Outcrawl vs ScrapeGraphAI

Outcrawl 40

No x402, MPP or L402 in the OpenAPI file, the docs, the pricing pages or the terms (0). Per-unit rates published without a login, 1 credit a page, 5 credits per 10 search results, 1 credit a browser minute, 2,000 credits a GB and 1 credit a monitor check, with the dollar rate per plan ($4.90 per 1,000 credits on Builder down to about $3.20 on Scale), top-up prices per 10,000 and an estimate of about 15 credits a minute for agent runs (20). Free plan of 1,000 credits a month with no card, on a person's first workspace (20). A person signs in with Google, GitHub, an email code or a magic link behind reCAPTCHA, and MCP's OAuth consent needs that browser sign-in; no keyless route, no programmatic key creation (0). 0+20+20+0 = 40.

ScrapeGraphAI 90

x402 on ScrapeGraphAI's own domain mints an account, key and credits. The protocols endpoint read on 1 November prices the packs at 4 USDC for 1,000 credits, 32 for 10,000 and 120 for 50,000 (5, 40 and 150 before), below the pricing page's $5, $40 and $150 by card, with USDC on Base for x402 and InFlow for MPP. Orthogonal's gateway at x402.orth.sh/scrapegraph takes per-call x402 on scrape, extract, search, crawl and monitor with no ScrapeGraphAI key, per the 1 October check. Per-call payment only through a third party, so 30 (30 of 40). Credit costs per operation, plans and non-expiring top-up packs are public (20). Free plan of 500 credits with no card (20). An agent can buy a key over x402 or MPP with no human signup (20). 30 + 20 + 20 + 20 = 90.

Outcrawl 79

@outcrawl/sdk and the PyPI package outcrawl both reached 0.4.15 on 20 October 2026, 13 days before the check, and the Scout mirror was synced on 1 November (30). 21 npm versions since 8 September and 17 PyPI releases since 22 September 2026, with 14 dated tags in outcrawlai/release (20). Scout's pull request #1 of 13 October was answered the same day with an import note and closed, while three pull requests and one issue opened on 18 October had no reply after 15 days; the service has no changelog, support is one email address, and no community channel exists (8 of 25). Not in the official MCP registry; official SDKs in TypeScript and Python current at 0.4.15, with a CLI (15). The three npm packages are published from GitHub Actions with trusted publishing, the TypeScript SDK has zero runtime dependencies and the Python SDK one, and Scout has tests per package, but the mirror has no CI workflows and @outcrawl/mcp has sat at 0.4.3 since 29 September with a tool list that differs from the hosted docs (6 of 10). 30+20+8+15+6 = 79.

ScrapeGraphAI 40

The newest changelog entry is still v3.5.0 of 30 July 2026 and the newest scrapegraph-py tag v2.3.2 of 31 July, 94 and 93 days before 1 November. scrapegraph-js has no tag after v2.0.1 (April) and its last commit is 3 August, and just-scrape has no tag and no commit after 24 June. Inside 180 days (10, 20 before, cause time). Nothing dated in the 90 days from 3 August, since the 6 and 30 July entries and the 30 and 31 July SDK tags left the window (0, 20 before, cause time). Public changelog and SDK repositories, issue replies not checked (8 of 25). Current Python SDK. The JavaScript SDK's last tag is v2.0.1 from April, with commits to 3 August (12 of 15). The Python SDK runs CI, CodeQL and dependency review (10). 10 + 0 + 8 + 12 + 10 = 40.

Outcrawl 66

OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, api; API keys shaped ock_<keyId>.<secret> are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above approvalAbove pause for a person's yes, and control hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries usage, /v1/usage groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.

ScrapeGraphAI 44

OAuth 2.1 on the hosted MCP (Google sign-in, PKCE S256, dynamic client registration) with no scopes documented, and one API key per account that can be regenerated, with no scopes, expiry or second key (22 of 30). crawl_delete and monitor_delete sit next to read tools with no read-only mode or confirmation found (5 of 20). Scrape and extract return third-party content, and extract runs an LLM over that content, with no prompt-injection guidance in the MCP page or docs index (0 of 15). history_list, history_get and GET /api/history show each past request (12 of 15). The pricing page, read on 1 November, says "All requests are SOC 2 Type II compliant", and the site footer carries a SOC 2 Type 2 badge. security.txt answers 404, and no disclosure policy or bug bounty was found. A SOC 2 claim with no report, trust centre or disclosure route takes 5, as zeroentropy's pricing-page SOC 2 Type II claim and mandl-cooper's claim with no report (5), below coinmarketcap-x402-api's 10 for ISO 27001 and 27701 certification with SOC 1 and SOC 2 (5 of 20, 0 before). 22 + 5 + 0 + 12 + 5 = 44.

