Firecrawl MCP vs Nexscope

Firecrawl MCP 92

27 tools in the full profile by the README's count (28 on the hosted endpoint with a key, per the contract snapshot), 3 on the keyless endpoint and 9 on the search-only endpoint, and env flags drop the feedback tools (23 of 25, the 11 to 30 band plus 8 for fixed subsets). Format selection, main-content filtering, page limits on map and crawl, and results over 20,000 estimated tokens handed off to retained storage instead of inline (20). Recovery payloads with next actions, and since 3.35.0 API refusals carry a machine-readable code, status and retryAfterSeconds in structuredContent, but schema mismatches reported in open issues (17 of 20). readOnlyHint or destructiveHint on all 28 tools of the hosted full profile, with monitor delete and interact stop marked destructive, and since 3.35.0 idempotentHint on the crawl, agent, interact and monitor tools. No idempotency keys for crawl or agent jobs (17 of 20). One required argument on most tools, and official SDKs in Python and Node (15).

Nexscope 44

Read on the MCP server, with the REST API where a line covers it. The MCP map lists 382 tools and says the category manifests 'narrow metadata for your integration; the MCP connection still advertises the full catalog'. That is more than 30 tools with no toolsets, dynamic loading or read-only subset found (5). Search tools page by page (about 20 results), with filters such as marketplace, category node, sort and device per tool, but no general pagination model or field selection, and output size depends on each tool (12 of 20). By default business errors answer HTTP 200 with an outer code. The X-Nexscope-Http-Status: semantic header maps them to HTTP statuses, the OpenAPI file names codes such as DATA_IMAGE_DOWNLOAD_FAILED and CAPABILITY_BACKEND_UNAVAILABLE in field text, and MCP errors aren't documented. SandBase earned 16 with typed bridge errors (11 of 20). Data calls only read. No idempotency keys and no readOnlyHint or destructiveHint documented. Async jobs return a taskId with a poll tool and a rule not to resubmit, and 1688 order, payment-link, receipt and cancel calls need an explicit JSON true confirmation (8 of 20). Few required parameters with defaults on most. No official SDK package, only standard-library clients in the repository for JavaScript and Python, which SoldFetch earned 8 for (8 of 15). 5+12+11+8+8 = 44.

Firecrawl MCP 78

Better Stack status page at status.firecrawl.dev with history (20). Four incidents in the 90 days to 1 November 2026, all partial degradations of api.firecrawl.dev, the longest 56 minutes on the /interact prompt field on 27 August (06:00 to 06:56 UTC in the feed) and the others 7, 16 and 46 minutes, with none after 15 September. The 20 July /interact incident has left the window (20). Rate limits published per plan and endpoint, from 10 scrapes a minute on Free to 10,000 on Scale, plus concurrent browsers and a per-IP daily cap for keyless use, re-read on 1 November (15). The Errors reference, linked from the rate-limit page, says 429s carry Retry-After when available, marks every error retryable or not, and gives backoff advice per code. No idempotency keys for calls that start crawl, agent or monitor jobs (13 of 15). SLA on Enterprise only, per the pricing page, with no terms published (0). GA (10). 20 + 20 + 15 + 13 + 0 + 10 = 78.

Nexscope 39

Hosted lines, graded on the remote MCP server and the REST API at api.nexscope.ai. No status page is linked from the home page, llms.txt, the API quickstart or the MCP map, and none was found (0). With no page there is no incident history to read (5). The pricing page publishes requests a second and concurrency per plan, the same for API and MCP, with 1 and 1 on the trial, 3 and 2 on Starter, 5 and 4 on Growth, 10 and 8 on Pro (15). The quickstart calls 429 an 'execution admission rate limit' and says to honour Retry-After on 429 and 503 when present. No idempotency key exists. The repository says 'Do not blindly retry POST requests' and to check whether a task was created before resubmitting, and the MCP tool pages say a reconnecting client should query existing async work rather than resubmit. SoldFetch earned 15 with idempotency keys and SandBase 11 with keys on some writes, so guidance without keys earns 9 (9 of 15). No SLA, and the terms say 'We cannot guarantee the Service will be available at all times' (0). No beta or preview label on the API or the MCP server (10). 0+5+15+9+0+10 = 39.

