NewsCatcher vs Tavily API + MCP

NewsCatcher 30

No x402, MPP or L402 (0). Credit prices per call published without login, and credits cost $1 per 1,000 through top-ups from $25 (20). 10,000 free credits every 30 days on a $0 plan, and the first top-up moves an account to pay as you go. No page says whether a card is needed to open the free plan, so half (10). A person signs up in the platform in a browser to get a key (0). NewsMCP's keyless tier belongs to a separate product and isn't counted. 0 + 20 + 10 + 0 = 30.

Tavily API + MCP 75

Official x402 at x402.tavily.com sells advanced search only, $0.01 in USDC on Base. An unpaid POST to /search returned 402 on 1 November with an x402 version 2 envelope offering the exact scheme on eip155:8453 for 10000 units (0.01 USDC), and a second agent-pay option on aws:base for 0.016, described as advanced mode. Extract, map, crawl and research aren't sold over x402 (15). Credit costs per endpoint and $0.008 a credit pay as you go, published without a login and unchanged on 1 November (20). 1,000 free credits a month, no card, re-read on 1 November (20). Keyless search and extract with the X-Tavily-Access-Mode: keyless header, plus the x402 route, so an agent needs no human signup (20).

NewsCatcher 67

Read with the hosted lines, for the News API, the agent and the hosted MCP server. status.newscatcherapi.com (Hyperping) shows one News API component with 99.820% uptime from August to November 2026 and an incident history. The agent and the MCP server have no component of their own (20). In the 90 days from 8 August, one incident, on 1 September 2026, when the vendor wrote that for about four hours a higher-than-usual number of requests to the production News API timed out because of one client's queries. Read as one major (10). Rate limits published per plan, 1 request a second free and up to 10 on pay as you go, with exact limits from the free GET /subscription (15). 429 carries Retry-After with instructions to retry the same request, 503 carries Retry-After, and failed or refused requests are not charged. Agent runs and monitor creation have no idempotency keys (12 of 15). An uptime SLA exists only in signed Enterprise agreements; none is published (0). Generally available since 30 October 2026, with OAuth for the MCP server announced as coming soon (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.

Tavily API + MCP 90

incident.io status page at status.tavily.com with separate API, MCP and website components (20). One incident in the 90 days from 3 August, website degraded performance on 17 September 2026, and none since per the status feed re-read on 1 November. The API and MCP showed 100% per the 1 October check (30). Published limits, re-read on 1 November, 100 requests a minute on development keys and 1,000 on production, crawl 100 and research 20 task creations on both (15). 429 carries Retry-After and the docs say to use that value and the status code rather than parse the message. Since October a 434 tells non-paying plans that live fetching with max_age_hours is refused under load, with the advice to retry or omit it (15). The pricing page lists 'Enterprise-grade support and SLAs' for the custom Enterprise plan but publishes no SLA terms, per the 17 October check, and none were found in the docs index or terms (0). GA (10).

NewsCatcher 79

The API is closed under terms of 2 November 2026 naming NewsCatcher, Inc., and the MCP server is MIT, so between the two bands (20 of 30). The terms say inputs and generated data are not used to train models, a DPA applies automatically, and the privacy policy gives retention periods (server logs 7 days, API logs with query text 90 days, then archived indefinitely, billing records about seven years). They agree with each other, but indefinite archives of query logs hold it back (22 of 30). The terms promise 30 days' email notice before a paid product or API version is discontinued, with refunds of unused credits, and the v3 News API has a migration guide (15 of 20). A sub-processor list dated 2 November 2026 with each provider's location and the data it handles. The MCP repository deploys to Vercel and can send pseudonymised analytics to PostHog, and neither appears on the list (16 of 20). 20 + 22 + 15 + 16 = 73.

Tavily API + MCP 62

MCP server MIT and SDKs open, API closed under platform terms (18). The privacy policy (last updated 24 November 2025, re-read on 1 November) keeps data for the life of the account with no fixed periods, says query data may be used to improve future responses unless a contract says otherwise, and describes no zero-retention option. No DPA on the privacy page, and the trust centre didn't render for us (per the 1 October check, not re-read on 1 November) (15). No deprecation policy or dated deprecation notices found, and none in the changelog on 1 November (0). Names Stripe, Google Analytics, Google Tag Manager, PostHog and third-party search index providers such as Google, with US processing under Standard Contractual Clauses (14).

