NewsCatcher vs You.com APIs

NewsCatcher 30

No x402, MPP or L402 (0). Credit prices per call published without login, and credits cost $1 per 1,000 through top-ups from $25 (20). 10,000 free credits every 30 days on a $0 plan, and the first top-up moves an account to pay as you go. No page says whether a card is needed to open the free plan, so half (10). A person signs up in the platform in a browser to get a key (0). NewsMCP's keyless tier belongs to a separate product and isn't counted. 0 + 20 + 10 + 0 = 30.

You.com APIs 88

x402 (USDC on Base or Solana) and MPP (USDC on Tempo) on GET /v1/search, /v1/agents/search and POST /v1/finance_research. On 1 November an unpaid GET https://api.you.com/v1/search returned 402 with an x402 v2 PAYMENT-REQUIRED challenge for 5,000 base units of USDC on Base and on Solana and an MPP WWW-Authenticate: Payment challenge on Tempo, and an unpaid POST /v1/finance_research returned the same pair, with x402 at 110,000 base units. Contents, Answer and Research still need a key (28). Per-call and per-page prices published without a login (20). The pricing FAQ now says $10 of API credit on sign-up and $90 more on verifying the account, no card, with sign-up credits valid 60 days. The Web Search card on the same page says '$10 free credit' (20). The MCP free profile needs no key (100 queries a day), and x402 or MPP needs no account (20).

NewsCatcher 45

API keys in the x-api-key header, several per account, revocable in the platform, with advice to keep one per application. A 403 for 'a key that may not use this API' suggests per-key API access, but no scopes are documented (20). The MCP server documents ?apiKey= on the server URL for Claude.ai custom connectors, with a warning, so less 10 (10 of 30). The MCP repository's SECURITY.md says URL keys are rejected unless the operator enables them, which the hosted server does per the docs. Toolsets let an operator load only the read-only news tools, write tools carry destructiveHint, and the server tells the assistant to confirm large or hourly agent jobs (14 of 20). Results are third-party article text and summaries, and no prompt-injection guidance was found in the docs or the MCP server's instructions (0 of 15). Every response carries a Correlation-ID, GET /subscription shows usage and balance, and runs are listed in the platform. No per-call audit log for the customer was found (7 of 15). The security page and footer claim SOC 2 Type II and link a trust centre on Oneleet, which wasn't read. A vulnerability disclosure policy covers the MCP server. No security.txt (404) and no bug bounty found (14 of 20). 10 + 14 + 0 + 7 + 14 = 45.

You.com APIs 59

Several keys per organisation in the X-API-Key header, revoked immediately on delete, rotation by create-then-delete, and roles where developers see only their own keys. The hosted MCP takes OAuth 2.1. No per-key scopes documented. No secret in a URL (22). Tool allow-lists on the MCP, a two-tool free profile and no tool that writes or deletes. Since 5 October a key can carry a spending cap per billing period, and a capped key answers 429 spend_cap_exceeded when it's reached, which bounds what a leaked or runaway key can spend, as kagi-search's per-key cap does (18). Search and Contents return untrusted page text. The only content control we found is safesearch, and no prompt-injection guidance (2). The key list shows a last-used date and each capped key's spend, and the troubleshooting page says Platform Logs list recent requests with error messages, response details and a request ID. No retention period, logs API or audit log of key actions was found, so 9, between numeral's 8 for a dashboard Logs tab and deepgram-stt's 10 for console and API logs (9). trust.you.com, a Vanta trust centre, links a vulnerability disclosure page and a subprocessor list but rendered only with JavaScript on 1 November, security.txt returned 404 on you.com, and the MCP repo runs Semgrep in CI (8).

NewsCatcher 67

Read with the hosted lines, for the News API, the agent and the hosted MCP server. status.newscatcherapi.com (Hyperping) shows one News API component with 99.820% uptime from August to November 2026 and an incident history. The agent and the MCP server have no component of their own (20). In the 90 days from 8 August, one incident, on 1 September 2026, when the vendor wrote that for about four hours a higher-than-usual number of requests to the production News API timed out because of one client's queries. Read as one major (10). Rate limits published per plan, 1 request a second free and up to 10 on pay as you go, with exact limits from the free GET /subscription (15). 429 carries Retry-After with instructions to retry the same request, 503 carries Retry-After, and failed or refused requests are not charged. Agent runs and monitor creation have no idempotency keys (12 of 15). An uptime SLA exists only in signed Enterprise agreements; none is published (0). Generally available since 30 October 2026, with OAuth for the MCP server announced as coming soon (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.

