ScrapingBee vs SoldFetch

ScrapingBee 85

CLI v1.6.0 on 2026-09-11 (30). Python SDK v2.1.0, v2.1.1 and v2.2.0, Node SDK v2.0.0 and CLI v1.5.0, v1.5.1 and v1.6.0 between 8 July and 11 September (20). We couldn't read GitHub issues. Dated SDK changelogs and email support (10 of 25). Current official Python and Node SDKs and a CLI. The MCP isn't in the official registry (15). Test workflows run in CI on all three repos (10).

SoldFetch 49

Closed service. The latest dated changes are commits to all three public repositories and four blog posts on 27 October 2026, and the docs sitemap dates the authentication page 30 October 2026 (30). No releases, versions or changelog entries exist; the dated record is three commits per repository from 9 to 27 October, terms and privacy revisions of 19 and 22 October and docs pages revised on 9, 10, 11, 18 and 30 October, so partial credit (10 of 20). No public changelog; support is a contact form and contact@soldfetch.com from the terms, with no Discord, forum or response-time promise, and the repositories' issues could not be read because the GitHub API was not available to us (4 of 15). The official MCP registry entry could not be read, so it is scored absent (the repository's server.json names io.github.ricciflow-api/soldfetch), and no official SDK package is on npm or PyPI (0 of 15). Three MIT repositories, standard library only with no dependencies, each with a GitHub Actions workflow running npm test and offline tests in the skill and examples; the run results could not be read (5 of 10). 30+10+4+0+5 = 49.

ScrapingBee 37

One API key per account, which the MCP notes say can be revoked (401 on revoked keys). Team management exists. No scopes (20). The api_key query parameter is deprecated but still works, and remote-mcp.txt says the hosted MCP takes the key only as ?api_key= in its URL, so less 10 (10 of 30). No read-only or scoped key, and the HTML API can send POST requests to target sites. The CLI gates shell post-processing behind an explicit unsafe flag (8 of 20). The official CLI skills and AGENTS.md say scraped output is data, never instructions, and tell the agent to report instruction-like content as a possible prompt injection. The MCP docs say nothing (12 of 15). A Usage API and a local CLI audit log. No per-request log in the docs (7 of 15). No security.txt per the 30 September check, and no bug bounty, disclosure policy or certification found (0 of 20).

SoldFetch 62

Workspace API keys created and revoked in the dashboard, shown once and stored as digests per the privacy policy, several per workspace so one can replace another, accepted in one header only; no scopes, expiry or OAuth, and the docs say never to put a key in a URL, with no query-string option documented (20 of 30). The whole surface reads public listing data and the only destructive call is cancelling one's own job; plans have hard caps with no overage, but no read-only or restricted key exists (15 of 20). Every response carries third-party listing text. The AI agents guide, the MCP README, SECURITY.md and the skill say marketplace text is untrusted data that cannot authorise more calls, request credentials or send the agent to other URLs, and a blog post of 15 October 2026 ships a policy that allows only the three tools and item IDs seen in the run; no server-side filtering is described (11 of 15). GET /requests returns request history with a cursor and date filters, 30-day retention and search text redacted, GET /usage the allowance, REST data responses carry X-SoldFetch-Usage-Units and every response X-Request-Id; the record's fields are not documented (12 of 15). No security.txt (client error), bug bounty, SOC 2 or ISO 27001; the repositories' SECURITY.md files give a reporting route to contact@soldfetch.com (4 of 20). 20+15+11+12+4 = 62.

ScrapingBee 65

Closed service with terms naming VostokInc SAS, Paris, registration 843 352 683 (15 of 30). The privacy policy, effective 15 July 2024, keeps prospect and customer data up to 3 years and links a DPA. It doesn't mention the Oxylabs group or say whether scraped content is stored (18 of 30). The Node SDK changelog dates removals, for example youtubeTranscript() dropped in v2.0.0 on 2026-09-01, and the api_key query parameter is marked deprecated. No standing deprecation policy (10 of 20). Processors described by category, located in the US or EU. No named list (8 of 20).

SoldFetch 41

Closed hosted service. The terms run to 18 sections with key rules, usage rights, caching limits and a liability cap of the greater of USD 100 or 12 months' fees, but name no legal entity and say they are governed by the law of 'the jurisdiction where SoldFetch is established' without naming it; the three repositories are MIT (10 of 30). The privacy policy (updated 22 October 2026) gives request-log retention of 7, 30 or 90 days by plan, about an hour for exports, digests for keys and cookie durations, and the docs give cache periods and 24 hours for job results; the pricing page's 30-day request logs on every plan disagrees with the policy's plan-based periods, backups have no period and no DPA was found (20 of 30). No deprecation policy or dated notices; terms 11.1 promise reasonable efforts to document schema changes and section 15 advance notice of material changes to the terms, with no changelog (3 of 20). Nine providers named with their purposes, including Oxylabs for upstream eBay data, though the terms leave the Upstream Providers unnamed; hosting, network and security providers are unnamed and no data location is given beyond processing in other countries (12 of 20). 10+20+3+12 = 45.

