Qovia vs Scrapfly

Qovia 40

Hosted reading, for the REST API with the MCP server described. No public status page was found. https://qovia.ai/status/ answers 404, status.qovia.ai does not resolve and neither the docs nor the footer links one (0). No readable incident history, so 5 by the rubric (5). Limits are published with numbers on the quickstart's rate-limits section, 60 requests a minute per account before the first top-up and 600 after on a sliding 60-second window, with X-RateLimit-Limit and X-RateLimit-Remaining headers, a 64 KiB body cap, an empty-call throttle (50 calls in 10 minutes with over 80 per cent empty, not found or rejected) and a per-second cap per endpoint without a number (15). Retry-After is declared on too_many_auth_failures, rate_limited, too_many_unbilled, endpoint_busy and upstream_busy, the error table marks the retryable codes, the docs say a 503 endpoint_unavailable carries none and will not clear, and the Python client retries 429 and 503 honouring the header. Every operation is a read, including POST /v1/search, and a failed or timed-out call is refunded, so idempotency keys are not needed (15). No SLA. The terms summary says nothing about uptime and the pricing FAQ excludes outages, rate limits and platform changes from refunds; the 11 September 2026 archived home page advertised a 99.95 per cent enterprise SLA that the current pages have dropped (0). The endpoints are sold and labelled Live on the docs and coverage pages, but every one of the 143 carries x-qovia-status beta in the OpenAPI file, the API version is 0.1.0 and the MCP server reports 0.1.0 (5 of 10). 0+5+15+15+0+5 = 40.

Scrapfly 85

scrapfly.io/status answers with Statuspage's status JSON, which names its page as scrapfly.statuspage.io. That page has 25 components and incident history back to 2022, read through its history feed on 1 November. The 1 October check read only the overall state and found no history (20, was 10). The newest incident is a Scrapium rendering fault on 21 May 2026, so nothing is posted in the 90 days from 3 August (30, was 5). Concurrency per plan is published (5 on Discovery to 100 on Enterprise) and each project has a configurable per-minute throttle (15). The error catalogue marks every code retryable or not and has three ERR::THROTTLE codes, but we found no Retry-After header or backoff guidance on the errors or throttling pages (10 of 15). The terms disclaim uptime and no uptime SLA is published, and the pricing page's SLA mentions cover support response on Enterprise (0). The Scrape API is GA. Vault and alerting are beta, outside the main surface (10). 20+30+15+10+0+10 = 85.

Qovia 30

Closed service. The Terms of Service is one paragraph that names no legal entity, address or liability terms, says Delaware law governs and that the page is a summary with the signed agreement governing; the repository's client is MIT. Between the closed and unclear bands (7 of 30). The privacy policy is one paragraph. Account information is used to deliver and bill, personal information is not sold, requests and results are not resold, deletion requests go to the support mailbox, and the agreement governs where it differs. No retention periods, no subprocessors, no DPA, and no statement about the cache the prov.source flag implies; the SECURITY.md repeats the same points (8 of 30). A 410 endpoint_disabled code exists for retired endpoints and the changelog is dated, but there is no deprecation policy or notice period and nothing is marked deprecated (5 of 20). Stripe is named on the pricing page as the card and Alipay processor; no other provider, data location or transfer basis is stated (3 of 20). 7+8+5+3 = 23.

Scrapfly 75

Closed service with terms updated 2026-09-30 under US law. SDKs are BSD 2-Clause, and the MCP source is public with no LICENSE file and ISC in package.json (15 of 30). Privacy policy updated 14 May 2026 with a published DPA and HIPAA BAA, but retention is as long as necessary, and the retention of scraped content isn't stated (18 of 30). Release notes date deprecations and removals, for example Scrapium v153 dropping legacy network interception on 11 September. No standing deprecation policy found (15 of 20). Stripe, Google Analytics, Google Ads and Google Cloud are named, with SCC and Data Privacy Framework transfers, but there's no full subprocessor list (10 of 20). The release notes still date each CDP removal, most recently Storage.getRelatedWebsiteSets in Scrapium v156 on 26 October. Not otherwise re-read on 1 November. 15+18+15+10 = 58.

