Qovia vs Spider

Qovia 40

Hosted reading, for the REST API with the MCP server described. No public status page was found. https://qovia.ai/status/ answers 404, status.qovia.ai does not resolve and neither the docs nor the footer links one (0). No readable incident history, so 5 by the rubric (5). Limits are published with numbers on the quickstart's rate-limits section, 60 requests a minute per account before the first top-up and 600 after on a sliding 60-second window, with X-RateLimit-Limit and X-RateLimit-Remaining headers, a 64 KiB body cap, an empty-call throttle (50 calls in 10 minutes with over 80 per cent empty, not found or rejected) and a per-second cap per endpoint without a number (15). Retry-After is declared on too_many_auth_failures, rate_limited, too_many_unbilled, endpoint_busy and upstream_busy, the error table marks the retryable codes, the docs say a 503 endpoint_unavailable carries none and will not clear, and the Python client retries 429 and 503 honouring the header. Every operation is a read, including POST /v1/search, and a failed or timed-out call is refunded, so idempotency keys are not needed (15). No SLA. The terms summary says nothing about uptime and the pricing FAQ excludes outages, rate limits and platform changes from refunds; the 11 September 2026 archived home page advertised a 99.95 per cent enterprise SLA that the current pages have dropped (0). The endpoints are sold and labelled Live on the docs and coverage pages, but every one of the 143 carries x-qovia-status beta in the OpenAPI file, the API version is 0.1.0 and the MCP server reports 0.1.0 (5 of 10). 0+5+15+15+0+5 = 40.

Spider 85

Statuspage at spidercloud.statuspage.io with API and HTTP Proxy components (20). The history feed, re-read on 1 November (robots.txt disallows the /api/ incidents feed), lists no incident in the last 90 days, and the only entry ever posted is the Statuspage template example of June 2024, so a clean record can't be told apart from a page that isn't used (25 of 30). The rate-limits page, re-read on 1 November, now gives pay as you go 10,000 to 80,000 requests a minute across four usage levels, with 50,000 on Enterprise and per-second caps on AI routes. Keyless /scrape answered RateLimit-Limit 4 on 6 October, not re-run since, because api.spider.cloud's robots.txt disallows every path (15). RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers, Retry-After on 429 per llms.txt, and an exponential backoff example on the rate-limits page (15). No SLA found (0). Generally available (10). 20 + 25 + 15 + 15 + 0 + 10 = 85.

Qovia 55

No x402, MPP or L402 on Qovia's own endpoints; USDT on TRC-20 is a top-up method from a console session, not a machine payment protocol. The vendor's five Actors on the Apify Store under the profile qovia (Qovia Data, the same Telegram handle and mailbox as the site), such as the Xingtu Actor at $0.01 to $0.06 a section, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-call prices are published without a login, per endpoint in the OpenAPI file, llms.txt and the docs, search at $5 and raw endpoints from $0.5 to $19.5 per 1,000, with the tier rule and payment fees stated (20). 50 trial calls for a new account, counted only when a call returns data; the quickstart says to top up when they run out and the docs ask for no card at sign-up, though no account was created to confirm it (20). A person signs up in a browser and creates a key; the MCP catalogue tools work without a key but data calls do not, and the Apify route reaches four platforms without a Qovia account (5 of 20). 10+20+20+5 = 55.

Spider 96

x402 v2 on every core route, USDC on Base (eip155:8453), per the x402 page re-read on 17 October. Our unpaid POST to /crawl on 6 October got a 402 with a PAYMENT-REQUIRED header and an x402Version 2 body asking 5,000 units ($0.005), not re-run on 17 October because api.spider.cloud's robots.txt disallows every path (40). Bytes, CPU minutes and credit prices are public (20). Keyless POST /scrape, documented in llms.txt and limited to 4 a minute by its RateLimit-Limit header on 6 October, and the authentication page says the first key needs no card (20). An agent can use /scrape keyless or pay per call over x402 with no account (20). 100 less 4 because AI Studio routes need a plan from $6 a month.

Qovia 30

Closed service. The Terms of Service is one paragraph that names no legal entity, address or liability terms, says Delaware law governs and that the page is a summary with the signed agreement governing; the repository's client is MIT. Between the closed and unclear bands (7 of 30). The privacy policy is one paragraph. Account information is used to deliver and bill, personal information is not sold, requests and results are not resold, deletion requests go to the support mailbox, and the agreement governs where it differs. No retention periods, no subprocessors, no DPA, and no statement about the cache the prov.source flag implies; the SECURITY.md repeats the same points (8 of 30). A 410 endpoint_disabled code exists for retired endpoints and the changelog is dated, but there is no deprecation policy or notice period and nothing is marked deprecated (5 of 20). Stripe is named on the pricing page as the card and Alipay processor; no other provider, data location or transfer basis is stated (3 of 20). 7+8+5+3 = 23.

