# Diffbot vs Outcrawl (slim)

> Outcrawl scores 62.4 (B) to Diffbot's 54.3 (C) for extraction. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/diffbot-vs-outcrawl.md (~6,800 tokens) · this version ~4,280 tokens · JSON https://www.anchorterminal.com/compare/diffbot-vs-outcrawl.json · canonical https://www.anchorterminal.com/compare/diffbot-vs-outcrawl
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-02
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Outcrawl scores 62.4 (B) on agent readiness against Diffbot's 54.3 (C), and leads in 3 of 7 scored categories. Diffbot leads on reliability, schema & documentation and transparency & trust. Both do extraction.

- Diffbot: C 54.3, rank #830 of 1268 · https://www.anchorterminal.com/tools/diffbot.min.md
- Outcrawl: B 62.4, rank #456 of 1268 · https://www.anchorterminal.com/tools/outcrawl.min.md
- Diffbot, good for Agents that want typed article, product or discussion data from arbitrary pages without writing selectors, and teams that also want the Knowledge Graph. Ahead on Reliability, 55 against 45; Schema & documentation, 83 against 71; Transparency & trust, 68 against 56.
- Outcrawl, good for Agents that want one key and one balance for reading pages, walking a site, searching with rendered results and handing a signed-in or multi-step task to a hosted browser agent with a hard budget, and teams on TypeScript that want a residential-exit browser over CDP with a replay of every session. Ahead on Agent ergonomics, 83 against 63; Security & auth, 66 against 21; Maintenance & community, 79 against 57.

| Category | Diffbot | Outcrawl |
| --- | --- | --- |
| Reliability (16%) | 55 | 45 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 83 | 71 |
| Agent ergonomics (13%) | 63 | 83 |
| Security & auth (14%) | 21 | 66 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 57 | 79 |
| Transparency & trust (7%) | 68 | 56 |

| Fact (where they differ) | Diffbot | Outcrawl |
| --- | --- | --- |
| Vendor | Diffbot Technologies Corp. | Aeonmind LLC (Outcrawl) |
| Hosted endpoint | `https://api.diffbot.com/v3` | `https://api.outcrawl.ai/v1` |
| Transports | HTTP | HTTP, Streamable HTTP |
| Auth | API key | OAuth or key |
| Price for extraction | $0.90 per 1,000 pages | not published |
| Licence | Proprietary service under Diffbot's Terms of Use. The Python client, the TypeScript client and the agent skills are MIT | Proprietary hosted service under Aeonmind LLC's terms of service (last updated 1 November 2026). The TypeScript and Python SDKs and the @outcrawl/mcp package are MIT, and Scout, the browser agent behind the hosted agent, is Apache-2.0 in a read-only GitHub mirror |
| Tools exposed | none | 29 |
| Last release | 2026-06-15 | 2026-10-20 |
| Terms last updated | no date given | 2026-11-01 |
| Privacy policy last updated | 2025-08-29 | 2026-11-01 |
| Terms restrict automated access | yes | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 9 npm/wk, 45 PyPI/wk | 948 stars, 53 npm/wk |

