Outcrawl vs ZenRows

Outcrawl 45

Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers quota_exceeded with ceiling: requests_per_minute and retryAfterSeconds, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and concurrency_limit tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.

ZenRows 87

Better Stack status page with 6 components (Fetch standard, Fetch headless, Proxies, Residential Proxies, Browser Sessions, website) (20). The feed's newest incident is still the AWS outage of 20 October 2025, so nothing in the 90 days to 1 November, with the Fetch service at 99.998 per cent and the website at 100 on 1 November (30). Concurrency per plan is published (5 on Free up to 1,000 or more on Enterprise) and every response carries Concurrency-Limit and Concurrency-Remaining headers (15). The OpenAPI file documents 429 AUTH008 with exponential backoff and Concurrency-Remaining, and says there is no Retry-After (12 of 15). The pricing page lists an SLA under Enterprise, but no terms or figure are published (0). Fetch is generally available. Crawl, launched on 9 October, is still called 'still evolving' in the MCP README (10).

Outcrawl 40

No x402, MPP or L402 in the OpenAPI file, the docs, the pricing pages or the terms (0). Per-unit rates published without a login, 1 credit a page, 5 credits per 10 search results, 1 credit a browser minute, 2,000 credits a GB and 1 credit a monitor check, with the dollar rate per plan ($4.90 per 1,000 credits on Builder down to about $3.20 on Scale), top-up prices per 10,000 and an estimate of about 15 credits a minute for agent runs (20). Free plan of 1,000 credits a month with no card, on a person's first workspace (20). A person signs in with Google, GitHub, an email code or a magic link behind reCAPTCHA, and MCP's OAuth consent needs that browser sign-in; no keyless route, no programmatic key creation (0). 0+20+20+0 = 40.

ZenRows 80

x402 and MPP through an agent storefront at agents.zenrows.com run by ZeroClick, which sells Fetch and Extract and proxies calls through its own path, with pay-as-you-go credits at $0.50 per 1,000 (10,000 minimum) per the pricing docs. Nothing on api.zenrows.com itself (20 of 40). Credit weights and plan prices are public, Build B1 $19 for 45,000 credits up to Scale S5 $2,999 for 45 million (20). 5,000 free credits a month, no card (20). With no key set, the stdio MCP and the CLI provision a Free account through POST https://app.zenrows.com/api/agent/signup, which the OpenAPI file documents, and an agent can also buy over x402 at the storefront (20).

Outcrawl 56

Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.

ZenRows 79

Closed service, with ZENROWS, S.L. named in full (Getxo, Spain, tax ID B10660298). The MCP is MIT (15 of 30). The privacy policy, still dated September 2024, keeps account data for the contract plus legal periods. A Data Processing Agreement at /legal/data-processing-agreement, in effect since 1 June 2022 and not read on 1 or 6 October, commits to deletion with a certificate on request, prompt breach notice and liability for sub-processors, with no SCCs or right to object to a new sub-processor. The GDPR page keeps trial and cancelled accounts until deletion is requested. Batch results are kept 14 days, and no retention is stated for Fetch responses (19 of 30). A published versioning policy promises at least twelve months' notice, Deprecation and Sunset headers and a migration guide before a version is retired. The 2026 renames carried no dated notices (15 of 20). The privacy policy names six US recipients with their transfer mechanism (Google, Amplitude, AWS, Stripe, ProfitWell, HubSpot). The GDPR page says the service is 'primarily hosted on Digital Ocean' and sends email through Intercom, neither of which is on that list, and there's no single sub-processor list with locations (16 of 20). 15+19+15+16 = 65.

Outcrawl 71

API reading, with the MCP server described. An OpenAPI 3.1 document at https://outcrawl.ai/docs/api-reference/openapi.json lists 62 operations over 51 paths with a summary each and the same 11 status codes, generated from the vendor's capability registry, but every request body is an untyped object marked additionalProperties: true with a pointer to the docs, every 200 response is an untyped object, and Error is the only schema; the typed shapes live in the SDK declarations and in the MCP server's zod schemas, which were read in the 0.4.3 npm package rather than from the hosted server (15 of 25). llms.txt and a 525 KB llms-full.txt on the docs, a Markdown twin of every page and an llms.txt on the site (10). The MCP descriptions each end with a Not for: clause naming the better tool and most with a Cost: clause, the OpenAPI summaries say when not to use a route, and the capability pages say which neighbour to use instead (18 of 20). Scrape formats are an enum of eight, event levels and record kinds are enums, caps.budget is required, and the SDK types bound every option, while the OpenAPI bodies carry none of it (10 of 15). curl, TypeScript and Python examples on every page, 20 worked programs, a 31-row error table with meanings and a retryable list, and MCP errors with a recovery string, though the closed union is sized 24, 31, 45 and 22 on different pages (13 of 15). /v1 in the path and 1.0.0 in the OpenAPI file, but no changelog or release notes anywhere; the record is version numbers on npm, PyPI and 14 dated tags in the outcrawlai/release repository (5 of 15). 15+10+18+10+13+5 = 71.

