Scrapewise vs SoldFetch

Scrapewise 79

Read as a closed service. Changelog items dated 18, 20, 21, 22 and 23 October 2026 (30). At least three dated changes in 90 days, the September entry and the October items among them (20). A public changelog, a support address and site chat. Two outside issues on the MCP repository from 11 and 15 October had no reply per the 15 October check; GitHub's issue pages couldn't be read on 2 November (8 of 15). Verified namespace in the official MCP registry, version 0.1.1 still the latest on 2 November (15). The Python SDK has CI and trusted publishing at version 0.1.0, Beta, with no commit since 7 October (6 of 10). 30 + 20 + 8 + 15 + 6 = 79.

SoldFetch 49

Closed service. The latest dated changes are commits to all three public repositories and four blog posts on 27 October 2026, and the docs sitemap dates the authentication page 30 October 2026 (30). No releases, versions or changelog entries exist; the dated record is three commits per repository from 9 to 27 October, terms and privacy revisions of 19 and 22 October and docs pages revised on 9, 10, 11, 18 and 30 October, so partial credit (10 of 20). No public changelog; support is a contact form and contact@soldfetch.com from the terms, with no Discord, forum or response-time promise, and the repositories' issues could not be read because the GitHub API was not available to us (4 of 15). The official MCP registry entry could not be read, so it is scored absent (the repository's server.json names io.github.ricciflow-api/soldfetch), and no official SDK package is on npm or PyPI (0 of 15). Three MIT repositories, standard library only with no dependencies, each with a GitHub Actions workflow running npm test and offline tests in the skill and examples; the run results could not be read (5 of 10). 30+10+4+0+5 = 49.

Scrapewise 54

Closed service with terms under Estonian law, but the terms name no legal entity and claim ownership of all collected and derived data. The MCP manifest and Python SDK are MIT (15 of 30). The 90-day retention agrees across the terms, pricing.md and billing docs. The privacy policy still speaks of subscriptions and plan limits, calls service data confidential while the terms claim ownership of it, and no DPA or retention period for logs was found (10 of 30). The API reference states a one-release deprecation rule and the changelog records changed columns with old rows left as they were (8 of 20). Analytics tools on the website named, chat stored on Hetzner in Germany, Stripe and Firebase named in the docs, but no subprocessor list or data locations for the service (5 of 20).

SoldFetch 41

Closed hosted service. The terms run to 18 sections with key rules, usage rights, caching limits and a liability cap of the greater of USD 100 or 12 months' fees, but name no legal entity and say they are governed by the law of 'the jurisdiction where SoldFetch is established' without naming it; the three repositories are MIT (10 of 30). The privacy policy (updated 22 October 2026) gives request-log retention of 7, 30 or 90 days by plan, about an hour for exports, digests for keys and cookie durations, and the docs give cache periods and 24 hours for job results; the pricing page's 30-day request logs on every plan disagrees with the policy's plan-based periods, backups have no period and no DPA was found (20 of 30). No deprecation policy or dated notices; terms 11.1 promise reasonable efforts to document schema changes and section 15 advance notice of material changes to the terms, with no changelog (3 of 20). Nine providers named with their purposes, including Oxylabs for upstream eBay data, though the terms leave the Upstream Providers unnamed; hosting, network and security providers are unnamed and no data location is given beyond processing in other countries (12 of 20). 10+20+3+12 = 45.

Scrapewise 79

Public OpenAPI 3.1 for the whole REST surface (247 operations on 2 November, 224 on 15 October) and an MCP subset (114 operations, 93 on 15 October), and MCP tools are generated from it with JSON Schema inputs (25). llms.txt, agents.md and pricing.md on scrapewise.ai, though docs.scrapewise.ai has no llms.txt (10). The data tools' descriptions say when to use each, what it returns, its price and that it is free or paid. Setup tools carry one-line descriptions (16 of 20). Required fields are marked and there are 55 enums in the MCP subset, but limits such as 1 to 20 results sit in prose, not as constraints, and paid tools wrap arguments in a body object (10 of 15). Request examples throughout, error codes listed with fixes, but the docs show two error envelope shapes and the MCP subset documents only 200, 204, 400 and 402 (10 of 15). A changelog with six entries, the newest items dated by day up to 23 October 2026, one evolving spec with no version prefix, and a one-release deprecation rule (8 of 15).

