jevcrawl vs Outcrawl

jevcrawl 68

Read as local software, though crawl and map also depend on TypeSafe's hosted Jev API. Installs from PyPI with Python 3.11 or later stated (20). CI runs ruff, mypy strict and the offline tests on Python 3.11 and 3.13, and every CI run on main from 11 to 15 October 2026 passed, per the 15 October check; the workflow is unchanged, and run results couldn't be read on 2 November (25). Eight issues, all opened by the maintainer as a roadmap, two closed, per the 15 October check. No outside bug reports were found then, and the project is three weeks old, so there is little record to read (15). Semver tags with GitHub release notes, no CHANGELOG file, v0.1.0's notes only a commit link, and breaking changes not marked (8). Version 0.2.0, still classified Development Status 3 Alpha (0). 20 + 25 + 15 + 8 + 0 = 68.

Outcrawl 45

Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers quota_exceeded with ceiling: requests_per_minute and retryAfterSeconds, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and concurrency_limit tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.

jevcrawl 68

v0.2.0 on 15 October 2026, 18 days before 2 November (30). Three releases between 13 and 15 October 2026 (20). One later change, the merged audit-fixes pull request of 26 October (redirect scope, per-step time limits, a 50 MB cap on gzip sitemaps), is in no release yet. No outside issues or pull requests were found on 15 October, and GitHub's issue pages couldn't be read on 2 November (8 of 25). Not in the official MCP registry, which returned no server for jevcrawl on 2 November (0). Current dependencies, a uv.lock, CI and PyPI trusted publishing in the workflows (10). 30 + 20 + 8 + 0 + 10 = 68.

Outcrawl 79

@outcrawl/sdk and the PyPI package outcrawl both reached 0.4.15 on 20 October 2026, 13 days before the check, and the Scout mirror was synced on 1 November (30). 21 npm versions since 8 September and 17 PyPI releases since 22 September 2026, with 14 dated tags in outcrawlai/release (20). Scout's pull request #1 of 13 October was answered the same day with an import note and closed, while three pull requests and one issue opened on 18 October had no reply after 15 days; the service has no changelog, support is one email address, and no community channel exists (8 of 25). Not in the official MCP registry; official SDKs in TypeScript and Python current at 0.4.15, with a CLI (15). The three npm packages are published from GitHub Actions with trusted publishing, the TypeScript SDK has zero runtime dependencies and the Python SDK one, and Scout has tests per package, but the mirror has no CI workflows and @outcrawl/mcp has sat at 0.4.3 since 29 September with a tool list that differs from the hosted docs (6 of 10). 30+20+8+15+6 = 79.

jevcrawl 81

Typed JSON Schema inputs on all three tools, generated from the Python signatures, with required parameters marked (25). No llms.txt. The repository ships an agent skill, skills/jevcrawl/SKILL.md, as Markdown for agents (5). Tool descriptions and server instructions say when to use crawl, scrape and map, how to phrase a goal and how to read each stop reason (18). Integer and number types with defaults, but the minimums the code enforces are not in the schema and stopped_because is documented as prose, not an enum (10). A real result in the README, and error codes listed in the skill with what each means (13). Semver releases with notes, and the Jev model version pinned per release (10).

Outcrawl 71

API reading, with the MCP server described. An OpenAPI 3.1 document at https://outcrawl.ai/docs/api-reference/openapi.json lists 62 operations over 51 paths with a summary each and the same 11 status codes, generated from the vendor's capability registry, but every request body is an untyped object marked additionalProperties: true with a pointer to the docs, every 200 response is an untyped object, and Error is the only schema; the typed shapes live in the SDK declarations and in the MCP server's zod schemas, which were read in the 0.4.3 npm package rather than from the hosted server (15 of 25). llms.txt and a 525 KB llms-full.txt on the docs, a Markdown twin of every page and an llms.txt on the site (10). The MCP descriptions each end with a Not for: clause naming the better tool and most with a Cost: clause, the OpenAPI summaries say when not to use a route, and the capability pages say which neighbour to use instead (18 of 20). Scrape formats are an enum of eight, event levels and record kinds are enums, caps.budget is required, and the SDK types bound every option, while the OpenAPI bodies carry none of it (10 of 15). curl, TypeScript and Python examples on every page, 20 worked programs, a 31-row error table with meanings and a retryable list, and MCP errors with a recovery string, though the closed union is sized 24, 31, 45 and 22 on different pages (13 of 15). /v1 in the path and 1.0.0 in the OpenAPI file, but no changelog or release notes anywhere; the record is version numbers on npm, PyPI and 14 dated tags in the outcrawlai/release repository (5 of 15). 15+10+18+10+13+5 = 71.

jevcrawl 30

No payment protocol (0). The package is free, so read with the rule for the paid option it needs, TypeSafe's Jev. Per-token price published at $0.042 per million input tokens for jev-1.13.0 and jev-1.14.0, re-read on 2 November (20). No free Jev tier found. scrape without a goal works with no key, which is a small free path (5 of 20). A person has to sign in at console.typesafe.ai, and TypeSafe describes Jev as early access. The console answered 403 to our reader. Keyless goal-less scraping earns a little (5 of 20).

Outcrawl 40

No x402, MPP or L402 in the OpenAPI file, the docs, the pricing pages or the terms (0). Per-unit rates published without a login, 1 credit a page, 5 credits per 10 search results, 1 credit a browser minute, 2,000 credits a GB and 1 credit a monitor check, with the dollar rate per plan ($4.90 per 1,000 credits on Builder down to about $3.20 on Scale), top-up prices per 10,000 and an estimate of about 15 credits a minute for agent runs (20). Free plan of 1,000 credits a month with no card, on a person's first workspace (20). A person signs in with Google, GitHub, an email code or a magic link behind reCAPTCHA, and MCP's OAuth consent needs that browser sign-in; no keyless route, no programmatic key creation (0). 0+20+20+0 = 40.

jevcrawl 59

Read with the API and MCP lines, since the server runs locally but sends data to a hosted API. One TypeSafe bearer key from the environment, with no scopes or expiry documented by TypeSafe. The README says the key is never written to disk or logs (20). Every tool only reads, a crawl stays on the start host, and robots.txt is followed by default. There is still no check against private, loopback or link-local addresses in the source on 2 November, so an agent can be steered to internal hosts. The unreleased 26 October change skips redirects off the crawl's hosts (12). Pages are untrusted content. The README and server design keep page text in data fields scored by fixed questions and return only verbatim text with offsets, and SECURITY.md names a change in fetch behaviour through page content as in scope. These are the author's claims, untested by us (12). Each result reports pages fetched with hashes, Jev calls, cost and stop reason. No persistent call log (7). SECURITY.md with GitHub private reporting and a one-week answer. No bounty, no advisories yet, and TypeSafe publishes no security.txt (8).

Outcrawl 66

OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, api; API keys shaped ock_<keyId>.<secret> are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above approvalAbove pause for a person's yes, and control hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries usage, /v1/usage groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.

jevcrawl 51

Apache-2.0 in LICENSE, pyproject.toml and as detected by GitHub (30). The README says plainly that page text, link labels and URLs go to TypeSafe and that answers are cached locally. TypeSafe's policies agree on no training but give no retention period, and jevcrawl has no privacy statement of its own (15). No deprecation policy. The model version is pinned and changes are in release notes (3). No telemetry or analytics found in the source. Outbound traffic is the target site and api.typesafe.ai, both stated in the README, so there is nothing hidden to opt out of, though no explicit telemetry statement exists (15).

Outcrawl 56

Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.