Why the edge:
- Security & auth, Outcrawl +45: Diffbot 21 (One token per account, sent in the URL query string as the documented and only scheme in the OpenAPI file. Tokens are revocable in the dashboard per a June 2025 changelog title, and child tokens exist on Plus and above (20 of 30, less 10 for the secret in the URL, so 10). Child tokens have the same rights as the primary one and there is no read-only mode. The skills limit the agent to the `db` binary through `allowed-tools` (5 of 20). The API returns untrusted web content and no guidance on prompt injection was found (0 of 15). The token details page shows usage activity and an Account API reports usage. No per-call log was found (6 of 15). No security.txt, security page, certification or bug bounty was found on the pages read, and the privacy policy says some API calls rely on HTTP without encryption (0 of 20).); Outcrawl 66 (OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, `api`; API keys shaped `ock_<keyId>.<secret>` are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above `approvalAbove` pause for a person's yes, and `control` hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries `usage`, `/v1/usage` groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.)
- Maintenance & community, Outcrawl +22: Diffbot 57 (The official Python client was tagged v3.0.0 on 28 September 2026, eleven days before the check. The API changelog's newest entry is 15 June 2026, 116 days before the check, and recency is scored on that entry (10). Tagged releases in the last 90 days are skills v1.1.0 and v1.1.1 on 12 and 13 August and Python v3.0.0 on 28 September. The API changelog has none in that window (20). A public changelog with RSS and a support address exist. GitHub issues were not read (8 of 15 for a closed service). Python and TypeScript clients are current, but the docs name the packages `diffbot-python` and `diffbot-typescript` while the repositories publish `diffbot` and `@diffbot/typescript` (12 of 15). The Python repository tests on Python 3.9 to 3.13 and raised two dependencies for security fixes on 28 September. We did not see CI results (7 of 10).); Outcrawl 79 (@outcrawl/sdk and the PyPI package outcrawl both reached 0.4.15 on 20 October 2026, 13 days before the check, and the Scout mirror was synced on 1 November (30). 21 npm versions since 8 September and 17 PyPI releases since 22 September 2026, with 14 dated tags in outcrawlai/release (20). Scout's pull request #1 of 13 October was answered the same day with an import note and closed, while three pull requests and one issue opened on 18 October had no reply after 15 days; the service has no changelog, support is one email address, and no community channel exists (8 of 25). Not in the official MCP registry; official SDKs in TypeScript and Python current at 0.4.15, with a CLI (15). The three npm packages are published from GitHub Actions with trusted publishing, the TypeScript SDK has zero runtime dependencies and the Python SDK one, and Scout has tests per package, but the mirror has no CI workflows and @outcrawl/mcp has sat at 0.4.3 since 29 September with a tool list that differs from the hosted docs (6 of 10). 30+20+8+15+6 = 79.)
- Agent ergonomics, Outcrawl +20: Diffbot 63 (Graded on the REST API, with the skills noted. `mode` limits extraction to one page type, `fields` adds optional fields and `discussion=false` drops comments, but an article response carries both `html` and `text` with no way found to drop either. The skills return Markdown by default (14 of 25). A single-URL call has no pagination. Web Search takes `size` and `maxTokens` and DQL takes `size` per the client. Crawl result paging was not read (10 of 20). Errors are JSON with `errorCode` and `error` and six docs pages. A failed extraction can arrive in a 200, and the 429 text says the site received too many requests when the cause is the caller's plan limit (12 of 20). Extract calls are GET reads and safe to retry. Whether a failed call uses a credit was not found, and there is no idempotency key for creating crawl jobs or custom APIs (12 of 20). Only `url` and `token` are required, with official Python and TypeScript clients and a CLI (15).); Outcrawl 83 (API reading. Scrape returns main content only by default with `formats` picking markdown, html, rawHtml, links, screenshots or schema JSON, search renders page bodies only on request, agent events take a `level` and an `after` cursor, the MCP server shows request bodies up to a character limit and says when it truncated, and the MCP surface is 29 tools with no toolsets (20 of 25). Cursor pagination on crawl results, agent results and downloads, `limit`, depth and path filters on crawl, status, outcome, task and age filters on sessions, and usage grouped by hour, day, month or capability (20). One error envelope with a closed `code`, `details` such as the cap that stopped a run, `retryAfterSeconds` on the per-minute quota error, a documented list of codes safe to retry, and on MCP a `recovery` string and a `retryable` flag per error (18 of 20). No idempotency key on any route, a repeated agent, crawl or monitor submit runs twice, and `concurrency_limit` carries no retry hint; cancel is idempotent, `integration_changed` (409) guards updates, and the npm MCP package sets readOnlyHint on GET tools, destructiveHint on DELETE tools and idempotentHint on either, which the hosted server was not read to confirm (10 of 20). Scrape needs a URL alone, agent runs need `caps.budget` on the API and SDKs with the MCP server defaulting it, and official SDKs exist in TypeScript and Python beside a CLI (15). 20+20+18+10+15 = 83.)
