Scrapfly vs SoldFetch

Scrapfly 84

Scrapium v156 in the release notes on 26 October 2026 and MCP v1.4.0 on 15 October (30). MCP tags v1.3.1 to v1.3.3 (26 and 27 August), v1.3.4 (8 September) and v1.4.0 (15 October), SDKs 0.12.0 on 8 September, and dated release notes on 14, 24 and 26 August, 11, 23 and 25 September, 7, 24 and 26 October (20). Dated release notes most weeks and a support address. We couldn't read GitHub issues, since github.com refuses our reader (12 of 25). In the official MCP registry as io.scrapfly.mcp/mcp under the vendor's domain, though the entry still lists 1.0.0, and the SDKs are current (15). MCP moved to Go 1.27 on 23 October. Its CI runs only a reference check and the npm publish, while the TypeScript SDK runs tests in CI (7 of 10). 30+20+12+15+7 = 84.

SoldFetch 49

Closed service. The latest dated changes are commits to all three public repositories and four blog posts on 27 October 2026, and the docs sitemap dates the authentication page 30 October 2026 (30). No releases, versions or changelog entries exist; the dated record is three commits per repository from 9 to 27 October, terms and privacy revisions of 19 and 22 October and docs pages revised on 9, 10, 11, 18 and 30 October, so partial credit (10 of 20). No public changelog; support is a contact form and contact@soldfetch.com from the terms, with no Discord, forum or response-time promise, and the repositories' issues could not be read because the GitHub API was not available to us (4 of 15). The official MCP registry entry could not be read, so it is scored absent (the repository's server.json names io.github.ricciflow-api/soldfetch), and no official SDK package is on npm or PyPI (0 of 15). Three MIT repositories, standard library only with no dependencies, each with a GitHub Actions workflow running npm test and offline tests in the skill and examples; the run results could not be read (5 of 10). 30+10+4+0+5 = 49.

Scrapfly 75

Closed service with terms updated 2026-09-30 under US law. SDKs are BSD 2-Clause, and the MCP source is public with no LICENSE file and ISC in package.json (15 of 30). Privacy policy updated 14 May 2026 with a published DPA and HIPAA BAA, but retention is as long as necessary, and the retention of scraped content isn't stated (18 of 30). Release notes date deprecations and removals, for example Scrapium v153 dropping legacy network interception on 11 September. No standing deprecation policy found (15 of 20). Stripe, Google Analytics, Google Ads and Google Cloud are named, with SCC and Data Privacy Framework transfers, but there's no full subprocessor list (10 of 20). The release notes still date each CDP removal, most recently Storage.getRelatedWebsiteSets in Scrapium v156 on 26 October. Not otherwise re-read on 1 November. 15+18+15+10 = 58.

SoldFetch 41

Closed hosted service. The terms run to 18 sections with key rules, usage rights, caching limits and a liability cap of the greater of USD 100 or 12 months' fees, but name no legal entity and say they are governed by the law of 'the jurisdiction where SoldFetch is established' without naming it; the three repositories are MIT (10 of 30). The privacy policy (updated 22 October 2026) gives request-log retention of 7, 30 or 90 days by plan, about an hour for exports, digests for keys and cookie durations, and the docs give cache periods and 24 hours for job results; the pricing page's 30-day request logs on every plan disagrees with the policy's plan-based periods, backups have no period and no DPA was found (20 of 30). No deprecation policy or dated notices; terms 11.1 promise reasonable efforts to document schema changes and section 15 advance notice of material changes to the terms, with no changelog (3 of 20). Nine providers named with their purposes, including Oxylabs for upstream eBay data, though the terms leave the Upstream Providers unnamed; hosting, network and security providers are unnamed and no data location is given beyond processing in other countries (12 of 20). 10+20+3+12 = 45.

