NewsCatcher vs SpecStream

NewsCatcher 30

No x402, MPP or L402 (0). Credit prices per call published without login, and credits cost $1 per 1,000 through top-ups from $25 (20). 10,000 free credits every 30 days on a $0 plan, and the first top-up moves an account to pay as you go. No page says whether a card is needed to open the free plan, so half (10). A person signs up in the platform in a browser to get a key (0). NewsMCP's keyless tier belongs to a separate product and isn't counted. 0 + 20 + 10 + 0 = 30.

SpecStream 85

x402 v2 (USDC on Base, Arbitrum or Polygon, Permit2 upto for the quoted maximum, settled for the results cost) and MPP by card on SpecStream's own POST /v1/agent/lists, the route for buying a list of 1 to 500 results without an account; enrichment of imported lists, refreshes, monitors and investigations need an account, and the route was read in the docs and not exercised because api.specstream.ai's robots.txt could not be read, so partial (25). Per-result prices published without a login, 5, 15 or 100 cents a result, 5 cents an email, 15 cents a phone, rechecks at half rate or 1 cent (20). $10 of work for 30 days with no card (20). An agent can buy a list over x402 or MPP with no account, and the A2A endpoint prices a request without a key (20). 25+20+20+20 = 85.

NewsCatcher 67

Read with the hosted lines, for the News API, the agent and the hosted MCP server. status.newscatcherapi.com (Hyperping) shows one News API component with 99.820% uptime from August to November 2026 and an incident history. The agent and the MCP server have no component of their own (20). In the 90 days from 8 August, one incident, on 1 September 2026, when the vendor wrote that for about four hours a higher-than-usual number of requests to the production News API timed out because of one client's queries. Read as one major (10). Rate limits published per plan, 1 request a second free and up to 10 on pay as you go, with exact limits from the free GET /subscription (15). 429 carries Retry-After with instructions to retry the same request, 503 carries Retry-After, and failed or refused requests are not charged. Agent runs and monitor creation have no idempotency keys (12 of 15). An uptime SLA exists only in signed Enterprise agreements; none is published (0). Generally available since 30 October 2026, with OAuth for the MCP server announced as coming soon (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.

SpecStream 23

Hosted reading, for the MCP server and REST API on api.specstream.ai. No public status page was found. None is linked from the site, llms.txt or the docs, llms-full.txt mentions none, and https://specstream.ai/status returned an error (0). No readable incident history, so the floor (5). No rate limit with numbers is published in the docs, llms.txt, llms-full.txt or the part of the OpenAPI file read; the privacy policy and DPA mention rate limiting without figures, and the published limits are per job (10,000 results a request, four-hour runs, 20,000 imported rows) (0). Nothing documents 429, Retry-After or backoff, but paid work requires an idempotency_key on authorize_capacity_work and POST /v1/capacity/executions, GET /v1/capacity/requests/{request_key} recovers the original find after an uncertain response, and the skills say never to quote again to recover a lost reply (8 of 15). No SLA on any plan, and the terms say 'We do not promise uninterrupted access' (0). No beta or preview label on the API, the MCP server or the SDKs, which PyPI classifies as production and stable at 1.2 (10). 0+5+0+8+0+10 = 23.

NewsCatcher 45

API keys in the x-api-key header, several per account, revocable in the platform, with advice to keep one per application. A 403 for 'a key that may not use this API' suggests per-key API access, but no scopes are documented (20). The MCP server documents ?apiKey= on the server URL for Claude.ai custom connectors, with a warning, so less 10 (10 of 30). The MCP repository's SECURITY.md says URL keys are rejected unless the operator enables them, which the hosted server does per the docs. Toolsets let an operator load only the read-only news tools, write tools carry destructiveHint, and the server tells the assistant to confirm large or hourly agent jobs (14 of 20). Results are third-party article text and summaries, and no prompt-injection guidance was found in the docs or the MCP server's instructions (0 of 15). Every response carries a Correlation-ID, GET /subscription shows usage and balance, and runs are listed in the platform. No per-call audit log for the customer was found (7 of 15). The security page and footer claim SOC 2 Type II and link a trust centre on Oneleet, which wasn't read. A vulnerability disclosure policy covers the MCP server. No security.txt (404) and no bug bounty found (14 of 20). 10 + 14 + 0 + 7 + 14 = 45.

