Nexscope vs Outcrawl

Nexscope 44

Read on the MCP server, with the REST API where a line covers it. The MCP map lists 382 tools and says the category manifests 'narrow metadata for your integration; the MCP connection still advertises the full catalog'. That is more than 30 tools with no toolsets, dynamic loading or read-only subset found (5). Search tools page by page (about 20 results), with filters such as marketplace, category node, sort and device per tool, but no general pagination model or field selection, and output size depends on each tool (12 of 20). By default business errors answer HTTP 200 with an outer code. The X-Nexscope-Http-Status: semantic header maps them to HTTP statuses, the OpenAPI file names codes such as DATA_IMAGE_DOWNLOAD_FAILED and CAPABILITY_BACKEND_UNAVAILABLE in field text, and MCP errors aren't documented. SandBase earned 16 with typed bridge errors (11 of 20). Data calls only read. No idempotency keys and no readOnlyHint or destructiveHint documented. Async jobs return a taskId with a poll tool and a rule not to resubmit, and 1688 order, payment-link, receipt and cancel calls need an explicit JSON true confirmation (8 of 20). Few required parameters with defaults on most. No official SDK package, only standard-library clients in the repository for JavaScript and Python, which SoldFetch earned 8 for (8 of 15). 5+12+11+8+8 = 44.

Outcrawl 83

API reading. Scrape returns main content only by default with formats picking markdown, html, rawHtml, links, screenshots or schema JSON, search renders page bodies only on request, agent events take a level and an after cursor, the MCP server shows request bodies up to a character limit and says when it truncated, and the MCP surface is 29 tools with no toolsets (20 of 25). Cursor pagination on crawl results, agent results and downloads, limit, depth and path filters on crawl, status, outcome, task and age filters on sessions, and usage grouped by hour, day, month or capability (20). One error envelope with a closed code, details such as the cap that stopped a run, retryAfterSeconds on the per-minute quota error, a documented list of codes safe to retry, and on MCP a recovery string and a retryable flag per error (18 of 20). No idempotency key on any route, a repeated agent, crawl or monitor submit runs twice, and concurrency_limit carries no retry hint; cancel is idempotent, integration_changed (409) guards updates, and the npm MCP package sets readOnlyHint on GET tools, destructiveHint on DELETE tools and idempotentHint on either, which the hosted server was not read to confirm (10 of 20). Scrape needs a URL alone, agent runs need caps.budget on the API and SDKs with the MCP server defaulting it, and official SDKs exist in TypeScript and Python beside a CLI (15). 20+20+18+10+15 = 83.

Nexscope 41

The MCP server takes OAuth 2.1 with PKCE and one scope, mcp:tools, per the tool pages, or a Bearer nk- API key. Keys are created by a person under API Access, shown once, and can be expired, disabled or deleted, with no scopes or rotation found. The OAuth metadata on api.nexscope.ai wasn't read. No query-string key option was found. Manifold earned 22 with OAuth and hashed keys whose storage it documents (20 of 30). Most tools read. Writes exist (1688 procurement on the user's own buyer account, Amazon Ads entity operations through an owned connection, paid generation jobs), and the 1688 calls need an explicit JSON true per action after a preview, with the guide saying to get the user's approval first. Credits cap spend. No read-only key or tool allowlist (12 of 20). Tools return third-party listings, reviews, social posts and web pages, and no prompt-injection guidance was found. Manifold, the closest marketing-data MCP, took 0 (0). The Account credits and Account usage APIs, costToken in data responses and credits charged on task results give per-call visibility. No key-level audit was found (9 of 15). security.txt answered a client error. No disclosure policy, bug bounty or certification found (0 of 20). 20+12+0+9+0 = 41.

Outcrawl 66

OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, api; API keys shaped ock_<keyId>.<secret> are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above approvalAbove pause for a person's yes, and control hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries usage, /v1/usage groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.

Nexscope 41

The editorial half. The service is closed. The terms (8 October 2026) name ECOCREATE TECHNOLOGY PTE. LTD. under Singapore law with no registration number or address. The repository's MIT licence covers client code only, and the documentation and definitions stay copyright Nexscope. Scrapewise earned 15 for closed terms with MIT side code (15 of 30). The privacy policy (8 October 2026) says uploads are not used to train AI models and that connected selling-partner data is deleted or de-identified when no longer needed, but 'this policy does not specify a single deletion deadline for all data', and no DPA was found. SandBase took 12 with no retention periods (10 of 30). No deprecation policy or dated notices. The terms promise notice of material changes before they take effect where practicable, and the MCP map keeps a legacy v1 beside v2 (3 of 20). Analytics and advertising vendors are named (Google Analytics, Microsoft Clarity, Ahrefs, Google Ads, X, FirstPromoter), but hosting, AI processing and payment providers only by type, with no data locations. The repository's source notes say supplier references 'are presented as Nexscope', so the data suppliers go unnamed except LinkFox Agent for 1688 authorisation (5 of 20). 15+10+3+5 = 33. The provenance half is computed from the provenance block.

Outcrawl 56

Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.

Nexscope 65

Read as a closed service with a public documentation repository. The repository synced the released 1688 procurement contracts on 9 November 2026 and committed again on 10 November (30). No releases or changelog. The dated record is the registry's four versions on 14 and 16 October, repository commits on 8, 9, 20 and 29 October and 2, 9 and 10 November, and source notes dating WooCommerce (29 October) and design search (2 November) additions. SoldFetch earned 10 for dated commits without releases (10 of 20). No public changelog. Support is service@nexscope.ai, WhatsApp and a booked call, untested. The repository's one merged pull request came from the organisation itself, and GitHub's API refused us, so issues weren't read (5 of 15). The official MCP registry lists io.github.nexscope/ecommerce, active, latest 1.0.3 of 16 October 2026, read first-hand (15). A CI workflow runs offline catalogue validation and unit tests on standard-library clients with no dependencies. The run results weren't read (5 of 10). 30+10+5+15+5 = 65.

