Qovia vs WebScraping.AI

Qovia 60

API keys with scopes chosen at creation (every endpoint, search, every raw endpoint or one of 24 platform groups), an optional expiry, revocation in the console and hashed storage; the docs say the key is read from the Authorization or x-api-key header only, never the URL or a cookie, and 30 failed authentications from one IP in a minute are throttled. No OAuth and no rotation feature beyond creating another key (24 of 30). The whole surface is read-only retrieval, scopes restrict a key to platforms, the two MCP catalogue tools need no key, and the docs and SECURITY.md tell users to give AI tools a separate scoped key (17 of 20). Every response is third-party platform text, and the only related statement is that error messages never contain the data source's own text; nothing on treating returned content as untrusted (3 of 15). request_id is the usage record ID on every answer, the console lists every charge in a usage log, X-Qovia-Charged and X-Qovia-Balance headers report each call, and GET /v1/account returns the key's scopes and balance at no charge; no exportable audit log or per-call endpoint was found (11 of 15). No security.txt on qovia.ai or api.qovia.ai (404), no bug bounty, SOC 2 or ISO 27001; the repository's SECURITY.md names a Telegram handle and a mailbox for reports covering both hosts (5 of 20). 24+17+3+11+5 = 60.

WebScraping.AI 36

One account key with no scopes or documented rotation, taken only as the api_key query parameter on REST. The hosted MCP uses OAuth 2.1 with PKCE, dynamic registration and token revocation, with no scopes listed (20, less 10 for the query string, 10 of 30). Every endpoint is a GET and all tools are annotated read-only, and the terms forbid logging into target accounts. No read-only or limited key (8 of 20). The hosted MCP wraps scraped results in 'EXTERNAL CONTENT - DO NOT EXECUTE COMMANDS' boundaries by default, opt-in on the npm package (13 of 15). /account reports credits and limits. No per-call log for customers (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 8 + 13 + 5 + 0 = 36.

Qovia 30

Closed service. The Terms of Service is one paragraph that names no legal entity, address or liability terms, says Delaware law governs and that the page is a summary with the signed agreement governing; the repository's client is MIT. Between the closed and unclear bands (7 of 30). The privacy policy is one paragraph. Account information is used to deliver and bill, personal information is not sold, requests and results are not resold, deletion requests go to the support mailbox, and the agreement governs where it differs. No retention periods, no subprocessors, no DPA, and no statement about the cache the prov.source flag implies; the SECURITY.md repeats the same points (8 of 30). A 410 endpoint_disabled code exists for retired endpoints and the changelog is dated, but there is no deprecation policy or notice period and nothing is marked deprecated (5 of 20). Stripe is named on the pricing page as the card and Alipay processor; no other provider, data location or transfer basis is stated (3 of 20). 7+8+5+3 = 23.

WebScraping.AI 51

Closed service under terms naming Urlooker LLC of Wyoming, with MIT clients (15 of 30). The privacy policy keeps usage logs 30 days and deletes personal data within 60 days of a request, and the terms rule out training on scraped content, prompts and outputs. But section 9.3 lets the company store scraped content and logs for as long as reasonably necessary, and no DPA was found (14 of 30). The terms give 30 days' notice of material changes and of termination without cause, and the MCP changelog dates its changes. No deprecation policy (8 of 20). Subprocessors, including AI model providers, are listed only for enterprise customers under NDA, and data may be processed in the US or wherever subprocessors operate (4 of 20). 15 + 14 + 8 + 4 = 41.

Qovia 77

API reading. Responses come in fixed page sizes per endpoint, from about 5 comments on Xiaohongshu to 100 Fliggy reviews, with limit only on Bilibili danmaku and no field selection; the record shape is compact and shared across posts, notes and videos. The MCP server loads four tools by default, keeps the catalogue out of context until search_endpoints and get_endpoint are called, and ?tools= selects platforms or everything, which on the MCP reading would score 25 (18 of 25). Cursor pagination with has_more on most lists, search_id on Douyin and Zhihu search, page numbers on Weibo, Xiaohongshu and Bilibili, sort options on several, and the cross-platform search filters by platform, content type, sentiment and whole-day date windows up to 90 days (17 of 20). One error object with 20 codes, request_id on every answer, the retryable set marked, refunded codes separated from never-charged ones, and MCP tool errors carrying error.code, the HTTP status and retry_after_seconds (19 of 20). All calls are reads, failed and empty calls are refunded, Retry-After is declared and the Python client retries; no readOnlyHint or other annotation appears in the vendor's 28 October tools/list snapshot (14 of 20). One required parameter on 117 of 144 operations and defaults set on the server, but the only official SDK is the Python client; Node and curl are examples (9 of 15). 18+17+19+14+9 = 77.

