ScrapeAtlas vs SoldFetch

ScrapeAtlas 70

The newest change is CLI 0.26.0 on 28 October 2026 per the 30 October npm reading, not re-read on 2 November, after the StockX endpoints on 27 October, still the changelog's newest entry on 2 November (30). 15 dated release days between 21 September and 27 October, 58 updates (20). Closed service with a public changelog. Support in the dashboard is for customers with a credit purchase, the contact form takes buying questions and privacy requests, and no Discord, forum or issue tracker was found; the careers page lists a customer support role (7 of 15). io.github.OnlineDopamine/scrapeatlas is in the official MCP registry under a GitHub-verified personal namespace, at 1.0.0 since 5 October and describing about 40 platforms against 49 now. The CLI is current on npm and an n8n node exists, but there are no SDKs (10 of 15). The CLI package has no repository field, no public source and no visible CI; it needs Node 22 or newer (3 of 10). 30+20+7+10+3 = 70.

SoldFetch 49

Closed service. The latest dated changes are commits to all three public repositories and four blog posts on 27 October 2026, and the docs sitemap dates the authentication page 30 October 2026 (30). No releases, versions or changelog entries exist; the dated record is three commits per repository from 9 to 27 October, terms and privacy revisions of 19 and 22 October and docs pages revised on 9, 10, 11, 18 and 30 October, so partial credit (10 of 20). No public changelog; support is a contact form and contact@soldfetch.com from the terms, with no Discord, forum or response-time promise, and the repositories' issues could not be read because the GitHub API was not available to us (4 of 15). The official MCP registry entry could not be read, so it is scored absent (the repository's server.json names io.github.ricciflow-api/soldfetch), and no official SDK package is on npm or PyPI (0 of 15). Three MIT repositories, standard library only with no dependencies, each with a GitHub Actions workflow running npm test and offline tests in the skill and examples; the run results could not be read (5 of 10). 30+10+4+0+5 = 49.

ScrapeAtlas 88

An OpenAPI 3.1.0 file (version 0.1.0, 34 MB) is public at scrapeatlas.com/docs/openapi.json with 384 paths and 386 operations, a per-platform x-api-key security scheme on each, response schemas for 200 and every documented error, and 931 component schemas (25). llms.txt at scrapeatlas.com/docs/llms.txt lists all 373 endpoints with one-line descriptions and schema links, and endpoint pages carry a copy-as-Markdown action (10). 386 operations have a summary and 373 a description, median 39 words, saying what public page is read, what the response holds, how to page and what it costs. llms.txt says not to assume one normalised JSON shape. Guidance on when not to call an endpoint is thin, with 9 descriptions using only and 2 instead (14 of 20). 1,390 parameters, 304 with enums, most with minLength, maxLength or a pattern, 232 operations needing one required parameter and 143 none; the 12 POST bodies are typed (14 of 15). A response example on 373 operations and examples on 508 parameters, HTTP 400 to 504 mapped to one failure object with 33 codes, per-endpoint error tables and code samples in six languages; no Retry-After header declared (14 of 15). Paths are under /v1 and a dated public changelog started on 24 September 2026 with 58 updates, but nothing is marked deprecated in the file, breaking changes aren't flagged, and the 14 October GitHub entry says former paths keep working without saying for how long (11 of 15). 25+10+14+14+14+11 = 88.

SoldFetch 68

API reading, with the MCP server described. An OpenAPI 3.1 file is published at https://soldfetch.com/api/v1/openapi.json, under a path robots.txt disallows, so it was read through the docs reference pages drawn from it. Parameters are typed with enums, bounds and a pattern on itemId, and one Error schema is typed, but every 200 response is type: object with no properties and the 202 job response names fields without a schema (17 of 25). llms.txt on the site and the docs, llms-full.txt, and Markdown twins of the docs pages (10). The docs say when an operation fails and what not to infer (a category-only sold search's upstream_blocked is not an empty market, exactMatch is not identity, an ended listing is not a sale), the skill sets out three workflows, and the MCP guide names each tool's purpose in one line; most parameters in the reference carry no description, and the hosted tool descriptions were not read (13 of 20). ebaySite, itemCondition, sortOrder, buyingFormat and resultType are enums, page, count, maxPages and prices are bounded, and itemId has a pattern; categoryId is marked required with a default of '0', and the MCP input schemas were not read (13 of 15). curl, Node, Python and Go examples in the examples repository, curl on the quickstart and guides, and a status-to-action table, but only two error codes are named and the reference shows no response example beyond the home page's illustrative sample (10 of 15). Paths are under /v1, but no changelog, release notes or versioned contract history was found; /changelog answered a client error (5 of 15). 17+10+13+13+10+5 = 68.

