Nexscope vs Qovia

Nexscope 44

Read on the MCP server, with the REST API where a line covers it. The MCP map lists 382 tools and says the category manifests 'narrow metadata for your integration; the MCP connection still advertises the full catalog'. That is more than 30 tools with no toolsets, dynamic loading or read-only subset found (5). Search tools page by page (about 20 results), with filters such as marketplace, category node, sort and device per tool, but no general pagination model or field selection, and output size depends on each tool (12 of 20). By default business errors answer HTTP 200 with an outer code. The X-Nexscope-Http-Status: semantic header maps them to HTTP statuses, the OpenAPI file names codes such as DATA_IMAGE_DOWNLOAD_FAILED and CAPABILITY_BACKEND_UNAVAILABLE in field text, and MCP errors aren't documented. SandBase earned 16 with typed bridge errors (11 of 20). Data calls only read. No idempotency keys and no readOnlyHint or destructiveHint documented. Async jobs return a taskId with a poll tool and a rule not to resubmit, and 1688 order, payment-link, receipt and cancel calls need an explicit JSON true confirmation (8 of 20). Few required parameters with defaults on most. No official SDK package, only standard-library clients in the repository for JavaScript and Python, which SoldFetch earned 8 for (8 of 15). 5+12+11+8+8 = 44.

Qovia 77

API reading. Responses come in fixed page sizes per endpoint, from about 5 comments on Xiaohongshu to 100 Fliggy reviews, with limit only on Bilibili danmaku and no field selection; the record shape is compact and shared across posts, notes and videos. The MCP server loads four tools by default, keeps the catalogue out of context until search_endpoints and get_endpoint are called, and ?tools= selects platforms or everything, which on the MCP reading would score 25 (18 of 25). Cursor pagination with has_more on most lists, search_id on Douyin and Zhihu search, page numbers on Weibo, Xiaohongshu and Bilibili, sort options on several, and the cross-platform search filters by platform, content type, sentiment and whole-day date windows up to 90 days (17 of 20). One error object with 20 codes, request_id on every answer, the retryable set marked, refunded codes separated from never-charged ones, and MCP tool errors carrying error.code, the HTTP status and retry_after_seconds (19 of 20). All calls are reads, failed and empty calls are refunded, Retry-After is declared and the Python client retries; no readOnlyHint or other annotation appears in the vendor's 28 October tools/list snapshot (14 of 20). One required parameter on 117 of 144 operations and defaults set on the server, but the only official SDK is the Python client; Node and curl are examples (9 of 15). 18+17+19+14+9 = 77.

Nexscope 64

A public OpenAPI 3.1 file at api.nexscope.ai/openapi.json, about 3.8 MB, linked from the quickstart. Visible request bodies are typed with required fields, patterns, enums and additionalProperties: false, but responses are open data objects and the components section, with the security scheme and the shared error response, wasn't reached. In the repository 166 of 252 request definitions are field descriptors rather than JSON Schema. The hosted tools/list wasn't read. SoldFetch took 17 with untyped responses and SandBase 22 with components unread (19 of 25). llms.txt on www.nexscope.ai and Markdown references for every API in the repository (10). MCP tool descriptions are one line ('Find Amazon products by keyword and marketplace. Results come back as structured JSON.'), with no when-not-to-use. The repository's references carry long trigger text ('trigger this skill whenever their need involves real-time Amazon search results'), not guidance on when to pick another tool (10 of 20). Tool pages list types, defaults, enums and length limits, but the Amazon Search page marks no argument required and omits the keyword its own examples pass, and many limits sit in prose (8 of 15). Every API has a request sample, a response fixture and cURL, JavaScript and Python clients, though most fixtures are labelled historical. Errors are an HTTP table, two named codes (11209, 12001) and a semantic error response whose schema wasn't read. MCP errors aren't documented (10 of 15). Path versioning under /v1, MCP v2 beside a legacy v1, and a dated OpenAPI version label, but no public changelog. SandBase earned 7 on the same pattern (7 of 15). 19+10+10+8+10+7 = 64.

