Keywords Everywhere API + MCP vs SpyFu API

Keywords Everywhere API + MCP 43

No OpenAPI file or other machine-readable contract was found for the REST API, and the MCP server's input schemas weren't read because its robots.txt closes the endpoint, so the contract line has no evidence (0). keywordseverywhere.com/llms.txt answered 404 on 9 October. The API reference is a docsify site whose pages are plain Markdown files listed in its sidebar, which a model can read directly (5 of 10). Each page states the endpoint's purpose and credit cost in a line or two, and the API overview says the service is not a rank tracker and that competition is an advertiser metric (11 of 20). Parameter tables give type, examples, options (gkp or cli), a range of 1 to 10,000 for num and a 100-keyword ceiling. Required status isn't stated (9 of 15). Every endpoint has request samples in eight languages, a sample response, a status code table and sample 401 and 402 bodies. There is no sample for 400 (13 of 15). Paths are versioned under /v1. The only changelog is the browser extension's, and the registry version the 9 October check also counted came from a JSON API this re-check doesn't use (5 of 15, an earlier partial kept). 0+5+11+9+13+5 = 43.

SpyFu API 75

Every reference page embeds an OpenAPI 3.1 definition with security schemes and responses, but no single downloadable file is linked (20 of 25). llms.txt and a Markdown twin of every page (10). Descriptions say what each endpoint returns and how it differs from its neighbours ('unlike term-based endpoints...') (17 of 20). Typed parameters with descriptions, examples and required flags (12 of 15). 200, 400, 401 and 500 in the definitions and a 429 example, little on error bodies (11 of 15). v2 in every path, but no changelog (/changelog answered 404) (5 of 15). 20+10+17+12+11+5 = 75.

Keywords Everywhere API + MCP 68

Closed service. The Terms of Service date from 30 May 2023, are adapted from the WordPress terms, and don't mention the API, reuse or resale of the data, or the legal entity. The vendor's n8n node is MIT (8 of 30). A privacy policy of 15 August 2025 (per the 9 October check), a DPA of July 2026 that applies to every customer without signature, and a security overview give retention figures of about 30 days for web server logs and no more than 90 days for backups, and the MCP docs say the server keeps request counters and short-lived logs only. The privacy policy describes its scope as the browser add-on and says only an email address is required, while the DPA lists names, keyword queries and usage data (19 of 30). No deprecation policy was found. The terms allow termination of access at any time without notice, and the only dated API notice is the banner of 7 June 2025 (3 of 20). Six sub-processors are named with purpose and location, with 30 days' notice of changes, and the DPA says data is stored mainly in the EU, also in the United States, and accessed from India (19 of 20). 8+19+3+19 = 49.

SpyFu API 38

Closed service under terms naming SpyFu, Inc., updated 25 February 2019, under Arizona law (15 of 30). The privacy policy carries no date, retention periods, controller or named processors, and says data is moved to the United States (5 of 30). No deprecation policy or notices found (0 of 20). No subprocessors named; data location is the United States (3 of 20). 15+5+0+3 = 23.

Keywords Everywhere API + MCP 54

The MCP server has 14 tools, which is 15 on the MCP line. The size of the definitions wasn't read (15 of 25). num caps the rows returned by keyword and backlink lists and get_keyword_data takes up to 100 keywords a call. No offset, cursor, filter or field selection was found, so a second page of results can't be requested (9 of 20). Errors are JSON with a message such as 402 Insufficient Credits and, on some endpoints, a description. 400 is documented only as invalid request data (11 of 20). Every endpoint and tool is a read, so a retry changes nothing in the account, though a repeated call spends credits again. The vendor says every tool is read-only. Tool annotations weren't read (12 of 20). Most parameters are optional and volume is global when country is omitted. No SDK was found. The vendor publishes an n8n node and code samples in eight languages (7 of 15). 15+9+11+12+7 = 54.

SpyFu API 65

Rows are billed, so page size controls cost; single or multiple rows per request by endpoint, and searchType selects analyses on one endpoint (18 of 25). Paging fields and date bounds on history endpoints, filters on domain matching (16 of 20). 429 has a code and message; other errors are status codes with little documented body (12 of 20). All GET reads, safe to retry (14 of 20). No official SDK found (5 of 15). 18+16+12+14+5 = 65.

