ScraperAPI vs WebScraping.AI

ScraperAPI 41

The newest dated entry is the October 2026 release note on automatic Akamai unblocking, dated by month only. Counted from its month, October lies 4 to 34 days back, so it is inside 90 days but not shown within 30, as crustdata's October entries. The skills plugin's 1.1.0 of 7 August is an untagged version bump, and the MCP server's v1.1.1 is from 17 July 2026 (20). Since 6 August only the October note and the 7 August plugin bump are dated, fewer than three (0 of 20). The npm and PyPI pages of the SDKs and CLI couldn't be read on 4 November. Monthly release notes and support through the dashboard and email. We did not read the repository's issues (8 of 15). SDKs are documented for five languages, but we could not check their release dates, and the Node.js SDK repository's last commit is from 12 January 2024 (8 of 15). The MCP repository has unit tests and a lock file but no public CI workflow (5 of 10). 20 + 0 + 8 + 8 + 5 = 41.

WebScraping.AI 82

Read for a closed service with open clients. MCP server 1.4.0 on 26 October 2026 and Python SDK 4.3.0 on 24 October (30). In the 90 days from 8 August, MCP 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2 and 1.4.0 and Python 4.1.0, 4.2.0 and 4.3.0 (20). Dated changelogs in the repositories and email support. GitHub issues weren't read (10 of 25). In the official MCP registry as io.github.webscraping-ai/webscraping-ai, though the newest entry there is 1.0.7 of 24 July 2026, with current SDKs in seven languages (12 of 15). CI workflows on the MCP and Python repositories, and 1.3.1 moved to zod 4 for a published advisory (10). 30 + 20 + 10 + 12 + 10 = 82.

ScraperAPI 67

No OpenAPI file found. The MCP server's source defines typed pydantic inputs for all 28 tools (12 of 25). The docs publish llms.txt, llms-full.txt and a Markdown twin of every page (10). MCP tool descriptions state when to use a tool and when not to, and the API reference describes each parameter with its credit cost (15 of 20). MCP inputs use enums for device type and output format. The HTTP API's parameters are query strings described in prose tables (10 of 15). Examples in cURL, Python, Node.js, PHP, Ruby and Java, a status code table that says which codes are billed, and an error table for the AI parser (12 of 15). Release notes are grouped by month without day dates, the HTTP API has no version, and the MCP server uses semver tags (8 of 15). 12 + 10 + 15 + 10 + 12 + 8 = 67.

WebScraping.AI 89

OpenAPI file (version 3.2.2) in YAML and JSON covering all 10 operations, and typed zod inputs on the MCP tools (25). llms.txt, llms-full.txt and a Markdown copy of every page (10). Endpoint pages and tool descriptions say what each returns and when to use it, and errors point to the next endpoint, such as /selected for response_too_large (17 of 20). Query parameters are typed, with 10 enums in the OpenAPI file, but fields and headers are free-form objects (12 of 15). Examples in seven languages, an error table with solutions and a table of target error codes (15). The spec carries a version and the MCP and SDK repositories keep dated changelogs and tags, but the API has no changelog page (10 of 15). 25 + 10 + 17 + 12 + 15 + 10 = 89.

ScraperAPI 74

28 MCP tools with no toolsets or dynamic loading (15 of 25). output_format returns Markdown or text, autoparse returns JSON on supported domains, structured endpoints page their results, and max_cost, crawl_budget and max_depth cap a job (15 of 20). Errors are HTTP status codes with plain-text messages. No machine-readable error codes (13 of 20). All 28 MCP tools carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint, failed requests are not charged, and async jobs return a status URL to poll (16 of 20). Only api_key and url are required, rendering is off by default, and SDKs are documented for Python, Node.js, PHP, Ruby and Java (15). 15 + 15 + 13 + 16 + 15 = 74.

WebScraping.AI 95

Ten MCP tools (25). Output can be sized with /text, /selected and /selected-multiple, AI answers and fields, text_format, return_links, and up to 5 SERP pages a call (18 of 20). Target errors return error_code, the target's status and a next_step with parameters and credit cost, and 402, 403, 429 and 503 have stated fixes (20). Failed requests are free, the docs say automating next_step retries is safe, 503 carries Retry-After, and all ten tools carry readOnlyHint true and destructiveHint false. No idempotency key, though every call is a read (18 of 20). Only url is required, but JavaScript is on by default at 5 credits. Official SDKs in seven languages and a CLI (14 of 15). 25 + 18 + 20 + 18 + 14 = 95.

ScraperAPI 29

One API key per account, regenerated from the dashboard at most once every 24 hours. No scopes (20). The documented default puts the key in the URL query string, so less 10, although an x-sapi-api_key header and a Bearer header on the remote MCP server exist (10 of 30). No read-only or restricted keys. max_cost, a monthly pay-as-you-go spending cap and destructive hints on the two MCP delete tools limit damage (6 of 20). The API returns untrusted web content and no prompt-injection guidance was found in the docs, the MCP README or the skills (2 of 15). The dashboard has analytics with error logs, each response carries sa-credit-cost, and the privacy policy says activity logs are deleted after 7 days (9 of 15). /.well-known/security.txt returned 404 on 9 October and 4 November, and no disclosure policy, bug bounty or certification was found. The home page claims CCPA and GDPR compliance (2 of 20). 10 + 6 + 2 + 9 + 2 = 29.

WebScraping.AI 36

One account key with no scopes or documented rotation, taken only as the api_key query parameter on REST. The hosted MCP uses OAuth 2.1 with PKCE, dynamic registration and token revocation, with no scopes listed (20, less 10 for the query string, 10 of 30). Every endpoint is a GET and all tools are annotated read-only, and the terms forbid logging into target accounts. No read-only or limited key (8 of 20). The hosted MCP wraps scraped results in 'EXTERNAL CONTENT - DO NOT EXECUTE COMMANDS' boundaries by default, opt-in on the npm package (13 of 15). /account reports credits and limits. No per-call log for customers (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 8 + 13 + 5 + 0 = 36.