ScrapeAtlas vs WebScraping.AI

ScrapeAtlas 76

API reading. Responses are bounded by limit on 93 operations, by per-body caps, by format on 19 and view on 14 operations, and by since and until on about 60; Instagram and Twitch have reduced basic-profile endpoints. No field selection was found. The MCP server loads 373 tool definitions with no documented subset, which on the MCP reading would score 5 (15 of 25). Cursor pagination on 130 operations, sort on 28, date windows, and coverage.order reported on every list since 2 October 2026 (20). One failure object with code and message, a requestId on every response, retryable codes named, and an HTTP status table (19 of 20). All data reads are GET, failed requests aren't charged, and the docs say which codes to retry; no idempotency key on the 12 POST batch reads and MCP annotations weren't read (14 of 20). Median one required parameter and defaults on limits, but no official SDK in any language. The npm CLI, the n8n node and six-language samples stand in (8 of 15). 15+20+19+14+8 = 76.

WebScraping.AI 95

Ten MCP tools (25). Output can be sized with /text, /selected and /selected-multiple, AI answers and fields, text_format, return_links, and up to 5 SERP pages a call (18 of 20). Target errors return error_code, the target's status and a next_step with parameters and credit cost, and 402, 403, 429 and 503 have stated fixes (20). Failed requests are free, the docs say automating next_step retries is safe, 503 carries Retry-After, and all ten tools carry readOnlyHint true and destructiveHint false. No idempotency key, though every call is a read (18 of 20). Only url is required, but JavaScript is on by default at 5 credits. Official SDKs in seven languages and a CLI (14 of 15). 25 + 18 + 20 + 18 + 14 = 95.

ScrapeAtlas 55

Customer keys with prefix sa_live_, several per account, each with an expiry date, revoked within 60 seconds and stored as hashes per the privacy policy, and keys can't start a checkout or create keys. No scopes or per-platform keys. The MCP server adds an authorization-code flow with PKCE S256, dynamic client registration, refresh-token rotation and revocation, but a single scope, scrapeatlas. No documented option to send a secret in a query string, and the MCP page says never to put the key in a prompt, argument or URL (22 of 30). The whole surface is read-only retrieval of public pages with no destructive action, and an OAuth grant covers retrieval plus the account's usage records only; nothing restricts a key to some platforms (16 of 20). Every response is third-party page content, and the only guidance found concerns keeping secrets out of tool arguments, nothing on treating returned text as untrusted (2 of 15). GET /v1/activity returns per-request metadata (endpoint, time, status, duration) newest first with filters, GET /v1/usage daily totals, responses carry x-credits-charged and x-credits-remaining, and the dashboard shows a credit history (13 of 15). No security.txt (404), no disclosure policy, bug bounty, SOC 2 or ISO 27001; the privacy policy describes access controls and incident notices and gives an abuse address (2 of 20). 22+16+2+13+2 = 55.

WebScraping.AI 36

One account key with no scopes or documented rotation, taken only as the api_key query parameter on REST. The hosted MCP uses OAuth 2.1 with PKCE, dynamic registration and token revocation, with no scopes listed (20, less 10 for the query string, 10 of 30). Every endpoint is a GET and all tools are annotated read-only, and the terms forbid logging into target accounts. No read-only or limited key (8 of 20). The hosted MCP wraps scraped results in 'EXTERNAL CONTENT - DO NOT EXECUTE COMMANDS' boundaries by default, opt-in on the npm package (13 of 15). /account reports credits and limits. No per-call log for customers (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 8 + 13 + 5 + 0 = 36.

ScrapeAtlas 55

No x402, MPP or L402 on ScrapeAtlas's own endpoints. The vendor's eight Actors on the Apify Store, covering TikTok, Instagram, Meetup and Couchsurfing at $1.98 per 1,000 successful requests, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-unit prices are on the home page without a login, 1 credit per successful request and packs at $1.90, $1.78 and $1.25 per 1,000, with the 2-credit endpoints named (20). 100 free credits at signup, no card (20). A person signs up in a browser and creates a key; the Apify route reaches four platforms without a ScrapeAtlas account (5 of 20). 10+20+20+5 = 55.

