Diffbot vs Microlink

Diffbot 21

One token per account, sent in the URL query string as the documented and only scheme in the OpenAPI file. Tokens are revocable in the dashboard per a June 2025 changelog title, and child tokens exist on Plus and above (20 of 30, less 10 for the secret in the URL, so 10). Child tokens have the same rights as the primary one and there is no read-only mode. The skills limit the agent to the db binary through allowed-tools (5 of 20). The API returns untrusted web content and no guidance on prompt injection was found (0 of 15). The token details page shows usage activity and an Account API reports usage. No per-call log was found (6 of 15). No security.txt, security page, certification or bug bounty was found on the pages read, and the privacy policy says some API calls rely on HTTP without encryption (0 of 20). Site pages per the 9 October check, not re-read on 4 November. OSV lists no advisory for diffbot on PyPI or @diffbot/typescript on npm on 4 November. 10 + 5 + 0 + 6 + 0 = 21.

Microlink 44

One API key per account in the x-api-key header, with no scopes, rotation or expiry documented. auth.md says to keep it out of URLs and no query option is documented (20 of 30). Tools are reads apart from microlink_function, which runs caller-supplied code against the page in Microlink's browser, and the checkout tools never return a key (10 of 20). Pages come back as Markdown and text, and no prompt-injection guidance was found in the docs, auth.md or the MCP README (0). A request id on every response, with no per-call log for the customer documented (4 of 15). security.txt is valid to 28 July 2027 and links a responsible-disclosure policy and acknowledgements. No bug bounty or certification found (10 of 20). 20 + 10 + 0 + 4 + 10 = 44.

Diffbot 63

Graded on the REST API, with the skills noted. mode limits extraction to one page type, fields adds optional fields and discussion=false drops comments, but an article response carries both html and text with no way found to drop either. The skills return Markdown by default (14 of 25). A single-URL call has no pagination. Web Search takes size and maxTokens and DQL takes size per the client. Crawl result paging was not read (10 of 20). Errors are JSON with errorCode and error and six docs pages. A failed extraction can arrive in a 200, and the 429 text says the site received too many requests when the cause is the caller's plan limit (12 of 20). Extract calls are GET reads and safe to retry. Whether a failed call uses a credit was not found, and there is no idempotency key for creating crawl jobs or custom APIs (12 of 20). Only url and token are required, with official Python and TypeScript clients and a CLI (15). Docs per the 9 October check, not re-read on 4 November. The Python client 3.1.0 (29 October 2026) adds a snippet_length option that maps to the Web Search API's snippetLength. 14 + 10 + 12 + 12 + 15 = 63.

Microlink 82

24 MCP tools in @microlink/mcp 2.8.17 with no toolset filter found (15 of 25). filter selects fields, embed returns one field as the body, and Markdown and text tools return only page content (18 of 20). Error codes such as EAUTH, ERATE, ECONCURRENCY, EPRO and EPROXYNEEDED with documented fixes (19 of 20). Every tool but microlink_function sets readOnlyHint true and destructiveHint false, and calls are reads with a cache and force to refresh. No idempotentHint (18 of 20). Only url is required; official JavaScript SDK (@microlink/mql) and CLI, with examples in seven languages but no other official SDK found (12 of 15). 15 + 18 + 19 + 18 + 12 = 82.

Diffbot 77

Every dated source of the vendor's own was looked for in its GitHub repositories, since its site wasn't re-read. The official Python client, diffbot in the listing's packages, was tagged v3.1.0 on 29 October 2026, adding a Web Search snippet_length option, and the agent skills were tagged v1.2.0 the same day with rewritten skill content, 6 days before this check (30; was 10 on the API changelog's 15 June 2026 entry, which is per the 9 October check, not re-read on 4 November). In the 90 days from 6 August, the skills were tagged v1.1.0 (12 August, five new skills), v1.1.1 (13 August, a plugin marketplace manifest, counted half) and v1.2.0, and the Python client v3.0.0 (28 September) and v3.1.0, counted half as SDK tags, 3.5 in all (20). A public changelog with RSS and a support address exist. GitHub issues were not read (8 of 15 for a closed service). Python and TypeScript clients exist, but the docs named the packages diffbot-python and diffbot-typescript on 9 October while the repositories publish diffbot and @diffbot/typescript, and the TypeScript repository has no tag and no commit since 17 August 2026 (12 of 15). The Python repository tests on Python 3.9 to 3.13. We did not see CI results (7 of 10). 30 + 20 + 8 + 12 + 7 = 77.