- Schema & documentation, Diffbot +12: Diffbot 83 (The Extract APIs have a public OpenAPI 3.1.0 file, version 1.1.0, with 13 operations, and the reference pages are generated from it. We read that file and one rendered page. The descriptions for Crawl, Knowledge Graph and Web Search were not read (25). llms.txt exists but is a short index with no Markdown twins of the docs pages found (5 of 10). The Analyze API page has sections on when to use it and when not to (17 of 20). Parameters are typed, `url` is the one required field and the file has 15 enums, but `fields` is a comma-separated string and the file defines no shared response schemas (10 of 15). The file carries 24 examples. It documents only 200 and 500, with separate docs pages for 401, 404, 429 and 457 (11 of 15). The path is versioned `/v3` and a dated changelog with RSS runs from 2015 to 15 June 2026 (15).); Outcrawl 71 (API reading, with the MCP server described. An OpenAPI 3.1 document at https://outcrawl.ai/docs/api-reference/openapi.json lists 62 operations over 51 paths with a summary each and the same 11 status codes, generated from the vendor's capability registry, but every request body is an untyped object marked `additionalProperties: true` with a pointer to the docs, every 200 response is an untyped object, and `Error` is the only schema; the typed shapes live in the SDK declarations and in the MCP server's zod schemas, which were read in the 0.4.3 npm package rather than from the hosted server (15 of 25). llms.txt and a 525 KB llms-full.txt on the docs, a Markdown twin of every page and an llms.txt on the site (10). The MCP descriptions each end with a `Not for:` clause naming the better tool and most with a `Cost:` clause, the OpenAPI summaries say when not to use a route, and the capability pages say which neighbour to use instead (18 of 20). Scrape formats are an enum of eight, event levels and record kinds are enums, `caps.budget` is required, and the SDK types bound every option, while the OpenAPI bodies carry none of it (10 of 15). curl, TypeScript and Python examples on every page, 20 worked programs, a 31-row error table with meanings and a retryable list, and MCP errors with a `recovery` string, though the closed union is sized 24, 31, 45 and 22 on different pages (13 of 15). `/v1` in the path and 1.0.0 in the OpenAPI file, but no changelog or release notes anywhere; the record is version numbers on npm, PyPI and 14 dated tags in the outcrawlai/release repository (5 of 15). 15+10+18+10+13+5 = 71.)
- Transparency & trust, Diffbot +12: Diffbot 68 (A closed service under undated Terms of Use that cover the Site and the Service, cap liability at $10 and grant Diffbot a perpetual licence to process submitted queries. The clients and skills are MIT (13 of 30). The privacy policy of 29 August 2025 says query history and API calls are stored against the API key and kept no longer than necessary, with no retention period given. The GDPR and data rights page was not read (14 of 30). There is no deprecation policy. The changelog carries dated notices, such as a May 2024 entry announcing a field removal for 30 August 2024, and the terms give 14 days' notice of fee changes (8 of 20). The privacy policy names its service providers one by one, among them AWS, Stripe, Intercom, Salesforce, Slack and Amplitude, and says all are in the United States (14 of 20).); Outcrawl 56 (Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.)
- Reliability, Diffbot +10: Diffbot 55 (Graded as a hosted API. status.diffbot.com is a Pingdom public report with 13 checks, among them Analyze API, Article API, Crawlbot and Websearch, with daily uptime for seven days and no incident notes (15 of 20). No 90-day record can be read. In the week to 9 October 2026 Analyze API shows 99.69 per cent, with 2, 11 and 17 minutes down on 4, 5 and 6 October, and Article API 5, 9 and 2 minutes on 5 to 7 October (5 of 30, the line for no readable history). Rate limits are published per plan, 5 calls a minute on Free, 5 a second on Startup and 25 a second on Plus (15). The 429 page says to pause one second and back off. No `Retry-After` header is documented, though the official client reads one (10 of 15). No SLA was found (0). The Extract APIs are at `/v3` with no beta label (10).); Outcrawl 45 (Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers `quota_exceeded` with `ceiling: requests_per_minute` and `retryAfterSeconds`, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and `concurrency_limit` tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.)