Diffbot vs SoldFetch

Diffbot 21

One token per account, sent in the URL query string as the documented and only scheme in the OpenAPI file. Tokens are revocable in the dashboard per a June 2025 changelog title, and child tokens exist on Plus and above (20 of 30, less 10 for the secret in the URL, so 10). Child tokens have the same rights as the primary one and there is no read-only mode. The skills limit the agent to the db binary through allowed-tools (5 of 20). The API returns untrusted web content and no guidance on prompt injection was found (0 of 15). The token details page shows usage activity and an Account API reports usage. No per-call log was found (6 of 15). No security.txt, security page, certification or bug bounty was found on the pages read, and the privacy policy says some API calls rely on HTTP without encryption (0 of 20).

SoldFetch 62

Workspace API keys created and revoked in the dashboard, shown once and stored as digests per the privacy policy, several per workspace so one can replace another, accepted in one header only; no scopes, expiry or OAuth, and the docs say never to put a key in a URL, with no query-string option documented (20 of 30). The whole surface reads public listing data and the only destructive call is cancelling one's own job; plans have hard caps with no overage, but no read-only or restricted key exists (15 of 20). Every response carries third-party listing text. The AI agents guide, the MCP README, SECURITY.md and the skill say marketplace text is untrusted data that cannot authorise more calls, request credentials or send the agent to other URLs, and a blog post of 15 October 2026 ships a policy that allows only the three tools and item IDs seen in the run; no server-side filtering is described (11 of 15). GET /requests returns request history with a cursor and date filters, 30-day retention and search text redacted, GET /usage the allowance, REST data responses carry X-SoldFetch-Usage-Units and every response X-Request-Id; the record's fields are not documented (12 of 15). No security.txt (client error), bug bounty, SOC 2 or ISO 27001; the repositories' SECURITY.md files give a reporting route to contact@soldfetch.com (4 of 20). 20+15+11+12+4 = 62.

Diffbot 68

A closed service under undated Terms of Use that cover the Site and the Service, cap liability at $10 and grant Diffbot a perpetual licence to process submitted queries. The clients and skills are MIT (13 of 30). The privacy policy of 29 August 2025 says query history and API calls are stored against the API key and kept no longer than necessary, with no retention period given. The GDPR and data rights page was not read (14 of 30). There is no deprecation policy. The changelog carries dated notices, such as a May 2024 entry announcing a field removal for 30 August 2024, and the terms give 14 days' notice of fee changes (8 of 20). The privacy policy names its service providers one by one, among them AWS, Stripe, Intercom, Salesforce, Slack and Amplitude, and says all are in the United States (14 of 20).

SoldFetch 41

Closed hosted service. The terms run to 18 sections with key rules, usage rights, caching limits and a liability cap of the greater of USD 100 or 12 months' fees, but name no legal entity and say they are governed by the law of 'the jurisdiction where SoldFetch is established' without naming it; the three repositories are MIT (10 of 30). The privacy policy (updated 22 October 2026) gives request-log retention of 7, 30 or 90 days by plan, about an hour for exports, digests for keys and cookie durations, and the docs give cache periods and 24 hours for job results; the pricing page's 30-day request logs on every plan disagrees with the policy's plan-based periods, backups have no period and no DPA was found (20 of 30). No deprecation policy or dated notices; terms 11.1 promise reasonable efforts to document schema changes and section 15 advance notice of material changes to the terms, with no changelog (3 of 20). Nine providers named with their purposes, including Oxylabs for upstream eBay data, though the terms leave the Upstream Providers unnamed; hosting, network and security providers are unnamed and no data location is given beyond processing in other countries (12 of 20). 10+20+3+12 = 45.

Diffbot 83

The Extract APIs have a public OpenAPI 3.1.0 file, version 1.1.0, with 13 operations, and the reference pages are generated from it. We read that file and one rendered page. The descriptions for Crawl, Knowledge Graph and Web Search were not read (25). llms.txt exists but is a short index with no Markdown twins of the docs pages found (5 of 10). The Analyze API page has sections on when to use it and when not to (17 of 20). Parameters are typed, url is the one required field and the file has 15 enums, but fields is a comma-separated string and the file defines no shared response schemas (10 of 15). The file carries 24 examples. It documents only 200 and 500, with separate docs pages for 401, 404, 429 and 457 (11 of 15). The path is versioned /v3 and a dated changelog with RSS runs from 2015 to 15 June 2026 (15).