SoldFetch 68

API reading, with the MCP server described. An OpenAPI 3.1 file is published at https://soldfetch.com/api/v1/openapi.json, under a path robots.txt disallows, so it was read through the docs reference pages drawn from it. Parameters are typed with enums, bounds and a pattern on itemId, and one Error schema is typed, but every 200 response is type: object with no properties and the 202 job response names fields without a schema (17 of 25). llms.txt on the site and the docs, llms-full.txt, and Markdown twins of the docs pages (10). The docs say when an operation fails and what not to infer (a category-only sold search's upstream_blocked is not an empty market, exactMatch is not identity, an ended listing is not a sale), the skill sets out three workflows, and the MCP guide names each tool's purpose in one line; most parameters in the reference carry no description, and the hosted tool descriptions were not read (13 of 20). ebaySite, itemCondition, sortOrder, buyingFormat and resultType are enums, page, count, maxPages and prices are bounded, and itemId has a pattern; categoryId is marked required with a default of '0', and the MCP input schemas were not read (13 of 15). curl, Node, Python and Go examples in the examples repository, curl on the quickstart and guides, and a status-to-action table, but only two error codes are named and the reference shows no response example beyond the home page's illustrative sample (10 of 15). Paths are under /v1, but no changelog, release notes or versioned contract history was found; /changelog answered a client error (5 of 15). 17+10+13+13+10+5 = 68.

Scrapewise 45

Read with the hosted lines. No status page found on scrapewise.ai, the docs, llms.txt or agents.md on 2 November 2026 (0). No readable incident history (5). Rate limits documented with numbers, per account per second and per day by plan (30 a second and 50,000 a day on STARTER up to 1,000 and 100,000,000 on BUSINESS, 2 a second unauthenticated), and 30 requests a second per key on the MCP gateway, plus an hourly cost ceiling there (15). 429 carries Retry-After and X-RateLimit-Remaining, Idempotency-Key is supported on scraper create and run, and paid MCP tools take an idempotency_key remembered for 24 hours (15). No SLA found (0). The API and MCP server are not marked beta, though AI control is in a test phase (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

SoldFetch 55

Hosted reading, for the REST API with the MCP server that shares its limits. SoldFetch's own status page at https://soldfetch.com/status lists ebay.com, ebay.co.uk and ebay.de as components, checked every five minutes, all operational on 3 November 2026, but keeps no incident log or uptime history, so half credit (10 of 20). No readable incident history, so the floor (5). Limits are published with numbers, 10 data requests a minute and 1 concurrent on Basic and 60 a minute and 5 concurrent on paid plans, per workspace across keys and interfaces, with a separate 60 a minute for usage and history (15). 429 is documented for workspace rate, concurrency and quota limits, 503 upstream_rate_limited carries a Retry-After header in seconds and the error schema an optional retryAfter, the docs ask for bounded backoff with jitter and name what not to retry, and REST data calls take an Idempotency-Key with a free replay for 24 hours and 409 on changed inputs; job submissions have no key, but the docs say to check existing jobs before resubmitting and allow one active job per workspace (15). No SLA on self-service plans; terms 11.2 keep uptime commitments to a signed enterprise order form (0). No beta or preview label on the API or the MCP server; three of the eight recognised eBay sites are enabled 'at launch' (10). 10+5+15+15+0+10 = 55.

Scrapewise 56

Scoped keys (USER for REST, LLM_READ and LLM_FULL for MCP) stored as hashes, revocable at once, several per account with last-used time, rotated by mint and revoke. No expiry and no finer scopes (26 of 30). LLM_READ cannot run paid tools or write, and deletes need a preview token committed within 5 minutes. Since 22 October the setup and destructive tools are no longer opt-in for a Full key, and LLM_FULL has no per-tool consent (16 of 20). A documented prompt-injection contract and guidance, but it rests on a type: "scraped" content block that the MCP specification of 25 November 2025 does not define, and the docs' statement that Anthropic's clients honour it by default was not confirmed (8 of 15). Every call is logged with a correlation id and key prefix and the wallet ledger itemises charges, but the operator sees logs only through support (6 of 15). No security.txt, disclosure policy, bug bounty or certification found, security.txt still 404 on 2 November (0 of 20).

SoldFetch 62

Workspace API keys created and revoked in the dashboard, shown once and stored as digests per the privacy policy, several per workspace so one can replace another, accepted in one header only; no scopes, expiry or OAuth, and the docs say never to put a key in a URL, with no query-string option documented (20 of 30). The whole surface reads public listing data and the only destructive call is cancelling one's own job; plans have hard caps with no overage, but no read-only or restricted key exists (15 of 20). Every response carries third-party listing text. The AI agents guide, the MCP README, SECURITY.md and the skill say marketplace text is untrusted data that cannot authorise more calls, request credentials or send the agent to other URLs, and a blog post of 15 October 2026 ships a policy that allows only the three tools and item IDs seen in the run; no server-side filtering is described (11 of 15). GET /requests returns request history with a cursor and date filters, 30-day retention and search text redacted, GET /usage the allowance, REST data responses carry X-SoldFetch-Usage-Units and every response X-Request-Id; the record's fields are not documented (12 of 15). No security.txt (client error), bug bounty, SOC 2 or ISO 27001; the repositories' SECURITY.md files give a reporting route to contact@soldfetch.com (4 of 20). 20+15+11+12+4 = 62.