Outcrawl vs Zyte API

Outcrawl 45

Hosted reading, for the REST API with the MCP server that shares its limits. No public status page was found. None is linked from the site or the docs, https://outcrawl.ai/status answers 404 and status.outcrawl.ai does not answer (0). No readable incident history, so the floor (5). Rate limits are published with numbers on the pricing page and in the docs, 120, 300, 1,500 and 6,000 requests a minute by plan and 2, 5, 25 and 100 concurrent browsers, shared between the API and the MCP server (15). Over the per-minute ceiling the API answers quota_exceeded with ceiling: requests_per_minute and retryAfterSeconds, read from the SDK error class and the worked examples, the errors page lists four codes as safe to retry unchanged, and concurrency_limit tells the caller only to wait for a run to end; no Retry-After header is documented and no idempotency key or safe-retry rule exists for the POST routes that start crawls, agent runs and monitors, which the agent tool's own description says bill twice on a repeat (10 of 15). An SLA exists only on Enterprise, a 99.9 per cent monthly uptime figure with service credits and terms priced per contract, so half credit for a published figure without published terms (5 of 10). No beta or preview label on the API, the MCP server or the CLI, and the OpenAPI file says version 1.0.0, though both SDKs are at 0.4.15 and the domain is nine weeks old (10). 0+5+15+10+5+10 = 45.

Zyte API 85

Graded as a hosted API. status.zyte.com runs on Atlassian Statuspage with ten components and incident history (20). In the 90 days to 1 November 2026 its history feed lists two Zyte API incidents, both degraded browser rendering with higher latency and 520 errors, on 10 to 11 September and 13 September, neither marked as an outage, and three incidents outside the API, Scrapy Cloud periodic jobs on 17 August and the web dashboard and Scrapy Cloud periodic jobs down from 28 to 30 October, which Zyte says affected no other product. All partial, so minor (20 of 30). Rate limits are published as 3,000 requests a minute per key on standard plans and a custom limit on Enterprise, though per-site limits aren't (15). 429, 503 and 520 carry Retry-After, and the docs give a backoff table and say which responses to retry, per the 9 October check (15). Enterprise plans list service level agreements for support response times. No uptime SLA is published (5 of 10). Zyte API is generally available, and Zyte MCP carries no beta label on 1 November (10).

Outcrawl 71

API reading, with the MCP server described. An OpenAPI 3.1 document at https://outcrawl.ai/docs/api-reference/openapi.json lists 62 operations over 51 paths with a summary each and the same 11 status codes, generated from the vendor's capability registry, but every request body is an untyped object marked additionalProperties: true with a pointer to the docs, every 200 response is an untyped object, and Error is the only schema; the typed shapes live in the SDK declarations and in the MCP server's zod schemas, which were read in the 0.4.3 npm package rather than from the hosted server (15 of 25). llms.txt and a 525 KB llms-full.txt on the docs, a Markdown twin of every page and an llms.txt on the site (10). The MCP descriptions each end with a Not for: clause naming the better tool and most with a Cost: clause, the OpenAPI summaries say when not to use a route, and the capability pages say which neighbour to use instead (18 of 20). Scrape formats are an enum of eight, event levels and record kinds are enums, caps.budget is required, and the SDK types bound every option, while the OpenAPI bodies carry none of it (10 of 15). curl, TypeScript and Python examples on every page, 20 worked programs, a 31-row error table with meanings and a retryable list, and MCP errors with a recovery string, though the closed union is sized 24, 31, 45 and 22 on different pages (13 of 15). /v1 in the path and 1.0.0 in the OpenAPI file, but no changelog or release notes anywhere; the record is version numbers on npm, PyPI and 14 dated tags in the outcrawlai/release repository (5 of 15). 15+10+18+10+13+5 = 71.

Zyte API 85

The reference prints an OpenAPI 3.0.3 document for POST /v1/extract, though the Search API's /v1/search is documented in tables outside it (25). docs.zyte.com has an llms.txt and Markdown twins of its pages (10). The operation description states which output fields can be combined and which can't, and field descriptions give defaults (17 of 20). Inputs are typed, with 51 enums and required fields marked. customAttributes takes a free-form schema (13 of 15). The spec has a dozen request examples, and each error status has a problem+json example (15). The path is versioned /v1 and the spec says 1.0.0, but we found no dated changelog for the API in the docs sitemap of 150 pages (5 of 15).

Outcrawl 83

API reading. Scrape returns main content only by default with formats picking markdown, html, rawHtml, links, screenshots or schema JSON, search renders page bodies only on request, agent events take a level and an after cursor, the MCP server shows request bodies up to a character limit and says when it truncated, and the MCP surface is 29 tools with no toolsets (20 of 25). Cursor pagination on crawl results, agent results and downloads, limit, depth and path filters on crawl, status, outcome, task and age filters on sessions, and usage grouped by hour, day, month or capability (20). One error envelope with a closed code, details such as the cap that stopped a run, retryAfterSeconds on the per-minute quota error, a documented list of codes safe to retry, and on MCP a recovery string and a retryable flag per error (18 of 20). No idempotency key on any route, a repeated agent, crawl or monitor submit runs twice, and concurrency_limit carries no retry hint; cancel is idempotent, integration_changed (409) guards updates, and the npm MCP package sets readOnlyHint on GET tools, destructiveHint on DELETE tools and idempotentHint on either, which the hosted server was not read to confirm (10 of 20). Scrape needs a URL alone, agent runs need caps.budget on the API and SDKs with the MCP server defaulting it, and official SDKs exist in TypeScript and Python beside a CLI (15). 20+20+18+10+15 = 83.

