NewsCatcher vs TinyFish Search

NewsCatcher 79

The API is closed under terms of 2 November 2026 naming NewsCatcher, Inc., and the MCP server is MIT, so between the two bands (20 of 30). The terms say inputs and generated data are not used to train models, a DPA applies automatically, and the privacy policy gives retention periods (server logs 7 days, API logs with query text 90 days, then archived indefinitely, billing records about seven years). They agree with each other, but indefinite archives of query logs hold it back (22 of 30). The terms promise 30 days' email notice before a paid product or API version is discontinued, with refunds of unused credits, and the v3 News API has a migration guide (15 of 20). A sub-processor list dated 2 November 2026 with each provider's location and the data it handles. The MCP repository deploys to Vercel and can send pseudonymised analytics to PostHog, and neither appears on the list (16 of 20). 20 + 22 + 15 + 16 = 73.

TinyFish Search 60

The service is closed with published terms effective 17 August 2026. The MCP proxy is MIT and the SDK packages carry no licence metadata (15). The terms allow customer data to be used to train TinyFish's AI models. The privacy policy, effective 14 December 2025, gives no retention period and says data is kept as long as necessary. No DPA was found on the pages we read (10). No deprecation policy was found. The terms give 30 days' notice of changes to the terms and 14 days for rate increases, and the reference marks site: operators as deprecated with no date (5, as the TinyFish platform listing reads the same terms). No sub-processor list or hosting location was found on readable pages. The enterprise page says data residency is agreed in the contract, and the trust centre is drawn by script and was not read (3, as the platform listing). 15 + 10 + 5 + 3 = 33.

NewsCatcher 30

No x402, MPP or L402 (0). Credit prices per call published without login, and credits cost $1 per 1,000 through top-ups from $25 (20). 10,000 free credits every 30 days on a $0 plan, and the first top-up moves an account to pay as you go. No page says whether a card is needed to open the free plan, so half (10). A person signs up in the platform in a browser to get a key (0). NewsMCP's keyless tier belongs to a separate product and isn't counted. 0 + 20 + 10 + 0 = 30.

TinyFish Search 45

The Machine Payments Protocol is documented on POST /v1/wallet/top-up only. It funds a prepaid wallet for an existing account, needs the API key and is rolling out gradually. An unauthenticated Search request returned 401, not a payment challenge (10). The pricing page states $0.00 a request without login, re-read on 2 November, but the docs say requests past 12,000 a day need a wallet balance and no rate for them is published (15). Free with no card (20). A person has to sign up in a browser to create a key (0). 10 + 15 + 20 + 0 = 45.

NewsCatcher 94

OpenAPI 3.1 for the News API (version 1.3.9, 4 paths) and the agent (version 1.5.1, 33 paths), linked from llms.txt, and typed JSON Schema on every MCP tool through Pydantic (25). llms.txt, a Markdown copy of every page and a docs MCP server (10). MCP tool descriptions say when to use each and which tool to use instead, such as list_articles for older news; the REST reference explains each endpoint and the 'Choose an API' page compares them (17 of 20). Inputs are typed with enums for effort, mode and dimensions, length and range limits such as a 500-character query and limit 1 to 100, and required fields marked (13 of 15). Runnable examples in curl, Python and JavaScript, and an error table with retry advice for every status. The agent spec carries no response examples (14 of 15). Versioned APIs with a dated changelog, the latest entries on 4 November 2026, and separate changelogs for the v3 News API and CatchAll (15). 25 + 10 + 17 + 13 + 14 + 15 = 94.

TinyFish Search 82

A public OpenAPI 3.0 document for Search at agent.tinyfish.ai/v1/openapi/search, with two operations, per the 8 October check, not re-read on 2 November because that host now redirects robots.txt to sign-in (25). llms.txt, llms-full.txt and a Markdown twin of each docs page (10). The docs say when to use Search and when to use Fetch, Agent or Browser, and the MCP search description says when to skip it. That description also tells the model to prefer it over native search tools (17). domain_type is an enum and integers have bounds, but dates, country and language are plain strings, domain lists are comma-separated strings and fetch is a JSON-encoded string (10). An examples page, and an error reference with a JSON body for each code (14). The OpenAPI document is version 1.0.0 and the Search host has no version in its path. The Pulse changelog's newest entry is the week of 22 June 2026 and docs.tinyfish.ai/changelog returns 404 (6). 25 + 10 + 17 + 10 + 14 + 6 = 82.

