Qovia vs ScrapeOps Proxy API Aggregator

Qovia 60

API keys with scopes chosen at creation (every endpoint, search, every raw endpoint or one of 24 platform groups), an optional expiry, revocation in the console and hashed storage; the docs say the key is read from the Authorization or x-api-key header only, never the URL or a cookie, and 30 failed authentications from one IP in a minute are throttled. No OAuth and no rotation feature beyond creating another key (24 of 30). The whole surface is read-only retrieval, scopes restrict a key to platforms, the two MCP catalogue tools need no key, and the docs and SECURITY.md tell users to give AI tools a separate scoped key (17 of 20). Every response is third-party platform text, and the only related statement is that error messages never contain the data source's own text; nothing on treating returned content as untrusted (3 of 15). request_id is the usage record ID on every answer, the console lists every charge in a usage log, X-Qovia-Charged and X-Qovia-Balance headers report each call, and GET /v1/account returns the key's scopes and balance at no charge; no exportable audit log or per-call endpoint was found (11 of 15). No security.txt on qovia.ai or api.qovia.ai (404), no bug bounty, SOC 2 or ISO 27001; the repository's SECURITY.md names a Telegram handle and a mailbox for reports covering both hosts (5 of 20). 24+17+3+11+5 = 60.

ScrapeOps Proxy API Aggregator 28

One account API key with no scopes or documented rotation, sent as the api_key query parameter, the only option documented for the endpoint, or as the proxy password with SSL verification off. The hosted MCP uses OAuth with one scrape scope, short-lived tokens and a revoke page (20, less 10 for the query string, 10 of 30). Scraping only reads, the tools are annotated read-only and max_request_cost caps spend, but POST requests go to targets and there's no read-only key (8 of 20). No prompt-injection guidance for returned pages was found (0 of 15). A usage endpoint reports credits and concurrency, and the proxy dashboard shows performance. No per-call audit log for customers (7 of 15). security.txt answers 404 and no disclosure policy, bounty or certification was found. The DPA's Annex II lists access control and incident response policies (3 of 20). 10 + 8 + 0 + 7 + 3 = 28.

Qovia 77

The newest changes are the registry entry ai.qovia/qovia 0.1.1 and the repository's tools snapshot and plugin manifests on 28 October 2026, after the Python client 0.1.1 on PyPI on 27 October; the repository was pushed on 1 November (30). Eight changelog entries on 21 and 22 October, two registry versions (22 and 28 October) and two PyPI releases (25 and 27 October) are more than three dated entries in 90 days, all within ten days (20). Closed service with a public changelog. Support is Telegram, WhatsApp, WeChat and one mailbox, with a one-business-day reply promised for email; GitHub issues are enabled on the repository with none opened, and no forum, Discord or community was found (7 of 15). ai.qovia/qovia is in the official MCP registry under a DNS-verified reverse-DNS namespace at 0.1.1, marked latest, and the Python client is an official package on PyPI (15). The client is standard-library Python with a test file, MIT, no dependencies and no CI workflow in the repository tree; the account's other nine repositories are forks of lists and directories (5 of 10). 30+20+7+15+5 = 77.

ScrapeOps Proxy API Aggregator 46

Read for a closed service. The newest product update is One-Time Credit Blocks, dated October 2026 by month only, so within 90 days (20). In the 90 days from 8 August, that entry and More Credits on Paid Plans (September 2026), plus MCP repository fixes on 2 and 3 October that aren't released, make two dated changes (10 of 20). Public changelog by product and support by email. GitHub issues weren't read (8 of 25). The MCP server's server.json names io.github.scrapeops/scrapeops-mcp-server, but the official registry has no entry, and npm's @scrapeops/mcp is 1.0.1 of 1 January 2026 while the repository says 1.1.0 (5 of 15). The MCP repository has tests but no CI workflow (3 of 10). 20 + 10 + 8 + 5 + 3 = 46.

Qovia 30

Closed service. The Terms of Service is one paragraph that names no legal entity, address or liability terms, says Delaware law governs and that the page is a summary with the signed agreement governing; the repository's client is MIT. Between the closed and unclear bands (7 of 30). The privacy policy is one paragraph. Account information is used to deliver and bill, personal information is not sold, requests and results are not resold, deletion requests go to the support mailbox, and the agreement governs where it differs. No retention periods, no subprocessors, no DPA, and no statement about the cache the prov.source flag implies; the SECURITY.md repeats the same points (8 of 30). A 410 endpoint_disabled code exists for retired endpoints and the changelog is dated, but there is no deprecation policy or notice period and nothing is marked deprecated (5 of 20). Stripe is named on the pricing page as the card and Alipay processor; no other provider, data location or transfer basis is stated (3 of 20). 7+8+5+3 = 23.

