NewsCatcher vs SerpApi

NewsCatcher 94

OpenAPI 3.1 for the News API (version 1.3.9, 4 paths) and the agent (version 1.5.1, 33 paths), linked from llms.txt, and typed JSON Schema on every MCP tool through Pydantic (25). llms.txt, a Markdown copy of every page and a docs MCP server (10). MCP tool descriptions say when to use each and which tool to use instead, such as list_articles for older news; the REST reference explains each endpoint and the 'Choose an API' page compares them (17 of 20). Inputs are typed with enums for effort, mode and dimensions, length and range limits such as a 500-character query and limit 1 to 100, and required fields marked (13 of 15). Runnable examples in curl, Python and JavaScript, and an error table with retry advice for every status. The agent spec carries no response examples (14 of 15). Versioned APIs with a dated changelog, the latest entries on 4 November 2026, and separate changelogs for the v3 News API and CatchAll (15). 25 + 10 + 17 + 13 + 14 + 15 = 94.

SerpApi 67

No OpenAPI or similar spec for the REST API. The MCP server publishes per-engine parameter lists as resources (serpapi://engines/<engine>), which we count as a partial contract (10). llms.txt, pricing.md and Markdown twins of the docs pages, such as search-api.md (10). Each engine page describes every parameter, and the MCP tool says when to use it but not when not to (14). Parameters list allowed values on the engine pages, but the MCP search tool takes one free-form params object (7). Examples on every engine page, and a status-and-errors page documents 400, 401, 403, 404, 410, 429 and 5xx with a JSON error field (14). Dated release notes with several entries a week, though the API itself isn't versioned (12).

NewsCatcher 76

Read for a closed service, with the MCP repository read as code. News API 1.1.0 and Agent 1.5.0 on 4 November 2026, MCP server 0.1.0 on 6 November and v3 News API 3.25.0 on 6 November (30). In the 90 days from 8 August, the 30 October launch, News API 1.1.0, Agent 1.5.0, MCP 0.1.0 and v3 releases 3.19.0 to 3.25.0 (20). Public dated changelogs, support by email and Pylon, and a security policy with a 3-business-day target. The MCP repository is a day old, so there are no issues to judge (10 of 15). The CatchAll MCP server is in the official registry under the verified namespace com.newscatcherapi, but the new server isn't, and no official SDK for the current API was found; the Enterprise APIs list libraries (8 of 15). The MCP repository runs its test suite in CI with a read-only token; pass state not read (8 of 10). 30 + 20 + 10 + 8 + 8 = 76.

SerpApi 82

Release notes carry dated entries almost daily, the latest on 2 November 2026, and serpapi-python 1.2.0 shipped on 30 October (30). Since 4 August, serpapi-python 1.1.0, 1.1.1, 1.1.2 and 1.2.0, MCP server 1.0.3 and 2.0.0, and serpapi-cli 0.3.0, 0.4.0 and 0.5.0, besides the release notes (20). Release notes run several entries a week and the MCP repo merged a fix on 27 October. Open issues weren't read, since GitHub's pages refuse our reader (12). The MCP server is in the official registry as io.github.serpapi/serpapi-mcp and the Python SDK and CLI are current, but the JavaScript SDK's last release is still 2.2.1 of 26 July 2025 (12). The MCP, Python and CLI repositories run tests in CI; pass state not read (8).

NewsCatcher 45

API keys in the x-api-key header, several per account, revocable in the platform, with advice to keep one per application. A 403 for 'a key that may not use this API' suggests per-key API access, but no scopes are documented (20). The MCP server documents ?apiKey= on the server URL for Claude.ai custom connectors, with a warning, so less 10 (10 of 30). The MCP repository's SECURITY.md says URL keys are rejected unless the operator enables them, which the hosted server does per the docs. Toolsets let an operator load only the read-only news tools, write tools carry destructiveHint, and the server tells the assistant to confirm large or hourly agent jobs (14 of 20). Results are third-party article text and summaries, and no prompt-injection guidance was found in the docs or the MCP server's instructions (0 of 15). Every response carries a Correlation-ID, GET /subscription shows usage and balance, and runs are listed in the platform. No per-call audit log for the customer was found (7 of 15). The security page and footer claim SOC 2 Type II and link a trust centre on Oneleet, which wasn't read. A vulnerability disclosure policy covers the MCP server. No security.txt (404) and no bug bounty found (14 of 20). 10 + 14 + 0 + 7 + 14 = 45.

SerpApi 40

One account key with no scopes found (10), documented as the api_key query parameter on every REST call, and the MCP README leads with the key in the URL path. The hosted MCP also accepts Authorization: Bearer (minus 10). Search is read-only and the MCP tool carries read-only annotations, but there's no least-privilege key (15). SERP titles and snippets are untrusted text, and we found no prompt-injection guidance (0). The Search Archive API returns any search from the last 31 days, and the security page says audit logs cover all critical parts of the service (10). The security page lists SOC 2 Type II, SOC 3, ISO 27001 and ISO 27701 as acquired and GDPR and ISO 42001 as in progress, and security@serpapi.com takes reports. serpapi.com/security.txt is valid (expires 1 January 2027), though the /.well-known/ path answers with the HTML security page. No bug bounty or public advisories found (15).

NewsCatcher 79

The API is closed under terms of 2 November 2026 naming NewsCatcher, Inc., and the MCP server is MIT, so between the two bands (20 of 30). The terms say inputs and generated data are not used to train models, a DPA applies automatically, and the privacy policy gives retention periods (server logs 7 days, API logs with query text 90 days, then archived indefinitely, billing records about seven years). They agree with each other, but indefinite archives of query logs hold it back (22 of 30). The terms promise 30 days' email notice before a paid product or API version is discontinued, with refunds of unused credits, and the v3 News API has a migration guide (15 of 20). A sub-processor list dated 2 November 2026 with each provider's location and the data it handles. The MCP repository deploys to Vercel and can send pseudonymised analytics to PostHog, and neither appears on the list (16 of 20). 20 + 22 + 15 + 16 = 73.

SerpApi 84

The API is closed under one terms-and-privacy page, and the MCP server is MIT (18). The legal page and the security page agree that search data is deleted after 31 days, ZeroTrace mode (an enterprise parameter) stores nothing, and a DPA is available on request (26). Deprecations show up as dated release notes, such as eBay's Sold and Completed filters on 28 September 2026, but there's no notice policy, and the terms allow termination without notice (8). Named subprocessors (AWS, Cloudflare, Wasabi, Stripe, Intercom and others) and US hosting with Standard Contractual Clauses (18).