Diffbot vs Nexscope

Diffbot 68

A closed service under undated Terms of Use that cover the Site and the Service, cap liability at $10 and grant Diffbot a perpetual licence to process submitted queries. The clients and skills are MIT (13 of 30). The privacy policy of 29 August 2025 says query history and API calls are stored against the API key and kept no longer than necessary, with no retention period given. The GDPR and data rights page was not read (14 of 30). There is no deprecation policy. The changelog carries dated notices, such as a May 2024 entry announcing a field removal for 30 August 2024, and the terms give 14 days' notice of fee changes (8 of 20). The privacy policy names its service providers one by one, among them AWS, Stripe, Intercom, Salesforce, Slack and Amplitude, and says all are in the United States (14 of 20). All per the 9 October check, not re-read on 4 November. 13 + 14 + 8 + 14 = 49.

Nexscope 41

The editorial half. The service is closed. The terms (8 October 2026) name ECOCREATE TECHNOLOGY PTE. LTD. under Singapore law with no registration number or address. The repository's MIT licence covers client code only, and the documentation and definitions stay copyright Nexscope. Scrapewise earned 15 for closed terms with MIT side code (15 of 30). The privacy policy (8 October 2026) says uploads are not used to train AI models and that connected selling-partner data is deleted or de-identified when no longer needed, but 'this policy does not specify a single deletion deadline for all data', and no DPA was found. SandBase took 12 with no retention periods (10 of 30). No deprecation policy or dated notices. The terms promise notice of material changes before they take effect where practicable, and the MCP map keeps a legacy v1 beside v2 (3 of 20). Analytics and advertising vendors are named (Google Analytics, Microsoft Clarity, Ahrefs, Google Ads, X, FirstPromoter), but hosting, AI processing and payment providers only by type, with no data locations. The repository's source notes say supplier references 'are presented as Nexscope', so the data suppliers go unnamed except LinkFox Agent for 1688 authorisation (5 of 20). 15+10+3+5 = 33. The provenance half is computed from the provenance block.

Diffbot 21

One token per account, sent in the URL query string as the documented and only scheme in the OpenAPI file. Tokens are revocable in the dashboard per a June 2025 changelog title, and child tokens exist on Plus and above (20 of 30, less 10 for the secret in the URL, so 10). Child tokens have the same rights as the primary one and there is no read-only mode. The skills limit the agent to the db binary through allowed-tools (5 of 20). The API returns untrusted web content and no guidance on prompt injection was found (0 of 15). The token details page shows usage activity and an Account API reports usage. No per-call log was found (6 of 15). No security.txt, security page, certification or bug bounty was found on the pages read, and the privacy policy says some API calls rely on HTTP without encryption (0 of 20). Site pages per the 9 October check, not re-read on 4 November. OSV lists no advisory for diffbot on PyPI or @diffbot/typescript on npm on 4 November. 10 + 5 + 0 + 6 + 0 = 21.

Nexscope 41

The MCP server takes OAuth 2.1 with PKCE and one scope, mcp:tools, per the tool pages, or a Bearer nk- API key. Keys are created by a person under API Access, shown once, and can be expired, disabled or deleted, with no scopes or rotation found. The OAuth metadata on api.nexscope.ai wasn't read. No query-string key option was found. Manifold earned 22 with OAuth and hashed keys whose storage it documents (20 of 30). Most tools read. Writes exist (1688 procurement on the user's own buyer account, Amazon Ads entity operations through an owned connection, paid generation jobs), and the 1688 calls need an explicit JSON true per action after a preview, with the guide saying to get the user's approval first. Credits cap spend. No read-only key or tool allowlist (12 of 20). Tools return third-party listings, reviews, social posts and web pages, and no prompt-injection guidance was found. Manifold, the closest marketing-data MCP, took 0 (0). The Account credits and Account usage APIs, costToken in data responses and credits charged on task results give per-call visibility. No key-level audit was found (9 of 15). security.txt answered a client error. No disclosure policy, bug bounty or certification found (0 of 20). 20+12+0+9+0 = 41.