Scrapfly 85

scrapfly.io/status answers with Statuspage's status JSON, which names its page as scrapfly.statuspage.io. That page has 25 components and incident history back to 2022, read through its history feed on 1 November. The 1 October check read only the overall state and found no history (20, was 10). The newest incident is a Scrapium rendering fault on 21 May 2026, so nothing is posted in the 90 days from 3 August (30, was 5). Concurrency per plan is published (5 on Discovery to 100 on Enterprise) and each project has a configurable per-minute throttle (15). The error catalogue marks every code retryable or not and has three ERR::THROTTLE codes, but we found no Retry-After header or backoff guidance on the errors or throttling pages (10 of 15). The terms disclaim uptime and no uptime SLA is published, and the pricing page's SLA mentions cover support response on Enterprise (0). The Scrape API is GA. Vault and alerting are beta, outside the main surface (10). 20+30+15+10+0+10 = 85.

SoldFetch 55

Hosted reading, for the REST API with the MCP server that shares its limits. SoldFetch's own status page at https://soldfetch.com/status lists ebay.com, ebay.co.uk and ebay.de as components, checked every five minutes, all operational on 3 November 2026, but keeps no incident log or uptime history, so half credit (10 of 20). No readable incident history, so the floor (5). Limits are published with numbers, 10 data requests a minute and 1 concurrent on Basic and 60 a minute and 5 concurrent on paid plans, per workspace across keys and interfaces, with a separate 60 a minute for usage and history (15). 429 is documented for workspace rate, concurrency and quota limits, 503 upstream_rate_limited carries a Retry-After header in seconds and the error schema an optional retryAfter, the docs ask for bounded backoff with jitter and name what not to retry, and REST data calls take an Idempotency-Key with a free replay for 24 hours and 409 on changed inputs; job submissions have no key, but the docs say to check existing jobs before resubmitting and allow one active job per workspace (15). No SLA on self-service plans; terms 11.2 keep uptime commitments to a signed enterprise order form (0). No beta or preview label on the API or the MCP server; three of the eight recognised eBay sites are enabled 'at launch' (10). 10+5+15+15+0+10 = 55.

Scrapfly 95

A Swagger reference per the 30 September check, and the MCP server exposes it as a web_scraping_openapi_specification resource. Every MCP tool has JSON Schema inputs generated from typed Go structs (25). llms.txt and Markdown twins such as pricing.md per the 30 September check. robots.txt still disallows /docs/llms.txt and the .md twins for crawlers it doesn't name, so they weren't re-read on 1 November (10). Descriptions say when to use a tool and when to switch, for example web_get_page falls back to web_scrape for tuning and to cloud_browser_open for interaction. A few are long and steer the model's next step (17 of 20). Typed inputs with enums, for example the vault service discriminator, and required fields (13 of 15). Error catalogue of 100+ ERR:: codes, each with HTTP status, retryable and billed flags and its own doc link (15). Dated release notes, newest 26 October 2026 (15). 25+10+17+13+15+15 = 95.

SoldFetch 68

API reading, with the MCP server described. An OpenAPI 3.1 file is published at https://soldfetch.com/api/v1/openapi.json, under a path robots.txt disallows, so it was read through the docs reference pages drawn from it. Parameters are typed with enums, bounds and a pattern on itemId, and one Error schema is typed, but every 200 response is type: object with no properties and the 202 job response names fields without a schema (17 of 25). llms.txt on the site and the docs, llms-full.txt, and Markdown twins of the docs pages (10). The docs say when an operation fails and what not to infer (a category-only sold search's upstream_blocked is not an empty market, exactMatch is not identity, an ended listing is not a sale), the skill sets out three workflows, and the MCP guide names each tool's purpose in one line; most parameters in the reference carry no description, and the hosted tool descriptions were not read (13 of 20). ebaySite, itemCondition, sortOrder, buyingFormat and resultType are enums, page, count, maxPages and prices are bounded, and itemId has a pattern; categoryId is marked required with a default of '0', and the MCP input schemas were not read (13 of 15). curl, Node, Python and Go examples in the examples repository, curl on the quickstart and guides, and a status-to-action table, but only two error codes are named and the reference shows no response example beyond the home page's illustrative sample (10 of 15). Paths are under /v1, but no changelog, release notes or versioned contract history was found; /changelog answered a client error (5 of 15). 17+10+13+13+10+5 = 68.