ScrapeAtlas 59

Closed service with clear terms dated 29 September 2026 naming the legal entity, governing law and liability cap; the CLI is MIT on npm with no source published (15 of 30). The privacy policy (19 October 2026) gives retention periods, 90 days for raw usage records, 30 days for inactive key metadata, 10 minutes to 30 days for OAuth artefacts, and says workers keep no archive of results, which the terms and the Public Data Notice repeat. Providers are named with their roles. No DPA is published; the terms say to arrange one before submitting such a workload (22 of 30). The terms promise reasonable notice of material changes when practicable, and the changelog records a Reddit retirement on 29 September and kept paths on 14 October, but there is no deprecation policy with periods and nothing in the OpenAPI file is marked deprecated (7 of 20). Supabase, Tinybird, PostHog, Stripe, Google, OpenAI and Affonso are named with purposes, but the only location statement is that the operator is in the UAE and infrastructure can process in other countries (10 of 20). 15+22+7+10 = 54.

SoldFetch 41

Closed hosted service. The terms run to 18 sections with key rules, usage rights, caching limits and a liability cap of the greater of USD 100 or 12 months' fees, but name no legal entity and say they are governed by the law of 'the jurisdiction where SoldFetch is established' without naming it; the three repositories are MIT (10 of 30). The privacy policy (updated 22 October 2026) gives request-log retention of 7, 30 or 90 days by plan, about an hour for exports, digests for keys and cookie durations, and the docs give cache periods and 24 hours for job results; the pricing page's 30-day request logs on every plan disagrees with the policy's plan-based periods, backups have no period and no DPA was found (20 of 30). No deprecation policy or dated notices; terms 11.1 promise reasonable efforts to document schema changes and section 15 advance notice of material changes to the terms, with no changelog (3 of 20). Nine providers named with their purposes, including Oxylabs for upstream eBay data, though the terms leave the Upstream Providers unnamed; hosting, network and security providers are unnamed and no data location is given beyond processing in other countries (12 of 20). 10+20+3+12 = 45.

ScrapeAtlas 55

No x402, MPP or L402 on ScrapeAtlas's own endpoints. The vendor's eight Actors on the Apify Store, covering TikTok, Instagram, Meetup and Couchsurfing at $1.98 per 1,000 successful requests, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-unit prices are on the home page without a login, 1 credit per successful request and packs at $1.90, $1.78 and $1.25 per 1,000, with the 2-credit endpoints named (20). 100 free credits at signup, no card (20). A person signs up in a browser and creates a key; the Apify route reaches four platforms without a ScrapeAtlas account (5 of 20). 10+20+20+5 = 55.

SoldFetch 40

No x402, MPP or L402 on the pricing page, terms, llms.txt or docs, and no third-party machine payment route was found; the RapidAPI alias does not take RapidAPI authentication (0). Per-unit pricing is public without a login, 1 unit per successful search page or item lookup, $9 for 2,000, $29 for 10,000 and $79 for 50,000 a month, with what is and isn't charged stated (20). Basic gives 100 units once and the terms say no payment method is required (20). A person signs in through the browser and creates a key in the dashboard; no keyless API route or programmatic key creation, and the anonymous playground is a web page for people (0). 0+20+20+0 = 40.