SpecStream 73

API keys ss_live_... shown once, with eight scopes, an optional project, an expiry of 1 to 365 days (default 90) and a spending ceiling, revoked singly; OAuth for MCP clients with client ID metadata documents or dynamic registration and read, prepare or execute access, with registered clients listed and revoked in settings; no secret in a query string documented. The authorisation server metadata on api.specstream.ai was not read and rotation is not described beyond expiry (28 of 30). Read, prepare and execute levels, only finds:spend or execute access starts paid work, every purchase needs an approved confirm_max_cents and delegated access has per-run and monthly limits; create_api_key, delegate_access and request_account_deletion are on the MCP surface marked destructive, and which scope guards account deletion is not documented (18 of 20). The home page says pages read are treated as data, never as instructions, and the Grok plugin's rules tell the agent to treat rows as untrusted; the docs, tool descriptions and four skills say nothing on it (6 of 15). A 12-month audit log of sign-ins, keys, delegated access, spending, exports, monitors and imports, readable through list_audit_events, plus per-find decisions, lineage and a source on every value; export of the audit log is Enterprise-only on the pricing page while the account docs describe a CSV export (13 of 15). security.txt is valid until October 2027 with support@specstream.ai, and SECURITY.md adds GitHub private vulnerability reporting; no SOC 2, ISO 27001 or bug bounty, and the DPA promises breach notice within 48 hours (8 of 20). 28+18+6+13+8 = 73.

NewsCatcher 84

15 MCP tools in four toolsets, chosen per connection with ?tools=, and tools return compact text rather than the full JSON. 15 for 11 to 30 tools plus 7 for toolsets (22 of 25). limit, search_window, effort, language, country, publisher, coverage and content-type filters, sorting, and paging on /articles; agent tables come back up to 200 rows at a time over MCP (20). Every status is documented with whether to retry; the agent returns stable code values, while the News API body has a status_code and a message meant for people (17 of 20). Every tool carries readOnlyHint and idempotentHint, writes carry destructiveHint, start_research has a free dry_run, and refused or failed calls aren't charged. No idempotency key for starting runs (17 of 20). Only q is required, with medium effort and a 7-day window as defaults. No official SDK for the current API was found; the docs show raw HTTP in three languages (8 of 15). 22 + 20 + 17 + 17 + 8 = 84.

SpecStream 65

MCP reading. 128 tools at about 143,700 characters of names, descriptions and schemas (more than 30, 5), with no server-side toolsets or dynamic loading; the framework packages for LangChain, LlamaIndex, CrewAI and the Vercel AI SDK and the Open WebUI tool expose two to four tools with the price cap held in code, and results default to short evidence (5 back, 10 of 25). Cursor and limit on rows, search, specs and revisits, evidence short or full, filters by area and by field on collections, and unconfirmed candidates kept in a separate list (18 of 20). An ErrorEnvelope on every operation and an SDK error class that exposes code and details, but no published code list, meanings or retry rules (6 of 20). Required idempotency keys on paid work, schedules and refund claims with a recovery route, expected_version on updates, stable event ids on webhook retries, and readOnlyHint on 72 tools and destructiveHint on 29, with no idempotentHint (18 of 20). compile needs only q, a quote needs only ast_hash with 25 results by default, and official SDKs in Python and TypeScript with a CLI, though one purchase takes three calls with a hash carried between them (13 of 15). 10+18+6+18+13 = 65.