Zyte API 72

Graded on the REST API, with the MCP server noted. A request names the outputs it wants, so an agent can ask for extracted fields or pageContent in place of full HTML, but HTML and bodies come whole, up to 10 MB. Zyte MCP lists 34 tools at once, 26 of them for Scrapy Cloud, recounted from its docs on 1 November (15 of 25). No pagination applies to a single-URL call. Search takes maxResults from 10 to 100, and the Stats API pages and filters (14 of 20). Errors are problem+json with a stable type path, and the docs say which to retry and which to fix (20). Calls are reads, failed and rate-limited requests are free, and retries are safe. We could not read the MCP tool annotations, which need a sign-in (14 of 20). A call needs only url and one output flag. The only official client is Python, with a Scrapy plugin (9 of 15).

Outcrawl 66

OAuth 2.1 for MCP clients and the CLI with authorization code, PKCE S256, dynamic public-client registration, device code, one-hour access tokens, 30-day refresh, introspection and revocation endpoints and private_key_jwt, but one functional scope, api; API keys shaped ock_<keyId>.<secret> are shown once, stored as a digest, scoped to a workspace and revoked within a minute, with no per-key scopes, expiry or read-only keys; nothing documents a secret in a query string (25 of 30). No read-only key or scope. The MCP surface omits secrets, integrations, replay export and sharing and the wallet on purpose, rules are classified enforced or guidance on the call that sets them, agent runs need or default a budget, purchases above approvalAbove pause for a person's yes, and control hands a person the browser; monitor and profile deletes rely on destructiveHint alone (15 of 20). Every tool returns untrusted page content. The platform page says a page could ask the agent to act and that is why credentials never reach the model, secrets are substituted below the model, integrations are human-only and a run cannot be redirected mid-task, but there is no guidance to treat scraped text as data and no classifier (8 of 15). Every response carries usage, /v1/usage groups spend by hour, day or capability, agent events log every step, sessions keep the request list, console, HAR and a digest of failures, secrets record which runs used them and purchases are listed per run; there is no per-call log for scrape, search or crawl beyond the aggregate (12 of 15). No security.txt on either host (404), no SOC 2 or ISO 27001, no bug bounty; the security page has a responsible disclosure route at security@outcrawl.ai with a 90-day window and a no-legal-action statement (6 of 20). 25+15+8+12+6 = 66.

Zyte API 55

API keys are revocable, an organisation can hold several, and none travels in a URL. Keys carry no permission scopes. Zyte MCP signs in over OAuth and works through its own key, mcp_access_key (22 of 30). An owner can set a blocking spending limit per key. We found no read-only mode, and the MCP docs warn that the agent can delete schedules and collections with no undo, leaving approval to the MCP client (8 of 20). The API returns untrusted web content, and the only guidance found is to review what the agent asks to do (2 of 15). The Stats API and dashboard break usage down by key, domain and request type, requests can be tagged, and each response has a request-id. No per-request log for the operator was found (10 of 15). ISO 27001 certification per the trust centre, a responsible disclosure programme with a hall of fame and no rewards, penetration test reports under NDA, and no security.txt (www.zyte.com/.well-known/security.txt answered 404 on 1 November) (13 of 20).

Outcrawl 56

Closed hosted service under terms last updated 1 November 2026 that name Aeonmind LLC, trading as Outcrawl, Delaware law and a liability cap; the SDKs and the MCP package are MIT and Scout, the agent behind the hosted agent, is Apache-2.0 in a read-only mirror of a private repository (20 of 30). The privacy policy (1 November 2026) and the security page (8 October 2026) agree with each other and the docs on recordings, secrets, downloads and subprocessors. Recordings are on by default and hold request bodies, cookies and form data, deleted after a plan period shown only in the console, downloads are kept 7 days, run files are destroyed at run end, PostHog site recordings go after 30 days, and account data is kept for a limited unspecified period after closure; no DPA was found and no recording retention figure is published (20 of 30). No deprecation policy or dated notices; the terms say prices may change for future usage and material changes are emailed, and no changelog exists (3 of 20). Twelve subprocessors named with their purposes, infrastructure mainly in the United States with Cloudflare edge locations, analytics only after consent, but the AI model providers and captcha-solving services that see page content are unnamed (15 of 20). 20+20+3+15 = 58.

Zyte API 67

A closed service with terms last updated on 22 September 2026 (unchanged on 1 November) that name Zyte Group Limited and contain a Zyte API section. The Python client is BSD 3-Clause (15 of 30). The privacy policy (30 August 2024), a DPA and a sub-processor list are public, with retention stated for support tickets (4 years) and invoices (7 years). Retention of request data and scraped content isn't stated, and the terms let Zyte use Service Data for product development and product training (17 of 30). Site tier changes get two weeks' notice and the Smart Proxy Manager retirement was announced with a date, but there is no standing API deprecation policy and the terms allow changes with or without notice (10 of 20). The sub-processor list names 36 companies with addresses and purposes, and the privacy policy names the United States and Ireland as processing locations (16 of 20).