Olostep vs Outcrawl

Olostep 33

Bearer API keys. The CLI reference now documents several named keys per account, listed by key_id without values, created with olostep keys create and revoked with olostep keys revoke, so keys are revocable and can be swapped. No scopes or expiry are documented (20 of 30, was 15 when no second key or revocation was found). The hosted MCP server also takes OAuth sign-in with the Olostep account. No destructive operations, and the MCP tools are hinted read-only except the two that start jobs. No way to limit a key found (10 of 20). Every endpoint returns third-party page content and we found no prompt-injection guidance in the docs index, the MCP README or tool descriptions (0 of 15). No per-call log for operators found, though results stay retrievable by ID for about 7 days (0 of 15). security.txt answers 404 and the docs index has no security or compliance page. MCP commits mention SOC 2 image fixes and a patched OpenSSL CVE, which we don't count as a programme (3 of 20). 20 + 10 + 0 + 0 + 3 = 33.

Outcrawl 66

OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, api; API keys shaped ock_<keyId>.<secret> are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above approvalAbove pause for a person's yes, and control hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries usage, /v1/usage groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.

Olostep 65

x402 documented on POST /v1/scrapes and /v1/maps at $0.01, /v1/answers at $0.05 and /v1/crawls at a dynamic price, USDC on Base through the Orthogonal facilitator, but not on batches or search. Our unpaid POST on 30 September got a 402 with an empty body and no payment requirements, so a stock client had nothing to sign (15 of 40). Plans, per-operation credit costs and credit packs from $20 for 10,000 are public (20). Trial of 500 successful requests with no card (20). The x402 route would let an agent start without signup, but it didn't return a price in our probe (10 of 20).

Outcrawl 40

No x402, MPP or L402 in the OpenAPI file, the docs, the pricing pages or the terms (0). Per-unit rates published without a login, 1 credit a page, 5 credits per 10 search results, 1 credit a browser minute, 2,000 credits a GB and 1 credit a monitor check, with the dollar rate per plan ($4.90 per 1,000 credits on Builder down to about $3.20 on Scale), top-up prices per 10,000 and an estimate of about 15 credits a minute for agent runs (20). Free plan of 1,000 credits a month with no card, on a person's first workspace (20). A person signs in with Google, GitHub, an email code or a magic link behind reCAPTCHA, and MCP's OAuth consent needs that browser sign-in; no keyless route, no programmatic key creation (0). 0+20+20+0 = 40.

Olostep 88

OpenAPI 3.0.3 published per endpoint under docs.olostep.com/openapi/ for scrapes, batches, crawls, maps, answers, search and more (25). llms.txt with 148 links and Markdown pages (10). MCP descriptions give usage rules, for example not to ask for json output without a parser or llm_extract schema, and create_crawl says to pair it with get_crawl_results (15 of 20). Enums for formats, transformer and screen type, url_to_scrape the only required field (13 of 15). Error body with type, code and message in the spec, and examples per endpoint (13 of 15). Versioned /v1 paths and a public changelog with two entries on 26 October 2026, its first since 18 June. The MCP repository's CHANGELOG still stops at 1.0.13 while the registry is at 1.0.19 (12 of 15, was 8 while the changelog had stood since June). 25 + 10 + 15 + 13 + 13 + 12 = 88.

Outcrawl 71

API reading, with the MCP server described. An OpenAPI 3.1 document at https://outcrawl.ai/docs/api-reference/openapi.json lists 62 operations over 51 paths with a summary each and the same 11 status codes, generated from the vendor's capability registry, but every request body is an untyped object marked additionalProperties: true with a pointer to the docs, every 200 response is an untyped object, and Error is the only schema; the typed shapes live in the SDK declarations and in the MCP server's zod schemas, which were read in the 0.4.3 npm package rather than from the hosted server (15 of 25). llms.txt and a 525 KB llms-full.txt on the docs, a Markdown twin of every page and an llms.txt on the site (10). The MCP descriptions each end with a Not for: clause naming the better tool and most with a Cost: clause, the OpenAPI summaries say when not to use a route, and the capability pages say which neighbour to use instead (18 of 20). Scrape formats are an enum of eight, event levels and record kinds are enums, caps.budget is required, and the SDK types bound every option, while the OpenAPI bodies carry none of it (10 of 15). curl, TypeScript and Python examples on every page, 20 worked programs, a 31-row error table with meanings and a retryable list, and MCP errors with a recovery string, though the closed union is sized 24, 31, 45 and 22 on different pages (13 of 15). /v1 in the path and 1.0.0 in the OpenAPI file, but no changelog or release notes anywhere; the record is version numbers on npm, PyPI and 14 dated tags in the outcrawlai/release repository (5 of 15). 15+10+18+10+13+5 = 71.

Olostep 60

Better Stack status page at status.olostep.com monitoring /scrapes, /batches, /crawls and /answers (20). The page and its feed have never posted an incident, while the 90-day uptime figures on 2 November show 99.935 to 99.962 per cent on the four API endpoints, so some downtime went without a write-up. A page that has never posted an incident scores 20 in this run (20 of 30). Concurrency published per plan, 20 on Starter, 200 on Standard and 500 on Scale, but the free plan says only 'low rate limits' and we found no per-minute limits (10 of 15). The scrapes OpenAPI documents 400, 402, 404, 500, 502 and 504 but no 429, Retry-After or backoff guidance (0). No SLA found (0). GA (10). 20 + 20 + 10 + 0 + 0 + 10 = 60.

Outcrawl 45

Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers quota_exceeded with ceiling: requests_per_minute and retryAfterSeconds, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and concurrency_limit tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.