ScrapeOps Proxy API Aggregator vs Scrapfly

ScrapeOps Proxy API Aggregator 37

Graded on the hosted lines. No status page was found on scrapeops.io or in the docs, and status.scrapeops.io did not answer (0). No readable incident history (5). Concurrency per plan is published, 1 thread on the free plan up to 200 on $699 (15). 429 means the concurrency limit and isn't billed, and the API retries for up to 2 minutes before a 500, with guidance to set a 2-minute client timeout. No Retry-After or backoff guidance (7 of 15). No SLA; the terms disclaim availability (0). Generally available since July 2022 (10). 0 + 5 + 15 + 7 + 0 + 10 = 37.

Scrapfly 85

scrapfly.io/status answers with Statuspage's status JSON, which names its page as scrapfly.statuspage.io. That page has 25 components and incident history back to 2022, read through its history feed on 1 November. The 1 October check read only the overall state and found no history (20, was 10). The newest incident is a Scrapium rendering fault on 21 May 2026, so nothing is posted in the 90 days from 3 August (30, was 5). Concurrency per plan is published (5 on Discovery to 100 on Enterprise) and each project has a configurable per-minute throttle (15). The error catalogue marks every code retryable or not and has three ERR::THROTTLE codes, but we found no Retry-After header or backoff guidance on the errors or throttling pages (10 of 15). The terms disclaim uptime and no uptime SLA is published, and the pricing page's SLA mentions cover support response on Enterprise (0). The Scrape API is GA. Vault and alerting are beta, outside the main surface (10). 20+30+15+10+0+10 = 85.

ScrapeOps Proxy API Aggregator 28

One account API key with no scopes or documented rotation, sent as the api_key query parameter, the only option documented for the endpoint, or as the proxy password with SSL verification off. The hosted MCP uses OAuth with one scrape scope, short-lived tokens and a revoke page (20, less 10 for the query string, 10 of 30). Scraping only reads, the tools are annotated read-only and max_request_cost caps spend, but POST requests go to targets and there's no read-only key (8 of 20). No prompt-injection guidance for returned pages was found (0 of 15). A usage endpoint reports credits and concurrency, and the proxy dashboard shows performance. No per-call audit log for customers (7 of 15). security.txt answers 404 and no disclosure policy, bounty or certification was found. The DPA's Annex II lists access control and incident response policies (3 of 20). 10 + 8 + 0 + 7 + 3 = 28.

Scrapfly 75

OAuth 2 on the hosted MCP with dashboard revocation, open to all plans. API keys are per project, live or test, and since 15 April 2026 can be restricted to products (30). The canonical API form puts the key in the key query parameter and the MCP also accepts ?key=, so less 10 (20 of 30). Product-restricted keys, confirm=true on every mutating vault and alert tool, info_api_key off in server-key mode, and the self-hosted HTTP server binds loopback by default. Since v1.4.0 Cloud Browser sessions are scoped to the API key that opened them (15 of 20). The source gates mutating vault tools behind a preview step because prompt injection can reach them and redacts keys from CDP URLs. We found no user-facing guidance on untrusted page content (8 of 15). Monitoring shows every call as a log with its error, credit cost line by line and Unblocker state, with replay, per the 24 October release notes, as well as per-domain metrics and alerting. The 1 October check couldn't confirm per-request logs (15, was 10). security.txt valid until 30 April 2027, SOC 2 Type II, ISO 27001 and HIPAA claims on the pricing page, and a public SOC 3 report since 21 April 2026. No bug bounty found (17 of 20). 20+15+8+15+17 = 75.

ScrapeOps Proxy API Aggregator 46

Read for a closed service. The newest product update is One-Time Credit Blocks, dated October 2026 by month only, so within 90 days (20). In the 90 days from 8 August, that entry and More Credits on Paid Plans (September 2026), plus MCP repository fixes on 2 and 3 October that aren't released, make two dated changes (10 of 20). Public changelog by product and support by email. GitHub issues weren't read (8 of 25). The MCP server's server.json names io.github.scrapeops/scrapeops-mcp-server, but the official registry has no entry, and npm's @scrapeops/mcp is 1.0.1 of 1 January 2026 while the repository says 1.1.0 (5 of 15). The MCP repository has tests but no CI workflow (3 of 10). 20 + 10 + 8 + 5 + 3 = 46.