Qovia 60

API keys with scopes chosen at creation (every endpoint, search, every raw endpoint or one of 24 platform groups), an optional expiry, revocation in the console and hashed storage; the docs say the key is read from the Authorization or x-api-key header only, never the URL or a cookie, and 30 failed authentications from one IP in a minute are throttled. No OAuth and no rotation feature beyond creating another key (24 of 30). The whole surface is read-only retrieval, scopes restrict a key to platforms, the two MCP catalogue tools need no key, and the docs and SECURITY.md tell users to give AI tools a separate scoped key (17 of 20). Every response is third-party platform text, and the only related statement is that error messages never contain the data source's own text; nothing on treating returned content as untrusted (3 of 15). request_id is the usage record ID on every answer, the console lists every charge in a usage log, X-Qovia-Charged and X-Qovia-Balance headers report each call, and GET /v1/account returns the key's scopes and balance at no charge; no exportable audit log or per-call endpoint was found (11 of 15). No security.txt on qovia.ai or api.qovia.ai (404), no bug bounty, SOC 2 or ISO 27001; the repository's SECURITY.md names a Telegram handle and a mailbox for reports covering both hosts (5 of 20). 24+17+3+11+5 = 60.

Scrapfly 75

OAuth 2 on the hosted MCP with dashboard revocation, open to all plans. API keys are per project, live or test, and since 15 April 2026 can be restricted to products (30). The canonical API form puts the key in the key query parameter and the MCP also accepts ?key=, so less 10 (20 of 30). Product-restricted keys, confirm=true on every mutating vault and alert tool, info_api_key off in server-key mode, and the self-hosted HTTP server binds loopback by default. Since v1.4.0 Cloud Browser sessions are scoped to the API key that opened them (15 of 20). The source gates mutating vault tools behind a preview step because prompt injection can reach them and redacts keys from CDP URLs. We found no user-facing guidance on untrusted page content (8 of 15). Monitoring shows every call as a log with its error, credit cost line by line and Unblocker state, with replay, per the 24 October release notes, as well as per-domain metrics and alerting. The 1 October check couldn't confirm per-request logs (15, was 10). security.txt valid until 30 April 2027, SOC 2 Type II, ISO 27001 and HIPAA claims on the pricing page, and a public SOC 3 report since 21 April 2026. No bug bounty found (17 of 20). 20+15+8+15+17 = 75.

Qovia 55

No x402, MPP or L402 on Qovia's own endpoints; USDT on TRC-20 is a top-up method from a console session, not a machine payment protocol. The vendor's five Actors on the Apify Store under the profile qovia (Qovia Data, the same Telegram handle and mailbox as the site), such as the Xingtu Actor at $0.01 to $0.06 a section, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-call prices are published without a login, per endpoint in the OpenAPI file, llms.txt and the docs, search at $5 and raw endpoints from $0.5 to $19.5 per 1,000, with the tier rule and payment fees stated (20). 50 trial calls for a new account, counted only when a call returns data; the quickstart says to top up when they run out and the docs ask for no card at sign-up, though no account was created to confirm it (20). A person signs up in a browser and creates a key; the MCP catalogue tools work without a key but data calls do not, and the Apify route reaches four platforms without a Qovia account (5 of 20). 10+20+20+5 = 55.

Scrapfly 40

No x402, MPP or L402 (0). Credit costs per request type (1 datacentre, 5 with rendering or Unblocker, 25 residential, 60 full-page screenshot) and plan prices are public. Unblocker surcharges per target aren't published, but cost_budget caps them (20). 1,000 free credits, no card, no time limit (20). A person signs up in a browser. OAuth still needs an account (0). Plan prices and the 1,000 free credits with no card re-read on the pricing page on 1 November. 0+20+20+0 = 40.

