Qovia vs ScraperAPI

Qovia 60

API keys with scopes chosen at creation (every endpoint, search, every raw endpoint or one of 24 platform groups), an optional expiry, revocation in the console and hashed storage; the docs say the key is read from the Authorization or x-api-key header only, never the URL or a cookie, and 30 failed authentications from one IP in a minute are throttled. No OAuth and no rotation feature beyond creating another key (24 of 30). The whole surface is read-only retrieval, scopes restrict a key to platforms, the two MCP catalogue tools need no key, and the docs and SECURITY.md tell users to give AI tools a separate scoped key (17 of 20). Every response is third-party platform text, and the only related statement is that error messages never contain the data source's own text; nothing on treating returned content as untrusted (3 of 15). request_id is the usage record ID on every answer, the console lists every charge in a usage log, X-Qovia-Charged and X-Qovia-Balance headers report each call, and GET /v1/account returns the key's scopes and balance at no charge; no exportable audit log or per-call endpoint was found (11 of 15). No security.txt on qovia.ai or api.qovia.ai (404), no bug bounty, SOC 2 or ISO 27001; the repository's SECURITY.md names a Telegram handle and a mailbox for reports covering both hosts (5 of 20). 24+17+3+11+5 = 60.

ScraperAPI 29

One API key per account, regenerated from the dashboard at most once every 24 hours. No scopes (20). The documented default puts the key in the URL query string, so less 10, although an x-sapi-api_key header and a Bearer header on the remote MCP server exist (10 of 30). No read-only or restricted keys. max_cost, a monthly pay-as-you-go spending cap and destructive hints on the two MCP delete tools limit damage (6 of 20). The API returns untrusted web content and no prompt-injection guidance was found in the docs, the MCP README or the skills (2 of 15). The dashboard has analytics with error logs, each response carries sa-credit-cost, and the privacy policy says activity logs are deleted after 7 days (9 of 15). /.well-known/security.txt returned 404, and no disclosure policy, bug bounty or certification was found. The home page claims CCPA and GDPR compliance (2 of 20).

Qovia 30

Closed service. The Terms of Service is one paragraph that names no legal entity, address or liability terms, says Delaware law governs and that the page is a summary with the signed agreement governing; the repository's client is MIT. Between the closed and unclear bands (7 of 30). The privacy policy is one paragraph. Account information is used to deliver and bill, personal information is not sold, requests and results are not resold, deletion requests go to the support mailbox, and the agreement governs where it differs. No retention periods, no subprocessors, no DPA, and no statement about the cache the prov.source flag implies; the SECURITY.md repeats the same points (8 of 30). A 410 endpoint_disabled code exists for retired endpoints and the changelog is dated, but there is no deprecation policy or notice period and nothing is marked deprecated (5 of 20). Stripe is named on the pricing page as the card and Alipay processor; no other provider, data location or transfer basis is stated (3 of 20). 7+8+5+3 = 23.

ScraperAPI 54

Closed service. The MCP server and skills are MIT. Terms of Use exist at /terms/, but robots.txt disallows that path, so we could not confirm what they say (10 of 30). The privacy policy says activity logs are deleted after 7 days and account data within 60 days of a request, async results are kept up to 72 hours and DataPipeline results 30 days. The policy is undated, names Saas.group Inc. while a November 2025 release note says the service operates as ScraperAPI LLC, and no DPA was found (14 of 30). The terms and billing change was announced with effective dates of 4 November 2025 and 5 January 2026. No standing deprecation policy (8 of 20). No sub-processor list or hosting location found, only a general statement on transfers outside the EEA (3 of 20).

Qovia 86

An OpenAPI 3.1.0 file (version 0.1.0, 1 MB) is public at qovia.ai/openapi.json with 144 paths and 144 operations, two security schemes, typed query parameters, a response example on every operation and the error responses declared on each. The data payload itself is typed only as object, array or null with per-endpoint examples, and the MCP call_endpoint tool takes a free params object, so 22 of 25 (22). llms.txt (75 KB, one line per endpoint with price and status) and llms-full.txt (331 KB, the whole documentation as text) are served, and the quickstart's billing, limits and error sections are in both (10). Every operation has a summary and a description; most say what the data holds, how to page, which ids to pass, which fields are unavailable and what answers 404 or empty, and the MCP server's instructions say to find, read then call. Guidance on when not to use an endpoint is thin, mostly pointers such as replies coming from another endpoint (16 of 20). 321 parameters, 75 with enums, patterns on ids, min and max on strings and integers, 117 operations with one required parameter and 16 with none, the POST body typed with additionalProperties false, and unknown parameters rejected with 400 (14 of 15). A response example on all 144 operations, 20 error codes with every message variant listed, response headers documented per error, and cURL, Python, JavaScript and raw HTTP samples; the examples are catalogue samples the docs say are not live data (14 of 15). Paths are under /v1, a 410 endpoint_disabled code exists for retired endpoints, and the changelog is dated, but it has two days (21 and 22 October 2026), nothing is marked deprecated and no notice period is stated (10 of 15). 22+10+16+14+14+10 = 86.