Keywords Everywhere API + MCP 10

No dated change to the REST API or the MCP server was found in a source this re-check can use. The newest is the API docs banner of 7 June 2025 (all methods on all plans), and the vendor's n8n node has been at 0.1.5 since 27 April 2025, both over 180 days ago (0). The 9 October award rested on the official registry's version date of 10 September 2026, read from the registry's JSON API, which this re-check doesn't use, and on the July 2026 dates of the security overview and DPA, which record no API change. The extension changelog (newest v11.56, 24 October 2026) covers the browser extension, which isn't graded here. No dated API or MCP entry in the 90 days from 7 August (0). A product news page lists known issues with fix dates, and support is by email. No forum or public issue tracker was found (8 of 15, an earlier partial kept). No registry page could be read, so registry presence rests on the vendor's claim and scores 0, and no SDK was found (0). The n8n node has been at 0.1.5 since 27 April 2025 (2 of 10). 0+0+8+0+2 = 10.

SpyFu API 16

Closed service. No changelog. The newest dated docs change found is 13 July 2026 (the rate-limits and pricing pages' updatedAt), 116 days before this check (10). Reference pages are dated between August 2025 and 9 July 2026, so fewer than three dated changes in 90 days (0). A help centre and support email, with no public changelog or tracker (6 of 15). No official SDK (0). No package to judge (0). 10+0+6+0+0 = 16.

Keywords Everywhere API + MCP 47

One API key per account, sent as a Bearer token and reset through an emailed link. It has no scopes and is shared by every seat on the plan and by the browser extension. The MCP server adds OAuth 2.1 with dynamic client registration, PKCE and 3-hour access tokens, and its docs say the key is stored encrypted with AES-256-GCM. Per the 9 October check, links on the vendor's own site carry the key as an apiKey query parameter to the subscription pages. The API docs show only the header (18 of 30, an earlier partial kept). Every endpoint and tool is read-only and nothing in the account can be changed. A key can spend the whole credit balance, and no cap per key was found (14 of 20). Responses carry third-party anchor text, URLs and keywords, and no prompt-injection guidance was found (3 of 15). Each response returns credits_consumed and the account has a stats page. No per-call log for the customer is documented (5 of 15). The security overview (last updated July 2026) describes access control, patching and 72-hour breach notice, gives privacy@keywordseverywhere.com for security enquiries, and states that the vendor holds no SOC 2 or ISO 27001 certification of its own. No security.txt, vulnerability disclosure policy or bug bounty was found (7 of 20, an earlier partial kept). 18+14+3+5+7 = 47.

SpyFu API 52

An API ID and secret key, sent by Basic auth or by a timestamped HMAC signature, with no scopes found (22), less 10 for the documented api_key query parameter (12 of 30). The API only reads (15 of 20). Ad copy, page titles and SERP data are third-party text, with no prompt-injection guidance (5 of 15). The Account API reports usage by month, day and method (12 of 15). A vulnerability disclosure policy with safe harbour and response targets; security.txt returns 404 and no certification or bug bounty was found (8 of 20). 12+15+5+12+8 = 52.

Keywords Everywhere API + MCP 15

No x402, MPP or L402 (0). Four annual plans are priced in public with their credit amounts, the pricing page says "1 Credit = 1 Keyword", and the docs give a credit cost for every endpoint, so a keyword lookup works out at $0.00084 on Bronze and $0.00018 on Platinum. Credits are sold publicly only inside annual plans, and top-up prices sit behind the account, so plan prices plus a credit formula take 15, as creatomate, bannerbear, placid and templated do (15). The API key is free, but data calls need a paid plan and no trial or free credits were found. Only balance, country and currency lookups cost nothing (0). A person enters an email address in a browser form and follows an emailed link to get the key, and buys a plan through Paddle (0). 0+15+0+0 = 15.

SpyFu API 20

No x402, MPP or L402 (0). Per-row prices for every endpoint are public on the developer site (20). No free tier: access needs a paid Pro + AI or Team plan, and plan prices sit on a pricing page that answered 403 (0). A person signs up and pays in a browser (0). 0+20+0+0 = 20.