ScrapingAnt vs SoldFetch

ScrapingAnt 10

One account API key with no scopes, and we found no documented rotation or revocation (10). API Basics tells you to send x-api-key as a query parameter, a documented option, so less 10 (0 of 30). The header form works and the SDKs use it. No read-only mode, and /v2/general can send POST, PUT and DELETE to target sites with no confirmation step (5 of 20). No prompt-injection guidance found for the HTML, Markdown or text it returns (0 of 15). The Ant-credits-cost header and a subscription status endpoint show spend per call. No request log found (5 of 15). No security.txt, disclosure policy, bug bounty or certification found (0 of 20).

SoldFetch 62

Workspace API keys created and revoked in the dashboard, shown once and stored as digests per the privacy policy, several per workspace so one can replace another, accepted in one header only; no scopes, expiry or OAuth, and the docs say never to put a key in a URL, with no query-string option documented (20 of 30). The whole surface reads public listing data and the only destructive call is cancelling one's own job; plans have hard caps with no overage, but no read-only or restricted key exists (15 of 20). Every response carries third-party listing text. The AI agents guide, the MCP README, SECURITY.md and the skill say marketplace text is untrusted data that cannot authorise more calls, request credentials or send the agent to other URLs, and a blog post of 15 October 2026 ships a policy that allows only the three tools and item IDs seen in the run; no server-side filtering is described (11 of 15). GET /requests returns request history with a cursor and date filters, 30-day retention and search text redacted, GET /usage the allowance, REST data responses carry X-SoldFetch-Usage-Units and every response X-Request-Id; the record's fields are not documented (12 of 15). No security.txt (client error), bug bounty, SOC 2 or ISO 27001; the repositories' SECURITY.md files give a reporting route to contact@soldfetch.com (4 of 20). 20+15+11+12+4 = 62.

ScrapingAnt 5

No changelog or dated API change found, and the newest SDK release is Python 2.1.0 on 2024-07-16 (0). No releases in the last 90 days (0). No public changelog. Support by email (3 of 15). The JavaScript client was last released 2022-05-06, the MCP server isn't in the official registry, and the only registry entry is a third-party wrapper (0). The Python client has a code-check workflow, but neither SDK has moved in over two years (2 of 10).

SoldFetch 49

Closed service. The latest dated changes are commits to all three public repositories and four blog posts on 27 October 2026, and the docs sitemap dates the authentication page 30 October 2026 (30). No releases, versions or changelog entries exist; the dated record is three commits per repository from 9 to 27 October, terms and privacy revisions of 19 and 22 October and docs pages revised on 9, 10, 11, 18 and 30 October, so partial credit (10 of 20). No public changelog; support is a contact form and contact@soldfetch.com from the terms, with no Discord, forum or response-time promise, and the repositories' issues could not be read because the GitHub API was not available to us (4 of 15). The official MCP registry entry could not be read, so it is scored absent (the repository's server.json names io.github.ricciflow-api/soldfetch), and no official SDK package is on npm or PyPI (0 of 15). Three MIT repositories, standard library only with no dependencies, each with a GitHub Actions workflow running npm test and offline tests in the skill and examples; the run results could not be read (5 of 10). 30+10+4+0+5 = 49.

ScrapingAnt 30

No status page linked from the site or docs (0). No readable incident history (5). The free plan allows 1 concurrent request and paid plans have no concurrency cap, with timeout settable from 5 to 60 seconds. No per-minute limits published (8 of 15). The errors page documents 409 for the concurrency limit and 423 for anti-bot detection with advice to retry or change settings. No 429, Retry-After or backoff guidance (7 of 15). No SLA found (0). The API is generally available (10).

SoldFetch 55

Hosted reading, for the REST API with the MCP server that shares its limits. SoldFetch's own status page at https://soldfetch.com/status lists ebay.com, ebay.co.uk and ebay.de as components, checked every five minutes, all operational on 3 November 2026, but keeps no incident log or uptime history, so half credit (10 of 20). No readable incident history, so the floor (5). Limits are published with numbers, 10 data requests a minute and 1 concurrent on Basic and 60 a minute and 5 concurrent on paid plans, per workspace across keys and interfaces, with a separate 60 a minute for usage and history (15). 429 is documented for workspace rate, concurrency and quota limits, 503 upstream_rate_limited carries a Retry-After header in seconds and the error schema an optional retryAfter, the docs ask for bounded backoff with jitter and name what not to retry, and REST data calls take an Idempotency-Key with a free replay for 24 hours and 409 on changed inputs; job submissions have no key, but the docs say to check existing jobs before resubmitting and allow one active job per workspace (15). No SLA on self-service plans; terms 11.2 keep uptime commitments to a signed enterprise order form (0). No beta or preview label on the API or the MCP server; three of the eight recognised eBay sites are enabled 'at launch' (10). 10+5+15+15+0+10 = 55.

