SE Ranking API + MCP vs SpyFu API

SE Ranking API + MCP 72

Closed service with API Terms of Service dated 3 March 2026 that cover commercial use, credits and credentials. Sections 1.3 and 2.6 say credentials are specific to each API and section 1.15 ties the Project API to Business or Enterprise plans, while the docs say one key works everywhere on every plan. The skills and OpenAPI repositories are MIT (14 of 30). The privacy statement of 25 June 2026 gives retention periods by purpose and says personal data isn't used to train general AI models. Retention of API logs is left to that statement, no DPA is on the legal page, and the API terms link a privacy URL that differs from the live one (19). Section 13 of the API terms promises up to 30 days' notice of breaking changes where practicable and reserves removal of deprecated functionality at any time (9). A processors page of 25 June 2026 names each processor with purpose and country, Hetzner in Germany and Amazon Web Services in Luxembourg for hosting, and promises two weeks' notice of new ones (17). Total 59.

SpyFu API 38

Closed service under terms naming SpyFu, Inc., updated 25 February 2019, under Arizona law (15 of 30). The privacy policy carries no date, retention periods, controller or named processors, and says data is moved to the United States (5 of 30). No deprecation policy or notices found (0 of 20). No subprocessors named; data location is the United States (3 of 20). 15+5+0+3 = 23.

SE Ranking API + MCP 44

An OpenAPI 3.0.0 file for the Data API (86 operations) sits in the vendor's GitHub organisation, but none of the docs pages read on 4 November 2026 links it; they link a Postman collection that opens in Postman. A contract no read page links scores 0 (as synthflow). seranking.com/llms.txt and /api/llms.txt returned 404 on 8 October and no Markdown twins were found (0). Each endpoint page states its purpose, cost and every parameter, and the pricing FAQ says when to use the Data API and when the Project API (14). Parameter tables give type, required status, default and ranges, and filters are bracketed query parameters (11). Every endpoint has a curl request and a JSON response sample and each API has an error table, though the tables disagree on some codes (11). Paths are versioned under /v1, and the What's New page lists API releases by year without dates in its HTML. The 8 October points for dated MCP versions came from the MCP registry's JSON API, which this run doesn't use, so the line keeps its earlier partial (8). 0 + 0 + 14 + 11 + 11 + 8 = 44.

SpyFu API 75

Every reference page embeds an OpenAPI 3.1 definition with security schemes and responses, but no single downloadable file is linked (20 of 25). llms.txt and a Markdown twin of every page (10). Descriptions say what each endpoint returns and how it differs from its neighbours ('unlike term-based endpoints...') (17 of 20). Typed parameters with descriptions, examples and required flags (12 of 15). 200, 400, 401 and 500 in the definitions and a 429 example, little on error bodies (11 of 15). v2 in every path, but no changelog (/changelog answered 404) (5 of 15). 20+10+17+12+11+5 = 75.

SE Ranking API + MCP 21

API keys are created and named in the API dashboard, several to an account, and the MCP server signs in by OAuth 2.1 with dynamic client registration. Keys have no scopes, and the terms mention rotation only where available (22). The key is also accepted as an apikey query parameter on every API, and the OpenAPI file documents only that method (minus 10, leaving 12). The MCP docs say restricted or read-only keys aren't available yet and that a key has the same access as the account. No approval step was found for Project API deletes (3). Responses carry third-party anchor text, page titles and AI answers, and no prompt-injection guidance was found (0). The API dashboard shows credit usage and the terms say SE Ranking keeps API logs. No per-call log for the customer is documented (4). No security page, SOC 2 or ISO 27001 statement or bug bounty was found, and /.well-known/security.txt answered 403. The privacy statement says security measures are in place without naming them (2). Total 21.

SpyFu API 52

An API ID and secret key, sent by Basic auth or by a timestamped HMAC signature, with no scopes found (22), less 10 for the documented api_key query parameter (12 of 30). The API only reads (15 of 20). Ad copy, page titles and SERP data are third-party text, with no prompt-injection guidance (5 of 15). The Account API reports usage by month, day and method (12 of 15). A vulnerability disclosure policy with safe harbour and response targets; security.txt returns 404 and no certification or bug bounty was found (8 of 20). 12+15+5+12+8 = 52.

SE Ranking API + MCP 44

The newest dated change is the removal of three AI search prompt filters on 14 October 2026, recorded with that date in the vendor's OpenAPI file, 21 days before this check (30). The 8 October recency and release count came from the MCP registry's JSON API, which this run doesn't use. Since 6 August the readable dated source is one merge to the OpenAPI repository's main branch on 14 October (commits dated 8 and 14 October), with no version or tag, and no What's New date is readable, so fewer than three releases (0). A What's New page, an API support address, a demo form and public GitHub repositories with issues open to all; no developer forum found (9). No readable registry page for com.seranking/mcp, so the registry line is 0. The OpenAPI repository runs a lint workflow (updated 14 October) and the skills repository has CI and signed releases to 2.10.4 of 17 June 2026 (5). 30 + 0 + 9 + 0 + 5 = 44.

SpyFu API 16

Closed service. No changelog. The newest dated docs change found is 13 July 2026 (the rate-limits and pricing pages' updatedAt), 116 days before this check (10). Reference pages are dated between August 2025 and 9 July 2026, so fewer than three dated changes in 90 days (0). A help centre and support email, with no public changelog or tracker (6 of 15). No official SDK (0). No package to judge (0). 10+0+6+0+0 = 16.

SE Ranking API + MCP 40

No x402, MPP or L402 (0). The docs publish a credit cost for every Data API endpoint and dollar prices for credits, from $50 for 250,000 pay-as-you-go credits to $179 per million on the smallest annual plan (20). The pricing page states a 14-day trial with 100,000 credits, API and MCP access and no card (20). A person signs up in a browser and confirms an email address before a key is issued (0). Total 40.

SpyFu API 20

No x402, MPP or L402 (0). Per-row prices for every endpoint are public on the developer site (20). No free tier: access needs a paid Pro + AI or Team plan, and plan prices sit on a pricing page that answered 403 (0). A person signs up and pays in a browser (0). 0+20+0+0 = 20.

SE Ranking API + MCP 58

The MCP page says the server has 180+ tools, and no toolset, read-only subset or tool filter is documented, which is 5 on the MCP line. Data API calls take cols and limit to size a response, so we scored between the two (10). limit on 24 operations and offset on 13 in the spec, with order_field and range filters on keyword and domain reports. limit above 1,000 is capped without an error (17). Errors are JSON with a code, message and description, and the tables list the common causes. Status codes for the same error differ between pages (14). Data API reads are safe to repeat and 4xx and 5xx responses cost no credits. No idempotency key was found for Project API writes and MCP annotations weren't read (10). Few required parameters and stated defaults. The vendor's API page says there are no first-party SDKs (7). Total 58.

SpyFu API 65

Rows are billed, so page size controls cost; single or multiple rows per request by endpoint, and searchType selects analyses on one endpoint (18 of 25). Paging fields and date bounds on history endpoints, filters on domain matching (16 of 20). 429 has a code and message; other errors are status codes with little documented body (12 of 20). All GET reads, safe to retry (14 of 20). No official SDK found (5 of 15). 18+16+12+14+5 = 65.