Outcrawl 79

@outcrawl/sdk and the PyPI package outcrawl both reached 0.4.15 on 20 October 2026, 13 days before the check, and the Scout mirror was synced on 1 November (30). 21 npm versions since 8 September and 17 PyPI releases since 22 September 2026, with 14 dated tags in outcrawlai/release (20). Scout's pull request #1 of 13 October was answered the same day with an import note and closed, while three pull requests and one issue opened on 18 October had no reply after 15 days; the service has no changelog, support is one email address, and no community channel exists (8 of 25). Not in the official MCP registry; official SDKs in TypeScript and Python current at 0.4.15, with a CLI (15). The three npm packages are published from GitHub Actions with trusted publishing, the TypeScript SDK has zero runtime dependencies and the Python SDK one, and Scout has tests per package, but the mirror has no CI workflows and @outcrawl/mcp has sat at 0.4.3 since 29 September with a tool list that differs from the hosted docs (6 of 10). 30+20+8+15+6 = 79.

Nexscope 64

A public OpenAPI 3.1 file at api.nexscope.ai/openapi.json, about 3.8 MB, linked from the quickstart. Visible request bodies are typed with required fields, patterns, enums and additionalProperties: false, but responses are open data objects and the components section, with the security scheme and the shared error response, wasn't reached. In the repository 166 of 252 request definitions are field descriptors rather than JSON Schema. The hosted tools/list wasn't read. SoldFetch took 17 with untyped responses and SandBase 22 with components unread (19 of 25). llms.txt on www.nexscope.ai and Markdown references for every API in the repository (10). MCP tool descriptions are one line ('Find Amazon products by keyword and marketplace. Results come back as structured JSON.'), with no when-not-to-use. The repository's references carry long trigger text ('trigger this skill whenever their need involves real-time Amazon search results'), not guidance on when to pick another tool (10 of 20). Tool pages list types, defaults, enums and length limits, but the Amazon Search page marks no argument required and omits the keyword its own examples pass, and many limits sit in prose (8 of 15). Every API has a request sample, a response fixture and cURL, JavaScript and Python clients, though most fixtures are labelled historical. Errors are an HTTP table, two named codes (11209, 12001) and a semantic error response whose schema wasn't read. MCP errors aren't documented (10 of 15). Path versioning under /v1, MCP v2 beside a legacy v1, and a dated OpenAPI version label, but no public changelog. SandBase earned 7 on the same pattern (7 of 15). 19+10+10+8+10+7 = 64.

Outcrawl 71

API reading, with the MCP server described. An OpenAPI 3.1 document at https://outcrawl.ai/docs/api-reference/openapi.json lists 62 operations over 51 paths with a summary each and the same 11 status codes, generated from the vendor's capability registry, but every request body is an untyped object marked additionalProperties: true with a pointer to the docs, every 200 response is an untyped object, and Error is the only schema; the typed shapes live in the SDK declarations and in the MCP server's zod schemas, which were read in the 0.4.3 npm package rather than from the hosted server (15 of 25). llms.txt and a 525 KB llms-full.txt on the docs, a Markdown twin of every page and an llms.txt on the site (10). The MCP descriptions each end with a Not for: clause naming the better tool and most with a Cost: clause, the OpenAPI summaries say when not to use a route, and the capability pages say which neighbour to use instead (18 of 20). Scrape formats are an enum of eight, event levels and record kinds are enums, caps.budget is required, and the SDK types bound every option, while the OpenAPI bodies carry none of it (10 of 15). curl, TypeScript and Python examples on every page, 20 worked programs, a 31-row error table with meanings and a retryable list, and MCP errors with a recovery string, though the closed union is sized 24, 31, 45 and 22 on different pages (13 of 15). /v1 in the path and 1.0.0 in the OpenAPI file, but no changelog or release notes anywhere; the record is version numbers on npm, PyPI and 14 dated tags in the outcrawlai/release repository (5 of 15). 15+10+18+10+13+5 = 71.

Nexscope 39

Hosted lines, graded on the remote MCP server and the REST API at api.nexscope.ai. No status page is linked from the home page, llms.txt, the API quickstart or the MCP map, and none was found (0). With no page there is no incident history to read (5). The pricing page publishes requests a second and concurrency per plan, the same for API and MCP, with 1 and 1 on the trial, 3 and 2 on Starter, 5 and 4 on Growth, 10 and 8 on Pro (15). The quickstart calls 429 an 'execution admission rate limit' and says to honour Retry-After on 429 and 503 when present. No idempotency key exists. The repository says 'Do not blindly retry POST requests' and to check whether a task was created before resubmitting, and the MCP tool pages say a reconnecting client should query existing async work rather than resubmit. SoldFetch earned 15 with idempotency keys and SandBase 11 with keys on some writes, so guidance without keys earns 9 (9 of 15). No SLA, and the terms say 'We cannot guarantee the Service will be available at all times' (0). No beta or preview label on the API or the MCP server (10). 0+5+15+9+0+10 = 39.

Outcrawl 45

Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers quota_exceeded with ceiling: requests_per_minute and retryAfterSeconds, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and concurrency_limit tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.