Qovia vs ScrapeAtlas

Qovia 30

Closed service. The Terms of Service is one paragraph that names no legal entity, address or liability terms, says Delaware law governs and that the page is a summary with the signed agreement governing; the repository's client is MIT. Between the closed and unclear bands (7 of 30). The privacy policy is one paragraph. Account information is used to deliver and bill, personal information is not sold, requests and results are not resold, deletion requests go to the support mailbox, and the agreement governs where it differs. No retention periods, no subprocessors, no DPA, and no statement about the cache the prov.source flag implies; the SECURITY.md repeats the same points (8 of 30). A 410 endpoint_disabled code exists for retired endpoints and the changelog is dated, but there is no deprecation policy or notice period and nothing is marked deprecated (5 of 20). Stripe is named on the pricing page as the card and Alipay processor; no other provider, data location or transfer basis is stated (3 of 20). 7+8+5+3 = 23.

ScrapeAtlas 59

Closed service with clear terms dated 29 September 2026 naming the legal entity, governing law and liability cap; the CLI is MIT on npm with no source published (15 of 30). The privacy policy (19 October 2026) gives retention periods, 90 days for raw usage records, 30 days for inactive key metadata, 10 minutes to 30 days for OAuth artefacts, and says workers keep no archive of results, which the terms and the Public Data Notice repeat. Providers are named with their roles. No DPA is published; the terms say to arrange one before submitting such a workload (22 of 30). The terms promise reasonable notice of material changes when practicable, and the changelog records a Reddit retirement on 29 September and kept paths on 14 October, but there is no deprecation policy with periods and nothing in the OpenAPI file is marked deprecated (7 of 20). Supabase, Tinybird, PostHog, Stripe, Google, OpenAI and Affonso are named with purposes, but the only location statement is that the operator is in the UAE and infrastructure can process in other countries (10 of 20). 15+22+7+10 = 54.

Qovia 77

The newest changes are the registry entry ai.qovia/qovia 0.1.1 and the repository's tools snapshot and plugin manifests on 28 October 2026, after the Python client 0.1.1 on PyPI on 27 October; the repository was pushed on 1 November (30). Eight changelog entries on 21 and 22 October, two registry versions (22 and 28 October) and two PyPI releases (25 and 27 October) are more than three dated entries in 90 days, all within ten days (20). Closed service with a public changelog. Support is Telegram, WhatsApp, WeChat and one mailbox, with a one-business-day reply promised for email; GitHub issues are enabled on the repository with none opened, and no forum, Discord or community was found (7 of 15). ai.qovia/qovia is in the official MCP registry under a DNS-verified reverse-DNS namespace at 0.1.1, marked latest, and the Python client is an official package on PyPI (15). The client is standard-library Python with a test file, MIT, no dependencies and no CI workflow in the repository tree; the account's other nine repositories are forks of lists and directories (5 of 10). 30+20+7+15+5 = 77.

ScrapeAtlas 70

The newest change is CLI 0.26.0 on 28 October 2026, after the StockX endpoints on 27 October (30). 15 dated release days between 21 September and 27 October, 58 updates (20). Closed service with a public changelog. Support in the dashboard is for customers with a credit purchase, the contact form takes buying questions and privacy requests, and no Discord, forum or issue tracker was found; the careers page lists a customer support role (7 of 15). io.github.OnlineDopamine/scrapeatlas is in the official MCP registry under a GitHub-verified personal namespace, at 1.0.0 since 5 October and describing about 40 platforms against 49 now. The CLI is current on npm and an n8n node exists, but there are no SDKs (10 of 15). The CLI package has no repository field, no public source and no visible CI; it needs Node 22 or newer (3 of 10). 30+20+7+10+3 = 70.

Qovia 60

API keys with scopes chosen at creation (every endpoint, search, every raw endpoint or one of 24 platform groups), an optional expiry, revocation in the console and hashed storage; the docs say the key is read from the Authorization or x-api-key header only, never the URL or a cookie, and 30 failed authentications from one IP in a minute are throttled. No OAuth and no rotation feature beyond creating another key (24 of 30). The whole surface is read-only retrieval, scopes restrict a key to platforms, the two MCP catalogue tools need no key, and the docs and SECURITY.md tell users to give AI tools a separate scoped key (17 of 20). Every response is third-party platform text, and the only related statement is that error messages never contain the data source's own text; nothing on treating returned content as untrusted (3 of 15). request_id is the usage record ID on every answer, the console lists every charge in a usage log, X-Qovia-Charged and X-Qovia-Balance headers report each call, and GET /v1/account returns the key's scopes and balance at no charge; no exportable audit log or per-call endpoint was found (11 of 15). No security.txt on qovia.ai or api.qovia.ai (404), no bug bounty, SOC 2 or ISO 27001; the repository's SECURITY.md names a Telegram handle and a mailbox for reports covering both hosts (5 of 20). 24+17+3+11+5 = 60.

ScrapeAtlas 55

Customer keys with prefix sa_live_, several per account, each with an expiry date, revoked within 60 seconds and stored as hashes per the privacy policy, and keys can't start a checkout or create keys. No scopes or per-platform keys. The MCP server adds an authorization-code flow with PKCE S256, dynamic client registration, refresh-token rotation and revocation, but a single scope, scrapeatlas. No documented option to send a secret in a query string, and the MCP page says never to put the key in a prompt, argument or URL (22 of 30). The whole surface is read-only retrieval of public pages with no destructive action, and an OAuth grant covers retrieval plus the account's usage records only; nothing restricts a key to some platforms (16 of 20). Every response is third-party page content, and the only guidance found concerns keeping secrets out of tool arguments, nothing on treating returned text as untrusted (2 of 15). GET /v1/activity returns per-request metadata (endpoint, time, status, duration) newest first with filters, GET /v1/usage daily totals, responses carry x-credits-charged and x-credits-remaining, and the dashboard shows a credit history (13 of 15). No security.txt (404), no disclosure policy, bug bounty, SOC 2 or ISO 27001; the privacy policy describes access controls and incident notices and gives an abuse address (2 of 20). 22+16+2+13+2 = 55.