ScraperAPI 67

No OpenAPI file found. The MCP server's source defines typed pydantic inputs for all 28 tools (12 of 25). The docs publish llms.txt, llms-full.txt and a Markdown twin of every page (10). MCP tool descriptions state when to use a tool and when not to, and the API reference describes each parameter with its credit cost (15 of 20). MCP inputs use enums for device type and output format. The HTTP API's parameters are query strings described in prose tables (10 of 15). Examples in cURL, Python, Node.js, PHP, Ruby and Java, a status code table that says which codes are billed, and an error table for the AI parser (12 of 15). Release notes are grouped by month without day dates, the HTTP API has no version, and the MCP server uses semver tags (8 of 15).

Qovia 77

The newest changes are the registry entry ai.qovia/qovia 0.1.1 and the repository's tools snapshot and plugin manifests on 28 October 2026, after the Python client 0.1.1 on PyPI on 27 October; the repository was pushed on 1 November (30). Eight changelog entries on 21 and 22 October, two registry versions (22 and 28 October) and two PyPI releases (25 and 27 October) are more than three dated entries in 90 days, all within ten days (20). Closed service with a public changelog. Support is Telegram, WhatsApp, WeChat and one mailbox, with a one-business-day reply promised for email; GitHub issues are enabled on the repository with none opened, and no forum, Discord or community was found (7 of 15). ai.qovia/qovia is in the official MCP registry under a DNS-verified reverse-DNS namespace at 0.1.1, marked latest, and the Python client is an official package on PyPI (15). The client is standard-library Python with a test file, MIT, no dependencies and no CI workflow in the repository tree; the account's other nine repositories are forks of lists and directories (5 of 10). 30+20+7+15+5 = 77.

ScraperAPI 61

The skills plugin was last updated on 7 August 2026, 63 days before the check, and the MCP server's v1.1.1 is from 17 July 2026 (20 of 30). MCP v1.1.0 and v1.1.1 on 17 July and the plugin update on 7 August fall within 90 days, with two July 2026 release notes dated by month only (20). Monthly release notes and support through the dashboard and email. We did not read the repository's issues (8 of 15). SDKs are documented for five languages, but we did not check their release dates, and the MCP server's registry entry was not checked (8 of 15). The MCP repository has unit tests and a lock file with current dependencies but no public CI workflow (5 of 10).

Qovia 55

No x402, MPP or L402 on Qovia's own endpoints; USDT on TRC-20 is a top-up method from a console session, not a machine payment protocol. The vendor's five Actors on the Apify Store under the profile qovia (Qovia Data, the same Telegram handle and mailbox as the site), such as the Xingtu Actor at $0.01 to $0.06 a section, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-call prices are published without a login, per endpoint in the OpenAPI file, llms.txt and the docs, search at $5 and raw endpoints from $0.5 to $19.5 per 1,000, with the tier rule and payment fees stated (20). 50 trial calls for a new account, counted only when a call returns data; the quickstart says to top up when they run out and the docs ask for no card at sign-up, though no account was created to confirm it (20). A person signs up in a browser and creates a key; the MCP catalogue tools work without a key but data calls do not, and the Apify route reaches four platforms without a Qovia account (5 of 20). 10+20+20+5 = 55.

ScraperAPI 40

No x402, MPP or L402 found in the docs index or pricing page (0). Plan prices and credit costs per request type are public without a login (20). Free plan of 1,000 credits a month and a 7-day trial of 5,000 credits, no card (20). A person signs up in a browser to get a key (0).

Qovia 40

Hosted reading, for the REST API with the MCP server described. No public status page was found. https://qovia.ai/status/ answers 404, status.qovia.ai does not resolve and neither the docs nor the footer links one (0). No readable incident history, so 5 by the rubric (5). Limits are published with numbers on the quickstart's rate-limits section, 60 requests a minute per account before the first top-up and 600 after on a sliding 60-second window, with X-RateLimit-Limit and X-RateLimit-Remaining headers, a 64 KiB body cap, an empty-call throttle (50 calls in 10 minutes with over 80 per cent empty, not found or rejected) and a per-second cap per endpoint without a number (15). Retry-After is declared on too_many_auth_failures, rate_limited, too_many_unbilled, endpoint_busy and upstream_busy, the error table marks the retryable codes, the docs say a 503 endpoint_unavailable carries none and will not clear, and the Python client retries 429 and 503 honouring the header. Every operation is a read, including POST /v1/search, and a failed or timed-out call is refunded, so idempotency keys are not needed (15). No SLA. The terms summary says nothing about uptime and the pricing FAQ excludes outages, rate limits and platform changes from refunds; the 11 September 2026 archived home page advertised a 99.95 per cent enterprise SLA that the current pages have dropped (0). The endpoints are sold and labelled Live on the docs and coverage pages, but every one of the 143 carries x-qovia-status beta in the OpenAPI file, the API version is 0.1.0 and the MCP server reports 0.1.0 (5 of 10). 0+5+15+15+0+5 = 40.

ScraperAPI 45

No status page is linked from the home, pricing, support or docs pages we read (0). No readable incident history (5). Concurrency limits are published per plan, 5 threads on Free, 20 on Hobby, 50, 100, 200, 300 and 500 above it, and the local MCP server limits itself to 10 calls in 60 seconds (15). 429 is documented as a concurrency rejection with no charge, the API retries a target for up to 70 seconds before returning 500, and the docs tell clients to retry failed requests. No Retry-After header or idempotency key was found (10 of 15). The pricing page lists a 99.9% uptime guarantee on every plan, with no SLA document or credit terms found, and the Terms of Use were unread (5 of 10). The API, async service and crawler are generally available (10).