You.com APIs 80

Rootly status page at status.you.com with Search/Index, Live News and AI Search API components (20). Its robots.txt loaded on 1 November, but incident pages still answered with a Cloudflare challenge, so we read the history RSS feed as before. In the 90 days to 1 November it lists one incident, an 'Authentication Outage' on the AI Search API component posted on 5 October, and nothing after it. The feed gives no duration, so we couldn't establish the outage as a major. Minor only (20). 10 requests a second per API and 5 for Finance Research on self-serve accounts, re-read on 1 November (15). 429 carries Retry-After, the docs give exponential backoff capped at 60 seconds, and X-RateLimit-* headers allow client-side throttling (15). No SLA found for the search APIs. The pricing page banner claims an uptime SLA of at least 99.9% for the new Inference Router, but we found no SLA document (0). GA (10).

NewsCatcher 79

The API is closed under terms of 2 November 2026 naming NewsCatcher, Inc., and the MCP server is MIT, so between the two bands (20 of 30). The terms say inputs and generated data are not used to train models, a DPA applies automatically, and the privacy policy gives retention periods (server logs 7 days, API logs with query text 90 days, then archived indefinitely, billing records about seven years). They agree with each other, but indefinite archives of query logs hold it back (22 of 30). The terms promise 30 days' email notice before a paid product or API version is discontinued, with refunds of unused credits, and the v3 News API has a migration guide (15 of 20). A sub-processor list dated 2 November 2026 with each provider's location and the data it handles. The MCP repository deploys to Vercel and can send pseudonymised analytics to PostHog, and neither appears on the list (16 of 20). 20 + 22 + 15 + 16 = 73.

You.com APIs 67

Closed API, with the MCP stdio bridge under MIT (18). The privacy policy (last updated 22 September 2026, re-read on 1 November) says prompts and outputs aren't used for training and a DPA is linked, but gives no retention periods. Zero Data Retention covers Web Search and Answer only, on enterprise agreements, not self-serve, and the machine payments page says it isn't available on keyless requests (17). No deprecation policy. The changelog dates one removal, the authors field from Web Search and Answer responses on 15 July 2026, announced as already done (5). The privacy policy names OpenAI, Anthropic and Google as model providers and points to trust.you.com for the full list, which we couldn't render. No data locations stated (10).

NewsCatcher 76

Read for a closed service, with the MCP repository read as code. News API 1.1.0 and Agent 1.5.0 on 4 November 2026, MCP server 0.1.0 on 6 November and v3 News API 3.25.0 on 6 November (30). In the 90 days from 8 August, the 30 October launch, News API 1.1.0, Agent 1.5.0, MCP 0.1.0 and v3 releases 3.19.0 to 3.25.0 (20). Public dated changelogs, support by email and Pylon, and a security policy with a 3-business-day target. The MCP repository is a day old, so there are no issues to judge (10 of 15). The CatchAll MCP server is in the official registry under the verified namespace com.newscatcherapi, but the new server isn't, and no official SDK for the current API was found; the Enterprise APIs list libraries (8 of 15). The MCP repository runs its test suite in CI with a read-only token; pass state not read (8 of 10). 30 + 20 + 10 + 8 + 8 = 76.

You.com APIs 85

@youdotcom-oss/mcp 4.0.7 tagged on 2026-10-28 and an API changelog entry on 26 October for the Inference Router (30). MCP 4.0.5, 4.0.6 and 4.0.7 between 19 and 28 October, all version-bump publishes, and API changelog entries on 4, 5 and 11 August, 2 and 23 September and 5, 7, 9 and 26 October (20). A dated public API changelog, support at api@you.com and a support page, and the MCP repo merges changes weekly. We didn't read the open issues (11). Listed in the official MCP registry as io.github.youdotcom-oss/mcp at 4.0.7, with a current Python SDK (3.6.0, 14 October). The TypeScript SDK is deprecated (15). CI, Semgrep and conventional commits on the MCP repo (9).