Pulsedive vs Shodan

Pulsedive 77

OpenAPI 3.0.3 documents for every endpoint, eleven YAML files under Apache 2.0, with typed parameters and response schemas, though split per endpoint and without a securitySchemes block in the scan and explore file (22 of 25). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). Each endpoint states its purpose, probe and submit are explained with their side effects, and the collection page says what each timestamp means, with little on when not to call (15 of 20). Enumerated 0 or 1 flags, required parameters marked, risk and type enums, but key is optional while 401 describes it missing, and explore summaries allow types the indicator schema does not (11 of 15). curl examples on every page and an error table for 400, 401, 404, 429 and 500 with an example body (12 of 15). No API version or changelog; the docs launch post of 30 March 2026 and a footer version number are the only dated changes, and the spec marks the recent field deprecated with no date (7 of 15). 22 + 10 + 15 + 11 + 12 + 7 = 77.

Shodan 46

The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with facets, query and fields as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an error field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46.

Pulsedive 40

Read as a closed service. The site footer shows version 6.3.18 dated 27 October, seven days before the check, and the newest blog post is 29 September 2026 (30). No changelog lists releases, so three dated changes in 90 days could not be shown (0 of 20). A Discord, support@pulsedive.com, a contact form and a docs troubleshooting section; the GitHub feedback repository is archived since 2020 (10 of 15). No entry in the official MCP registry (the docs MCP server is not listed and the registry's pulsedive entries are third-party) and no official SDK (0 of 15). No official packages to assess (0 of 10). 30 + 0 + 10 + 0 + 0 = 40.

Shodan 16

No dated API change found. The blog's newest post is 7 August 2024, and the official Python library shodan 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16.

Pulsedive 57

A closed service with terms naming Pulsedive LLC and New Jersey law, with the OpenAPI files under Apache 2.0 (15 of 30). The privacy policy of 28 August 2024 lists processors and what is logged, keeps deleted-account data for compliance with no periods, and names no DPA; an enterprise privacy page exists and was not read (14 of 30). The recent field is marked deprecated in the spec with no date and there is no policy (5 of 20). DigitalOcean, Plausible, Stripe, SendGrid, Google Workspace, Monday, QuickBooks and Typeform named, storage in the United States (16 of 20). 15 + 14 + 5 + 16 = 50.

Shodan 44

Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13.

Pulsedive 50

No x402, MPP or L402 (0). Pro $29 a month is on the site menu and the Team and Business API prices are in the vendor's plan post of 11 March 2024, sold as monthly quotas rather than per call (10). A free account needs no card (20). Requests without a key are accepted, so an agent can look up an indicator with no signup at about 10 a day (20). 0 + 10 + 20 + 20 = 50.

Shodan 40

No x402, MPP or L402 (0). Plan prices and credit quotas are public on the billing page without a login, from a $49 one-time Membership to $1,099 a month, sold by monthly credit quota rather than per call (10). A free account with a free API plan, and the billing page does not ask for a card (20). The REST API key comes from a browser signup. InternetDB and CVEDB answer with no account or key at all, for non-commercial use, which is keyless use of part of the surface (10 of 20). 0 + 10 + 20 + 10 = 40.

Pulsedive 31

Read with the hosted lines. No status page was found on the site, the docs, the support page or in search (0). No readable history (5). The limits page names Free, Pro, Commercial and Enterprise tiers and three remaining-request headers but gives no numbers, pointing to the account page; the vendor's plan post of 11 March 2024 gives 50 a day on Free and 250 on Pro (8 of 15). A 429 returns a JSON error naming the limit and the headers show what remains, with no Retry-After or backoff guidance; scans are safe to repeat and polling is free (8 of 15). No SLA; the terms supply the services as is and as available (0). The API is generally available (10). 0 + 5 + 8 + 8 + 0 + 10 = 31.

Shodan 40

Read with the hosted lines. A public status page exists at status.shodan.io (UptimeRobot), but on 3 November 2026 its component list failed to load and it showed only that there were no updates in the last 7 days, so no component history was readable (10 of 20). No readable incident record for the 90 days (5). The billing page states that all API plans are limited to 1 request a second, and credits per plan are published with numbers (15). No 429, Retry-After or backoff guidance was found in the reference or the OpenAPI document; the only error statement is that a non-200 status carries an error message, and no idempotency keys exist for alert, notifier or scan writes. The official Python client throttles itself to 1 request a second and retries a timed-out search cursor, which is client behaviour, not an API contract (0). No SLA found on the billing, enterprise or developer pages (0). The REST API is generally available (10). 10 + 5 + 15 + 0 + 0 + 10 = 40.