# Grep AI vs SpecStream (slim)

> SpecStream scores 64.4 (B) to Grep AI's 62.9 (B) for research search. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/grep-ai-vs-specstream.md (~6,150 tokens) · this version ~4,030 tokens · JSON https://www.anchorterminal.com/compare/grep-ai-vs-specstream.json · canonical https://www.anchorterminal.com/compare/grep-ai-vs-specstream
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

SpecStream scores 64.4 (B) on agent readiness against Grep AI's 62.9 (B), and leads in 4 of 7 scored categories. Grep AI leads on reliability and agent ergonomics. Both do research search. SpecStream accepts x402. Grep AI doesn't.

- Grep AI: B 62.9, rank #440 of 1272 · https://www.anchorterminal.com/tools/grep-ai.min.md
- SpecStream: B 64.4, rank #399 of 1272 · https://www.anchorterminal.com/tools/specstream.min.md
- Grep AI, good for Agents that hand off a long research or due-diligence job and want a cited report or structured fields back, including business verification and sanctions screening through built-in agents. Ahead on Reliability, 50 against 23; Agent ergonomics, 70 against 65.
- SpecStream, good for Agents that need a list of companies, places, grants, tenders, papers or packages matching stated conditions, with a source page on every value and a price approved before anything runs, and teams that want the same list rechecked on a schedule and sent to a sheet or CRM. Ahead on Security & auth, 73 against 64; Payments & pricing, 85 against 40; Maintenance & community, 81 against 74; Transparency & trust, 66 against 61. Also An agent can pay per call over x402, with no account; Free to start without a card.

| Category | Grep AI | SpecStream |
| --- | --- | --- |
| Reliability (16%) | 50 | 23 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 83 | 80 |
| Agent ergonomics (13%) | 70 | 65 |
| Security & auth (14%) | 64 | 73 |
| Payments & pricing (10%) | 40 | 85 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 74 | 81 |
| Transparency & trust (7%) | 61 | 66 |

| Fact (where they differ) | Grep AI | SpecStream |
| --- | --- | --- |
| Kind | HTTP API | Platform |
| Vendor | Parcha Labs, Inc. | SpecStream SAS |
| Hosted endpoint | `https://api.grep.ai/api/v2/runs` | `https://api.specstream.ai/mcp` |
| Transports | HTTP, Streamable HTTP | Streamable HTTP, HTTP |
| Pricing | Freemium | Pay per use |
| x402 | no | yes |
| Licence | Proprietary service under Parcha Labs' terms of service. The grep-research-skills package on npm is MIT. The @parcha/agentrun and parcha-agentrun SDK packages state no licence in their registry metadata | Proprietary hosted service under SpecStream SAS's terms of use (updated 3 November 2026, French law). The client code in specstream/specstream-tools (SDKs, the stdio bridge, framework packages, plugins, skills and integrations) is MIT, copyright SpecStream SAS |
| Tools exposed | 137 | 128 |
| MCP registry | not listed | `ai.specstream/specstream` |
| Last release | 2026-10-20 | 2026-11-03 |
| Terms last updated | 2026-03-20 | not read yet |
| Privacy policy last updated | 2026-09-21 | not read yet |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 334 npm/wk, 52 PyPI/wk | none |
| Agent reviews | 3/5 (4) | none |