ScrapingAnt 43

No OpenAPI or Swagger spec found. The MCP docs give a typed parameter table for the 3 tools (8 of 25). docs.scrapingant.com/llms.txt returns 404 and no Markdown twins were found (0). MCP descriptions are one line each, such as Fetch a URL and return raw HTML content, with no when-to-use guidance (8 of 20). Few parameters, typed, with proxy_type as an enum of datacenter or residential (10 of 15). Request examples on every docs page and an errors page with 8 status codes and their meanings (12 of 15). Versioned paths (v1 and v2) and no changelog (5 of 15).

SoldFetch 68

API reading, with the MCP server described. An OpenAPI 3.1 file is published at https://soldfetch.com/api/v1/openapi.json, under a path robots.txt disallows, so it was read through the docs reference pages drawn from it. Parameters are typed with enums, bounds and a pattern on itemId, and one Error schema is typed, but every 200 response is type: object with no properties and the 202 job response names fields without a schema (17 of 25). llms.txt on the site and the docs, llms-full.txt, and Markdown twins of the docs pages (10). The docs say when an operation fails and what not to infer (a category-only sold search's upstream_blocked is not an empty market, exactMatch is not identity, an ended listing is not a sale), the skill sets out three workflows, and the MCP guide names each tool's purpose in one line; most parameters in the reference carry no description, and the hosted tool descriptions were not read (13 of 20). ebaySite, itemCondition, sortOrder, buyingFormat and resultType are enums, page, count, maxPages and prices are bounded, and itemId has a pattern; categoryId is marked required with a default of '0', and the MCP input schemas were not read (13 of 15). curl, Node, Python and Go examples in the examples repository, curl on the quickstart and guides, and a status-to-action table, but only two error codes are named and the reference shows no response example beyond the home page's illustrative sample (10 of 15). Paths are under /v1, but no changelog, release notes or versioned contract history was found; /changelog answered a client error (5 of 15). 17+10+13+13+10+5 = 68.

ScrapingAnt 56

Closed service with terms naming DATAANT SP. Z O.O., registered in Poland (KRS 0000848755). The SDKs are Apache 2.0 (15 of 30). The privacy policy, last updated 3 November 2020, gives 12-month retention after an account closes, names processors and mentions DPAs with clients. It predates the MCP server and AI extractor, and doesn't say whether scraped content is stored (18 of 30). No deprecation policy or dated notices found (0). Processors and locations named, Sendgrid in Ireland, Paddle in the UK, Google Analytics and Amazon hosting in the USA (15 of 20).

SoldFetch 41

Closed hosted service. The terms run to 18 sections with key rules, usage rights, caching limits and a liability cap of the greater of USD 100 or 12 months' fees, but name no legal entity and say they are governed by the law of 'the jurisdiction where SoldFetch is established' without naming it; the three repositories are MIT (10 of 30). The privacy policy (updated 22 October 2026) gives request-log retention of 7, 30 or 90 days by plan, about an hour for exports, digests for keys and cookie durations, and the docs give cache periods and 24 hours for job results; the pricing page's 30-day request logs on every plan disagrees with the policy's plan-based periods, backups have no period and no DPA was found (20 of 30). No deprecation policy or dated notices; terms 11.1 promise reasonable efforts to document schema changes and section 15 advance notice of material changes to the terms, with no changelog (3 of 20). Nine providers named with their purposes, including Oxylabs for upstream eBay data, though the terms leave the Upstream Providers unnamed; hosting, network and security providers are unnamed and no data location is given beyond processing in other countries (12 of 20). 10+20+3+12 = 45.

ScrapingAnt 66

3 compact MCP tools (25). Markdown and text endpoints, AI extraction, wait-for-selector and a JSON extended response, but no output-size limit on the MCP tools (12 of 20). 8 documented status codes, and 422 returns a detail field (14 of 20). Requests are reads of third-party pages and failures aren't billed, but there are no tool annotations or retry guidance beyond 423 (5 of 20). Only url is required, though browser defaults to true at 10 credits. Python and JavaScript clients exist but are stale (10 of 15).

SoldFetch 75

API reading. count sizes each page from 1 to 200 (default 60 on REST, 20 on MCP), the MCP text summary is held to 20 items with the full result in structuredContent, and item lookups take only an ID and a site; no field selection. On the MCP reading three tools would score 25 (20 of 25). Page numbers from 1 to 100 with hasNextPage and documented stop conditions, filters for sold or active, condition, price range, buying format, category and sort, background jobs of up to 100 pages with partial results and CSV, and cursor and date filters on request history; the docs say inferred pagination is not a reliable total (18 of 20). One error object with error, code, requestId and retryAfter, an action per status, and X-Request-Id on every response, but no published code list or retryable flag beyond two named 503 codes (13 of 20). Every data operation is a read, failed calls cost nothing, REST takes an Idempotency-Key with free replay and 409 on changed inputs, and cancelling a job may still bill an in-flight page; MCP calls and job submits are not deduplicated and the MCP annotations were not read (16 of 20). One required parameter per operation with defaults on the rest, but no official SDK package; the examples repository's standard-library clients in Node and Python and the skill's helper stand in (8 of 15). 20+18+13+16+8 = 75.