Microlink 86

@microlink/mcp 2.8.17 and microlink.io 1.1.4 on 31 October 2026, and October changelog entries for the API (30). 31 MCP releases tagged since 17 September and the October changelog's API changes (20). No open issues on microlinkhq/microlink, a monthly changelog, and email and feedback-form support (18 of 25). Not in the official MCP registry under its own namespace, though the server card names io.microlink/mcp; the JavaScript SDK is current (8 of 15). Lint, tests and coverage run on pull requests (10). 30 + 20 + 18 + 8 + 10 = 86.

Diffbot 40

No x402, MPP or L402 was found (0 of 40). Plan prices, the credit cost of each action and overage per credit are public without a login (20). The Free plan has 10,000 credits a month and needs no card (20). A person signs up in a browser at app.diffbot.com to get a token (0). Pricing per the 9 October check, not re-read on 4 November. 0 + 20 + 20 + 0 = 40.

Microlink 47

No x402, MPP or L402 (0). Plans are public and the Pro price is stated per 1,000 requests ($1.07), but Business and Enterprise are on request (15 of 20). Free key with 25 requests a day, no card (20). The free endpoint and hosted MCP server answer 5 requests a day with no key or signup, and the MCP checkout tools let an agent start a purchase that a person completes (12 of 20). 0 + 15 + 20 + 12 = 47.

Diffbot 68

A closed service under undated Terms of Use that cover the Site and the Service, cap liability at $10 and grant Diffbot a perpetual licence to process submitted queries. The clients and skills are MIT (13 of 30). The privacy policy of 29 August 2025 says query history and API calls are stored against the API key and kept no longer than necessary, with no retention period given. The GDPR and data rights page was not read (14 of 30). There is no deprecation policy. The changelog carries dated notices, such as a May 2024 entry announcing a field removal for 30 August 2024, and the terms give 14 days' notice of fee changes (8 of 20). The privacy policy names its service providers one by one, among them AWS, Stripe, Intercom, Salesforce, Slack and Amplitude, and says all are in the United States (14 of 20). All per the 9 October check, not re-read on 4 November. 13 + 14 + 8 + 14 = 49.

Microlink 75

The API is closed under terms naming Microlink Labs, S.L. with its registry details, and the SDK, MCP server and the libraries behind it are MIT (20 of 30). The DPA, updated 30 October 2026, gives cache retention of 24 hours by default up to 31 days, logs 15 days and deletion within 15 days, but the privacy policy is undated, names no controller and gives no periods (20 of 30). The terms promise advance notice before a paid feature is materially reduced, and the changelog records changes by month, with no notice period (10 of 20). Subprocessors list updated 16 October 2026, with services, data types and locations (18 of 20). 20 + 20 + 10 + 18 = 68.

Diffbot 83

The Extract APIs have a public OpenAPI 3.1.0 file, version 1.1.0, with 13 operations, and the reference pages are generated from it. We read that file and one rendered page. The descriptions for Crawl, Knowledge Graph and Web Search were not read (25). llms.txt exists but is a short index with no Markdown twins of the docs pages found (5 of 10). The Analyze API page has sections on when to use it and when not to (17 of 20). Parameters are typed, url is the one required field and the file has 15 enums, but fields is a comma-separated string and the file defines no shared response schemas (10 of 15). The file carries 24 examples. It documents only 200 and 500, with separate docs pages for 401, 404, 429 and 457 (11 of 15). The path is versioned /v3 and a dated changelog with RSS runs from 2015 to 15 June 2026 (15). All per the 9 October check, not re-read on 4 November (terms bar automated access to the site). 25 + 5 + 17 + 10 + 11 + 15 = 83.

Microlink 89

OpenAPI 3.1 at microlink.io/openapi.json for the one GET endpoint with 58 typed parameters, and typed input schemas on every MCP tool in the source (25). llms.txt of 527 lines, auth.md, an API catalogue and Markdown copies of every docs page (10). Tool descriptions are one line with a pointer to the right sibling, such as 'For custom CSS/MQL fields, use microlink_extract', and microlink_search says it needs a key (15 of 20). Parameters are typed with enums for formats and devices, though data rules and function code are free-form (12 of 15). Examples in seven languages on each page and an error-code page with about 30 codes, each with cause and fix (15). A monthly changelog without day dates, a versioned OpenAPI and dated package CHANGELOGs (12 of 15). 25 + 10 + 15 + 12 + 15 + 12 = 89.