Scrapfly 75

OAuth 2 on the hosted MCP with dashboard revocation, open to all plans. API keys are per project, live or test, and since 15 April 2026 can be restricted to products (30). The canonical API form puts the key in the key query parameter and the MCP also accepts ?key=, so less 10 (20 of 30). Product-restricted keys, confirm=true on every mutating vault and alert tool, info_api_key off in server-key mode, and the self-hosted HTTP server binds loopback by default. Since v1.4.0 Cloud Browser sessions are scoped to the API key that opened them (15 of 20). The source gates mutating vault tools behind a preview step because prompt injection can reach them and redacts keys from CDP URLs. We found no user-facing guidance on untrusted page content (8 of 15). Monitoring shows every call as a log with its error, credit cost line by line and Unblocker state, with replay, per the 24 October release notes, as well as per-domain metrics and alerting. The 1 October check couldn't confirm per-request logs (15, was 10). security.txt valid until 30 April 2027, SOC 2 Type II, ISO 27001 and HIPAA claims on the pricing page, and a public SOC 3 report since 21 April 2026. No bug bounty found (17 of 20). 20+15+8+15+17 = 75.

SoldFetch 62

Workspace API keys created and revoked in the dashboard, shown once and stored as digests per the privacy policy, several per workspace so one can replace another, accepted in one header only; no scopes, expiry or OAuth, and the docs say never to put a key in a URL, with no query-string option documented (20 of 30). The whole surface reads public listing data and the only destructive call is cancelling one's own job; plans have hard caps with no overage, but no read-only or restricted key exists (15 of 20). Every response carries third-party listing text. The AI agents guide, the MCP README, SECURITY.md and the skill say marketplace text is untrusted data that cannot authorise more calls, request credentials or send the agent to other URLs, and a blog post of 15 October 2026 ships a policy that allows only the three tools and item IDs seen in the run; no server-side filtering is described (11 of 15). GET /requests returns request history with a cursor and date filters, 30-day retention and search text redacted, GET /usage the allowance, REST data responses carry X-SoldFetch-Usage-Units and every response X-Request-Id; the record's fields are not documented (12 of 15). No security.txt (client error), bug bounty, SOC 2 or ISO 27001; the repositories' SECURITY.md files give a reporting route to contact@soldfetch.com (4 of 20). 20+15+11+12+4 = 62.

Scrapfly 80

The open-source server registers 62 tools by default in v1.4.0 (5 web scraping, 2 account, 9 Cloud Browser sessions, 17 page interaction, 2 WebMCP, 15 credential vault, 12 alerts), all at once, and the docs list a smaller core. There's a code path to mount interaction tools per session, but registration is always-on for clients that don't refetch. On the API side, format=markdown and the extraction API keep responses small, and since v1.4.0 the scrape tools report api_cost and cost_details (10 of 25). Output format, extraction templates, crawler limits and 100-URL batches (15 of 20). Error codes an agent can branch on, with retryable and billed flags (20). Tools carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and mutating vault and alert tools need confirm=true after a preview (20). web_get_page works with a URL alone, and official SDKs exist for Python, TypeScript, Go and Rust (15). 10+15+20+20+15 = 80.

SoldFetch 75

API reading. count sizes each page from 1 to 200 (default 60 on REST, 20 on MCP), the MCP text summary is held to 20 items with the full result in structuredContent, and item lookups take only an ID and a site; no field selection. On the MCP reading three tools would score 25 (20 of 25). Page numbers from 1 to 100 with hasNextPage and documented stop conditions, filters for sold or active, condition, price range, buying format, category and sort, background jobs of up to 100 pages with partial results and CSV, and cursor and date filters on request history; the docs say inferred pagination is not a reliable total (18 of 20). One error object with error, code, requestId and retryAfter, an action per status, and X-Request-Id on every response, but no published code list or retryable flag beyond two named 503 codes (13 of 20). Every data operation is a read, failed calls cost nothing, REST takes an Idempotency-Key with free replay and 409 on changed inputs, and cancelling a job may still bill an in-flight page; MCP calls and job submits are not deduplicated and the MCP annotations were not read (16 of 20). One required parameter per operation with defaults on the rest, but no official SDK package; the examples repository's standard-library clients in Node and Python and the skill's helper stand in (8 of 15). 20+18+13+16+8 = 75.