation lists the same generic error set (11 of 15). The version sits in the path (/api/v2), with the Universal Credits endpoints alongside. No changelog was found (5 of 15). Total 72.

Dievio 56

MCP uses OAuth with the authorization code flow, PKCE S256, dynamic registration of public clients, refresh tokens of 30 days, a revocation endpoint and six scopes, revoked per connection on the dashboard; REST uses a plain API key from the dashboard as a bearer or X-API-Key header, with no documented scopes, rotation, expiry or revocation, and nothing documents a secret in a query string (25 of 30). mcp:read is the required baseline and cannot spend credits, leads:search, lists:write, leads:export and team:manage are separate consents, team:manage works for the owner only, the permissions page asks agents to confirm before deleting saved data and to invite or remove people only when asked, and the terms ask users to review filters and the maximum result count before authorising a paid operation; nothing asks for confirmation inside the server and REST keys have no least-privilege mode (16 of 20). Returned records are third-party contact data, and the permissions page says to treat names, descriptions, URLs and other field values as data rather than instructions, with no further mitigation (8 of 15). get_account reports the selected account, permissions and balances, list_search_jobs lists recent jobs, the dashboard lists and revokes each connection, and the privacy policy says operation results are kept to prevent duplicate actions; no audit log or per-call record is exposed to the operator (7 of 15). No security.txt on either host (404), no disclosure policy, bug bounty, SOC 2 or ISO 27001 (0 of 20). 25+16+8+7+0 = 56.

RocketReach API 34

REST takes one key per account in the Api-Key header. Only one key is active at a time and generating a new one invalidates the old. The MCP server uses OAuth 2.1 with PKCE, open dynamic client registration, one-hour access tokens, 30-day refresh tokens that rotate, and a revocation endpoint. The access token carries the API key inside an encrypted envelope, and the account tool returns api_key in its response, so the key reaches the model's context (18 of 30). The docs say older clients may still send the key as an api_key query parameter, marked deprecated (5 off, 13). One scope, rocketreach:read, covers every tool, including lookups that spend credits and add contacts to My Contacts. No read-only mode, per-key limit or confirmation step was found. The account object has an api_key_domain field (4 of 20). Results are third-party profile data. No prompt-injection guidance was found (3 of 15). Usage and rate-limit counts from the account endpoint, a recent-errors panel in account settings, RR-Request-ID on webhooks, and MCP lookups tagged with the client name. No per-call log was found (8 of 15). security.txt is valid, with a contact address and an expiry of 8 June 2029. The DPA lists security measures in an annex and names a Trust Centre that we did not find linked. No certification or bug bounty was found (6 of 20). Total 34.

Dievio 63

API reading. REST responses are sized with _per_page (default 25), max_results, include_emails, include_phones, _include_raw to drop the raw object and email_status; the MCP server lists 30 tools with no toolsets or read-only subset, previews mask contact fields and limit runs 1 to 500 (18 of 25). Page-based pagination with has_more and next_page over REST, offset and limit with next_offset over MCP, 20 filters, max_results caps and column selection on exports (20). Errors are 401, 402, 500 and 502 as status codes with one-line meanings and no error body, and a balance below the page size returns fewer rows with success true, which an agent must detect from count; MCP job errors are read from get_search_job (8 of 20). request_id on every MCP mutation with replay semantics, asynchronous searches polled by job id, save_search_results deduplicated by list, job and position, and only queued jobs cancellable; the REST search has no idempotency key and a repeat is charged, and readOnlyHint and destructiveHint are not documented (10 of 20). Every filter is optional with defaults for page size and max_results, and the MCP tools need only filters and a request_id; no official SDK or CLI, only a third-party MIT OpenClaw skill and an n8n template on GitHub (7 of 15). 18+20+8+10+7 = 63.

RocketReach API 72

The MCP server documents nine tools. We read the docs page and did not connect, so the size of the live definitions is unread (22 of 25). start, page_size up to 100, order_by, an exclude object and about 50 search facets, with a ceiling of 10,000 results a query (18 of 20). MCP errors carry error_code in _meta with retry_after_seconds, credit_type or field and reason. On REST only the 402 from email verification is structured, and running out of lookup credits returns a 403 with a text detail (15 of 20). Repeat lookups and polling are free and terminal errors are named. No idempotency keys, and MCP tool annotations were not read (9 of 20). Few parameters are needed for a call. One official SDK, Python 2.1.8, whose last code change is dated 26 March 2025 (8 of 15). Total 72.