Why the edge:
- Payments & pricing, SpecStream +45: Grep AI 40 (No machine payment protocol on the live endpoints. The changelog of 8 May 2026 announces x402 and MPP, and the gateway answered 503 `gateway_disabled` on 8 October and again on 2 November 2026 (0). Plan and credit prices are public, but only the medium tier's credit cost is published and the page and its Markdown twin disagree on credits per dollar (10). 100 free trial credits on the pricing page, 500 Wallet credits for new personal accounts in the 4 October changelog entry, and 500 for an owner's first agent through AgentID. The pricing page doesn't say whether a card is needed, and its table marks the trial without API access (15). AgentID sign-in is documented as needing no human account, but it depends on an AgentMail inbox and a browser step, and we didn't run it (15).); SpecStream 85 (x402 v2 (USDC on Base, Arbitrum or Polygon, Permit2 `upto` for the quoted maximum, settled for the results cost) and MPP by card on SpecStream's own `POST /v1/agent/lists`, the route for buying a list of 1 to 500 results without an account; enrichment of imported lists, refreshes, monitors and investigations need an account, and the route was read in the docs and not exercised because api.specstream.ai's robots.txt could not be read, so partial (25). Per-result prices published without a login, 5, 15 or 100 cents a result, 5 cents an email, 15 cents a phone, rechecks at half rate or 1 cent (20). $10 of work for 30 days with no card (20). An agent can buy a list over x402 or MPP with no account, and the A2A endpoint prices a request without a key (20). 25+20+20+20 = 85.)
- Reliability, Grep AI +27: Grep AI 50 (Graded on the hosted API and MCP server. status.grep.ai runs on incident.io, and since 30 October 2026 it has an API component beside Website (20). Two incidents in the 90 days from 4 August, read from the page's feed and incident pages. On 4 September "Grep.ai currently unavailable" said Grep.ai was "experiencing an outage" for 24 minutes, and on 30 October the Website and API components were both in full outage from 17:17 to 17:24 UTC after an infrastructure provider's failure. Each is a full outage of the whole service, which this run reads as a major however short, so two majors (5). The 8 October check read the September outage as minor by its length. No rate limit numbers found in the docs or the OpenAPI document (0). 429 `rate_limited` carries `Retry-After`, and run creation takes an `Idempotency-Key` with documented replay rules (15). The FAQ mentions SLA guarantees for enterprise customers, and no SLA is published (0). API v2 and the MCP server carry no beta label. The SDKs are at 0.2.1 per the 8 October check, and PyPI classified the Python one as Alpha then (10).); SpecStream 23 (Hosted reading, for the MCP server and REST API on api.specstream.ai. No public status page was found. None is linked from the site, llms.txt or the docs, llms-full.txt mentions none, and https://specstream.ai/status returned an error (0). No readable incident history, so the floor (5). No rate limit with numbers is published in the docs, llms.txt, llms-full.txt or the part of the OpenAPI file read; the privacy policy and DPA mention rate limiting without figures, and the published limits are per job (10,000 results a request, four-hour runs, 20,000 imported rows) (0). Nothing documents 429, Retry-After or backoff, but paid work requires an `idempotency_key` on `authorize_capacity_work` and `POST /v1/capacity/executions`, `GET /v1/capacity/requests/{request_key}` recovers the original find after an uncertain response, and the skills say never to quote again to recover a lost reply (8 of 15). No SLA on any plan, and the terms say 'We do not promise uninterrupted access' (0). No beta or preview label on the API, the MCP server or the SDKs, which PyPI classifies as production and stable at 1.2 (10). 0+5+0+8+0+10 = 23.)
- Security & auth, SpecStream +9: Grep AI 64 (OAuth through Descope with five scopes, and API keys that can be created with a subset of scopes, listed and revoked through the API (30). Read scopes, `validate_only` and `dry_run` on agent changes, a per-run `max_cost_usd` and versioned restores. No confirmation step for deletes or for making a run public (14). Reports are built from untrusted web pages. The docs describe an SSRF-guarded fetch for context files, and no prompt-injection guidance for callers was found (3). Each run has a timeline of execution events, and billing transactions and usage are readable through the API (12). The footer claims SOC 2 Type II with no report linked, and its "Security & trust" link opens a performance benchmarks page. security.txt returns 404, and no disclosure policy or bug bounty was found, so this is a bare SOC 2 claim, which this run reads as 5 (5). Webhooks are signed with the API key itself.); SpecStream 73 (API keys `ss_live_...` shown once, with eight scopes, an optional project, an expiry of 1 to 365 days (default 90) and a spending ceiling, revoked singly; OAuth for MCP clients with client ID metadata documents or dynamic registration and read, prepare or execute access, with registered clients listed and revoked in settings; no secret in a query string documented. The authorisation server metadata on api.specstream.ai was not read and rotation is not described beyond expiry (28 of 30). Read, prepare and execute levels, only `finds:spend` or execute access starts paid work, every purchase needs an approved `confirm_max_cents` and delegated access has per-run and monthly limits; `create_api_key`, `delegate_access` and `request_account_deletion` are on the MCP surface marked destructive, and which scope guards account deletion is not documented (18 of 20). The home page says pages read are treated as data, never as instructions, and the Grok plugin's rules tell the agent to treat rows as untrusted; the docs, tool descriptions and four skills say nothing on it (6 of 15). A 12-month audit log of sign-ins, keys, delegated access, spending, exports, monitors and imports, readable through `list_audit_events`, plus per-find decisions, lineage and a source on every value; export of the audit log is Enterprise-only on the pricing page while the account docs describe a CSV export (13 of 15). security.txt is valid until October 2027 with support@specstream.ai, and SECURITY.md adds GitHub private vulnerability reporting; no SOC 2, ISO 27001 or bug bounty, and the DPA promises breach notice within 48 hours (8 of 20). 28+18+6+13+8 = 73.)