Qovia 86

An OpenAPI 3.1.0 file (version 0.1.0, 1 MB) is public at qovia.ai/openapi.json with 144 paths and 144 operations, two security schemes, typed query parameters, a response example on every operation and the error responses declared on each. The data payload itself is typed only as object, array or null with per-endpoint examples, and the MCP call_endpoint tool takes a free params object, so 22 of 25 (22). llms.txt (75 KB, one line per endpoint with price and status) and llms-full.txt (331 KB, the whole documentation as text) are served, and the quickstart's billing, limits and error sections are in both (10). Every operation has a summary and a description; most say what the data holds, how to page, which ids to pass, which fields are unavailable and what answers 404 or empty, and the MCP server's instructions say to find, read then call. Guidance on when not to use an endpoint is thin, mostly pointers such as replies coming from another endpoint (16 of 20). 321 parameters, 75 with enums, patterns on ids, min and max on strings and integers, 117 operations with one required parameter and 16 with none, the POST body typed with additionalProperties false, and unknown parameters rejected with 400 (14 of 15). A response example on all 144 operations, 20 error codes with every message variant listed, response headers documented per error, and cURL, Python, JavaScript and raw HTTP samples; the examples are catalogue samples the docs say are not live data (14 of 15). Paths are under /v1, a 410 endpoint_disabled code exists for retired endpoints, and the changelog is dated, but it has two days (21 and 22 October 2026), nothing is marked deprecated and no notice period is stated (10 of 15). 22+10+16+14+14+10 = 86.

Nexscope 35

No x402, MPP or L402 on pricing, the quickstart, the MCP map, llms.txt or the visible OpenAPI paths. Credits come from a subscription or a Data top-up (0). Plans and credits per plan are public without a login ($29 for 30,000, $55 for 75,000, $129 for 150,000), and tool pages show credits per call, such as Amazon Search from 21 credits with a recent average of 30. Many tools on the MCP map list no cost and pricing is marked 'dynamic-credits'. Manifold earned 20 with a cost for every tool (15 of 20). A Free Trial of 1,000 credits for 3 days with 'No credit card required', API and MCP limits included. Creative API keys need a subscription (20). A person signs in through the browser to approve OAuth or create a key, and no keyless or programmatic route was found (0). 0+15+20+0 = 35.

Qovia 55

No x402, MPP or L402 on Qovia's own endpoints; USDT on TRC-20 is a top-up method from a console session, not a machine payment protocol. The vendor's five Actors on the Apify Store under the profile qovia (Qovia Data, the same Telegram handle and mailbox as the site), such as the Xingtu Actor at $0.01 to $0.06 a section, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-call prices are published without a login, per endpoint in the OpenAPI file, llms.txt and the docs, search at $5 and raw endpoints from $0.5 to $19.5 per 1,000, with the tier rule and payment fees stated (20). 50 trial calls for a new account, counted only when a call returns data; the quickstart says to top up when they run out and the docs ask for no card at sign-up, though no account was created to confirm it (20). A person signs up in a browser and creates a key; the MCP catalogue tools work without a key but data calls do not, and the Apify route reaches four platforms without a Qovia account (5 of 20). 10+20+20+5 = 55.

Nexscope 41

The MCP server takes OAuth 2.1 with PKCE and one scope, mcp:tools, per the tool pages, or a Bearer nk- API key. Keys are created by a person under API Access, shown once, and can be expired, disabled or deleted, with no scopes or rotation found. The OAuth metadata on api.nexscope.ai wasn't read. No query-string key option was found. Manifold earned 22 with OAuth and hashed keys whose storage it documents (20 of 30). Most tools read. Writes exist (1688 procurement on the user's own buyer account, Amazon Ads entity operations through an owned connection, paid generation jobs), and the 1688 calls need an explicit JSON true per action after a preview, with the guide saying to get the user's approval first. Credits cap spend. No read-only key or tool allowlist (12 of 20). Tools return third-party listings, reviews, social posts and web pages, and no prompt-injection guidance was found. Manifold, the closest marketing-data MCP, took 0 (0). The Account credits and Account usage APIs, costToken in data responses and credits charged on task results give per-call visibility. No key-level audit was found (9 of 15). security.txt answered a client error. No disclosure policy, bug bounty or certification found (0 of 20). 20+12+0+9+0 = 41.

Qovia 60

API keys with scopes chosen at creation (every endpoint, search, every raw endpoint or one of 24 platform groups), an optional expiry, revocation in the console and hashed storage; the docs say the key is read from the Authorization or x-api-key header only, never the URL or a cookie, and 30 failed authentications from one IP in a minute are throttled. No OAuth and no rotation feature beyond creating another key (24 of 30). The whole surface is read-only retrieval, scopes restrict a key to platforms, the two MCP catalogue tools need no key, and the docs and SECURITY.md tell users to give AI tools a separate scoped key (17 of 20). Every response is third-party platform text, and the only related statement is that error messages never contain the data source's own text; nothing on treating returned content as untrusted (3 of 15). request_id is the usage record ID on every answer, the console lists every charge in a usage log, X-Qovia-Charged and X-Qovia-Balance headers report each call, and GET /v1/account returns the key's scopes and balance at no charge; no exportable audit log or per-call endpoint was found (11 of 15). No security.txt on qovia.ai or api.qovia.ai (404), no bug bounty, SOC 2 or ISO 27001; the repository's SECURITY.md names a Telegram handle and a mailbox for reports covering both hosts (5 of 20). 24+17+3+11+5 = 60.

