Qovia vs ScrapeGraphAI

Qovia 55

No x402, MPP or L402 on Qovia's own endpoints; USDT on TRC-20 is a top-up method from a console session, not a machine payment protocol. The vendor's five Actors on the Apify Store under the profile qovia (Qovia Data, the same Telegram handle and mailbox as the site), such as the Xingtu Actor at $0.01 to $0.06 a section, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-call prices are published without a login, per endpoint in the OpenAPI file, llms.txt and the docs, search at $5 and raw endpoints from $0.5 to $19.5 per 1,000, with the tier rule and payment fees stated (20). 50 trial calls for a new account, counted only when a call returns data; the quickstart says to top up when they run out and the docs ask for no card at sign-up, though no account was created to confirm it (20). A person signs up in a browser and creates a key; the MCP catalogue tools work without a key but data calls do not, and the Apify route reaches four platforms without a Qovia account (5 of 20). 10+20+20+5 = 55.

ScrapeGraphAI 90

x402 on ScrapeGraphAI's own domain mints an account, key and credits (5 USDC for 1,000 credits, 40 for 10,000, 150 for 50,000, USDC on Base), and Orthogonal's gateway at x402.orth.sh/scrapegraph takes per-call x402 on scrape, extract, search, crawl and monitor with no ScrapeGraphAI key. Per-call payment only through a third party, so 30 (30 of 40). Credit costs per operation, plans and non-expiring top-up packs are public (20). Free plan of 500 credits with no card (20). An agent can buy a key over x402 or MPP with no human signup (20).

Qovia 30

Closed service. The Terms of Service is one paragraph that names no legal entity, address or liability terms, says Delaware law governs and that the page is a summary with the signed agreement governing; the repository's client is MIT. Between the closed and unclear bands (7 of 30). The privacy policy is one paragraph. Account information is used to deliver and bill, personal information is not sold, requests and results are not resold, deletion requests go to the support mailbox, and the agreement governs where it differs. No retention periods, no subprocessors, no DPA, and no statement about the cache the prov.source flag implies; the SECURITY.md repeats the same points (8 of 30). A 410 endpoint_disabled code exists for retired endpoints and the changelog is dated, but there is no deprecation policy or notice period and nothing is marked deprecated (5 of 20). Stripe is named on the pricing page as the card and Alipay processor; no other provider, data location or transfer basis is stated (3 of 20). 7+8+5+3 = 23.

ScrapeGraphAI 61

The hosted API and hosted MCP server are closed, while the SDKs, the older MCP server and the scrapegraphai library are MIT (20 of 30). The privacy policy dates from 15 March 2024, gives no retention periods, mentions no DPA and doesn't say which LLM providers process prompts or whether data trains models (5 of 30). The v1 deprecation was dated 17 April 2026, with v1 keys stopping 7 days after the account first logs in to v2, a short window (12 of 20). Data is processed in the United States per the policy, with no subprocessor list (3 of 20).

Qovia 40

Hosted reading, for the REST API with the MCP server described. No public status page was found. https://qovia.ai/status/ answers 404, status.qovia.ai does not resolve and neither the docs nor the footer links one (0). No readable incident history, so 5 by the rubric (5). Limits are published with numbers on the quickstart's rate-limits section, 60 requests a minute per account before the first top-up and 600 after on a sliding 60-second window, with X-RateLimit-Limit and X-RateLimit-Remaining headers, a 64 KiB body cap, an empty-call throttle (50 calls in 10 minutes with over 80 per cent empty, not found or rejected) and a per-second cap per endpoint without a number (15). Retry-After is declared on too_many_auth_failures, rate_limited, too_many_unbilled, endpoint_busy and upstream_busy, the error table marks the retryable codes, the docs say a 503 endpoint_unavailable carries none and will not clear, and the Python client retries 429 and 503 honouring the header. Every operation is a read, including POST /v1/search, and a failed or timed-out call is refunded, so idempotency keys are not needed (15). No SLA. The terms summary says nothing about uptime and the pricing FAQ excludes outages, rate limits and platform changes from refunds; the 11 September 2026 archived home page advertised a 99.95 per cent enterprise SLA that the current pages have dropped (0). The endpoints are sold and labelled Live on the docs and coverage pages, but every one of the 143 carries x-qovia-status beta in the OpenAPI file, the API version is 0.1.0 and the MCP server reports 0.1.0 (5 of 10). 0+5+15+15+0+5 = 40.

ScrapeGraphAI 64

openstatus page at scrapegraphapi.openstatus.dev (20). Only the last seven days were readable, 'no reports within the last 7 days', and last week's check found it still listing v1 services (10 of 30). Rate limits published, but the rate-limits page gives 10, 100, 500 and 5,000 a minute per the 30 September check while the troubleshooting page gives 5, 30 and 100, so the numbers can't both be right (12 of 15). 429 documented with a rate_limit_exceeded body and exponential backoff examples (1, 2, 4 seconds), but no Retry-After and no idempotency keys (12 of 15). No SLA found (0). v2 is GA (10).