Qovia 86

An OpenAPI 3.1.0 file (version 0.1.0, 1 MB) is public at qovia.ai/openapi.json with 144 paths and 144 operations, two security schemes, typed query parameters, a response example on every operation and the error responses declared on each. The data payload itself is typed only as object, array or null with per-endpoint examples, and the MCP call_endpoint tool takes a free params object, so 22 of 25 (22). llms.txt (75 KB, one line per endpoint with price and status) and llms-full.txt (331 KB, the whole documentation as text) are served, and the quickstart's billing, limits and error sections are in both (10). Every operation has a summary and a description; most say what the data holds, how to page, which ids to pass, which fields are unavailable and what answers 404 or empty, and the MCP server's instructions say to find, read then call. Guidance on when not to use an endpoint is thin, mostly pointers such as replies coming from another endpoint (16 of 20). 321 parameters, 75 with enums, patterns on ids, min and max on strings and integers, 117 operations with one required parameter and 16 with none, the POST body typed with additionalProperties false, and unknown parameters rejected with 400 (14 of 15). A response example on all 144 operations, 20 error codes with every message variant listed, response headers documented per error, and cURL, Python, JavaScript and raw HTTP samples; the examples are catalogue samples the docs say are not live data (14 of 15). Paths are under /v1, a 410 endpoint_disabled code exists for retired endpoints, and the changelog is dated, but it has two days (21 and 22 October 2026), nothing is marked deprecated and no notice period is stated (10 of 15). 22+10+16+14+14+10 = 86.

Scrapfly 95

A Swagger reference per the 30 September check, and the MCP server exposes it as a web_scraping_openapi_specification resource. Every MCP tool has JSON Schema inputs generated from typed Go structs (25). llms.txt and Markdown twins such as pricing.md per the 30 September check. robots.txt still disallows /docs/llms.txt and the .md twins for crawlers it doesn't name, so they weren't re-read on 1 November (10). Descriptions say when to use a tool and when to switch, for example web_get_page falls back to web_scrape for tuning and to cloud_browser_open for interaction. A few are long and steer the model's next step (17 of 20). Typed inputs with enums, for example the vault service discriminator, and required fields (13 of 15). Error catalogue of 100+ ERR:: codes, each with HTTP status, retryable and billed flags and its own doc link (15). Dated release notes, newest 26 October 2026 (15). 25+10+17+13+15+15 = 95.

Qovia 77

The newest changes are the registry entry ai.qovia/qovia 0.1.1 and the repository's tools snapshot and plugin manifests on 28 October 2026, after the Python client 0.1.1 on PyPI on 27 October; the repository was pushed on 1 November (30). Eight changelog entries on 21 and 22 October, two registry versions (22 and 28 October) and two PyPI releases (25 and 27 October) are more than three dated entries in 90 days, all within ten days (20). Closed service with a public changelog. Support is Telegram, WhatsApp, WeChat and one mailbox, with a one-business-day reply promised for email; GitHub issues are enabled on the repository with none opened, and no forum, Discord or community was found (7 of 15). ai.qovia/qovia is in the official MCP registry under a DNS-verified reverse-DNS namespace at 0.1.1, marked latest, and the Python client is an official package on PyPI (15). The client is standard-library Python with a test file, MIT, no dependencies and no CI workflow in the repository tree; the account's other nine repositories are forks of lists and directories (5 of 10). 30+20+7+15+5 = 77.

Scrapfly 84

Scrapium v156 in the release notes on 26 October 2026 and MCP v1.4.0 on 15 October (30). MCP tags v1.3.1 to v1.3.3 (26 and 27 August), v1.3.4 (8 September) and v1.4.0 (15 October), SDKs 0.12.0 on 8 September, and dated release notes on 14, 24 and 26 August, 11, 23 and 25 September, 7, 24 and 26 October (20). Dated release notes most weeks and a support address. We couldn't read GitHub issues, since github.com refuses our reader (12 of 25). In the official MCP registry as io.scrapfly.mcp/mcp under the vendor's domain, though the entry still lists 1.0.0, and the SDKs are current (15). MCP moved to Go 1.27 on 23 October. Its CI runs only a reference check and the npm publish, while the TypeScript SDK runs tests in CI (7 of 10). 30+20+12+15+7 = 84.