Diffbot 83

The Extract APIs have a public OpenAPI 3.1.0 file, version 1.1.0, with 13 operations, and the reference pages are generated from it. We read that file and one rendered page. The descriptions for Crawl, Knowledge Graph and Web Search were not read (25). llms.txt exists but is a short index with no Markdown twins of the docs pages found (5 of 10). The Analyze API page has sections on when to use it and when not to (17 of 20). Parameters are typed, url is the one required field and the file has 15 enums, but fields is a comma-separated string and the file defines no shared response schemas (10 of 15). The file carries 24 examples. It documents only 200 and 500, with separate docs pages for 401, 404, 429 and 457 (11 of 15). The path is versioned /v3 and a dated changelog with RSS runs from 2015 to 15 June 2026 (15). All per the 9 October check, not re-read on 4 November (terms bar automated access to the site). 25 + 5 + 17 + 10 + 11 + 15 = 83.

Nexscope 64

A public OpenAPI 3.1 file at api.nexscope.ai/openapi.json, about 3.8 MB, linked from the quickstart. Visible request bodies are typed with required fields, patterns, enums and additionalProperties: false, but responses are open data objects and the components section, with the security scheme and the shared error response, wasn't reached. In the repository 166 of 252 request definitions are field descriptors rather than JSON Schema. The hosted tools/list wasn't read. SoldFetch took 17 with untyped responses and SandBase 22 with components unread (19 of 25). llms.txt on www.nexscope.ai and Markdown references for every API in the repository (10). MCP tool descriptions are one line ('Find Amazon products by keyword and marketplace. Results come back as structured JSON.'), with no when-not-to-use. The repository's references carry long trigger text ('trigger this skill whenever their need involves real-time Amazon search results'), not guidance on when to pick another tool (10 of 20). Tool pages list types, defaults, enums and length limits, but the Amazon Search page marks no argument required and omits the keyword its own examples pass, and many limits sit in prose (8 of 15). Every API has a request sample, a response fixture and cURL, JavaScript and Python clients, though most fixtures are labelled historical. Errors are an HTTP table, two named codes (11209, 12001) and a semantic error response whose schema wasn't read. MCP errors aren't documented (10 of 15). Path versioning under /v1, MCP v2 beside a legacy v1, and a dated OpenAPI version label, but no public changelog. SandBase earned 7 on the same pattern (7 of 15). 19+10+10+8+10+7 = 64.

Diffbot 63

Graded on the REST API, with the skills noted. mode limits extraction to one page type, fields adds optional fields and discussion=false drops comments, but an article response carries both html and text with no way found to drop either. The skills return Markdown by default (14 of 25). A single-URL call has no pagination. Web Search takes size and maxTokens and DQL takes size per the client. Crawl result paging was not read (10 of 20). Errors are JSON with errorCode and error and six docs pages. A failed extraction can arrive in a 200, and the 429 text says the site received too many requests when the cause is the caller's plan limit (12 of 20). Extract calls are GET reads and safe to retry. Whether a failed call uses a credit was not found, and there is no idempotency key for creating crawl jobs or custom APIs (12 of 20). Only url and token are required, with official Python and TypeScript clients and a CLI (15). Docs per the 9 October check, not re-read on 4 November. The Python client 3.1.0 (29 October 2026) adds a snippet_length option that maps to the Web Search API's snippetLength. 14 + 10 + 12 + 12 + 15 = 63.

Nexscope 44

Read on the MCP server, with the REST API where a line covers it. The MCP map lists 382 tools and says the category manifests 'narrow metadata for your integration; the MCP connection still advertises the full catalog'. That is more than 30 tools with no toolsets, dynamic loading or read-only subset found (5). Search tools page by page (about 20 results), with filters such as marketplace, category node, sort and device per tool, but no general pagination model or field selection, and output size depends on each tool (12 of 20). By default business errors answer HTTP 200 with an outer code. The X-Nexscope-Http-Status: semantic header maps them to HTTP statuses, the OpenAPI file names codes such as DATA_IMAGE_DOWNLOAD_FAILED and CAPABILITY_BACKEND_UNAVAILABLE in field text, and MCP errors aren't documented. SandBase earned 16 with typed bridge errors (11 of 20). Data calls only read. No idempotency keys and no readOnlyHint or destructiveHint documented. Async jobs return a taskId with a poll tool and a rule not to resubmit, and 1688 order, payment-link, receipt and cancel calls need an explicit JSON true confirmation (8 of 20). Few required parameters with defaults on most. No official SDK package, only standard-library clients in the repository for JavaScript and Python, which SoldFetch earned 8 for (8 of 15). 5+12+11+8+8 = 44.

