# Outcrawl vs Oxylabs Web Scraper API (slim)

> Oxylabs Web Scraper and Outcrawl score within a point of each other for scraping, 62.9 and 62.4 out of 100. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/outcrawl-vs-oxylabs-web-scraper.md (~5,550 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/outcrawl-vs-oxylabs-web-scraper.json · canonical https://www.anchorterminal.com/compare/outcrawl-vs-oxylabs-web-scraper
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-02
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Oxylabs Web Scraper API and Outcrawl score within a point of each other on agent readiness, 62.9 (B) and 62.4 (B). Outcrawl leads on security & auth. Both do scraping.

- Outcrawl: B 62.4, rank #456 of 1268 · https://www.anchorterminal.com/tools/outcrawl.min.md
- Oxylabs Web Scraper API: B 62.9, rank #441 of 1268 · https://www.anchorterminal.com/tools/oxylabs-web-scraper.min.md
- Outcrawl, good for Agents that want one key and one balance for reading pages, walking a site, searching with rendered results and handing a signed-in or multi-step task to a hosted browser agent with a hard budget, and teams on TypeScript that want a residential-exit browser over CDP with a replay of every session. Ahead on Security & auth, 66 against 53. Also No incidents deducted, where Oxylabs Web Scraper API loses 3 points for them.
- Oxylabs Web Scraper API, good for Agents that need parsed Google, Amazon and other large-site results or bulk asynchronous jobs through one API. Ahead on Reliability, 75 against 45; Transparency & trust, 64 against 56. Also Runs on your own machine.

| Category | Outcrawl | Oxylabs Web Scraper API |
| --- | --- | --- |
| Reliability (16%) | 45 | 75 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 71 | 68 |
| Agent ergonomics (13%) | 83 | 79 |
| Security & auth (14%) | 66 | 53 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 79 | 82 |
| Transparency & trust (7%) | 56 | 64 |

| Fact (where they differ) | Outcrawl | Oxylabs Web Scraper API |
| --- | --- | --- |
| Vendor | Aeonmind LLC (Outcrawl) | oxylabs, UAB |
| Hosted endpoint | `https://api.outcrawl.ai/v1` | `https://realtime.oxylabs.io/v1/queries` |
| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP, stdio |
| Auth | OAuth or key | API key |
| Pricing | Freemium | Pay per use |
| Price for scraping | $4.90 per 1,000 pages | not published |
| Licence | Proprietary hosted service under Aeonmind LLC's terms of service (last updated 1 November 2026). The TypeScript and Python SDKs and the @outcrawl/mcp package are MIT, and Scout, the browser agent behind the hosted agent, is Apache-2.0 in a read-only GitHub mirror | Proprietary service under the Oxylabs General Conditions. The MCP server and the Python SDK on GitHub are MIT |
| Tools exposed | 29 | 10 |
| MCP registry | not listed | `io.oxylabs/oxylabs-mcp` |
| Last release | 2026-10-20 | 2026-10-29 |
| Terms last updated | 2026-11-01 | 2026-10-05 |
| Privacy policy last updated | 2026-11-01 | 2024-10-14 |
| Customer content may train models | not found in the text | yes |
| Terms restrict benchmarking | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 948 stars, 53 npm/wk | 18k PyPI/wk |
| Agent reviews | none | 3/5 (4) |

Why the edge:
- Reliability, Oxylabs Web Scraper API +30: Outcrawl 45 (Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers `quota_exceeded` with `ceiling: requests_per_minute` and `retryAfterSeconds`, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and `concurrency_limit` tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.); Oxylabs Web Scraper API 75 (Graded on the Web Scraper API (Classic) surface. Status page at uptime.oxylabs.io on incident.io with separate components for Scraper APIs Push-Pull and Real-Time (20). Its feed lists two incidents since 4 August 2026, a Datacenter Proxies outage on 13 August that doesn't touch this API and, on 26 October, 12 minutes (05:34 to 05:46 on the page's clock) on both Scraper API components and Web Unblocker. The page labels it a full outage, but its own text says users "may experience degraded performance, intermittent errors, or timeouts", so we read it as partial and minor (20 of 30). Job rates per plan are published, from 10 a second on the free trial to 100 on Business and Corporate, with rendered-job limits (15). 429 is not billed, responses carry `x-ratelimit` limit and remaining headers, and 612 and 613 faults can be retried at no cost. No Retry-After or backoff guidance was found for this API (10 of 15). No SLA is published. The General Conditions promise reasonable efforts (0). Generally available (10).)
- Security & auth, Outcrawl +13: Outcrawl 66 (OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, `api`; API keys shaped `ock_<keyId>.<secret>` are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above `approvalAbove` pause for a person's yes, and `control` hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries `usage`, `/v1/usage` groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.); Oxylabs Web Scraper API 53 (A username and password per product instance over HTTP Basic, with an editable password, optional IP whitelisting and several instances per account. The MCP server's v0.10.0 (15 October 2026) adds Web Scraper API tokens sent as a Bearer header, but the API docs still describe only the username and password, and no scopes were found (20 of 30). The Proxy Endpoint puts the pair in the proxy URL and needs TLS verification switched off, which we note without the query-string deduction. Scraping is read-only apart from POST requests to targets, callbacks and uploads to the customer's bucket, each instance can take a spending limit that disables it, and every MCP tool is marked read-only (10 of 20). No guidance on untrusted page content was found in the Web Scraper API docs, the MCP README or the agent skill (2 of 15). `GET /v2/stats` and the dashboard report usage by day and source, and jobs accept client notes. No per-request access log was found (7 of 15). ISO/IEC 27001:2022, SOC 2 Type 2 for Scraper API and yearly penetration tests per the trust centre (per the 8 October check, not re-read on 2 November). The disclosure programme is still paused except for critical issues sent to security@oxylabs.io, security.txt returns 404 and no bug bounty was found. That is above the 12 given for certification claims with no disclosure route (fireworks-inference, people-data-labs), because a route for critical issues and penetration tests are published (14 of 20).)
- Transparency & trust, Oxylabs Web Scraper API +8: Outcrawl 56 (Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.); Oxylabs Web Scraper API 64 (Closed service under public General Conditions naming oxylabs, UAB of Vilnius, still last updated 5 October 2026, with MIT clients (15 of 30). The privacy policy was last reviewed on 22 October 2026 and still doesn't name the controller or say anything about scraped content. Clause 4.3.9 of the General Conditions lets Oxylabs keep data gathered through Web API and Web Unblocker and use it at its discretion, and it is unclear whether Web API there includes this Classic API. A DPA is published and Push-Pull results are kept for at least 24 hours (14 of 30). No deprecation policy. Removals appear in the changelog on the day they take effect, and the General Conditions give 14 days' notice of contract changes (6 of 20). The DPA says the sub-processor list is available on request. The privacy policy names some vendors, and data locations are given only as the EEA and the US (7 of 20).)