SoldFetch 68

API reading, with the MCP server described. An OpenAPI 3.1 file is published at https://soldfetch.com/api/v1/openapi.json, under a path robots.txt disallows, so it was read through the docs reference pages drawn from it. Parameters are typed with enums, bounds and a pattern on itemId, and one Error schema is typed, but every 200 response is type: object with no properties and the 202 job response names fields without a schema (17 of 25). llms.txt on the site and the docs, llms-full.txt, and Markdown twins of the docs pages (10). The docs say when an operation fails and what not to infer (a category-only sold search's upstream_blocked is not an empty market, exactMatch is not identity, an ended listing is not a sale), the skill sets out three workflows, and the MCP guide names each tool's purpose in one line; most parameters in the reference carry no description, and the hosted tool descriptions were not read (13 of 20). ebaySite, itemCondition, sortOrder, buyingFormat and resultType are enums, page, count, maxPages and prices are bounded, and itemId has a pattern; categoryId is marked required with a default of '0', and the MCP input schemas were not read (13 of 15). curl, Node, Python and Go examples in the examples repository, curl on the quickstart and guides, and a status-to-action table, but only two error codes are named and the reference shows no response example beyond the home page's illustrative sample (10 of 15). Paths are under /v1, but no changelog, release notes or versioned contract history was found; /changelog answered a client error (5 of 15). 17+10+13+13+10+5 = 68.

Diffbot 63

Graded on the REST API, with the skills noted. mode limits extraction to one page type, fields adds optional fields and discussion=false drops comments, but an article response carries both html and text with no way found to drop either. The skills return Markdown by default (14 of 25). A single-URL call has no pagination. Web Search takes size and maxTokens and DQL takes size per the client. Crawl result paging was not read (10 of 20). Errors are JSON with errorCode and error and six docs pages. A failed extraction can arrive in a 200, and the 429 text says the site received too many requests when the cause is the caller's plan limit (12 of 20). Extract calls are GET reads and safe to retry. Whether a failed call uses a credit was not found, and there is no idempotency key for creating crawl jobs or custom APIs (12 of 20). Only url and token are required, with official Python and TypeScript clients and a CLI (15).

SoldFetch 75

API reading. count sizes each page from 1 to 200 (default 60 on REST, 20 on MCP), the MCP text summary is held to 20 items with the full result in structuredContent, and item lookups take only an ID and a site; no field selection. On the MCP reading three tools would score 25 (20 of 25). Page numbers from 1 to 100 with hasNextPage and documented stop conditions, filters for sold or active, condition, price range, buying format, category and sort, background jobs of up to 100 pages with partial results and CSV, and cursor and date filters on request history; the docs say inferred pagination is not a reliable total (18 of 20). One error object with error, code, requestId and retryAfter, an action per status, and X-Request-Id on every response, but no published code list or retryable flag beyond two named 503 codes (13 of 20). Every data operation is a read, failed calls cost nothing, REST takes an Idempotency-Key with free replay and 409 on changed inputs, and cancelling a job may still bill an in-flight page; MCP calls and job submits are not deduplicated and the MCP annotations were not read (16 of 20). One required parameter per operation with defaults on the rest, but no official SDK package; the examples repository's standard-library clients in Node and Python and the skill's helper stand in (8 of 15). 20+18+13+16+8 = 75.

Diffbot 57

The official Python client was tagged v3.0.0 on 28 September 2026, eleven days before the check. The API changelog's newest entry is 15 June 2026, 116 days before the check, and recency is scored on that entry (10). Tagged releases in the last 90 days are skills v1.1.0 and v1.1.1 on 12 and 13 August and Python v3.0.0 on 28 September. The API changelog has none in that window (20). A public changelog with RSS and a support address exist. GitHub issues were not read (8 of 15 for a closed service). Python and TypeScript clients are current, but the docs name the packages diffbot-python and diffbot-typescript while the repositories publish diffbot and @diffbot/typescript (12 of 15). The Python repository tests on Python 3.9 to 3.13 and raised two dependencies for security fixes on 28 September. We did not see CI results (7 of 10).

SoldFetch 49

Closed service. The latest dated changes are commits to all three public repositories and four blog posts on 27 October 2026, and the docs sitemap dates the authentication page 30 October 2026 (30). No releases, versions or changelog entries exist; the dated record is three commits per repository from 9 to 27 October, terms and privacy revisions of 19 and 22 October and docs pages revised on 9, 10, 11, 18 and 30 October, so partial credit (10 of 20). No public changelog; support is a contact form and contact@soldfetch.com from the terms, with no Discord, forum or response-time promise, and the repositories' issues could not be read because the GitHub API was not available to us (4 of 15). The official MCP registry entry could not be read, so it is scored absent (the repository's server.json names io.github.ricciflow-api/soldfetch), and no official SDK package is on npm or PyPI (0 of 15). Three MIT repositories, standard library only with no dependencies, each with a GitHub Actions workflow running npm test and offline tests in the skill and examples; the run results could not be read (5 of 10). 30+10+4+0+5 = 49.