NewsCatcher 94

OpenAPI 3.1 for the News API (version 1.3.9, 4 paths) and the agent (version 1.5.1, 33 paths), linked from llms.txt, and typed JSON Schema on every MCP tool through Pydantic (25). llms.txt, a Markdown copy of every page and a docs MCP server (10). MCP tool descriptions say when to use each and which tool to use instead, such as list_articles for older news; the REST reference explains each endpoint and the 'Choose an API' page compares them (17 of 20). Inputs are typed with enums for effort, mode and dimensions, length and range limits such as a 500-character query and limit 1 to 100, and required fields marked (13 of 15). Runnable examples in curl, Python and JavaScript, and an error table with retry advice for every status. The agent spec carries no response examples (14 of 15). Versioned APIs with a dated changelog, the latest entries on 4 November 2026, and separate changelogs for the v3 News API and CatchAll (15). 25 + 10 + 17 + 13 + 14 + 15 = 94.

SpecStream 80

MCP reading, with the REST API described. The tool list shipped in specstream-mcp-stdio 1.2.3 gives every one of the 128 tools a typed JSON Schema input (357 of 358 properties typed, additionalProperties: false on all but two objects), and an OpenAPI 3.1 file at https://specstream.ai/openapi.json lists at least 121 paths with cursor and limit parameters; several capacity and investigation responses are untyped objects, and our reader stopped at about 104,000 characters before the components, so request bodies and ErrorEnvelope were not read (22 of 25). llms.txt, llms-full.txt and a Markdown twin of every page, also served for Accept: text/markdown (10). Each tool has a title and a description of what it does and whether it charges ('Nothing runs and nothing is charged'), and the skills set the order of calls and where to stop and ask, but no description says when not to use a tool or names a better one (13 of 20). 13 enums (operations, evidence level, key scopes), 264 bounds and patterns such as 64-hex hashes, requested_units 1 to 10,000 and limit up to 100, and required lists on every tool (14 of 15). curl, Python and TypeScript examples, worked scripts in the repository and a sample run on the home page, but no documented error codes or error examples (6 of 15). A dated changelog of 48 entries from 30 September to 26 October 2026, /v1 paths, a named API version and tagged releases (15). 22+10+13+14+6+15 = 80.

NewsCatcher 79

The API is closed under terms of 2 November 2026 naming NewsCatcher, Inc., and the MCP server is MIT, so between the two bands (20 of 30). The terms say inputs and generated data are not used to train models, a DPA applies automatically, and the privacy policy gives retention periods (server logs 7 days, API logs with query text 90 days, then archived indefinitely, billing records about seven years). They agree with each other, but indefinite archives of query logs hold it back (22 of 30). The terms promise 30 days' email notice before a paid product or API version is discontinued, with refunds of unused credits, and the v3 News API has a migration guide (15 of 20). A sub-processor list dated 2 November 2026 with each provider's location and the data it handles. The MCP repository deploys to Vercel and can send pseudonymised analytics to PostHog, and neither appears on the list (16 of 20). 20 + 22 + 15 + 16 = 73.

SpecStream 66

Closed hosted service under terms of 3 November 2026 naming SpecStream SAS, French law and a liability cap of the greater of 12 months' fees or 100 euros; the client code is MIT (20 of 30). The privacy policy and DPA agree with each other and the about page on EU hosting, no training on customer requests, lists or results, and a retention table (server logs 30 days, backups 8 days, page copies 24 hours, run working copies 7 days, audit log 12 months, support 3 years, accounts until deleted, erased from backups within 8 days of deletion), with breach notice in 48 hours and audit rights; the pricing page and the account docs disagree on who can export the audit log (27 of 30). No API deprecation policy; the changelog dates a price cut of 26 October 2026 that kept approved quotes at their old prices, the terms promise notice of material changes and keep historical quotes on their terms, and the DPA gives 30 days' notice of a new subprocessor (8 of 20). Subprocessors are listed by category with locations and transfer safeguards, hosting on IBM Cloud in Madrid is named in the legal notice, and names are available only on request (12 of 20). 20+27+8+12 = 67.