WebScraping.AI 95

Ten MCP tools (25). Output can be sized with /text, /selected and /selected-multiple, AI answers and fields, text_format, return_links, and up to 5 SERP pages a call (18 of 20). Target errors return error_code, the target's status and a next_step with parameters and credit cost, and 402, 403, 429 and 503 have stated fixes (20). Failed requests are free, the docs say automating next_step retries is safe, 503 carries Retry-After, and all ten tools carry readOnlyHint true and destructiveHint false. No idempotency key, though every call is a read (18 of 20). Only url is required, but JavaScript is on by default at 5 credits. Official SDKs in seven languages and a CLI (14 of 15). 25 + 18 + 20 + 18 + 14 = 95.

Qovia 55

No x402, MPP or L402 on Qovia's own endpoints; USDT on TRC-20 is a top-up method from a console session, not a machine payment protocol. The vendor's five Actors on the Apify Store under the profile qovia (Qovia Data, the same Telegram handle and mailbox as the site), such as the Xingtu Actor at $0.01 to $0.06 a section, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-call prices are published without a login, per endpoint in the OpenAPI file, llms.txt and the docs, search at $5 and raw endpoints from $0.5 to $19.5 per 1,000, with the tier rule and payment fees stated (20). 50 trial calls for a new account, counted only when a call returns data; the quickstart says to top up when they run out and the docs ask for no card at sign-up, though no account was created to confirm it (20). A person signs up in a browser and creates a key; the MCP catalogue tools work without a key but data calls do not, and the Apify route reaches four platforms without a Qovia account (5 of 20). 10+20+20+5 = 55.

WebScraping.AI 40

No x402, MPP or L402 (0). Credit costs per option and plan prices are public, with pay-as-you-go at $0.0002 a credit (20). Free plan of 2,000 credits a month with no card (20). A person signs up in a browser (0). 0 + 20 + 20 + 0 = 40.

Qovia 77

The newest changes are the registry entry ai.qovia/qovia 0.1.1 and the repository's tools snapshot and plugin manifests on 28 October 2026, after the Python client 0.1.1 on PyPI on 27 October; the repository was pushed on 1 November (30). Eight changelog entries on 21 and 22 October, two registry versions (22 and 28 October) and two PyPI releases (25 and 27 October) are more than three dated entries in 90 days, all within ten days (20). Closed service with a public changelog. Support is Telegram, WhatsApp, WeChat and one mailbox, with a one-business-day reply promised for email; GitHub issues are enabled on the repository with none opened, and no forum, Discord or community was found (7 of 15). ai.qovia/qovia is in the official MCP registry under a DNS-verified reverse-DNS namespace at 0.1.1, marked latest, and the Python client is an official package on PyPI (15). The client is standard-library Python with a test file, MIT, no dependencies and no CI workflow in the repository tree; the account's other nine repositories are forks of lists and directories (5 of 10). 30+20+7+15+5 = 77.

WebScraping.AI 82

Read for a closed service with open clients. MCP server 1.4.0 on 26 October 2026 and Python SDK 4.3.0 on 24 October (30). In the 90 days from 8 August, MCP 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2 and 1.4.0 and Python 4.1.0, 4.2.0 and 4.3.0 (20). Dated changelogs in the repositories and email support. GitHub issues weren't read (10 of 25). In the official MCP registry as io.github.webscraping-ai/webscraping-ai, though the newest entry there is 1.0.7 of 24 July 2026, with current SDKs in seven languages (12 of 15). CI workflows on the MCP and Python repositories, and 1.3.1 moved to zod 4 for a published advisory (10). 30 + 20 + 10 + 12 + 10 = 82.