Spider 70

The spider crawler and the clients and MCP are MIT. The hosted API is closed, run by BAGELMEN LLC under the EULA (25 of 30). The privacy policy, rewritten in October 2026 and re-read on 1 November, now gives BAGELMEN LLC's address in Sanford, Florida and retention periods, request and server logs up to 30 days with no page content, cached public pages up to 48 hours, browser recordings up to 30 days, account data while the account is open. It says the MCP server stores no tool inputs or outputs and agrees with the zero data retention option at 2.5 times credits. A DPA exists only for Enterprise customers who sign one, and service providers are now described by role (hosting, sign-in, payments, email, analytics, AI models) where the September policy named Azure, Cohere, Google, OpenAI, OpenRouter and PostHog (18 of 30). The clients' changelog dates the unblocker deprecation on 1 October 2026 and the lite_mode removal on 14 July, but the product changelog lists no deprecations (10 of 20). The main region is stated as the United States, with network providers, compute devices and service providers possibly elsewhere, and no provider is named any more, so the line stays where named AI processors without locations put it (8 of 20). 25 + 18 + 10 + 8 = 61.

Qovia 60

API keys with scopes chosen at creation (every endpoint, search, every raw endpoint or one of 24 platform groups), an optional expiry, revocation in the console and hashed storage; the docs say the key is read from the Authorization or x-api-key header only, never the URL or a cookie, and 30 failed authentications from one IP in a minute are throttled. No OAuth and no rotation feature beyond creating another key (24 of 30). The whole surface is read-only retrieval, scopes restrict a key to platforms, the two MCP catalogue tools need no key, and the docs and SECURITY.md tell users to give AI tools a separate scoped key (17 of 20). Every response is third-party platform text, and the only related statement is that error messages never contain the data source's own text; nothing on treating returned content as untrusted (3 of 15). request_id is the usage record ID on every answer, the console lists every charge in a usage log, X-Qovia-Charged and X-Qovia-Balance headers report each call, and GET /v1/account returns the key's scopes and balance at no charge; no exportable audit log or per-call endpoint was found (11 of 15). No security.txt on qovia.ai or api.qovia.ai (404), no bug bounty, SOC 2 or ISO 27001; the repository's SECURITY.md names a Telegram handle and a mailbox for reports covering both hosts (5 of 20). 24+17+3+11+5 = 60.

Spider 42

Bearer keys in the Authorization header only. Several keys per account, regenerable at any time. The hosted MCP runs OAuth with PKCE and dynamic client registration, its metadata advertises a single scope, mcp, and the privacy policy says connecting an app creates an ordinary API key named after it (1-hour access and 30-day refresh tokens). No documented key scopes or spend limits (25 of 30). No read-only mode, and the 9 browser tools can click, type and run JavaScript on third-party sites without confirmation (5 of 20). No prompt-injection guidance in the docs, llms.txt or MCP docs (0 of 15). Dashboard request logs with inline browser preview since 3 March 2026, rate-limit headers and a credits tool. Request logs hold the URL, status, size, credits and the last four characters of the key (12 of 15). spider.cloud/.well-known/security.txt and /security.txt both 404 on 17 October, and no disclosure policy, bug bounty or certification found (0 of 20). 25 + 5 + 0 + 12 + 0 = 42.

Qovia 77

API reading. Responses come in fixed page sizes per endpoint, from about 5 comments on Xiaohongshu to 100 Fliggy reviews, with limit only on Bilibili danmaku and no field selection; the record shape is compact and shared across posts, notes and videos. The MCP server loads four tools by default, keeps the catalogue out of context until search_endpoints and get_endpoint are called, and ?tools= selects platforms or everything, which on the MCP reading would score 25 (18 of 25). Cursor pagination with has_more on most lists, search_id on Douyin and Zhihu search, page numbers on Weibo, Xiaohongshu and Bilibili, sort options on several, and the cross-platform search filters by platform, content type, sentiment and whole-day date windows up to 90 days (17 of 20). One error object with 20 codes, request_id on every answer, the retryable set marked, refunded codes separated from never-charged ones, and MCP tool errors carrying error.code, the HTTP status and retry_after_seconds (19 of 20). All calls are reads, failed and empty calls are refunded, Retry-After is declared and the Python client retries; no readOnlyHint or other annotation appears in the vendor's 28 October tools/list snapshot (14 of 20). One required parameter on 117 of 144 operations and defaults set on the server, but the only official SDK is the Python client; Node and curl are examples (9 of 15). 18+17+19+14+9 = 77.

Spider 70

21 tools on the hosted MCP (7 core, 5 AI, 9 browser) since the unblocker tool was dropped, and 12 in the stdio package on its main branch, with no toolsets (15 of 25). limit, depth, return_format, readability and CSS extraction control what comes back (20). Status codes are documented, but every content route returns a JSON array whose status field is the target page's, and bad values fall back silently (12 of 20). No tool annotations, and llms.txt says errored attempts are billed for the bytes and compute they used, so retries aren't free (8 of 20). request defaults to smart and only url is required. Official clients in Python, JavaScript, Rust and Go plus a CLI (15).