Kagi Search API vs Mojeek Web Search API

Kagi Search API 64

Several named keys an account, each limited to chosen products and optionally to IP addresses or ranges, revoked by deleting. The v1 key travels only in the Authorization header. No expiry or OAuth (27). The API only reads. Per-key product limits and a spending cap in USD narrow what a leaked key can do (16). Search and Extract return third-party page text, and we found no prompt-injection guidance in the reference, the docs or the MCP README (2). The portal shows use count and last-used time per key and requests and cost per day per API, and every response carries a trace ID. No per-call log (7). security.txt with a contact, a bug bounty with a safe harbour policy, and an independent audit by Illumant cited on the security page, whose date we did not read. No SOC 2 or ISO 27001 statement found. security.txt re-read on 4 November (12). 27 + 16 + 2 + 7 + 12 = 64.

Mojeek Web Search API 15

One key per account, documented only as the api_key query parameter, and rotation or revocation is by email to the API team (a staff reply of 22 October 2026 on the community forum asks for the key's last 8 digits). One all-powerful key (10) less 10 for the key in the URL (0). Search is read-only and there is nothing to write, but no scoped or restricted key (10 of 20). Results are third-party titles and snippets, with no prompt-injection guidance found (0). No audit log or per-call usage view was found in the docs; the FAQ mentions budget alerts on the account (0 of 15). security.txt names security@mojeek.com, with no Expires field. No bug bounty, disclosure policy, SOC 2 or ISO 27001 found; the API page claims compliance with European rules such as the EU Data Act without a certification (5 of 20). 0 + 10 + 0 + 0 + 5 = 15.

Kagi Search API 71

Public OpenAPI 3.0 file at kagi.com/api/docs/_spec/openapi.yaml, linked as 'OpenAPI Spec' from the API overview page (25). No llms.txt on kagi.com or help.kagi.com, both 404. The docs' Markdown source is in a public GitHub repository, which is not the same as serving it to agents (0). Parameter descriptions say what each does and which option wins when lens, filters and query operators overlap, and the MCP tool says when to pick each workflow (14). Enums for workflow, format, time_relative and rule kinds, ranges on page, limit, timeout and extract.count, and one required field. Result props and meta are open objects (13). Three request examples with full responses and one 401 example. The error envelope is typed, but there is no list of error codes, and the file says its error documentation URLs return 404 for now (9). The path carries /v1 and v0 is documented as legacy. The changelog is product-wide, with API items on 21 May, 16 June and 21 August 2026 and none in the 10 September or 16 October posts (10). 25 + 0 + 14 + 13 + 9 + 10 = 71.

Mojeek Web Search API 29

No OpenAPI or other machine-readable contract (0). No llms.txt (404) and no Markdown pages for agents (0). The parameters page states what each parameter does, with notes on when not to use reg and clufmt, but nothing on when another endpoint fits better (12 of 20). Every parameter has a type, defaults and valid ranges (tlen 0 to 127, dlen 0 to 511, rbb and lbb 1 to 100, up to 25 domains), though reg is called an enum without listing its values (11 of 15). One curl example and annotated JSON and XML response formats; errors appear only as a status string with one example (6 of 15). No API version, changelog or dated release notes, and the quickstart and the parameters page give different hosts (0). 0 + 0 + 12 + 11 + 6 + 0 = 29.

Kagi Search API 41

The last dated API change is the Extract API fix in the changelog post of 21 August 2026, 75 days before this check. The posts of 10 September and 16 October carry no API item (20). That is the only dated API entry in the 90 days from 6 August (0). The MCP server's repository gained commits on 27 and 28 October 2026 (compact JSON results, readOnlyHint, per-page extraction errors) and a version bump to 1.1.0 with no tag, so no release is shown; PyPI didn't resolve for us. A public changelog that credits user reports, developers@kagi.com, a Discord #api forum and GitHub discussions. We could not read the issue list, since the GitHub API answered 403 (9). Four generated clients last synced on 26 May 2026, Python tagged only as 1.0.0rc3, TypeScript not on npm on 9 October, and kagimcp tagged last as v0.1.5 (8 April 2026). We did not look the server up in the MCP registry (8). The Python client has a generated CI workflow and the MCP server has a lock file but no CI workflow (4). 20 + 0 + 9 + 8 + 4 = 41.

Mojeek Web Search API 10

Read for a closed service. No API changelog, release notes or dated API change were found, and the blog's posts since 2024 are about search in general, so the last change can't be dated (0). No dated changes in the 90 days from 8 August (0). A staff member answered API questions on the community forum within a day in December 2025 and October 2026, and support is by email; no public changelog (10 of 15). No official SDKs or MCP server (0). No public packages or CI to measure (0). 0 + 0 + 10 + 0 + 0 = 10.

Kagi Search API 75

limit caps results, extraction of page text is opt-in, snippet length follows an account setting, and an experimental Markdown response format exists. The MCP server has two tools (22). page 1 to 10, limit 1 to 1,024, lens and filters for domains, keywords, file type, dates and region (20). Errors return a namespaced code, a message, the field location and a trace ID, but no code catalogue is published and the linked error pages are not live (12). Both operations are read-only, so a retry is safe, though the docs do not say so and failed-call billing is stated only for extraction. The released MCP server sets no read-only annotations. A commit of 27 October adds readOnlyHint to its source with an untagged 1.1.0 version bump, not yet shown as released (10). Only query is required and defaults are stated. Generated clients exist for Python, TypeScript, Go and Rust, installable from GitHub. @kagi/api returned 404 on npm on 9 October (11). 22 + 20 + 12 + 10 + 11 = 75.

Mojeek Web Search API 66

Responses can be sized with t (up to 10, 40 or 100 results by plan), tlen, dlen and opt-in date and size fields (22 of 25). s for paging, since and before, site, included and excluded domains, region and language boosting and safe search (20). Errors are a free-text status with no documented codes, which an agent can't branch on reliably (5 of 20). Searches only read, so a retry is safe, but no page says whether failed or empty requests are billed (12 of 20). Only q and api_key are required, with recommended values for the boosts. No official SDK in any language (7 of 15). 22 + 20 + 5 + 12 + 7 = 66.

Kagi Search API 74

Closed service with clear API terms dated 22 September 2026. The MCP server is MIT and the OpenAPI file states Apache-2.0 (18). The privacy policy's API section agrees with the API terms. Queries are not stored against the account, load balancer and VM logs are kept 7 days and sampled Sentry errors 90 days. The Data Processing Addendum both documents cite is not yet published (23). v0 is marked deprecated with no end date, and the terms promise reasonable notice of breaking changes only where practicable (5). The privacy page names the payment processors and Sentry, the FAQ names GCP as the hosting provider and the docs name search sources, but there is no subprocessor list and no data locations (8). 18 + 23 + 5 + 8 = 54.

Mojeek Web Search API 68

Closed service with API terms naming Mojeek Limited under English law (15 of 30). The API page states 90-day retention, zero retention on request, no sub-processors and that Mojeek is the processor and the customer the controller, while the API terms say both parties are independent controllers under GDPR, and the privacy policy of 2 February 2022 covers only the website (12 of 30). The terms promise 30 days' notice of material changes and of price changes, but there is no deprecation policy or dated notices (5 of 20). The API page says there are no sub-processors and infrastructure is owned and run in Europe, in a UK data centre per the about page (18 of 20). 15 + 12 + 5 + 18 = 50.