Nexscope 65

Read as a closed service with a public documentation repository. The repository synced the released 1688 procurement contracts on 9 November 2026 and committed again on 10 November (30). No releases or changelog. The dated record is the registry's four versions on 14 and 16 October, repository commits on 8, 9, 20 and 29 October and 2, 9 and 10 November, and source notes dating WooCommerce (29 October) and design search (2 November) additions. SoldFetch earned 10 for dated commits without releases (10 of 20). No public changelog. Support is service@nexscope.ai, WhatsApp and a booked call, untested. The repository's one merged pull request came from the organisation itself, and GitHub's API refused us, so issues weren't read (5 of 15). The official MCP registry lists io.github.nexscope/ecommerce, active, latest 1.0.3 of 16 October 2026, read first-hand (15). A CI workflow runs offline catalogue validation and unit tests on standard-library clients with no dependencies. The run results weren't read (5 of 10). 30+10+5+15+5 = 65.

Qovia 77

The newest changes are the registry entry ai.qovia/qovia 0.1.1 and the repository's tools snapshot and plugin manifests on 28 October 2026, after the Python client 0.1.1 on PyPI on 27 October; the repository was pushed on 1 November (30). Eight changelog entries on 21 and 22 October, two registry versions (22 and 28 October) and two PyPI releases (25 and 27 October) are more than three dated entries in 90 days, all within ten days (20). Closed service with a public changelog. Support is Telegram, WhatsApp, WeChat and one mailbox, with a one-business-day reply promised for email; GitHub issues are enabled on the repository with none opened, and no forum, Discord or community was found (7 of 15). ai.qovia/qovia is in the official MCP registry under a DNS-verified reverse-DNS namespace at 0.1.1, marked latest, and the Python client is an official package on PyPI (15). The client is standard-library Python with a test file, MIT, no dependencies and no CI workflow in the repository tree; the account's other nine repositories are forks of lists and directories (5 of 10). 30+20+7+15+5 = 77.

Nexscope 41

The editorial half. The service is closed. The terms (8 October 2026) name ECOCREATE TECHNOLOGY PTE. LTD. under Singapore law with no registration number or address. The repository's MIT licence covers client code only, and the documentation and definitions stay copyright Nexscope. Scrapewise earned 15 for closed terms with MIT side code (15 of 30). The privacy policy (8 October 2026) says uploads are not used to train AI models and that connected selling-partner data is deleted or de-identified when no longer needed, but 'this policy does not specify a single deletion deadline for all data', and no DPA was found. SandBase took 12 with no retention periods (10 of 30). No deprecation policy or dated notices. The terms promise notice of material changes before they take effect where practicable, and the MCP map keeps a legacy v1 beside v2 (3 of 20). Analytics and advertising vendors are named (Google Analytics, Microsoft Clarity, Ahrefs, Google Ads, X, FirstPromoter), but hosting, AI processing and payment providers only by type, with no data locations. The repository's source notes say supplier references 'are presented as Nexscope', so the data suppliers go unnamed except LinkFox Agent for 1688 authorisation (5 of 20). 15+10+3+5 = 33. The provenance half is computed from the provenance block.

Qovia 30

Closed service. The Terms of Service is one paragraph that names no legal entity, address or liability terms, says Delaware law governs and that the page is a summary with the signed agreement governing; the repository's client is MIT. Between the closed and unclear bands (7 of 30). The privacy policy is one paragraph. Account information is used to deliver and bill, personal information is not sold, requests and results are not resold, deletion requests go to the support mailbox, and the agreement governs where it differs. No retention periods, no subprocessors, no DPA, and no statement about the cache the prov.source flag implies; the SECURITY.md repeats the same points (8 of 30). A 410 endpoint_disabled code exists for retired endpoints and the changelog is dated, but there is no deprecation policy or notice period and nothing is marked deprecated (5 of 20). Stripe is named on the pricing page as the card and Alipay processor; no other provider, data location or transfer basis is stated (3 of 20). 7+8+5+3 = 23.