ScrapeGraphAI vs SoldFetch

ScrapeGraphAI 90

x402 on ScrapeGraphAI's own domain mints an account, key and credits. The protocols endpoint read on 1 November prices the packs at 4 USDC for 1,000 credits, 32 for 10,000 and 120 for 50,000 (5, 40 and 150 before), below the pricing page's $5, $40 and $150 by card, with USDC on Base for x402 and InFlow for MPP. Orthogonal's gateway at x402.orth.sh/scrapegraph takes per-call x402 on scrape, extract, search, crawl and monitor with no ScrapeGraphAI key, per the 1 October check. Per-call payment only through a third party, so 30 (30 of 40). Credit costs per operation, plans and non-expiring top-up packs are public (20). Free plan of 500 credits with no card (20). An agent can buy a key over x402 or MPP with no human signup (20). 30 + 20 + 20 + 20 = 90.

SoldFetch 40

No x402, MPP or L402 on the pricing page, terms, llms.txt or docs, and no third-party machine payment route was found; the RapidAPI alias does not take RapidAPI authentication (0). Per-unit pricing is public without a login, 1 unit per successful search page or item lookup, $9 for 2,000, $29 for 10,000 and $79 for 50,000 a month, with what is and isn't charged stated (20). Basic gives 100 units once and the terms say no payment method is required (20). A person signs in through the browser and creates a key in the dashboard; no keyless API route or programmatic key creation, and the anonymous playground is a web page for people (0). 0+20+20+0 = 40.

ScrapeGraphAI 88

OpenAPI 3.1.0 at v2-api.scrapegraphai.com/api/openapi.json, info version 2.0.0 (25). llms.txt and Markdown docs (10). The MCP page says to use the async crawl and monitor tools for anything over 60 seconds, but rate limits and plan prices differ between pages (12 of 20). Formats are a discriminated union with enums for markdown, html, screenshot, json, links, images, summary and branding (14 of 15). Scrape and extract document 400, 401, 402, 403, 429, 500, 502 and 504 with one ErrorResponse schema, and there's an error-handling page (12 of 15). Versioned, dated changelog, v3.5.0 on 30 July 2026 (15). Not re-read on 1 November apart from the rate-limit pages. 25 + 10 + 12 + 14 + 12 + 15 = 88.

SoldFetch 68

API reading, with the MCP server described. An OpenAPI 3.1 file is published at https://soldfetch.com/api/v1/openapi.json, under a path robots.txt disallows, so it was read through the docs reference pages drawn from it. Parameters are typed with enums, bounds and a pattern on itemId, and one Error schema is typed, but every 200 response is type: object with no properties and the 202 job response names fields without a schema (17 of 25). llms.txt on the site and the docs, llms-full.txt, and Markdown twins of the docs pages (10). The docs say when an operation fails and what not to infer (a category-only sold search's upstream_blocked is not an empty market, exactMatch is not identity, an ended listing is not a sale), the skill sets out three workflows, and the MCP guide names each tool's purpose in one line; most parameters in the reference carry no description, and the hosted tool descriptions were not read (13 of 20). ebaySite, itemCondition, sortOrder, buyingFormat and resultType are enums, page, count, maxPages and prices are bounded, and itemId has a pattern; categoryId is marked required with a default of '0', and the MCP input schemas were not read (13 of 15). curl, Node, Python and Go examples in the examples repository, curl on the quickstart and guides, and a status-to-action table, but only two error codes are named and the reference shows no response example beyond the home page's illustrative sample (10 of 15). Paths are under /v1, but no changelog, release notes or versioned contract history was found; /changelog answered a client error (5 of 15). 17+10+13+13+10+5 = 68.

