Outcrawl vs Oxylabs Web Scraper API

Outcrawl 45

Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers quota_exceeded with ceiling: requests_per_minute and retryAfterSeconds, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and concurrency_limit tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.

Oxylabs Web Scraper API 75

Graded on the Web Scraper API (Classic) surface. Status page at uptime.oxylabs.io on incident.io with separate components for Scraper APIs Push-Pull and Real-Time (20). Its feed lists two incidents since 4 August 2026, a Datacenter Proxies outage on 13 August that doesn't touch this API and, on 26 October, 12 minutes (05:34 to 05:46 on the page's clock) on both Scraper API components and Web Unblocker. The page labels it a full outage, but its own text says users "may experience degraded performance, intermittent errors, or timeouts", so we read it as partial and minor (20 of 30). Job rates per plan are published, from 10 a second on the free trial to 100 on Business and Corporate, with rendered-job limits (15). 429 is not billed, responses carry x-ratelimit limit and remaining headers, and 612 and 613 faults can be retried at no cost. No Retry-After or backoff guidance was found for this API (10 of 15). No SLA is published. The General Conditions promise reasonable efforts (0). Generally available (10).

Outcrawl 66

OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, api; API keys shaped ock_<keyId>.<secret> are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above approvalAbove pause for a person's yes, and control hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries usage, /v1/usage groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.

Oxylabs Web Scraper API 53

A username and password per product instance over HTTP Basic, with an editable password, optional IP whitelisting and several instances per account. The MCP server's v0.10.0 (15 October 2026) adds Web Scraper API tokens sent as a Bearer header, but the API docs still describe only the username and password, and no scopes were found (20 of 30). The Proxy Endpoint puts the pair in the proxy URL and needs TLS verification switched off, which we note without the query-string deduction. Scraping is read-only apart from POST requests to targets, callbacks and uploads to the customer's bucket, each instance can take a spending limit that disables it, and every MCP tool is marked read-only (10 of 20). No guidance on untrusted page content was found in the Web Scraper API docs, the MCP README or the agent skill (2 of 15). GET /v2/stats and the dashboard report usage by day and source, and jobs accept client notes. No per-request access log was found (7 of 15). ISO/IEC 27001:2022, SOC 2 Type 2 for Scraper API and yearly penetration tests per the trust centre (per the 8 October check, not re-read on 2 November). The disclosure programme is still paused except for critical issues sent to security@oxylabs.io, security.txt returns 404 and no bug bounty was found. That is above the 12 given for certification claims with no disclosure route (fireworks-inference, people-data-labs), because a route for critical issues and penetration tests are published (14 of 20).

Outcrawl 56

Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.

Oxylabs Web Scraper API 64

Closed service under public General Conditions naming oxylabs, UAB of Vilnius, still last updated 5 October 2026, with MIT clients (15 of 30). The privacy policy was last reviewed on 22 October 2026 and still doesn't name the controller or say anything about scraped content. Clause 4.3.9 of the General Conditions lets Oxylabs keep data gathered through Web API and Web Unblocker and use it at its discretion, and it is unclear whether Web API there includes this Classic API. A DPA is published and Push-Pull results are kept for at least 24 hours (14 of 30). No deprecation policy. Removals appear in the changelog on the day they take effect, and the General Conditions give 14 days' notice of contract changes (6 of 20). The DPA says the sub-processor list is available on request. The privacy policy names some vendors, and data locations are given only as the EEA and the US (7 of 20).