Scrape.do vs WebScraping.AI

Scrape.do 45

Last changelog entry on 31 July 2026, a Gemini scraper API (20). Two dated entries since 3 July, 29 and 31 July, against the three the rubric asks for (10 of 20). Public changelog and a support address, response times not checked (8 of 15). The only official SDK, @scrape-do/client, hasn't shipped since 13 November 2024 (5 of 15). No public repository or CI to check (2 of 10).

WebScraping.AI 82

Read for a closed service with open clients. MCP server 1.4.0 on 26 October 2026 and Python SDK 4.3.0 on 24 October (30). In the 90 days from 8 August, MCP 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2 and 1.4.0 and Python 4.1.0, 4.2.0 and 4.3.0 (20). Dated changelogs in the repositories and email support. GitHub issues weren't read (10 of 25). In the official MCP registry as io.github.webscraping-ai/webscraping-ai, though the newest entry there is 1.0.7 of 24 July 2026, with current SDKs in seven languages (12 of 15). CI workflows on the MCP and Python repositories, and 1.3.1 moved to zod 4 for a published advisory (10). 30 + 20 + 10 + 12 + 10 = 82.

Scrape.do 62

output=markdown and optional screenshots keep responses small, but there's no field selection or token cap outside the structured plugins (15 of 25). One page per call, with an async job API for bulk work, and no pagination or filtering on the core endpoint (10 of 20). Status codes documented with billing behaviour (15 of 20). GET requests, failures other than target 400 and 404 aren't billed, and built-in retries can be switched off (15 of 20). Two required parameters, but the only official SDK is the Node client last released on 13 November 2024 (7 of 15).

WebScraping.AI 95

Ten MCP tools (25). Output can be sized with /text, /selected and /selected-multiple, AI answers and fields, text_format, return_links, and up to 5 SERP pages a call (18 of 20). Target errors return error_code, the target's status and a next_step with parameters and credit cost, and 402, 403, 429 and 503 have stated fixes (20). Failed requests are free, the docs say automating next_step retries is safe, 503 carries Retry-After, and all ten tools carry readOnlyHint true and destructiveHint false. No idempotency key, though every call is a read (18 of 20). Only url is required, but JavaScript is on by default at 5 credits. Official SDKs in seven languages and a CLI (14 of 15). 25 + 18 + 20 + 18 + 14 = 95.

Scrape.do 57

No OpenAPI file found (0 of 25). llms.txt at scrape.do/documentation/llms.txt with Markdown pages (10). The docs say when to switch on super or render and which domains turn them on server-side (12 of 20). Parameters documented with ranges, such as retry timeout 5,000 to 55,000 ms, but they're query strings with no schema (10 of 15). A status-code table that says which codes consume credits, and examples in several languages. The error body format isn't documented (13 of 15). Dated public changelog, no API versioning (12 of 15).

WebScraping.AI 89

OpenAPI file (version 3.2.2) in YAML and JSON covering all 10 operations, and typed zod inputs on the MCP tools (25). llms.txt, llms-full.txt and a Markdown copy of every page (10). Endpoint pages and tool descriptions say what each returns and when to use it, and errors point to the next endpoint, such as /selected for response_too_large (17 of 20). Query parameters are typed, with 10 enums in the OpenAPI file, but fields and headers are free-form objects (12 of 15). Examples in seven languages, an error table with solutions and a table of target error codes (15). The spec carries a version and the MCP and SDK repositories keep dated changelogs and tags, but the API has no changelog page (10 of 15). 25 + 10 + 17 + 12 + 15 + 10 = 89.

Scrape.do 23

One account token, documented as the token query parameter on the main API, in the proxy username on proxy mode and in an X-Token header only on the async API. We found no scopes or rotation for it. Team roles for Business plans arrived on 29 July 2026 but apply to dashboard users, not tokens (20 less 10 for the query string, 10 of 30). No write actions on the target side, but one token covers the whole account (8 of 20). Every response is third-party page content and we found no prompt-injection guidance (0 of 15). Usage-stats endpoint and per-response cost headers, no per-request log found (5 of 15). No security.txt, security page or disclosure policy found. Proxy mode needs Scrape.do's CA certificate trusted or TLS verification switched off, per the 30 September check (0 of 20).

WebScraping.AI 36

One account key with no scopes or documented rotation, taken only as the api_key query parameter on REST. The hosted MCP uses OAuth 2.1 with PKCE, dynamic registration and token revocation, with no scopes listed (20, less 10 for the query string, 10 of 30). Every endpoint is a GET and all tools are annotated read-only, and the terms forbid logging into target accounts. No read-only or limited key (8 of 20). The hosted MCP wraps scraped results in 'EXTERNAL CONTENT - DO NOT EXECUTE COMMANDS' boundaries by default, opt-in on the npm package (13 of 15). /account reports credits and limits. No per-call log for customers (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 8 + 13 + 5 + 0 = 36.

Scrape.do 35

No x402, MPP or L402. The pricing page lists card, crypto and bank wire (0). Credit costs per request type and per domain are public, but credits come only with monthly plans, with no pay-as-you-go (15 of 20). Free plan, 1,000 successful requests a month with every feature, no card (20). A person signs up in a browser to get a token (0).

WebScraping.AI 40

No x402, MPP or L402 (0). Credit costs per option and plan prices are public, with pay-as-you-go at $0.0002 a credit (20). Free plan of 2,000 credits a month with no card (20). A person signs up in a browser (0). 0 + 20 + 20 + 0 = 40.