ScrapeOps Proxy API Aggregator 61

Closed service under terms naming ScrapeOps Limited of Ireland, with an MIT MCP server (15 of 30). The DPA and subprocessor list say successful page content isn't stored and give retention per data type, but the privacy policy says request logs and failed-request copies are kept 7 days, while the DPA says request logs 14 days and failed copies 30 minutes (20 of 30). No deprecation policy. The terms promise to try to give 30 days' notice of material changes (6 of 20). Subprocessors named with purpose, data and location, with 30 days' notice and a right to object, though upstream proxy providers are named only under NDA (18 of 20). 15 + 20 + 6 + 18 = 59.

Qovia 86

An OpenAPI 3.1.0 file (version 0.1.0, 1 MB) is public at qovia.ai/openapi.json with 144 paths and 144 operations, two security schemes, typed query parameters, a response example on every operation and the error responses declared on each. The data payload itself is typed only as object, array or null with per-endpoint examples, and the MCP call_endpoint tool takes a free params object, so 22 of 25 (22). llms.txt (75 KB, one line per endpoint with price and status) and llms-full.txt (331 KB, the whole documentation as text) are served, and the quickstart's billing, limits and error sections are in both (10). Every operation has a summary and a description; most say what the data holds, how to page, which ids to pass, which fields are unavailable and what answers 404 or empty, and the MCP server's instructions say to find, read then call. Guidance on when not to use an endpoint is thin, mostly pointers such as replies coming from another endpoint (16 of 20). 321 parameters, 75 with enums, patterns on ids, min and max on strings and integers, 117 operations with one required parameter and 16 with none, the POST body typed with additionalProperties false, and unknown parameters rejected with 400 (14 of 15). A response example on all 144 operations, 20 error codes with every message variant listed, response headers documented per error, and cURL, Python, JavaScript and raw HTTP samples; the examples are catalogue samples the docs say are not live data (14 of 15). Paths are under /v1, a 410 endpoint_disabled code exists for retired endpoints, and the changelog is dated, but it has two days (21 and 22 October 2026), nothing is marked deprecated and no notice period is stated (10 of 15). 22+10+16+14+14+10 = 86.

ScrapeOps Proxy API Aggregator 67

No OpenAPI or similar spec. The MCP server's three tools have typed inputs in its source (10 of 25). llms.txt and llms-full.txt index the docs for models (10). Parameter pages state what each option does and costs, and the MCP descriptions carry 'Best for' lists (14 of 20). Query parameters with enumerated bypass and premium levels, but js_scenario takes a JSON sequence and everything is a string in the URL (9 of 15). Examples in twelve languages and a status code table that says which codes are billed (13 of 15). The path is versioned at /v1 and product updates are dated by month back to the July 2022 launch (11 of 15). 10 + 10 + 14 + 9 + 13 + 11 = 67.

Qovia 55

No x402, MPP or L402 on Qovia's own endpoints; USDT on TRC-20 is a top-up method from a console session, not a machine payment protocol. The vendor's five Actors on the Apify Store under the profile qovia (Qovia Data, the same Telegram handle and mailbox as the site), such as the Xingtu Actor at $0.01 to $0.06 a section, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-call prices are published without a login, per endpoint in the OpenAPI file, llms.txt and the docs, search at $5 and raw endpoints from $0.5 to $19.5 per 1,000, with the tier rule and payment fees stated (20). 50 trial calls for a new account, counted only when a call returns data; the quickstart says to top up when they run out and the docs ask for no card at sign-up, though no account was created to confirm it (20). A person signs up in a browser and creates a key; the MCP catalogue tools work without a key but data calls do not, and the Apify route reaches four platforms without a Qovia account (5 of 20). 10+20+20+5 = 55.

ScrapeOps Proxy API Aggregator 40

No x402, MPP or L402 (0). Credit costs per option and all twelve plan prices are public (20). Free plan of 1,000 credits a month with no card (20). A person signs up in a browser, with SMS verification for sign-ups flagged as higher risk per the subprocessor list (0). 0 + 20 + 20 + 0 = 40.