ScrapeOps Proxy API Aggregator vs ZenRows

ScrapeOps Proxy API Aggregator 37

Graded on the hosted lines. No status page was found on scrapeops.io or in the docs, and status.scrapeops.io did not answer (0). No readable incident history (5). Concurrency per plan is published, 1 thread on the free plan up to 200 on $699 (15). 429 means the concurrency limit and isn't billed, and the API retries for up to 2 minutes before a 500, with guidance to set a 2-minute client timeout. No Retry-After or backoff guidance (7 of 15). No SLA; the terms disclaim availability (0). Generally available since July 2022 (10). 0 + 5 + 15 + 7 + 0 + 10 = 37.

ZenRows 87

Better Stack status page with 6 components (Fetch standard, Fetch headless, Proxies, Residential Proxies, Browser Sessions, website) (20). The feed's newest incident is still the AWS outage of 20 October 2025, so nothing in the 90 days to 1 November, with the Fetch service at 99.998 per cent and the website at 100 on 1 November (30). Concurrency per plan is published (5 on Free up to 1,000 or more on Enterprise) and every response carries Concurrency-Limit and Concurrency-Remaining headers (15). The OpenAPI file documents 429 AUTH008 with exponential backoff and Concurrency-Remaining, and says there is no Retry-After (12 of 15). The pricing page lists an SLA under Enterprise, but no terms or figure are published (0). Fetch is generally available. Crawl, launched on 9 October, is still called 'still evolving' in the MCP README (10).

ScrapeOps Proxy API Aggregator 46

Read for a closed service. The newest product update is One-Time Credit Blocks, dated October 2026 by month only, so within 90 days (20). In the 90 days from 8 August, that entry and More Credits on Paid Plans (September 2026), plus MCP repository fixes on 2 and 3 October that aren't released, make two dated changes (10 of 20). Public changelog by product and support by email. GitHub issues weren't read (8 of 25). The MCP server's server.json names io.github.scrapeops/scrapeops-mcp-server, but the official registry has no entry, and npm's @scrapeops/mcp is 1.0.1 of 1 January 2026 while the repository says 1.1.0 (5 of 15). The MCP repository has tests but no CI workflow (3 of 10). 20 + 10 + 8 + 5 + 3 = 46.

ZenRows 90

MCP v2.18.0 on 2026-10-30 (30). Seven MCP minor releases from 18 to 30 October alone (v2.12.0 to v2.18.0), and dated changelog entries on 2, 5 and 9 October (20). We couldn't read GitHub issues. PRs are merged within days and the dated changelog on zenrows.com runs to 9 October (15 of 25). In the official MCP registry as io.github.ZenRows/zenrows-mcp, with 2.18.0 published on 30 October and marked latest (15). CI runs typecheck, lint and tests on a Node matrix, and a check that server.json matches the package version (10).

ScrapeOps Proxy API Aggregator 40

No x402, MPP or L402 (0). Credit costs per option and all twelve plan prices are public (20). Free plan of 1,000 credits a month with no card (20). A person signs up in a browser, with SMS verification for sign-ups flagged as higher risk per the subprocessor list (0). 0 + 20 + 20 + 0 = 40.

ZenRows 80

x402 and MPP through an agent storefront at agents.zenrows.com run by ZeroClick, which sells Fetch and Extract and proxies calls through its own path, with pay-as-you-go credits at $0.50 per 1,000 (10,000 minimum) per the pricing docs. Nothing on api.zenrows.com itself (20 of 40). Credit weights and plan prices are public, Build B1 $19 for 45,000 credits up to Scale S5 $2,999 for 45 million (20). 5,000 free credits a month, no card (20). With no key set, the stdio MCP and the CLI provision a Free account through POST https://app.zenrows.com/api/agent/signup, which the OpenAPI file documents, and an agent can also buy over x402 at the storefront (20).

ScrapeOps Proxy API Aggregator 67

No OpenAPI or similar spec. The MCP server's three tools have typed inputs in its source (10 of 25). llms.txt and llms-full.txt index the docs for models (10). Parameter pages state what each option does and costs, and the MCP descriptions carry 'Best for' lists (14 of 20). Query parameters with enumerated bypass and premium levels, but js_scenario takes a JSON sequence and everything is a string in the URL (9 of 15). Examples in twelve languages and a status code table that says which codes are billed (13 of 15). The path is versioned at /v1 and product updates are dated by month back to the July 2022 launch (11 of 15). 10 + 10 + 14 + 9 + 13 + 11 = 67.

