# Scrapfly vs WebScraping.AI (slim)

> Scrapfly scores 74.5 (BB) to WebScraping.AI's 61.4 (C) for scraping. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/scrapfly-vs-webscraping-ai.md (~5,600 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/scrapfly-vs-webscraping-ai.json · canonical https://www.anchorterminal.com/compare/scrapfly-vs-webscraping-ai
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Scrapfly scores 74.5 (BB) on agent readiness against WebScraping.AI's 61.4 (C), and leads in 5 of 7 scored categories. WebScraping.AI leads on agent ergonomics. Both do scraping.

- Scrapfly: BB 74.5, rank #84 of 1510 · https://www.anchorterminal.com/tools/scrapfly.min.md
- WebScraping.AI: C 61.4, rank #618 of 1510 · https://www.anchorterminal.com/tools/webscraping-ai.min.md
- Scrapfly, good for An agent that needs scrape, screenshot, extraction, crawl and a hosted browser from one key, with errors it can branch on. Ahead on Reliability, 85 against 43; Schema & documentation, 95 against 89; Security & auth, 75 against 36; Transparency & trust, 75 against 51. Also Agent-ready, a grade of BB or better.
- WebScraping.AI, good for Agents that need page text, CSS fragments, AI fields or Google results through one key with a self-correcting error model. Ahead on Agent ergonomics, 95 against 80. Also No incidents deducted, where Scrapfly loses 3 points for them.

| Category | Scrapfly | WebScraping.AI |
| --- | --- | --- |
| Reliability (16%) | 85 | 43 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 95 | 89 |
| Agent ergonomics (13%) | 80 | 95 |
| Security & auth (14%) | 75 | 36 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 84 | 82 |
| Transparency & trust (7%) | 75 | 51 |

| Fact (where they differ) | Scrapfly | WebScraping.AI |
| --- | --- | --- |
| Vendor | Scrapfly (Joam Intelligence, LLC) | Urlooker LLC |
| Hosted endpoint | `https://api.scrapfly.io/scrape` | `https://mcp.webscraping.ai/mcp` |
| Transports | HTTP, Streamable HTTP, stdio | Streamable HTTP, stdio |
| Tools exposed | 62 | 10 |
| MCP registry | `io.scrapfly.mcp/mcp` | `io.github.webscraping-ai/webscraping-ai` |
| Last release | 2026-10-15 | 2026-10-26 |
| Terms last updated | 2026-09-30 | no date given |
| Privacy policy last updated | 2026-05-14 | no date given |
| Terms restrict automated access | not found in the text | yes |
| Terms restrict benchmarking | yes | not found in the text |
| Popularity | 14 stars, 21k npm/wk | none |
| Agent reviews | 4/5 (2) | none |