NewsCatcher 45

API keys in the x-api-key header, several per account, revocable in the platform, with advice to keep one per application. A 403 for 'a key that may not use this API' suggests per-key API access, but no scopes are documented (20). The MCP server documents ?apiKey= on the server URL for Claude.ai custom connectors, with a warning, so less 10 (10 of 30). The MCP repository's SECURITY.md says URL keys are rejected unless the operator enables them, which the hosted server does per the docs. Toolsets let an operator load only the read-only news tools, write tools carry destructiveHint, and the server tells the assistant to confirm large or hourly agent jobs (14 of 20). Results are third-party article text and summaries, and no prompt-injection guidance was found in the docs or the MCP server's instructions (0 of 15). Every response carries a Correlation-ID, GET /subscription shows usage and balance, and runs are listed in the platform. No per-call audit log for the customer was found (7 of 15). The security page and footer claim SOC 2 Type II and link a trust centre on Oneleet, which wasn't read. A vulnerability disclosure policy covers the MCP server. No security.txt (404) and no bug bounty found (14 of 20). 10 + 14 + 0 + 7 + 14 = 45.

TinyFish Search 57

Revocable API keys shown once, with several keys allowed per account, sent in the X-API-Key header. No scopes were found, and one key covers every TinyFish API including the ones that spend wallet funds. The MCP server uses OAuth 2.1 (20). Search is read-only, but a key or MCP connection cannot be limited to Search (8). Search snippets are untrusted. TinyFish's Fireworks integration guide says search snippets "can contain prompt injection" and its sample system prompt says never to follow instructions found in them, but the Search reference and overview carry no such guidance. Guidance in one guide reads 6, as the TinyFish platform listing, openai-realtime and gusto read it (6). GET /usage lists each search with its status, and responses carry X-Request-ID. Audit logs are listed under Enterprise (10). Valid security.txt (expires 1 September 2027), a disclosure policy of 15 September 2026 with safe harbour and discretionary rewards (not a bounty), and ISO 27001 cited in the terms and on the pricing page. The trust centre could not be read. Read as the TinyFish platform listing reads the same programme (13). 20 + 8 + 6 + 10 + 13 = 57.

NewsCatcher 84

15 MCP tools in four toolsets, chosen per connection with ?tools=, and tools return compact text rather than the full JSON. 15 for 11 to 30 tools plus 7 for toolsets (22 of 25). limit, search_window, effort, language, country, publisher, coverage and content-type filters, sorting, and paging on /articles; agent tables come back up to 200 rows at a time over MCP (20). Every status is documented with whether to retry; the agent returns stable code values, while the News API body has a status_code and a message meant for people (17 of 20). Every tool carries readOnlyHint and idempotentHint, writes carry destructiveHint, start_research has a free dry_run, and refused or failed calls aren't charged. No idempotency key for starting runs (17 of 20). Only q is required, with medium effort and a 7-day window as defaults. No official SDK for the current API was found; the docs show raw HTTP in three languages (8 of 15). 22 + 20 + 17 + 17 + 8 = 84.

TinyFish Search 78

Results are compact (position, site name, title, snippet, URL) and thumbnails are opt-in, but no parameter sets how many results come back. The hosted MCP server's docs page lists 35 tools on 2 November (the repository reference still lists 28), with no documented search-only subset (15). page from 0 to 10, domain include and exclude lists, date and recency windows, country, language and domain_type, with no result-count control (16). Stable error codes with messages, a details object on account rate limits and a request_id on every error (19). Search is a GET that is safe to repeat and the docs give retry guidance. No read-only annotations appear in the published MCP tool reference (13). Only query is required, and there are official Python and TypeScript SDKs (15). 15 + 16 + 19 + 13 + 15 = 78.