Scrapfly 84

Scrapium v156 in the release notes on 26 October 2026 and MCP v1.4.0 on 15 October (30). MCP tags v1.3.1 to v1.3.3 (26 and 27 August), v1.3.4 (8 September) and v1.4.0 (15 October), SDKs 0.12.0 on 8 September, and dated release notes on 14, 24 and 26 August, 11, 23 and 25 September, 7, 24 and 26 October (20). Dated release notes most weeks and a support address. We couldn't read GitHub issues, since github.com refuses our reader (12 of 25). In the official MCP registry as io.scrapfly.mcp/mcp under the vendor's domain, though the entry still lists 1.0.0, and the SDKs are current (15). MCP moved to Go 1.27 on 23 October. Its CI runs only a reference check and the npm publish, while the TypeScript SDK runs tests in CI (7 of 10). 30+20+12+15+7 = 84.

ScrapeOps Proxy API Aggregator 67

No OpenAPI or similar spec. The MCP server's three tools have typed inputs in its source (10 of 25). llms.txt and llms-full.txt index the docs for models (10). Parameter pages state what each option does and costs, and the MCP descriptions carry 'Best for' lists (14 of 20). Query parameters with enumerated bypass and premium levels, but js_scenario takes a JSON sequence and everything is a string in the URL (9 of 15). Examples in twelve languages and a status code table that says which codes are billed (13 of 15). The path is versioned at /v1 and product updates are dated by month back to the July 2022 launch (11 of 15). 10 + 10 + 14 + 9 + 13 + 11 = 67.

Scrapfly 95

A Swagger reference per the 30 September check, and the MCP server exposes it as a web_scraping_openapi_specification resource. Every MCP tool has JSON Schema inputs generated from typed Go structs (25). llms.txt and Markdown twins such as pricing.md per the 30 September check. robots.txt still disallows /docs/llms.txt and the .md twins for crawlers it doesn't name, so they weren't re-read on 1 November (10). Descriptions say when to use a tool and when to switch, for example web_get_page falls back to web_scrape for tuning and to cloud_browser_open for interaction. A few are long and steer the model's next step (17 of 20). Typed inputs with enums, for example the vault service discriminator, and required fields (13 of 15). Error catalogue of 100+ ERR:: codes, each with HTTP status, retryable and billed flags and its own doc link (15). Dated release notes, newest 26 October 2026 (15). 25+10+17+13+15+15 = 95.

ScrapeOps Proxy API Aggregator 61

Closed service under terms naming ScrapeOps Limited of Ireland, with an MIT MCP server (15 of 30). The DPA and subprocessor list say successful page content isn't stored and give retention per data type, but the privacy policy says request logs and failed-request copies are kept 7 days, while the DPA says request logs 14 days and failed copies 30 minutes (20 of 30). No deprecation policy. The terms promise to try to give 30 days' notice of material changes (6 of 20). Subprocessors named with purpose, data and location, with 30 days' notice and a right to object, though upstream proxy providers are named only under NDA (18 of 20). 15 + 20 + 6 + 18 = 59.

Scrapfly 75

Closed service with terms updated 2026-09-30 under US law. SDKs are BSD 2-Clause, and the MCP source is public with no LICENSE file and ISC in package.json (15 of 30). Privacy policy updated 14 May 2026 with a published DPA and HIPAA BAA, but retention is as long as necessary, and the retention of scraped content isn't stated (18 of 30). Release notes date deprecations and removals, for example Scrapium v153 dropping legacy network interception on 11 September. No standing deprecation policy found (15 of 20). Stripe, Google Analytics, Google Ads and Google Cloud are named, with SCC and Data Privacy Framework transfers, but there's no full subprocessor list (10 of 20). The release notes still date each CDP removal, most recently Storage.getRelatedWebsiteSets in Scrapium v156 on 26 October. Not otherwise re-read on 1 November. 15+18+15+10 = 58.