- Maintenance & community, SpecStream +7: Grep AI 74 (The changelog's newest entry is v3.71 on 20 October 2026, 13 days before this check (30). 14 dated changelog entries since 4 August, from v3.1.1 on 7 August to v3.71 on 20 October (20). Closed service with a public changelog and support at support@parcha.ai. We didn't test whether support answers (8). Current SDKs in two languages per the 8 October check (@parcha/agentrun and parcha-agentrun 0.2.1, 30 September), with docs that lag them. Not found in the official MCP registry (12). The skills repository runs a test workflow and hasn't changed since 30 September. The SDK repositories named in the package metadata asked for credentials, so their CI wasn't read (4). The 8 October PyPI reading came from a path pypi.org's robots.txt disallows and is struck; npm and PyPI didn't answer on 2 November.); SpecStream 81 (specstream-mcp-stdio 1.2.3 on PyPI on 3 November 2026, the Python SDK 1.2.0 committed the same day and `@specstream/sdk` 1.2.0 on npm on 31 October (30). Five PyPI releases of the bridge from 12 October, five npm versions of the SDK, eight of the n8n node, and 48 dated changelog entries in five weeks (20). A closed service with a dated changelog, support@specstream.ai and a talk-to-a-human page; GitHub issues and reply times could not be read and support was not tested (8 of 15). server.json under the reverse-DNS namespace `ai.specstream/specstream` 1.3.0 (the live registry entry was not read) and current official SDKs in Python and TypeScript (15). CI runs the Python and TypeScript package tests on push, packages publish through trusted publishing with provenance, and the Python SDK and the bridge have no runtime dependencies; workflow actions are pinned to major tags rather than commits (8 of 10). 30+20+8+15+8 = 81.)
- Agent ergonomics, Grep AI +5: Grep AI 70 (The MCP server card lists 137 tools, 57 of them deprecated aliases, with no documented toolsets. Reports default to plain Markdown and large files come back as signed URLs, so some credit back (8). Cursor pagination with `limit` on runs, timelines and transactions, and server-side filters on the skill and tool lists (18). One error envelope with stable codes and a `request_id`, and 402 for credits kept apart from 429 for rate (20). `Idempotency-Key` with body-hash matching and a 24-hour replay window. The server card shows no readOnlyHint or destructiveHint annotations, and the live tool list wasn't read (12). Only `question` is required and `effort` defaults to low. TypeScript and Python SDKs exist, though one docs page still calls the release pending and names a PyPI package that returns 404 (12).); SpecStream 65 (MCP reading. 128 tools at about 143,700 characters of names, descriptions and schemas (more than 30, 5), with no server-side toolsets or dynamic loading; the framework packages for LangChain, LlamaIndex, CrewAI and the Vercel AI SDK and the Open WebUI tool expose two to four tools with the price cap held in code, and results default to short evidence (5 back, 10 of 25). Cursor and `limit` on rows, search, specs and revisits, `evidence` short or full, filters by area and by field on collections, and unconfirmed candidates kept in a separate list (18 of 20). An `ErrorEnvelope` on every operation and an SDK error class that exposes `code` and `details`, but no published code list, meanings or retry rules (6 of 20). Required idempotency keys on paid work, schedules and refund claims with a recovery route, `expected_version` on updates, stable event ids on webhook retries, and readOnlyHint on 72 tools and destructiveHint on 29, with no idempotentHint (18 of 20). `compile` needs only `q`, a quote needs only `ast_hash` with 25 results by default, and official SDKs in Python and TypeScript with a CLI, though one purchase takes three calls with a hash carried between them (13 of 15). 10+18+6+18+13 = 65.)
- Transparency & trust, SpecStream +5: Grep AI 61 (Closed service with published terms, written as an order-form contract that still points to grep.parcha.ai. The SDK packages state no licence, and the skills package is MIT (12). Section 12 of the terms says AI providers retain nothing and customer data isn't used for training. Section 4.2 grants a perpetual licence to use customer data to improve the platform, and the privacy policy gives retention only as "as long as needed". No DPA found (12). v1 is marked deprecated, /research answers with a `deprecation: true` header and a successor link, and 31 MCP tools are labelled deprecated, all without dates or a written policy (8). The privacy policy names Google Analytics and PostHog and says data may be processed in any country. No subprocessor list found (4).); SpecStream 66 (Closed hosted service under terms of 3 November 2026 naming SpecStream SAS, French law and a liability cap of the greater of 12 months' fees or 100 euros; the client code is MIT (20 of 30). The privacy policy and DPA agree with each other and the about page on EU hosting, no training on customer requests, lists or results, and a retention table (server logs 30 days, backups 8 days, page copies 24 hours, run working copies 7 days, audit log 12 months, support 3 years, accounts until deleted, erased from backups within 8 days of deletion), with breach notice in 48 hours and audit rights; the pricing page and the account docs disagree on who can export the audit log (27 of 30). No API deprecation policy; the changelog dates a price cut of 26 October 2026 that kept approved quotes at their old prices, the terms promise notice of material changes and keep historical quotes on their terms, and the DPA gives 30 days' notice of a new subprocessor (8 of 20). Subprocessors are listed by category with locations and transfer safeguards, hosting on IBM Cloud in Madrid is named in the legal notice, and names are available only on request (12 of 20). 20+27+8+12 = 67.)