ScrapeGraphAI 61

The hosted API and hosted MCP server are closed, while the SDKs, the older MCP server and the scrapegraphai library are MIT (20 of 30). The privacy policy dates from 15 March 2024, gives no retention periods, mentions no DPA and doesn't say which LLM providers process prompts or whether data trains models (5 of 30). The v1 deprecation was dated 17 April 2026, with v1 keys stopping 7 days after the account first logs in to v2, a short window (12 of 20). Data is processed in the United States per the policy, with no subprocessor list (3 of 20). Not re-read on 1 November. 20 + 5 + 12 + 3 = 40.

SoldFetch 41

Closed hosted service. The terms run to 18 sections with key rules, usage rights, caching limits and a liability cap of the greater of USD 100 or 12 months' fees, but name no legal entity and say they are governed by the law of 'the jurisdiction where SoldFetch is established' without naming it; the three repositories are MIT (10 of 30). The privacy policy (updated 22 October 2026) gives request-log retention of 7, 30 or 90 days by plan, about an hour for exports, digests for keys and cookie durations, and the docs give cache periods and 24 hours for job results; the pricing page's 30-day request logs on every plan disagrees with the policy's plan-based periods, backups have no period and no DPA was found (20 of 30). No deprecation policy or dated notices; terms 11.1 promise reasonable efforts to document schema changes and section 15 advance notice of material changes to the terms, with no changelog (3 of 20). Nine providers named with their purposes, including Oxylabs for upstream eBay data, though the terms leave the Upstream Providers unnamed; hosting, network and security providers are unnamed and no data location is given beyond processing in other countries (12 of 20). 10+20+3+12 = 45.

ScrapeGraphAI 44

OAuth 2.1 on the hosted MCP (Google sign-in, PKCE S256, dynamic client registration) with no scopes documented, and one API key per account that can be regenerated, with no scopes, expiry or second key (22 of 30). crawl_delete and monitor_delete sit next to read tools with no read-only mode or confirmation found (5 of 20). Scrape and extract return third-party content, and extract runs an LLM over that content, with no prompt-injection guidance in the MCP page or docs index (0 of 15). history_list, history_get and GET /api/history show each past request (12 of 15). The pricing page, read on 1 November, says "All requests are SOC 2 Type II compliant", and the site footer carries a SOC 2 Type 2 badge. security.txt answers 404, and no disclosure policy or bug bounty was found. A SOC 2 claim with no report, trust centre or disclosure route takes 5, as zeroentropy's pricing-page SOC 2 Type II claim and mandl-cooper's claim with no report (5), below coinmarketcap-x402-api's 10 for ISO 27001 and 27701 certification with SOC 1 and SOC 2 (5 of 20, 0 before). 22 + 5 + 0 + 12 + 5 = 44.

SoldFetch 62

Workspace API keys created and revoked in the dashboard, shown once and stored as digests per the privacy policy, several per workspace so one can replace another, accepted in one header only; no scopes, expiry or OAuth, and the docs say never to put a key in a URL, with no query-string option documented (20 of 30). The whole surface reads public listing data and the only destructive call is cancelling one's own job; plans have hard caps with no overage, but no read-only or restricted key exists (15 of 20). Every response carries third-party listing text. The AI agents guide, the MCP README, SECURITY.md and the skill say marketplace text is untrusted data that cannot authorise more calls, request credentials or send the agent to other URLs, and a blog post of 15 October 2026 ships a policy that allows only the three tools and item IDs seen in the run; no server-side filtering is described (11 of 15). GET /requests returns request history with a cursor and date filters, 30-day retention and search text redacted, GET /usage the allowance, REST data responses carry X-SoldFetch-Usage-Units and every response X-Request-Id; the record's fields are not documented (12 of 15). No security.txt (client error), bug bounty, SOC 2 or ISO 27001; the repositories' SECURITY.md files give a reporting route to contact@soldfetch.com (4 of 20). 20+15+11+12+4 = 62.