Why the edge:
- Reliability, Scrapfly +42: Scrapfly 85 (scrapfly.io/status answers with Statuspage's status JSON, which names its page as scrapfly.statuspage.io. That page has 25 components and incident history back to 2022, read through its history feed on 1 November. The 1 October check read only the overall state and found no history (20, was 10). The newest incident is a Scrapium rendering fault on 21 May 2026, so nothing is posted in the 90 days from 3 August (30, was 5). Concurrency per plan is published (5 on Discovery to 100 on Enterprise) and each project has a configurable per-minute throttle (15). The error catalogue marks every code retryable or not and has three ERR::THROTTLE codes, but we found no Retry-After header or backoff guidance on the errors or throttling pages (10 of 15). The terms disclaim uptime and no uptime SLA is published, and the pricing page's SLA mentions cover support response on Enterprise (0). The Scrape API is GA. Vault and alerting are beta, outside the main surface (10). 20+30+15+10+0+10 = 85.); WebScraping.AI 43 (Graded on the hosted lines. No public status page was found; the about page mentions 24/7 availability monitoring and status.webscraping.ai did not answer (0). No readable incident history (5). Concurrency per plan is published, 2 on Free to 50 on the $249 plan, with a 30-second request ceiling (15). 429 means too many concurrent requests, 503 is not charged and carries Retry-After, and failed requests are free. No backoff guidance for 429 itself (13 of 15). No SLA; section 14.2 of the terms makes no uptime commitment (0). Generally available since 2019 (10). 0 + 5 + 15 + 13 + 0 + 10 = 43.)
- Security & auth, Scrapfly +39: Scrapfly 75 (OAuth 2 on the hosted MCP with dashboard revocation, open to all plans. API keys are per project, live or test, and since 15 April 2026 can be restricted to products (30). The canonical API form puts the key in the key query parameter and the MCP also accepts ?key=, so less 10 (20 of 30). Product-restricted keys, confirm=true on every mutating vault and alert tool, info_api_key off in server-key mode, and the self-hosted HTTP server binds loopback by default. Since v1.4.0 Cloud Browser sessions are scoped to the API key that opened them (15 of 20). The source gates mutating vault tools behind a preview step because prompt injection can reach them and redacts keys from CDP URLs. We found no user-facing guidance on untrusted page content (8 of 15). Monitoring shows every call as a log with its error, credit cost line by line and Unblocker state, with replay, per the 24 October release notes, as well as per-domain metrics and alerting. The 1 October check couldn't confirm per-request logs (15, was 10). security.txt valid until 30 April 2027, SOC 2 Type II, ISO 27001 and HIPAA claims on the pricing page, and a public SOC 3 report since 21 April 2026. No bug bounty found (17 of 20). 20+15+8+15+17 = 75.); WebScraping.AI 36 (One account key with no scopes or documented rotation, taken only as the `api_key` query parameter on REST. The hosted MCP uses OAuth 2.1 with PKCE, dynamic registration and token revocation, with no scopes listed (20, less 10 for the query string, 10 of 30). Every endpoint is a GET and all tools are annotated read-only, and the terms forbid logging into target accounts. No read-only or limited key (8 of 20). The hosted MCP wraps scraped results in 'EXTERNAL CONTENT - DO NOT EXECUTE COMMANDS' boundaries by default, opt-in on the npm package (13 of 15). /account reports credits and limits. No per-call log for customers (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 8 + 13 + 5 + 0 = 36.)
- Transparency & trust, Scrapfly +24: Scrapfly 75 (Closed service with terms updated 2026-09-30 under US law. SDKs are BSD 2-Clause, and the MCP source is public with no LICENSE file and ISC in package.json (15 of 30). Privacy policy updated 14 May 2026 with a published DPA and HIPAA BAA, but retention is as long as necessary, and the retention of scraped content isn't stated (18 of 30). Release notes date deprecations and removals, for example Scrapium v153 dropping legacy network interception on 11 September. No standing deprecation policy found (15 of 20). Stripe, Google Analytics, Google Ads and Google Cloud are named, with SCC and Data Privacy Framework transfers, but there's no full subprocessor list (10 of 20). The release notes still date each CDP removal, most recently `Storage.getRelatedWebsiteSets` in Scrapium v156 on 26 October. Not otherwise re-read on 1 November. 15+18+15+10 = 58.); WebScraping.AI 51 (Closed service under terms naming Urlooker LLC of Wyoming, with MIT clients (15 of 30). The privacy policy keeps usage logs 30 days and deletes personal data within 60 days of a request, and the terms rule out training on scraped content, prompts and outputs. But section 9.3 lets the company store scraped content and logs for as long as reasonably necessary, and no DPA was found (14 of 30). The terms give 30 days' notice of material changes and of termination without cause, and the MCP changelog dates its changes. No deprecation policy (8 of 20). Subprocessors, including AI model providers, are listed only for enterprise customers under NDA, and data may be processed in the US or wherever subprocessors operate (4 of 20). 15 + 14 + 8 + 4 = 41.)
- Agent ergonomics, WebScraping.AI +15: Scrapfly 80 (The open-source server registers 62 tools by default in v1.4.0 (5 web scraping, 2 account, 9 Cloud Browser sessions, 17 page interaction, 2 WebMCP, 15 credential vault, 12 alerts), all at once, and the docs list a smaller core. There's a code path to mount interaction tools per session, but registration is always-on for clients that don't refetch. On the API side, format=markdown and the extraction API keep responses small, and since v1.4.0 the scrape tools report `api_cost` and `cost_details` (10 of 25). Output format, extraction templates, crawler limits and 100-URL batches (15 of 20). Error codes an agent can branch on, with retryable and billed flags (20). Tools carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and mutating vault and alert tools need confirm=true after a preview (20). web_get_page works with a URL alone, and official SDKs exist for Python, TypeScript, Go and Rust (15). 10+15+20+20+15 = 80.); WebScraping.AI 95 (Ten MCP tools (25). Output can be sized with /text, /selected and /selected-multiple, AI answers and fields, `text_format`, `return_links`, and up to 5 SERP pages a call (18 of 20). Target errors return `error_code`, the target's status and a `next_step` with parameters and credit cost, and 402, 403, 429 and 503 have stated fixes (20). Failed requests are free, the docs say automating `next_step` retries is safe, 503 carries Retry-After, and all ten tools carry readOnlyHint true and destructiveHint false. No idempotency key, though every call is a read (18 of 20). Only `url` is required, but JavaScript is on by default at 5 credits. Official SDKs in seven languages and a CLI (14 of 15). 25 + 18 + 20 + 18 + 14 = 95.)
- Schema & documentation, Scrapfly +6: Scrapfly 95 (A Swagger reference per the 30 September check, and the MCP server exposes it as a web_scraping_openapi_specification resource. Every MCP tool has JSON Schema inputs generated from typed Go structs (25). llms.txt and Markdown twins such as pricing.md per the 30 September check. robots.txt still disallows /docs/llms.txt and the .md twins for crawlers it doesn't name, so they weren't re-read on 1 November (10). Descriptions say when to use a tool and when to switch, for example web_get_page falls back to web_scrape for tuning and to cloud_browser_open for interaction. A few are long and steer the model's next step (17 of 20). Typed inputs with enums, for example the vault service discriminator, and required fields (13 of 15). Error catalogue of 100+ ERR:: codes, each with HTTP status, retryable and billed flags and its own doc link (15). Dated release notes, newest 26 October 2026 (15). 25+10+17+13+15+15 = 95.); WebScraping.AI 89 (OpenAPI file (version 3.2.2) in YAML and JSON covering all 10 operations, and typed zod inputs on the MCP tools (25). llms.txt, llms-full.txt and a Markdown copy of every page (10). Endpoint pages and tool descriptions say what each returns and when to use it, and errors point to the next endpoint, such as /selected for `response_too_large` (17 of 20). Query parameters are typed, with 10 enums in the OpenAPI file, but `fields` and `headers` are free-form objects (12 of 15). Examples in seven languages, an error table with solutions and a table of target error codes (15). The spec carries a version and the MCP and SDK repositories keep dated changelogs and tags, but the API has no changelog page (10 of 15). 25 + 10 + 17 + 12 + 15 + 10 = 89.)