ScrapeAtlas 42

Hosted reading, for the REST API with the MCP server described. No public status page was found. https://scrapeatlas.com/status/ answers 404 and neither the docs nor the footer links one (0). No readable incident history, so 5 by the rubric (5). Limits are published with numbers on the authentication page, 120 requests a minute and 4 concurrent requests per account, with per-worker deadlines and byte caps on the platform pages (15). A 429 is documented for account and upstream limits with a retry-after to respect, 503 busy for full capacity, and the responses page says to retry only on upstream_rate_limited, timeout or busy. No Retry-After header is declared in the OpenAPI file and the CLI does no automatic retries. Writes don't exist, the 12 POST operations are batch reads, so idempotency keys aren't needed (12 of 15). No SLA. The terms (29 September 2026) say no particular uptime, throughput or continued availability is promised unless a separate signed agreement says otherwise (0). The API is sold and listed as available on every platform page, with 15 of 386 operations saying preview in their descriptions; the MCP server is labelled Preview and scored under the API (10). 0+5+15+12+0+10 = 42.

SoldFetch 55

Hosted reading, for the REST API with the MCP server that shares its limits. SoldFetch's own status page at https://soldfetch.com/status lists ebay.com, ebay.co.uk and ebay.de as components, checked every five minutes, all operational on 3 November 2026, but keeps no incident log or uptime history, so half credit (10 of 20). No readable incident history, so the floor (5). Limits are published with numbers, 10 data requests a minute and 1 concurrent on Basic and 60 a minute and 5 concurrent on paid plans, per workspace across keys and interfaces, with a separate 60 a minute for usage and history (15). 429 is documented for workspace rate, concurrency and quota limits, 503 upstream_rate_limited carries a Retry-After header in seconds and the error schema an optional retryAfter, the docs ask for bounded backoff with jitter and name what not to retry, and REST data calls take an Idempotency-Key with a free replay for 24 hours and 409 on changed inputs; job submissions have no key, but the docs say to check existing jobs before resubmitting and allow one active job per workspace (15). No SLA on self-service plans; terms 11.2 keep uptime commitments to a signed enterprise order form (0). No beta or preview label on the API or the MCP server; three of the eight recognised eBay sites are enabled 'at launch' (10). 10+5+15+15+0+10 = 55.

ScrapeAtlas 55

Customer keys with prefix sa_live_, several per account, each with an expiry date, revoked within 60 seconds and stored as hashes per the privacy policy, and keys can't start a checkout or create keys. No scopes or per-platform keys. The MCP server adds an authorization-code flow with PKCE S256, dynamic client registration, refresh-token rotation and revocation, but a single scope, scrapeatlas. No documented option to send a secret in a query string, and the MCP page says never to put the key in a prompt, argument or URL (22 of 30). The whole surface is read-only retrieval of public pages with no destructive action, and an OAuth grant covers retrieval plus the account's usage records only; nothing restricts a key to some platforms (16 of 20). Every response is third-party page content, and the only guidance found concerns keeping secrets out of tool arguments, nothing on treating returned text as untrusted (2 of 15). GET /v1/activity returns per-request metadata (endpoint, time, status, duration) newest first with filters, GET /v1/usage daily totals, responses carry x-credits-charged and x-credits-remaining, and the dashboard shows a credit history (13 of 15). No security.txt (404), no disclosure policy, bug bounty, SOC 2 or ISO 27001; the privacy policy describes access controls and incident notices and gives an abuse address (2 of 20). 22+16+2+13+2 = 55.

SoldFetch 62

Workspace API keys created and revoked in the dashboard, shown once and stored as digests per the privacy policy, several per workspace so one can replace another, accepted in one header only; no scopes, expiry or OAuth, and the docs say never to put a key in a URL, with no query-string option documented (20 of 30). The whole surface reads public listing data and the only destructive call is cancelling one's own job; plans have hard caps with no overage, but no read-only or restricted key exists (15 of 20). Every response carries third-party listing text. The AI agents guide, the MCP README, SECURITY.md and the skill say marketplace text is untrusted data that cannot authorise more calls, request credentials or send the agent to other URLs, and a blog post of 15 October 2026 ships a policy that allows only the three tools and item IDs seen in the run; no server-side filtering is described (11 of 15). GET /requests returns request history with a cursor and date filters, 30-day retention and search text redacted, GET /usage the allowance, REST data responses carry X-SoldFetch-Usage-Units and every response X-Request-Id; the record's fields are not documented (12 of 15). No security.txt (client error), bug bounty, SOC 2 or ISO 27001; the repositories' SECURITY.md files give a reporting route to contact@soldfetch.com (4 of 20). 20+15+11+12+4 = 62.