Firecrawl MCP 75

MIT (30). Zero data retention on Enterprise and a DPA from Standard up, but the privacy policy, re-read on 1 November, still dates from 26 December 2024, keeps personal data until you ask for deletion and gives no retention period for scraped content (12 of 30). The v1 endpoints are kept as legacy alongside v2 and the pricing change of 4 September 2026 was dated, but we found no deprecation policy (8 of 20). Data stored in the United States, and Stripe, PostHog, Crisp and Vercel Analytics are named, with no full subprocessor list (10 of 20).

Nexscope 41

The editorial half. The service is closed. The terms (8 October 2026) name ECOCREATE TECHNOLOGY PTE. LTD. under Singapore law with no registration number or address. The repository's MIT licence covers client code only, and the documentation and definitions stay copyright Nexscope. Scrapewise earned 15 for closed terms with MIT side code (15 of 30). The privacy policy (8 October 2026) says uploads are not used to train AI models and that connected selling-partner data is deleted or de-identified when no longer needed, but 'this policy does not specify a single deletion deadline for all data', and no DPA was found. SandBase took 12 with no retention periods (10 of 30). No deprecation policy or dated notices. The terms promise notice of material changes before they take effect where practicable, and the MCP map keeps a legacy v1 beside v2 (3 of 20). Analytics and advertising vendors are named (Google Analytics, Microsoft Clarity, Ahrefs, Google Ads, X, FirstPromoter), but hosting, AI processing and payment providers only by type, with no data locations. The repository's source notes say supplier references 'are presented as Nexscope', so the data suppliers go unnamed except LinkFox Agent for 1688 authorisation (5 of 20). 15+10+3+5 = 33. The provenance half is computed from the provenance block.

Firecrawl MCP 70

OAuth on the hosted endpoint /v2/mcp-oauth, a separate OAuth identity for the search-only endpoint, and plain revocable keys as Authorization: Bearer. Keys locked to endpoints and formats, and IP allowlists, are Enterprise only (25 of 30). The README says never to put a key in the server URL. 3.29.1 removed the credential-in-path route from the repository's service image, and it was never documented as an option, so no deduction. 3.36.0 checks Host and Origin in local HTTP mode against DNS rebinding. Keyless and search-only surfaces limit what a session can do, write tools carry destructiveHint, and Alexandria provider terms need explicit user consent and confirmed: true (18 of 20). Retained Alexandria results tell the model that source content is data, not instructions, and Enterprise Threat Protection blocks risky URLs, off by default. The API's opt-in checkPromptInjection classifier is now a top-level scrape option for any format, markdown included, and for crawl, search and monitors (+4 credits, 403 SCRAPE_PROMPT_INJECTION_DETECTED). The MCP tool schemas still don't expose it, so an agent using this server can't turn it on (8 of 15). firecrawl_credit_usage shows spend, by endpoint and by day since 3.34.0, but its description says it can't attribute single jobs, URLs or MCP clients, and we found no per-call log for operators (5 of 15). SOC 2 Type II on the Enterprise page, and security.txt valid to 10 June 2027 with a Bugcrowd vulnerability disclosure programme, re-read on 1 November. CVE-2026-116066 (High in GitHub's unreviewed database, published 25 October), a DNS-rebinding SSRF in the Firecrawl API's Playwright service before 2.11.586, was fixed in a public commit on 21 October that cites issue #5256. No bug bounty found (14 of 20).

Nexscope 41

The MCP server takes OAuth 2.1 with PKCE and one scope, mcp:tools, per the tool pages, or a Bearer nk- API key. Keys are created by a person under API Access, shown once, and can be expired, disabled or deleted, with no scopes or rotation found. The OAuth metadata on api.nexscope.ai wasn't read. No query-string key option was found. Manifold earned 22 with OAuth and hashed keys whose storage it documents (20 of 30). Most tools read. Writes exist (1688 procurement on the user's own buyer account, Amazon Ads entity operations through an owned connection, paid generation jobs), and the 1688 calls need an explicit JSON true per action after a preview, with the guide saying to get the user's approval first. Credits cap spend. No read-only key or tool allowlist (12 of 20). Tools return third-party listings, reviews, social posts and web pages, and no prompt-injection guidance was found. Manifold, the closest marketing-data MCP, took 0 (0). The Account credits and Account usage APIs, costToken in data responses and credits charged on task results give per-call visibility. No key-level audit was found (9 of 15). security.txt answered a client error. No disclosure policy, bug bounty or certification found (0 of 20). 20+12+0+9+0 = 41.

