Kagi Search API vs SpecStream

Kagi Search API 20

No x402, MPP or L402 (0). $12 per 1,000 searches and $4 per 1,000 extracted pages, published without a login (20). No free tier or trial for the API. The quick start asks for a payment method, and the $5 credit of 21 May 2026 was a one-off for subscribers (0). A person signs up in a browser and creates the key in the portal (0). 20.

SpecStream 85

x402 v2 (USDC on Base, Arbitrum or Polygon, Permit2 upto for the quoted maximum, settled for the results cost) and MPP by card on SpecStream's own POST /v1/agent/lists, the route for buying a list of 1 to 500 results without an account; enrichment of imported lists, refreshes, monitors and investigations need an account, and the route was read in the docs and not exercised because api.specstream.ai's robots.txt could not be read, so partial (25). Per-result prices published without a login, 5, 15 or 100 cents a result, 5 cents an email, 15 cents a phone, rechecks at half rate or 1 cent (20). $10 of work for 30 days with no card (20). An agent can buy a list over x402 or MPP with no account, and the A2A endpoint prices a request without a key (20). 25+20+20+20 = 85.

Kagi Search API 41

The last dated API change is the Extract API fix in the changelog of 21 August 2026, 49 days before the check (20). That is the only dated API entry in the last 90 days. The MCP server's last commit is 7 July 2026 (0). A public changelog that credits user reports, developers@kagi.com, a Discord #api forum and GitHub discussions. We could not read the issue list, since the GitHub API answered 403 (9). Four generated clients last synced on 26 May 2026, Python tagged only as 1.0.0rc3, TypeScript not on npm, and kagimcp at 1.0.2 untagged. We did not look the server up in the MCP registry (8). The Python client has a generated CI workflow and the MCP server has a lock file but no CI workflow (4). 41.

SpecStream 81

specstream-mcp-stdio 1.2.3 on PyPI on 3 November 2026, the Python SDK 1.2.0 committed the same day and @specstream/sdk 1.2.0 on npm on 31 October (30). Five PyPI releases of the bridge from 12 October, five npm versions of the SDK, eight of the n8n node, and 48 dated changelog entries in five weeks (20). A closed service with a dated changelog, support@specstream.ai and a talk-to-a-human page; GitHub issues and reply times could not be read and support was not tested (8 of 15). server.json under the reverse-DNS namespace ai.specstream/specstream 1.3.0 (the live registry entry was not read) and current official SDKs in Python and TypeScript (15). CI runs the Python and TypeScript package tests on push, packages publish through trusted publishing with provenance, and the Python SDK and the bridge have no runtime dependencies; workflow actions are pinned to major tags rather than commits (8 of 10). 30+20+8+15+8 = 81.

Kagi Search API 8

No status page is linked from the API docs, the pricing page, the API terms or the changelog, and we did not type an address for one (0). With no readable incident history the record takes the floor (5). No rate limit numbers are published. The terms say only that limits and quotas apply per plan (0). The OpenAPI file documents 429 as 'Rate limited or usage limit exhausted' with no Retry-After header or backoff guidance. The calls are read-only, and Kagi's own MCP server retries 429 and 5xx twice by default (3). The pricing page lists SLAs under Enterprise by quote, and the API terms say there is no uptime or service-level commitment unless agreed in writing (0). The API has been a public preview since 21 May 2026 (0). 8.

SpecStream 23

Hosted reading, for the MCP server and REST API on api.specstream.ai. No public status page was found. None is linked from the site, llms.txt or the docs, llms-full.txt mentions none, and https://specstream.ai/status returned an error (0). No readable incident history, so the floor (5). No rate limit with numbers is published in the docs, llms.txt, llms-full.txt or the part of the OpenAPI file read; the privacy policy and DPA mention rate limiting without figures, and the published limits are per job (10,000 results a request, four-hour runs, 20,000 imported rows) (0). Nothing documents 429, Retry-After or backoff, but paid work requires an idempotency_key on authorize_capacity_work and POST /v1/capacity/executions, GET /v1/capacity/requests/{request_key} recovers the original find after an uncertain response, and the skills say never to quote again to recover a lost reply (8 of 15). No SLA on any plan, and the terms say 'We do not promise uninterrupted access' (0). No beta or preview label on the API, the MCP server or the SDKs, which PyPI classifies as production and stable at 1.2 (10). 0+5+0+8+0+10 = 23.

Kagi Search API 75

limit caps results, extraction of page text is opt-in, snippet length follows an account setting, and an experimental Markdown response format exists. The MCP server has two tools (22). page 1 to 10, limit 1 to 1,024, lens and filters for domains, keywords, file type, dates and region (20). Errors return a namespaced code, a message, the field location and a trace ID, but no code catalogue is published and the linked error pages are not live (12). Both operations are read-only, so a retry is safe, though the docs do not say so and failed-call billing is stated only for extraction. The MCP tools set no read-only annotations (10). Only query is required and defaults are stated. Generated clients exist for Python, TypeScript, Go and Rust, installable from GitHub. @kagi/api returned 404 on npm (11). 75.

