Microlink vs Scrapfly

Microlink 52

Graded on the hosted lines. microlink.io/status exists but is drawn by script, showing only 'Please wait' to our reader, and status.microlink.io failed through our proxy, so components and history are unchecked and scored absent (0). No readable history (5). Free and keyed quotas are published, 5 and 25 requests a day and 2 at a time, with paid quotas from 46,000 a month and x-rate-limit headers on every response (15). 429 with ECONCURRENCY says to wait a second and retry, a quota 429 gives the reset time, and every call only reads, but there is no Retry-After header documented (12 of 15). The terms commit to 99.9% uptime on paid plans, with service credits only under an Enterprise agreement (10). Generally available (10). 0 + 5 + 15 + 12 + 10 + 10 = 52.

Scrapfly 85

scrapfly.io/status answers with Statuspage's status JSON, which names its page as scrapfly.statuspage.io. That page has 25 components and incident history back to 2022, read through its history feed on 1 November. The 1 October check read only the overall state and found no history (20, was 10). The newest incident is a Scrapium rendering fault on 21 May 2026, so nothing is posted in the 90 days from 3 August (30, was 5). Concurrency per plan is published (5 on Discovery to 100 on Enterprise) and each project has a configurable per-minute throttle (15). The error catalogue marks every code retryable or not and has three ERR::THROTTLE codes, but we found no Retry-After header or backoff guidance on the errors or throttling pages (10 of 15). The terms disclaim uptime and no uptime SLA is published, and the pricing page's SLA mentions cover support response on Enterprise (0). The Scrape API is GA. Vault and alerting are beta, outside the main surface (10). 20+30+15+10+0+10 = 85.

Microlink 44

One API key per account in the x-api-key header, with no scopes, rotation or expiry documented. auth.md says to keep it out of URLs and no query option is documented (20 of 30). Tools are reads apart from microlink_function, which runs caller-supplied code against the page in Microlink's browser, and the checkout tools never return a key (10 of 20). Pages come back as Markdown and text, and no prompt-injection guidance was found in the docs, auth.md or the MCP README (0). A request id on every response, with no per-call log for the customer documented (4 of 15). security.txt is valid to 28 July 2027 and links a responsible-disclosure policy and acknowledgements. No bug bounty or certification found (10 of 20). 20 + 10 + 0 + 4 + 10 = 44.

Scrapfly 75

OAuth 2 on the hosted MCP with dashboard revocation, open to all plans. API keys are per project, live or test, and since 15 April 2026 can be restricted to products (30). The canonical API form puts the key in the key query parameter and the MCP also accepts ?key=, so less 10 (20 of 30). Product-restricted keys, confirm=true on every mutating vault and alert tool, info_api_key off in server-key mode, and the self-hosted HTTP server binds loopback by default. Since v1.4.0 Cloud Browser sessions are scoped to the API key that opened them (15 of 20). The source gates mutating vault tools behind a preview step because prompt injection can reach them and redacts keys from CDP URLs. We found no user-facing guidance on untrusted page content (8 of 15). Monitoring shows every call as a log with its error, credit cost line by line and Unblocker state, with replay, per the 24 October release notes, as well as per-domain metrics and alerting. The 1 October check couldn't confirm per-request logs (15, was 10). security.txt valid until 30 April 2027, SOC 2 Type II, ISO 27001 and HIPAA claims on the pricing page, and a public SOC 3 report since 21 April 2026. No bug bounty found (17 of 20). 20+15+8+15+17 = 75.

Microlink 47

No x402, MPP or L402 (0). Plans are public and the Pro price is stated per 1,000 requests ($1.07), but Business and Enterprise are on request (15 of 20). Free key with 25 requests a day, no card (20). The free endpoint and hosted MCP server answer 5 requests a day with no key or signup, and the MCP checkout tools let an agent start a purchase that a person completes (12 of 20). 0 + 15 + 20 + 12 = 47.

Scrapfly 40

No x402, MPP or L402 (0). Credit costs per request type (1 datacentre, 5 with rendering or Unblocker, 25 residential, 60 full-page screenshot) and plan prices are public. Unblocker surcharges per target aren't published, but cost_budget caps them (20). 1,000 free credits, no card, no time limit (20). A person signs up in a browser. OAuth still needs an account (0). Plan prices and the 1,000 free credits with no card re-read on the pricing page on 1 November. 0+20+20+0 = 40.

Microlink 89

OpenAPI 3.1 at microlink.io/openapi.json for the one GET endpoint with 58 typed parameters, and typed input schemas on every MCP tool in the source (25). llms.txt of 527 lines, auth.md, an API catalogue and Markdown copies of every docs page (10). Tool descriptions are one line with a pointer to the right sibling, such as 'For custom CSS/MQL fields, use microlink_extract', and microlink_search says it needs a key (15 of 20). Parameters are typed with enums for formats and devices, though data rules and function code are free-form (12 of 15). Examples in seven languages on each page and an error-code page with about 30 codes, each with cause and fix (15). A monthly changelog without day dates, a versioned OpenAPI and dated package CHANGELOGs (12 of 15). 25 + 10 + 15 + 12 + 15 + 12 = 89.

Scrapfly 95

A Swagger reference per the 30 September check, and the MCP server exposes it as a web_scraping_openapi_specification resource. Every MCP tool has JSON Schema inputs generated from typed Go structs (25). llms.txt and Markdown twins such as pricing.md per the 30 September check. robots.txt still disallows /docs/llms.txt and the .md twins for crawlers it doesn't name, so they weren't re-read on 1 November (10). Descriptions say when to use a tool and when to switch, for example web_get_page falls back to web_scrape for tuning and to cloud_browser_open for interaction. A few are long and steer the model's next step (17 of 20). Typed inputs with enums, for example the vault service discriminator, and required fields (13 of 15). Error catalogue of 100+ ERR:: codes, each with HTTP status, retryable and billed flags and its own doc link (15). Dated release notes, newest 26 October 2026 (15). 25+10+17+13+15+15 = 95.