Firecrawl MCP 91

Public OpenAPI at docs.firecrawl.dev/api-reference/v2-openapi.json (and v1), and zod schemas on every MCP tool (25). llms.txt and Markdown docs (10). The README and server instructions say when not to use a tool, for example to look elsewhere when a browser session must be driven step by step across many calls, and 3.33.4 added when-to-use sentences to the search and scrape descriptions (18 of 20). Typed inputs with enums, but open issue #325 counts 132 parameters with no description and #373 reports a published schema that disagrees with the API, per the 1 October check, not re-read on 1 November. 3.35.0 briefly advertised record-typed inputs as closed empty objects, fixed in 3.36.0 the next day (11 of 15). Examples throughout, keyless failures return structured recovery payloads with next_actions and signup_url, and an Errors reference lists each HTTP status and error string with cause, remedy and whether to retry (15 of 15). A CHANGELOG and firecrawl.dev/changelog. The CHANGELOG now has dated entries for 3.29.0 to 3.36.0, but still skips 3.22 to 3.24 and 3.26 to 3.28 and lists 3.25.0 as unreleased (12 of 15).

Nexscope 64

A public OpenAPI 3.1 file at api.nexscope.ai/openapi.json, about 3.8 MB, linked from the quickstart. Visible request bodies are typed with required fields, patterns, enums and additionalProperties: false, but responses are open data objects and the components section, with the security scheme and the shared error response, wasn't reached. In the repository 166 of 252 request definitions are field descriptors rather than JSON Schema. The hosted tools/list wasn't read. SoldFetch took 17 with untyped responses and SandBase 22 with components unread (19 of 25). llms.txt on www.nexscope.ai and Markdown references for every API in the repository (10). MCP tool descriptions are one line ('Find Amazon products by keyword and marketplace. Results come back as structured JSON.'), with no when-not-to-use. The repository's references carry long trigger text ('trigger this skill whenever their need involves real-time Amazon search results'), not guidance on when to pick another tool (10 of 20). Tool pages list types, defaults, enums and length limits, but the Amazon Search page marks no argument required and omits the keyword its own examples pass, and many limits sit in prose (8 of 15). Every API has a request sample, a response fixture and cURL, JavaScript and Python clients, though most fixtures are labelled historical. Errors are an HTTP table, two named codes (11209, 12001) and a semantic error response whose schema wasn't read. MCP errors aren't documented (10 of 15). Path versioning under /v1, MCP v2 beside a legacy v1, and a dated OpenAPI version label, but no public changelog. SandBase earned 7 on the same pattern (7 of 15). 19+10+10+8+10+7 = 64.

Firecrawl MCP 87

firecrawl-mcp 3.36.0 on 27 October 2026, matching the registry (30). 43 version bumps in the 90 days from 3 August to 1 November, 12 of them since 17 October (20). Reported bugs from July and August (#325, #357, #373) show no fix in the repository's commits to 29 October. Issue states and reply times couldn't be read on 1 November (12 of 25, per the 1 October check). io.github.firecrawl/firecrawl-mcp-server at 3.36.0 in the official registry under a GitHub-verified namespace, published 27 October and marked latest (15). CI builds and tests on push and pull request to main, with npm trusted publishing and, since 23 October, a signed container image (10). 30 + 20 + 12 + 15 + 10 = 87.

Nexscope 65

Read as a closed service with a public documentation repository. The repository synced the released 1688 procurement contracts on 9 November 2026 and committed again on 10 November (30). No releases or changelog. The dated record is the registry's four versions on 14 and 16 October, repository commits on 8, 9, 20 and 29 October and 2, 9 and 10 November, and source notes dating WooCommerce (29 October) and design search (2 November) additions. SoldFetch earned 10 for dated commits without releases (10 of 20). No public changelog. Support is service@nexscope.ai, WhatsApp and a booked call, untested. The repository's one merged pull request came from the organisation itself, and GitHub's API refused us, so issues weren't read (5 of 15). The official MCP registry lists io.github.nexscope/ecommerce, active, latest 1.0.3 of 16 October 2026, read first-hand (15). A CI workflow runs offline catalogue validation and unit tests on standard-library clients with no dependencies. The run results weren't read (5 of 10). 30+10+5+15+5 = 65.