ZenRows 93

OpenAPI 3.1 at www.zenrows.com/openapi.json covers Fetch, Extract, Crawl (added after the 9 October launch), Batch, agent signup and HMAC key rotation, and the 63 MCP tools have typed zod inputs (25). llms.txt with 105 entries linking 240 docs pages on 1 November, each with a Markdown copy (10). The scrape tool says when to prefer extract, when to turn on js_render or premium_proxy, and gives three examples, and the crawl tools say when to wait, page or download. The browser tools are terser (18 of 20). Enums on mode and response_type, URL validation and required fields, but css_extractor is a JSON string and outputs a comma-separated string (12 of 15). Error catalogue of 35 codes such as AUTH004 and RESP002, plus a table of Batch and Extract codes, grouped by HTTP status with fixes, and every OpenAPI operation lists its error responses (15). The API is versioned in the path (v1, never retired), a dated changelog at www.zenrows.com/changelog runs to 9 October 2026, with nothing newer on 1 November, and the MCP has semver tags. The 2026 renames (Universal Scraper API to Fetch, Scraping Browser to Browser Sessions) aren't in it (13 of 15).

Outcrawl 66

OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, api; API keys shaped ock_<keyId>.<secret> are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above approvalAbove pause for a person's yes, and control hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries usage, /v1/usage groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.

ZenRows 50

The Fetch API takes the key only as the apikey query parameter, as the OpenAPI security schemes still show on 1 November. Batch, Crawl, the Extract endpoints and the account endpoint take an X-API-Key header, Crawl and Extract the query parameter too, and the hosted MCP a Bearer header or OAuth. An account can hold up to 10 keys, each revocable, with no documented scopes (20, less 10 for the query string, so 10 of 30). Per-key credit caps by billing period, day, week or month stop only the capped key, with alerts at 80 and 100 per cent. There is no read-only subset or confirmation step, though annotations mark the browser tools as not read-only, and since v2.15.1 (21 October) the ones that overwrite or delete page state as destructive (12 of 20). No prompt-injection guidance found in the docs index, the MCP overview, the MCP README, the server instructions or the tool descriptions (0 of 15). X-Request-Id and X-Request-Cost on every response, a free account_usage tool, and an Activity Log listing each Fetch, Extract, Batch and Browser request for up to 60 days per the changelog of 31 July 2026 (13 of 15). security.txt on www.zenrows.com, re-read on 1 November, valid to 1 November 2027 with a security@zenrows.com contact and a linked information security policy. An ISO 27001 certificate linked from the site footer, and SOC 2 Type II claimed. No bug bounty found (15 of 20).

Outcrawl 79

@outcrawl/sdk and the PyPI package outcrawl both reached 0.4.15 on 20 October 2026, 13 days before the check, and the Scout mirror was synced on 1 November (30). 21 npm versions since 8 September and 17 PyPI releases since 22 September 2026, with 14 dated tags in outcrawlai/release (20). Scout's pull request #1 of 13 October was answered the same day with an import note and closed, while three pull requests and one issue opened on 18 October had no reply after 15 days; the service has no changelog, support is one email address, and no community channel exists (8 of 25). Not in the official MCP registry; official SDKs in TypeScript and Python current at 0.4.15, with a CLI (15). The three npm packages are published from GitHub Actions with trusted publishing, the TypeScript SDK has zero runtime dependencies and the Python SDK one, and Scout has tests per package, but the mirror has no CI workflows and @outcrawl/mcp has sat at 0.4.3 since 29 September with a tool list that differs from the hosted docs (6 of 10). 30+20+8+15+6 = 79.

ZenRows 90

MCP v2.18.0 on 2026-10-30 (30). Seven MCP minor releases from 18 to 30 October alone (v2.12.0 to v2.18.0), and dated changelog entries on 2, 5 and 9 October (20). We couldn't read GitHub issues. PRs are merged within days and the dated changelog on zenrows.com runs to 9 October (15 of 25). In the official MCP registry as io.github.ZenRows/zenrows-mcp, with 2.18.0 published on 30 October and marked latest (15). CI runs typecheck, lint and tests on a Node matrix, and a check that server.json matches the package version (10).