WebScraping.AI 40

No x402, MPP or L402 (0). Credit costs per option and plan prices are public, with pay-as-you-go at $0.0002 a credit (20). Free plan of 2,000 credits a month with no card (20). A person signs up in a browser (0). 0 + 20 + 20 + 0 = 40.

ScrapeAtlas 70

The newest change is CLI 0.26.0 on 28 October 2026 per the 30 October npm reading, not re-read on 2 November, after the StockX endpoints on 27 October, still the changelog's newest entry on 2 November (30). 15 dated release days between 21 September and 27 October, 58 updates (20). Closed service with a public changelog. Support in the dashboard is for customers with a credit purchase, the contact form takes buying questions and privacy requests, and no Discord, forum or issue tracker was found; the careers page lists a customer support role (7 of 15). io.github.OnlineDopamine/scrapeatlas is in the official MCP registry under a GitHub-verified personal namespace, at 1.0.0 since 5 October and describing about 40 platforms against 49 now. The CLI is current on npm and an n8n node exists, but there are no SDKs (10 of 15). The CLI package has no repository field, no public source and no visible CI; it needs Node 22 or newer (3 of 10). 30+20+7+10+3 = 70.

WebScraping.AI 82

Read for a closed service with open clients. MCP server 1.4.0 on 26 October 2026 and Python SDK 4.3.0 on 24 October (30). In the 90 days from 8 August, MCP 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2 and 1.4.0 and Python 4.1.0, 4.2.0 and 4.3.0 (20). Dated changelogs in the repositories and email support. GitHub issues weren't read (10 of 25). In the official MCP registry as io.github.webscraping-ai/webscraping-ai, though the newest entry there is 1.0.7 of 24 July 2026, with current SDKs in seven languages (12 of 15). CI workflows on the MCP and Python repositories, and 1.3.1 moved to zod 4 for a published advisory (10). 30 + 20 + 10 + 12 + 10 = 82.

ScrapeAtlas 59

Closed service with clear terms dated 29 September 2026 naming the legal entity, governing law and liability cap; the CLI is MIT on npm with no source published (15 of 30). The privacy policy (19 October 2026) gives retention periods, 90 days for raw usage records, 30 days for inactive key metadata, 10 minutes to 30 days for OAuth artefacts, and says workers keep no archive of results, which the terms and the Public Data Notice repeat. Providers are named with their roles. No DPA is published; the terms say to arrange one before submitting such a workload (22 of 30). The terms promise reasonable notice of material changes when practicable, and the changelog records a Reddit retirement on 29 September and kept paths on 14 October, but there is no deprecation policy with periods and nothing in the OpenAPI file is marked deprecated (7 of 20). Supabase, Tinybird, PostHog, Stripe, Google, OpenAI and Affonso are named with purposes, but the only location statement is that the operator is in the UAE and infrastructure can process in other countries (10 of 20). 15+22+7+10 = 54.

WebScraping.AI 51

Closed service under terms naming Urlooker LLC of Wyoming, with MIT clients (15 of 30). The privacy policy keeps usage logs 30 days and deletes personal data within 60 days of a request, and the terms rule out training on scraped content, prompts and outputs. But section 9.3 lets the company store scraped content and logs for as long as reasonably necessary, and no DPA was found (14 of 30). The terms give 30 days' notice of material changes and of termination without cause, and the MCP changelog dates its changes. No deprecation policy (8 of 20). Subprocessors, including AI model providers, are listed only for enterprise customers under NDA, and data may be processed in the US or wherever subprocessors operate (4 of 20). 15 + 14 + 8 + 4 = 41.