Qovia 60

API keys with scopes chosen at creation (every endpoint, search, every raw endpoint or one of 24 platform groups), an optional expiry, revocation in the console and hashed storage; the docs say the key is read from the Authorization or x-api-key header only, never the URL or a cookie, and 30 failed authentications from one IP in a minute are throttled. No OAuth and no rotation feature beyond creating another key (24 of 30). The whole surface is read-only retrieval, scopes restrict a key to platforms, the two MCP catalogue tools need no key, and the docs and SECURITY.md tell users to give AI tools a separate scoped key (17 of 20). Every response is third-party platform text, and the only related statement is that error messages never contain the data source's own text; nothing on treating returned content as untrusted (3 of 15). request_id is the usage record ID on every answer, the console lists every charge in a usage log, X-Qovia-Charged and X-Qovia-Balance headers report each call, and GET /v1/account returns the key's scopes and balance at no charge; no exportable audit log or per-call endpoint was found (11 of 15). No security.txt on qovia.ai or api.qovia.ai (404), no bug bounty, SOC 2 or ISO 27001; the repository's SECURITY.md names a Telegram handle and a mailbox for reports covering both hosts (5 of 20). 24+17+3+11+5 = 60.

ScrapeGraphAI 39

OAuth 2.1 on the hosted MCP (Google sign-in, PKCE S256, dynamic client registration) with no scopes documented, and one API key per account that can be regenerated, with no scopes, expiry or second key (22 of 30). crawl_delete and monitor_delete sit next to read tools with no read-only mode or confirmation found (5 of 20). Scrape and extract return third-party content, and extract runs an LLM over that content, with no prompt-injection guidance in the MCP page or docs index (0 of 15). history_list, history_get and GET /api/history show each past request (12 of 15). No security.txt per the 30 September check and no security or compliance page in the docs index (0 of 20).

Qovia 77

The newest changes are the registry entry ai.qovia/qovia 0.1.1 and the repository's tools snapshot and plugin manifests on 28 October 2026, after the Python client 0.1.1 on PyPI on 27 October; the repository was pushed on 1 November (30). Eight changelog entries on 21 and 22 October, two registry versions (22 and 28 October) and two PyPI releases (25 and 27 October) are more than three dated entries in 90 days, all within ten days (20). Closed service with a public changelog. Support is Telegram, WhatsApp, WeChat and one mailbox, with a one-business-day reply promised for email; GitHub issues are enabled on the repository with none opened, and no forum, Discord or community was found (7 of 15). ai.qovia/qovia is in the official MCP registry under a DNS-verified reverse-DNS namespace at 0.1.1, marked latest, and the Python client is an official package on PyPI (15). The client is standard-library Python with a test file, MIT, no dependencies and no CI workflow in the repository tree; the account's other nine repositories are forks of lists and directories (5 of 10). 30+20+7+15+5 = 77.

ScrapeGraphAI 70

Changelog v3.5.0 on 30 July and scrapegraph-py 2.3.2 on 31 July 2026 (20). v3.4.2 on 6 July, v3.5.0 on 30 July and SDK 2.3.0 to 2.3.2 on 30 and 31 July (20). Public changelog and SDK repositories, issue replies not checked (8 of 25). Current Python SDK. The JavaScript SDK's last tag is v2.0.1 from April, with commits to 3 August (12 of 15). The Python SDK runs CI, CodeQL and dependency review (10).

Qovia 77

API reading. Responses come in fixed page sizes per endpoint, from about 5 comments on Xiaohongshu to 100 Fliggy reviews, with limit only on Bilibili danmaku and no field selection; the record shape is compact and shared across posts, notes and videos. The MCP server loads four tools by default, keeps the catalogue out of context until search_endpoints and get_endpoint are called, and ?tools= selects platforms or everything, which on the MCP reading would score 25 (18 of 25). Cursor pagination with has_more on most lists, search_id on Douyin and Zhihu search, page numbers on Weibo, Xiaohongshu and Bilibili, sort options on several, and the cross-platform search filters by platform, content type, sentiment and whole-day date windows up to 90 days (17 of 20). One error object with 20 codes, request_id on every answer, the retryable set marked, refunded codes separated from never-charged ones, and MCP tool errors carrying error.code, the HTTP status and retry_after_seconds (19 of 20). All calls are reads, failed and empty calls are refunded, Retry-After is declared and the Python client retries; no readOnlyHint or other annotation appears in the vendor's 28 October tools/list snapshot (14 of 20). One required parameter on 117 of 144 operations and defaults set on the server, but the only official SDK is the Python client; Node and curl are examples (9 of 15). 18+17+19+14+9 = 77.

ScrapeGraphAI 72

20 tools on the hosted MCP server with no tool filtering found (15 of 25). Format selection and paginated crawl pages and history (17 of 20). One error shape with type and message, 402 when credits run out (17 of 20). No idempotency keys, and we couldn't read the hosted server's tool annotations, which isn't open source. The older open-source server annotated every tool (8 of 20). Official Python and JavaScript SDKs, and a scrape needs only a URL (15).