NewsCatcher 76

Read for a closed service, with the MCP repository read as code. News API 1.1.0 and Agent 1.5.0 on 4 November 2026, MCP server 0.1.0 on 6 November and v3 News API 3.25.0 on 6 November (30). In the 90 days from 8 August, the 30 October launch, News API 1.1.0, Agent 1.5.0, MCP 0.1.0 and v3 releases 3.19.0 to 3.25.0 (20). Public dated changelogs, support by email and Pylon, and a security policy with a 3-business-day target. The MCP repository is a day old, so there are no issues to judge (10 of 15). The CatchAll MCP server is in the official registry under the verified namespace com.newscatcherapi, but the new server isn't, and no official SDK for the current API was found; the Enterprise APIs list libraries (8 of 15). The MCP repository runs its test suite in CI with a read-only token; pass state not read (8 of 10). 30 + 20 + 10 + 8 + 8 = 76.

Tavily API + MCP 85

@tavily/core 0.7.14 on npm, published on 6 October 2026, and tavily-python bumped to 0.8.5 in the repository the same day (PyPI's pages and release feed returned nothing to us on 1 November, so its publication there is unchecked). No newer SDK release by 1 November, so this line drops to 20 after 5 November unless one lands (30). The tavily-mcp npm release is older, 0.2.22 on 5 August 2026. Version 0.2.23 was committed on 16 September and still isn't on npm on 1 November, though the MCP repository had dependency bumps on 15 and 26 October and new descriptions on 27 October. Eight @tavily/core releases on npm since 5 August, tavily-python version bumps in its repository, tavily-mcp 0.2.22, and August and October changelog entries in the last 90 days (20). Maintainers merge pull requests and dependency fixes within days. Ten issues were open on tavily-mcp on 4 October, the oldest from 14 July 2026, including OAuth failures (#203, #220), empty extracts on single-page sites (#204) and a missing isError on a 401 (#211), per the 4 October check, not re-read on 1 November (GitHub answered 403) (15). Listed in the official MCP registry as io.github.tavily-ai/tavily-mcp, though the entry is still at 0.2.15 from 26 January 2026 on 1 November (15). The MCP repo has no CI workflows and no git tags, though it has a test file and regular security bumps. tavily-python runs tests in CI (5).

NewsCatcher 45

API keys in the x-api-key header, several per account, revocable in the platform, with advice to keep one per application. A 403 for 'a key that may not use this API' suggests per-key API access, but no scopes are documented (20). The MCP server documents ?apiKey= on the server URL for Claude.ai custom connectors, with a warning, so less 10 (10 of 30). The MCP repository's SECURITY.md says URL keys are rejected unless the operator enables them, which the hosted server does per the docs. Toolsets let an operator load only the read-only news tools, write tools carry destructiveHint, and the server tells the assistant to confirm large or hourly agent jobs (14 of 20). Results are third-party article text and summaries, and no prompt-injection guidance was found in the docs or the MCP server's instructions (0 of 15). Every response carries a Correlation-ID, GET /subscription shows usage and balance, and runs are listed in the platform. No per-call audit log for the customer was found (7 of 15). The security page and footer claim SOC 2 Type II and link a trust centre on Oneleet, which wasn't read. A vulnerability disclosure policy covers the MCP server. No security.txt (404) and no bug bounty found (14 of 20). 10 + 14 + 0 + 7 + 14 = 45.

Tavily API + MCP 52

Revocable keys, separate development and production keys, and the Logs API filters by key, so several keys per account work. The hosted MCP adds OAuth but maps it to one dashboard key with no scopes (22). The MCP README and docs still lead with ?tavilyApiKey= in the URL on 1 November (minus 10). The five tools in the npm release all read. The GitHub main branch adds tavily_feedback, which posts scores to Tavily, the hosted server's tool list is unknown, and there's no read-only toolset (10). The home page says requests pass through 'security, privacy, and content validation layers that block PII leakage, prompt injection, and malicious sources'. That's a claim with no technical detail in the docs, plus a safe_search flag for adult content, per the 1 October check (7). The Logs API (filter by key and endpoint since August 2026) and include_usage give per-call visibility (13). SOC 2 and ISO 27001 named on the privacy page, per the 4 October check, and the MCP repo patches vulnerable dependencies about monthly (seven updates on 26 October). The trust centre is JavaScript-only for us (per the 1 October check, not re-read on 1 November), www.tavily.com/.well-known/security.txt returned 404 on 1 November, and no bug bounty found (10).