ScrapeGraphAI 40

The newest changelog entry is still v3.5.0 of 30 July 2026 and the newest scrapegraph-py tag v2.3.2 of 31 July, 94 and 93 days before 1 November. scrapegraph-js has no tag after v2.0.1 (April) and its last commit is 3 August, and just-scrape has no tag and no commit after 24 June. Inside 180 days (10, 20 before, cause time). Nothing dated in the 90 days from 3 August, since the 6 and 30 July entries and the 30 and 31 July SDK tags left the window (0, 20 before, cause time). Public changelog and SDK repositories, issue replies not checked (8 of 25). Current Python SDK. The JavaScript SDK's last tag is v2.0.1 from April, with commits to 3 August (12 of 15). The Python SDK runs CI, CodeQL and dependency review (10). 10 + 0 + 8 + 12 + 10 = 40.

SoldFetch 49

Closed service. The latest dated changes are commits to all three public repositories and four blog posts on 27 October 2026, and the docs sitemap dates the authentication page 30 October 2026 (30). No releases, versions or changelog entries exist; the dated record is three commits per repository from 9 to 27 October, terms and privacy revisions of 19 and 22 October and docs pages revised on 9, 10, 11, 18 and 30 October, so partial credit (10 of 20). No public changelog; support is a contact form and contact@soldfetch.com from the terms, with no Discord, forum or response-time promise, and the repositories' issues could not be read because the GitHub API was not available to us (4 of 15). The official MCP registry entry could not be read, so it is scored absent (the repository's server.json names io.github.ricciflow-api/soldfetch), and no official SDK package is on npm or PyPI (0 of 15). Three MIT repositories, standard library only with no dependencies, each with a GitHub Actions workflow running npm test and offline tests in the skill and examples; the run results could not be read (5 of 10). 30+10+4+0+5 = 49.

ScrapeGraphAI 49

openstatus page at scrapegraphapi.openstatus.dev. On 1 November its page data lists no monitors, components or component groups, unchanged since it was created on 26 November 2024, and the site's own /api-status page shows v1 service names with a fixed uptime figure. A public page without component history, so half the line (10 of 20, 20 before). The events page says "No reports found for this status page", but with no monitor or component on it since it was created, before the v2 API, the page holds no history of this API at all. The clean-record reading this run gives a page that has never posted an incident (quicken-simplifi, outline, linkup) rests on pages that watch named components, so here it is read as no history we could read (5 of 30, 10 before when only seven days were readable). Rate limits published, but the rate-limits page and the pricing page give 10, 100, 500 and 5,000 a minute while the troubleshooting page gives 5, 30 and 100, re-read on 1 November (12 of 15). 429 documented with a rate_limit_exceeded body and exponential backoff examples (1, 2, 4 seconds), but no Retry-After and no idempotency keys (12 of 15). No SLA found. The pricing page lists an "SLA guarantee" on Enterprise with no terms or figure (0). v2 is GA (10). 10 + 5 + 12 + 12 + 0 + 10 = 49.

SoldFetch 55

Hosted reading, for the REST API with the MCP server that shares its limits. SoldFetch's own status page at https://soldfetch.com/status lists ebay.com, ebay.co.uk and ebay.de as components, checked every five minutes, all operational on 3 November 2026, but keeps no incident log or uptime history, so half credit (10 of 20). No readable incident history, so the floor (5). Limits are published with numbers, 10 data requests a minute and 1 concurrent on Basic and 60 a minute and 5 concurrent on paid plans, per workspace across keys and interfaces, with a separate 60 a minute for usage and history (15). 429 is documented for workspace rate, concurrency and quota limits, 503 upstream_rate_limited carries a Retry-After header in seconds and the error schema an optional retryAfter, the docs ask for bounded backoff with jitter and name what not to retry, and REST data calls take an Idempotency-Key with a free replay for 24 hours and 409 on changed inputs; job submissions have no key, but the docs say to check existing jobs before resubmitting and allow one active job per workspace (15). No SLA on self-service plans; terms 11.2 keep uptime commitments to a signed enterprise order form (0). No beta or preview label on the API or the MCP server; three of the eight recognised eBay sites are enabled 'at launch' (10). 10+5+15+15+0+10 = 55.