SpecStream 65

MCP reading. 128 tools at about 143,700 characters of names, descriptions and schemas (more than 30, 5), with no server-side toolsets or dynamic loading; the framework packages for LangChain, LlamaIndex, CrewAI and the Vercel AI SDK and the Open WebUI tool expose two to four tools with the price cap held in code, and results default to short evidence (5 back, 10 of 25). Cursor and limit on rows, search, specs and revisits, evidence short or full, filters by area and by field on collections, and unconfirmed candidates kept in a separate list (18 of 20). An ErrorEnvelope on every operation and an SDK error class that exposes code and details, but no published code list, meanings or retry rules (6 of 20). Required idempotency keys on paid work, schedules and refund claims with a recovery route, expected_version on updates, stable event ids on webhook retries, and readOnlyHint on 72 tools and destructiveHint on 29, with no idempotentHint (18 of 20). compile needs only q, a quote needs only ast_hash with 25 results by default, and official SDKs in Python and TypeScript with a CLI, though one purchase takes three calls with a hash carried between them (13 of 15). 10+18+6+18+13 = 65.

Kagi Search API 71

Public OpenAPI 3.0 file at kagi.com/api/docs/_spec/openapi.yaml, linked from the docs (25). No llms.txt on kagi.com or help.kagi.com, both 404. The docs' Markdown source is in a public GitHub repository, which is not the same as serving it to agents (0). Parameter descriptions say what each does and which option wins when lens, filters and query operators overlap, and the MCP tool says when to pick each workflow (14). Enums for workflow, format, time_relative and rule kinds, ranges on page, limit, timeout and extract.count, and one required field. Result props and meta are open objects (13). Three request examples with full responses and one 401 example. The error envelope is typed, but there is no list of error codes, and the file says its error documentation URLs return 404 for now (9). The path carries /v1 and v0 is documented as legacy. The changelog is product-wide, with API items on 21 May, 16 June and 21 August 2026 (10). 71.

SpecStream 80

MCP reading, with the REST API described. The tool list shipped in specstream-mcp-stdio 1.2.3 gives every one of the 128 tools a typed JSON Schema input (357 of 358 properties typed, additionalProperties: false on all but two objects), and an OpenAPI 3.1 file at https://specstream.ai/openapi.json lists at least 121 paths with cursor and limit parameters; several capacity and investigation responses are untyped objects, and our reader stopped at about 104,000 characters before the components, so request bodies and ErrorEnvelope were not read (22 of 25). llms.txt, llms-full.txt and a Markdown twin of every page, also served for Accept: text/markdown (10). Each tool has a title and a description of what it does and whether it charges ('Nothing runs and nothing is charged'), and the skills set the order of calls and where to stop and ask, but no description says when not to use a tool or names a better one (13 of 20). 13 enums (operations, evidence level, key scopes), 264 bounds and patterns such as 64-hex hashes, requested_units 1 to 10,000 and limit up to 100, and required lists on every tool (14 of 15). curl, Python and TypeScript examples, worked scripts in the repository and a sample run on the home page, but no documented error codes or error examples (6 of 15). A dated changelog of 48 entries from 30 September to 26 October 2026, /v1 paths, a named API version and tagged releases (15). 22+10+13+14+6+15 = 80.

Kagi Search API 64

Several named keys an account, each limited to chosen products and optionally to IP addresses or ranges, revoked by deleting. The v1 key travels only in the Authorization header. No expiry or OAuth (27). The API only reads. Per-key product limits and a spending cap in USD narrow what a leaked key can do (16). Search and Extract return third-party page text, and we found no prompt-injection guidance in the reference, the docs or the MCP README (2). The portal shows use count and last-used time per key and requests and cost per day per API, and every response carries a trace ID. No per-call log (7). security.txt with a contact, a bug bounty with a safe harbour policy, and an independent audit by Illumant cited on the security page, whose date we did not read. No SOC 2 or ISO 27001 statement found (12). 64.

SpecStream 73

API keys ss_live_... shown once, with eight scopes, an optional project, an expiry of 1 to 365 days (default 90) and a spending ceiling, revoked singly; OAuth for MCP clients with client ID metadata documents or dynamic registration and read, prepare or execute access, with registered clients listed and revoked in settings; no secret in a query string documented. The authorisation server metadata on api.specstream.ai was not read and rotation is not described beyond expiry (28 of 30). Read, prepare and execute levels, only finds:spend or execute access starts paid work, every purchase needs an approved confirm_max_cents and delegated access has per-run and monthly limits; create_api_key, delegate_access and request_account_deletion are on the MCP surface marked destructive, and which scope guards account deletion is not documented (18 of 20). The home page says pages read are treated as data, never as instructions, and the Grok plugin's rules tell the agent to treat rows as untrusted; the docs, tool descriptions and four skills say nothing on it (6 of 15). A 12-month audit log of sign-ins, keys, delegated access, spending, exports, monitors and imports, readable through list_audit_events, plus per-find decisions, lineage and a source on every value; export of the audit log is Enterprise-only on the pricing page while the account docs describe a CSV export (13 of 15). security.txt is valid until October 2027 with support@specstream.ai, and SECURITY.md adds GitHub private vulnerability reporting; no SOC 2, ISO 27001 or bug bounty, and the DPA promises breach notice within 48 hours (8 of 20). 28+18+6+13+8 = 73.