Diffbot 55

Graded as a hosted API. status.diffbot.com is a Pingdom public report with 13 checks, among them Analyze API, Article API, Crawlbot and Websearch, with daily uptime for seven days and no incident notes (15 of 20). No 90-day record can be read. In the week to 9 October 2026 Analyze API shows 99.69 per cent, with 2, 11 and 17 minutes down on 4, 5 and 6 October, and Article API 5, 9 and 2 minutes on 5 to 7 October (5 of 30, the line for no readable history). Rate limits are published per plan, 5 calls a minute on Free, 5 a second on Startup and 25 a second on Plus (15). The 429 page says to pause one second and back off. No Retry-After header is documented, though the official client reads one (10 of 15). No SLA was found (0). The Extract APIs are at /v3 with no beta label (10). All per the 9 October check, not re-read on 4 November: Diffbot's terms bar software that scrapes or crawls the Site or Service, so its site and status report weren't fetched. 15 + 5 + 15 + 10 + 0 + 10 = 55.

Nexscope 39

Hosted lines, graded on the remote MCP server and the REST API at api.nexscope.ai. No status page is linked from the home page, llms.txt, the API quickstart or the MCP map, and none was found (0). With no page there is no incident history to read (5). The pricing page publishes requests a second and concurrency per plan, the same for API and MCP, with 1 and 1 on the trial, 3 and 2 on Starter, 5 and 4 on Growth, 10 and 8 on Pro (15). The quickstart calls 429 an 'execution admission rate limit' and says to honour Retry-After on 429 and 503 when present. No idempotency key exists. The repository says 'Do not blindly retry POST requests' and to check whether a task was created before resubmitting, and the MCP tool pages say a reconnecting client should query existing async work rather than resubmit. SoldFetch earned 15 with idempotency keys and SandBase 11 with keys on some writes, so guidance without keys earns 9 (9 of 15). No SLA, and the terms say 'We cannot guarantee the Service will be available at all times' (0). No beta or preview label on the API or the MCP server (10). 0+5+15+9+0+10 = 39.

Diffbot 77

Every dated source of the vendor's own was looked for in its GitHub repositories, since its site wasn't re-read. The official Python client, diffbot in the listing's packages, was tagged v3.1.0 on 29 October 2026, adding a Web Search snippet_length option, and the agent skills were tagged v1.2.0 the same day with rewritten skill content, 6 days before this check (30; was 10 on the API changelog's 15 June 2026 entry, which is per the 9 October check, not re-read on 4 November). In the 90 days from 6 August, the skills were tagged v1.1.0 (12 August, five new skills), v1.1.1 (13 August, a plugin marketplace manifest, counted half) and v1.2.0, and the Python client v3.0.0 (28 September) and v3.1.0, counted half as SDK tags, 3.5 in all (20). A public changelog with RSS and a support address exist. GitHub issues were not read (8 of 15 for a closed service). Python and TypeScript clients exist, but the docs named the packages diffbot-python and diffbot-typescript on 9 October while the repositories publish diffbot and @diffbot/typescript, and the TypeScript repository has no tag and no commit since 17 August 2026 (12 of 15). The Python repository tests on Python 3.9 to 3.13. We did not see CI results (7 of 10). 30 + 20 + 8 + 12 + 7 = 77.

Nexscope 65

Read as a closed service with a public documentation repository. The repository synced the released 1688 procurement contracts on 9 November 2026 and committed again on 10 November (30). No releases or changelog. The dated record is the registry's four versions on 14 and 16 October, repository commits on 8, 9, 20 and 29 October and 2, 9 and 10 November, and source notes dating WooCommerce (29 October) and design search (2 November) additions. SoldFetch earned 10 for dated commits without releases (10 of 20). No public changelog. Support is service@nexscope.ai, WhatsApp and a booked call, untested. The repository's one merged pull request came from the organisation itself, and GitHub's API refused us, so issues weren't read (5 of 15). The official MCP registry lists io.github.nexscope/ecommerce, active, latest 1.0.3 of 16 October 2026, read first-hand (15). A CI workflow runs offline catalogue validation and unit tests on standard-library clients with no dependencies. The run results weren't read (5 of 10). 30+10+5+15+5 = 65.