ScrapingBee 70

Hyperping status page at status.scrapingbee.com with 6 components and history (20). In the last 90 days the dedicated APIs (Google, Amazon, Walmart) were down for about 40 minutes on 24 July, the HTML scraper ran degraded for about 24 hours from 28 July, and the Google API was degraded on 22 September. No full core outage of an hour, but the day-long degradation of the main API weighs more than a minor, so we scored between the bands (15 of 30). Concurrency per plan is published, 25 on Hobby to 400 on Business+ (15). 429 means the concurrency limit and isn't billed, failed target requests are retried server-side for up to 30 seconds, and the MCP notes advise exponential backoff. No Retry-After found (10 of 15). No SLA found (0). Generally available (10).

SoldFetch 55

Hosted reading, for the REST API with the MCP server that shares its limits. SoldFetch's own status page at https://soldfetch.com/status lists ebay.com, ebay.co.uk and ebay.de as components, checked every five minutes, all operational on 3 November 2026, but keeps no incident log or uptime history, so half credit (10 of 20). No readable incident history, so the floor (5). Limits are published with numbers, 10 data requests a minute and 1 concurrent on Basic and 60 a minute and 5 concurrent on paid plans, per workspace across keys and interfaces, with a separate 60 a minute for usage and history (15). 429 is documented for workspace rate, concurrency and quota limits, 503 upstream_rate_limited carries a Retry-After header in seconds and the error schema an optional retryAfter, the docs ask for bounded backoff with jitter and name what not to retry, and REST data calls take an Idempotency-Key with a free replay for 24 hours and 409 on changed inputs; job submissions have no key, but the docs say to check existing jobs before resubmitting and allow one active job per workspace (15). No SLA on self-service plans; terms 11.2 keep uptime commitments to a signed enterprise order form (0). No beta or preview label on the API or the MCP server; three of the eight recognised eBay sites are enabled 'at launch' (10). 10+5+15+15+0+10 = 55.

ScrapingBee 60

No OpenAPI spec found. Per-endpoint llms files list parameters with types and defaults, and the hosted MCP's schemas weren't visible to us (8 of 25). llms.txt indexes 26 per-endpoint text files written for models (10). The API files explain each parameter's purpose and cost, and a reference-notes file lists 9 known conflicts between its own pages. MCP tool descriptions aren't published (10 of 20). Parameters are typed with defaults, and mode, proxies and render_js are documented as enumerated options (10 of 15). Status code table with whether each code is billed, plus examples per endpoint (14 of 15). The SDKs and CLI keep dated CHANGELOGs. The API has no changelog (8 of 15).

SoldFetch 68

API reading, with the MCP server described. An OpenAPI 3.1 file is published at https://soldfetch.com/api/v1/openapi.json, under a path robots.txt disallows, so it was read through the docs reference pages drawn from it. Parameters are typed with enums, bounds and a pattern on itemId, and one Error schema is typed, but every 200 response is type: object with no properties and the 202 job response names fields without a schema (17 of 25). llms.txt on the site and the docs, llms-full.txt, and Markdown twins of the docs pages (10). The docs say when an operation fails and what not to infer (a category-only sold search's upstream_blocked is not an empty market, exactMatch is not identity, an ended listing is not a sale), the skill sets out three workflows, and the MCP guide names each tool's purpose in one line; most parameters in the reference carry no description, and the hosted tool descriptions were not read (13 of 20). ebaySite, itemCondition, sortOrder, buyingFormat and resultType are enums, page, count, maxPages and prices are bounded, and itemId has a pattern; categoryId is marked required with a default of '0', and the MCP input schemas were not read (13 of 15). curl, Node, Python and Go examples in the examples repository, curl on the quickstart and guides, and a status-to-action table, but only two error codes are named and the reference shows no response example beyond the home page's illustrative sample (10 of 15). Paths are under /v1, but no changelog, release notes or versioned contract history was found; /changelog answered a client error (5 of 15). 17+10+13+13+10+5 = 68.

ScrapingBee 68

18 MCP tools (15 of 25). json_response, extract_rules, ai_query, return_page_markdown and return_page_text, plus max_cost to cap escalation (18 of 20). HTTP status codes with meanings and billing, but no machine-readable error codes beyond the status (15 of 20). Failed and 429 requests aren't billed and mode=auto bills only the tier that works. No tool annotations found (8 of 20). Only url is required, but render_js defaults on at 5 credits. Official Python and Node SDKs plus a CLI (12 of 15).

SoldFetch 75

API reading. count sizes each page from 1 to 200 (default 60 on REST, 20 on MCP), the MCP text summary is held to 20 items with the full result in structuredContent, and item lookups take only an ID and a site; no field selection. On the MCP reading three tools would score 25 (20 of 25). Page numbers from 1 to 100 with hasNextPage and documented stop conditions, filters for sold or active, condition, price range, buying format, category and sort, background jobs of up to 100 pages with partial results and CSV, and cursor and date filters on request history; the docs say inferred pagination is not a reliable total (18 of 20). One error object with error, code, requestId and retryAfter, an action per status, and X-Request-Id on every response, but no published code list or retryable flag beyond two named 503 codes (13 of 20). Every data operation is a read, failed calls cost nothing, REST takes an Idempotency-Key with free replay and 409 on changed inputs, and cancelling a job may still bill an in-flight page; MCP calls and job submits are not deduplicated and the MCP annotations were not read (16 of 20). One required parameter per operation with defaults on the rest, but no official SDK package; the examples repository's standard-library clients in Node and Python and the skill's helper stand in (8 of 15). 20+18+13+16+8 = 75.