Grep AI vs NewsCatcher

Grep AI 64

OAuth through Descope with five scopes, and API keys that can be created with a subset of scopes, listed and revoked through the API (30). Read scopes, validate_only and dry_run on agent changes, a per-run max_cost_usd and versioned restores. No confirmation step for deletes or for making a run public (14). Reports are built from untrusted web pages. The docs describe an SSRF-guarded fetch for context files, and no prompt-injection guidance for callers was found (3). Each run has a timeline of execution events, and billing transactions and usage are readable through the API (12). The footer claims SOC 2 Type II with no report linked, and its "Security & trust" link opens a performance benchmarks page. security.txt returns 404, and no disclosure policy or bug bounty was found, so this is a bare SOC 2 claim, which this run reads as 5 (5). Webhooks are signed with the API key itself.

NewsCatcher 45

API keys in the x-api-key header, several per account, revocable in the platform, with advice to keep one per application. A 403 for 'a key that may not use this API' suggests per-key API access, but no scopes are documented (20). The MCP server documents ?apiKey= on the server URL for Claude.ai custom connectors, with a warning, so less 10 (10 of 30). The MCP repository's SECURITY.md says URL keys are rejected unless the operator enables them, which the hosted server does per the docs. Toolsets let an operator load only the read-only news tools, write tools carry destructiveHint, and the server tells the assistant to confirm large or hourly agent jobs (14 of 20). Results are third-party article text and summaries, and no prompt-injection guidance was found in the docs or the MCP server's instructions (0 of 15). Every response carries a Correlation-ID, GET /subscription shows usage and balance, and runs are listed in the platform. No per-call audit log for the customer was found (7 of 15). The security page and footer claim SOC 2 Type II and link a trust centre on Oneleet, which wasn't read. A vulnerability disclosure policy covers the MCP server. No security.txt (404) and no bug bounty found (14 of 20). 10 + 14 + 0 + 7 + 14 = 45.

Grep AI 61

Closed service with published terms, written as an order-form contract that still points to grep.parcha.ai. The SDK packages state no licence, and the skills package is MIT (12). Section 12 of the terms says AI providers retain nothing and customer data isn't used for training. Section 4.2 grants a perpetual licence to use customer data to improve the platform, and the privacy policy gives retention only as "as long as needed". No DPA found (12). v1 is marked deprecated, /research answers with a deprecation: true header and a successor link, and 31 MCP tools are labelled deprecated, all without dates or a written policy (8). The privacy policy names Google Analytics and PostHog and says data may be processed in any country. No subprocessor list found (4).

NewsCatcher 79

The API is closed under terms of 2 November 2026 naming NewsCatcher, Inc., and the MCP server is MIT, so between the two bands (20 of 30). The terms say inputs and generated data are not used to train models, a DPA applies automatically, and the privacy policy gives retention periods (server logs 7 days, API logs with query text 90 days, then archived indefinitely, billing records about seven years). They agree with each other, but indefinite archives of query logs hold it back (22 of 30). The terms promise 30 days' email notice before a paid product or API version is discontinued, with refunds of unused credits, and the v3 News API has a migration guide (15 of 20). A sub-processor list dated 2 November 2026 with each provider's location and the data it handles. The MCP repository deploys to Vercel and can send pseudonymised analytics to PostHog, and neither appears on the list (16 of 20). 20 + 22 + 15 + 16 = 73.

Grep AI 50

Graded on the hosted API and MCP server. status.grep.ai runs on incident.io, and since 30 October 2026 it has an API component beside Website (20). Two incidents in the 90 days from 4 August, read from the page's feed and incident pages. On 4 September "Grep.ai currently unavailable" said Grep.ai was "experiencing an outage" for 24 minutes, and on 30 October the Website and API components were both in full outage from 17:17 to 17:24 UTC after an infrastructure provider's failure. Each is a full outage of the whole service, which this run reads as a major however short, so two majors (5). The 8 October check read the September outage as minor by its length. No rate limit numbers found in the docs or the OpenAPI document (0). 429 rate_limited carries Retry-After, and run creation takes an Idempotency-Key with documented replay rules (15). The FAQ mentions SLA guarantees for enterprise customers, and no SLA is published (0). API v2 and the MCP server carry no beta label. The SDKs are at 0.2.1 per the 8 October check, and PyPI classified the Python one as Alpha then (10).

NewsCatcher 67

Read with the hosted lines, for the News API, the agent and the hosted MCP server. status.newscatcherapi.com (Hyperping) shows one News API component with 99.820% uptime from August to November 2026 and an incident history. The agent and the MCP server have no component of their own (20). In the 90 days from 8 August, one incident, on 1 September 2026, when the vendor wrote that for about four hours a higher-than-usual number of requests to the production News API timed out because of one client's queries. Read as one major (10). Rate limits published per plan, 1 request a second free and up to 10 on pay as you go, with exact limits from the free GET /subscription (15). 429 carries Retry-After with instructions to retry the same request, 503 carries Retry-After, and failed or refused requests are not charged. Agent runs and monitor creation have no idempotency keys (12 of 15). An uptime SLA exists only in signed Enterprise agreements; none is published (0). Generally available since 30 October 2026, with OAuth for the MCP server announced as coming soon (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.