ZenRows 93

OpenAPI 3.1 at www.zenrows.com/openapi.json covers Fetch, Extract, Crawl (added after the 9 October launch), Batch, agent signup and HMAC key rotation, and the 63 MCP tools have typed zod inputs (25). llms.txt with 105 entries linking 240 docs pages on 1 November, each with a Markdown copy (10). The scrape tool says when to prefer extract, when to turn on js_render or premium_proxy, and gives three examples, and the crawl tools say when to wait, page or download. The browser tools are terser (18 of 20). Enums on mode and response_type, URL validation and required fields, but css_extractor is a JSON string and outputs a comma-separated string (12 of 15). Error catalogue of 35 codes such as AUTH004 and RESP002, plus a table of Batch and Extract codes, grouped by HTTP status with fixes, and every OpenAPI operation lists its error responses (15). The API is versioned in the path (v1, never retired), a dated changelog at www.zenrows.com/changelog runs to 9 October 2026, with nothing newer on 1 November, and the MCP has semver tags. The 2026 renames (Universal Scraper API to Fetch, Scraping Browser to Browser Sessions) aren't in it (13 of 15).

ScrapeOps Proxy API Aggregator 28

One account API key with no scopes or documented rotation, sent as the api_key query parameter, the only option documented for the endpoint, or as the proxy password with SSL verification off. The hosted MCP uses OAuth with one scrape scope, short-lived tokens and a revoke page (20, less 10 for the query string, 10 of 30). Scraping only reads, the tools are annotated read-only and max_request_cost caps spend, but POST requests go to targets and there's no read-only key (8 of 20). No prompt-injection guidance for returned pages was found (0 of 15). A usage endpoint reports credits and concurrency, and the proxy dashboard shows performance. No per-call audit log for customers (7 of 15). security.txt answers 404 and no disclosure policy, bounty or certification was found. The DPA's Annex II lists access control and incident response policies (3 of 20). 10 + 8 + 0 + 7 + 3 = 28.

ZenRows 50

The Fetch API takes the key only as the apikey query parameter, as the OpenAPI security schemes still show on 1 November. Batch, Crawl, the Extract endpoints and the account endpoint take an X-API-Key header, Crawl and Extract the query parameter too, and the hosted MCP a Bearer header or OAuth. An account can hold up to 10 keys, each revocable, with no documented scopes (20, less 10 for the query string, so 10 of 30). Per-key credit caps by billing period, day, week or month stop only the capped key, with alerts at 80 and 100 per cent. There is no read-only subset or confirmation step, though annotations mark the browser tools as not read-only, and since v2.15.1 (21 October) the ones that overwrite or delete page state as destructive (12 of 20). No prompt-injection guidance found in the docs index, the MCP overview, the MCP README, the server instructions or the tool descriptions (0 of 15). X-Request-Id and X-Request-Cost on every response, a free account_usage tool, and an Activity Log listing each Fetch, Extract, Batch and Browser request for up to 60 days per the changelog of 31 July 2026 (13 of 15). security.txt on www.zenrows.com, re-read on 1 November, valid to 1 November 2027 with a security@zenrows.com contact and a linked information security policy. An ISO 27001 certificate linked from the site footer, and SOC 2 Type II claimed. No bug bounty found (15 of 20).

ScrapeOps Proxy API Aggregator 61

Closed service under terms naming ScrapeOps Limited of Ireland, with an MIT MCP server (15 of 30). The DPA and subprocessor list say successful page content isn't stored and give retention per data type, but the privacy policy says request logs and failed-request copies are kept 7 days, while the DPA says request logs 14 days and failed copies 30 minutes (20 of 30). No deprecation policy. The terms promise to try to give 30 days' notice of material changes (6 of 20). Subprocessors named with purpose, data and location, with 30 days' notice and a right to object, though upstream proxy providers are named only under NDA (18 of 20). 15 + 20 + 6 + 18 = 59.

ZenRows 79

Closed service, with ZENROWS, S.L. named in full (Getxo, Spain, tax ID B10660298). The MCP is MIT (15 of 30). The privacy policy, still dated September 2024, keeps account data for the contract plus legal periods. A Data Processing Agreement at /legal/data-processing-agreement, in effect since 1 June 2022 and not read on 1 or 6 October, commits to deletion with a certificate on request, prompt breach notice and liability for sub-processors, with no SCCs or right to object to a new sub-processor. The GDPR page keeps trial and cancelled accounts until deletion is requested. Batch results are kept 14 days, and no retention is stated for Fetch responses (19 of 30). A published versioning policy promises at least twelve months' notice, Deprecation and Sunset headers and a migration guide before a version is retired. The 2026 renames carried no dated notices (15 of 20). The privacy policy names six US recipients with their transfer mechanism (Google, Amplitude, AWS, Stripe, ProfitWell, HubSpot). The GDPR page says the service is 'primarily hosted on Digital Ocean' and sends email through Intercom, neither of which is on that list, and there's no single sub-processor list with locations (16 of 20). 15+19+15+16 = 65.