Outcrawl 71

API reading, with the MCP server described. An OpenAPI 3.1 document at https://outcrawl.ai/docs/api-reference/openapi.json lists 62 operations over 51 paths with a summary each and the same 11 status codes, generated from the vendor's capability registry, but every request body is an untyped object marked additionalProperties: true with a pointer to the docs, every 200 response is an untyped object, and Error is the only schema; the typed shapes live in the SDK declarations and in the MCP server's zod schemas, which were read in the 0.4.3 npm package rather than from the hosted server (15 of 25). llms.txt and a 525 KB llms-full.txt on the docs, a Markdown twin of every page and an llms.txt on the site (10). The MCP descriptions each end with a Not for: clause naming the better tool and most with a Cost: clause, the OpenAPI summaries say when not to use a route, and the capability pages say which neighbour to use instead (18 of 20). Scrape formats are an enum of eight, event levels and record kinds are enums, caps.budget is required, and the SDK types bound every option, while the OpenAPI bodies carry none of it (10 of 15). curl, TypeScript and Python examples on every page, 20 worked programs, a 31-row error table with meanings and a retryable list, and MCP errors with a recovery string, though the closed union is sized 24, 31, 45 and 22 on different pages (13 of 15). /v1 in the path and 1.0.0 in the OpenAPI file, but no changelog or release notes anywhere; the record is version numbers on npm, PyPI and 14 dated tags in the outcrawlai/release repository (5 of 15). 15+10+18+10+13+5 = 71.

ScrapeGraphAI 88

OpenAPI 3.1.0 at v2-api.scrapegraphai.com/api/openapi.json, info version 2.0.0 (25). llms.txt and Markdown docs (10). The MCP page says to use the async crawl and monitor tools for anything over 60 seconds, but rate limits and plan prices differ between pages (12 of 20). Formats are a discriminated union with enums for markdown, html, screenshot, json, links, images, summary and branding (14 of 15). Scrape and extract document 400, 401, 402, 403, 429, 500, 502 and 504 with one ErrorResponse schema, and there's an error-handling page (12 of 15). Versioned, dated changelog, v3.5.0 on 30 July 2026 (15). Not re-read on 1 November apart from the rate-limit pages. 25 + 10 + 12 + 14 + 12 + 15 = 88.

Outcrawl 83

API reading. Scrape returns main content only by default with formats picking markdown, html, rawHtml, links, screenshots or schema JSON, search renders page bodies only on request, agent events take a level and an after cursor, the MCP server shows request bodies up to a character limit and says when it truncated, and the MCP surface is 29 tools with no toolsets (20 of 25). Cursor pagination on crawl results, agent results and downloads, limit, depth and path filters on crawl, status, outcome, task and age filters on sessions, and usage grouped by hour, day, month or capability (20). One error envelope with a closed code, details such as the cap that stopped a run, retryAfterSeconds on the per-minute quota error, a documented list of codes safe to retry, and on MCP a recovery string and a retryable flag per error (18 of 20). No idempotency key on any route, a repeated agent, crawl or monitor submit runs twice, and concurrency_limit carries no retry hint; cancel is idempotent, integration_changed (409) guards updates, and the npm MCP package sets readOnlyHint on GET tools, destructiveHint on DELETE tools and idempotentHint on either, which the hosted server was not read to confirm (10 of 20). Scrape needs a URL alone, agent runs need caps.budget on the API and SDKs with the MCP server defaulting it, and official SDKs exist in TypeScript and Python beside a CLI (15). 20+20+18+10+15 = 83.

ScrapeGraphAI 72

20 tools on the hosted MCP server with no tool filtering found (15 of 25). Format selection and paginated crawl pages and history (17 of 20). One error shape with type and message, 402 when credits run out (17 of 20). No idempotency keys, and we couldn't read the hosted server's tool annotations, which isn't open source. The older open-source server annotated every tool (8 of 20). Official Python and JavaScript SDKs, and a scrape needs only a URL (15). Not re-read on 1 November. 15 + 17 + 17 + 8 + 15 = 72.

Outcrawl 56

Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.

ScrapeGraphAI 61

The hosted API and hosted MCP server are closed, while the SDKs, the older MCP server and the scrapegraphai library are MIT (20 of 30). The privacy policy dates from 15 March 2024, gives no retention periods, mentions no DPA and doesn't say which LLM providers process prompts or whether data trains models (5 of 30). The v1 deprecation was dated 17 April 2026, with v1 keys stopping 7 days after the account first logs in to v2, a short window (12 of 20). Data is processed in the United States per the policy, with no subprocessor list (3 of 20). Not re-read on 1 November. 20 + 5 + 12 + 3 = 40.