Grep AI 70

The MCP server card lists 137 tools, 57 of them deprecated aliases, with no documented toolsets. Reports default to plain Markdown and large files come back as signed URLs, so some credit back (8). Cursor pagination with limit on runs, timelines and transactions, and server-side filters on the skill and tool lists (18). One error envelope with stable codes and a request_id, and 402 for credits kept apart from 429 for rate (20). Idempotency-Key with body-hash matching and a 24-hour replay window. The server card shows no readOnlyHint or destructiveHint annotations, and the live tool list wasn't read (12). Only question is required and effort defaults to low. TypeScript and Python SDKs exist, though one docs page still calls the release pending and names a PyPI package that returns 404 (12).

NewsCatcher 84

15 MCP tools in four toolsets, chosen per connection with ?tools=, and tools return compact text rather than the full JSON. 15 for 11 to 30 tools plus 7 for toolsets (22 of 25). limit, search_window, effort, language, country, publisher, coverage and content-type filters, sorting, and paging on /articles; agent tables come back up to 200 rows at a time over MCP (20). Every status is documented with whether to retry; the agent returns stable code values, while the News API body has a status_code and a message meant for people (17 of 20). Every tool carries readOnlyHint and idempotentHint, writes carry destructiveHint, start_research has a free dry_run, and refused or failed calls aren't charged. No idempotency key for starting runs (17 of 20). Only q is required, with medium effort and a 7-day window as defaults. No official SDK for the current API was found; the docs show raw HTTP in three languages (8 of 15). 22 + 20 + 17 + 17 + 8 = 84.

Grep AI 83

Public OpenAPI document at api.grep.ai/api/v2/openapi.json, now 128 operations on 98 paths and 159 schemas (25). llms.txt and a Markdown twin of each developer page (10). Most operations carry a description, and the effort field says what each tier returns and how long it takes. 19 operations have none, and the MCP server card gives each of its 137 tools one line. The MCP input schemas need OAuth and weren't read (12). 75 enums, numeric bounds and additionalProperties: false on the run request (12). Curl examples and an 11-code error registry in the docs, but the OpenAPI document has no examples and documents only 200 and 422 responses (9). The path is versioned, v1 and 42 v2 operations are marked deprecated, and the dated changelog now runs to v3.71 on 20 October 2026, with 14 entries since 4 August (15).

NewsCatcher 94

OpenAPI 3.1 for the News API (version 1.3.9, 4 paths) and the agent (version 1.5.1, 33 paths), linked from llms.txt, and typed JSON Schema on every MCP tool through Pydantic (25). llms.txt, a Markdown copy of every page and a docs MCP server (10). MCP tool descriptions say when to use each and which tool to use instead, such as list_articles for older news; the REST reference explains each endpoint and the 'Choose an API' page compares them (17 of 20). Inputs are typed with enums for effort, mode and dimensions, length and range limits such as a 500-character query and limit 1 to 100, and required fields marked (13 of 15). Runnable examples in curl, Python and JavaScript, and an error table with retry advice for every status. The agent spec carries no response examples (14 of 15). Versioned APIs with a dated changelog, the latest entries on 4 November 2026, and separate changelogs for the v3 News API and CatchAll (15). 25 + 10 + 17 + 13 + 14 + 15 = 94.

Grep AI 40

No machine payment protocol on the live endpoints. The changelog of 8 May 2026 announces x402 and MPP, and the gateway answered 503 gateway_disabled on 8 October and again on 2 November 2026 (0). Plan and credit prices are public, but only the medium tier's credit cost is published and the page and its Markdown twin disagree on credits per dollar (10). 100 free trial credits on the pricing page, 500 Wallet credits for new personal accounts in the 4 October changelog entry, and 500 for an owner's first agent through AgentID. The pricing page doesn't say whether a card is needed, and its table marks the trial without API access (15). AgentID sign-in is documented as needing no human account, but it depends on an AgentMail inbox and a browser step, and we didn't run it (15).

NewsCatcher 30

No x402, MPP or L402 (0). Credit prices per call published without login, and credits cost $1 per 1,000 through top-ups from $25 (20). 10,000 free credits every 30 days on a $0 plan, and the first top-up moves an account to pay as you go. No page says whether a card is needed to open the free plan, so half (10). A person signs up in the platform in a browser to get a key (0). NewsMCP's keyless tier belongs to a separate product and isn't counted. 0 + 20 + 10 + 0 = 30.