Serper vs SpecStream

Serper 3

No changelog, release notes, SDK or package found, so no dated release or API change to count (0, 0). No public changelog. Support is by email per the privacy policy (3). No official SDKs (0). No packages or CI to assess (0).

SpecStream 81

specstream-mcp-stdio 1.2.3 on PyPI on 3 November 2026, the Python SDK 1.2.0 committed the same day and @specstream/sdk 1.2.0 on npm on 31 October (30). Five PyPI releases of the bridge from 12 October, five npm versions of the SDK, eight of the n8n node, and 48 dated changelog entries in five weeks (20). A closed service with a dated changelog, support@specstream.ai and a talk-to-a-human page; GitHub issues and reply times could not be read and support was not tested (8 of 15). server.json under the reverse-DNS namespace ai.specstream/specstream 1.3.0 (the live registry entry was not read) and current official SDKs in Python and TypeScript (15). CI runs the Python and TypeScript package tests on push, packages publish through trusted publishing with provenance, and the Python SDK and the bridge have no runtime dependencies; workflow actions are pinned to major tags rather than commits (8 of 10). 30+20+8+15+8 = 81.

Serper 6

No OpenAPI or other spec (0). serper.dev/llms.txt returns 404 and there are no Markdown docs (0). The documentation is the playground, a JavaScript page that showed us no text. Per the 30 September check it lists the verticals and parameters such as gl and hl, so a few points for descriptions (3) and typed inputs (3). No examples or error responses we could read (0). No changelog or API versioning (0).

SpecStream 80

MCP reading, with the REST API described. The tool list shipped in specstream-mcp-stdio 1.2.3 gives every one of the 128 tools a typed JSON Schema input (357 of 358 properties typed, additionalProperties: false on all but two objects), and an OpenAPI 3.1 file at https://specstream.ai/openapi.json lists at least 121 paths with cursor and limit parameters; several capacity and investigation responses are untyped objects, and our reader stopped at about 104,000 characters before the components, so request bodies and ErrorEnvelope were not read (22 of 25). llms.txt, llms-full.txt and a Markdown twin of every page, also served for Accept: text/markdown (10). Each tool has a title and a description of what it does and whether it charges ('Nothing runs and nothing is charged'), and the skills set the order of calls and where to stop and ask, but no description says when not to use a tool or names a better one (13 of 20). 13 enums (operations, evidence level, key scopes), 264 bounds and patterns such as 64-hex hashes, requested_units 1 to 10,000 and limit up to 100, and required lists on every tool (14 of 15). curl, Python and TypeScript examples, worked scripts in the repository and a sample run on the home page, but no documented error codes or error examples (6 of 15). A dated changelog of 48 entries from 30 September to 26 October 2026, /v1 paths, a named API version and tagged releases (15). 22+10+13+14+6+15 = 80.

Serper 20

API key in the X-API-KEY header, never in the URL. No scopes, multiple keys or rotation found (10). Read-only search with no write surface, but no MCP annotations or least-privilege mode (10). Returns third-party titles and snippets with no prompt-injection guidance (0). No per-call log or audit trail found outside the logged-in dashboard, which we couldn't see (0). serper.dev/.well-known/security.txt returns 404, and we found no disclosure policy, bug bounty or certification (0).

SpecStream 73

API keys ss_live_... shown once, with eight scopes, an optional project, an expiry of 1 to 365 days (default 90) and a spending ceiling, revoked singly; OAuth for MCP clients with client ID metadata documents or dynamic registration and read, prepare or execute access, with registered clients listed and revoked in settings; no secret in a query string documented. The authorisation server metadata on api.specstream.ai was not read and rotation is not described beyond expiry (28 of 30). Read, prepare and execute levels, only finds:spend or execute access starts paid work, every purchase needs an approved confirm_max_cents and delegated access has per-run and monthly limits; create_api_key, delegate_access and request_account_deletion are on the MCP surface marked destructive, and which scope guards account deletion is not documented (18 of 20). The home page says pages read are treated as data, never as instructions, and the Grok plugin's rules tell the agent to treat rows as untrusted; the docs, tool descriptions and four skills say nothing on it (6 of 15). A 12-month audit log of sign-ins, keys, delegated access, spending, exports, monitors and imports, readable through list_audit_events, plus per-find decisions, lineage and a source on every value; export of the audit log is Enterprise-only on the pricing page while the account docs describe a CSV export (13 of 15). security.txt is valid until October 2027 with support@specstream.ai, and SECURITY.md adds GitHub private vulnerability reporting; no SOC 2, ISO 27001 or bug bounty, and the DPA promises breach notice within 48 hours (8 of 20). 28+18+6+13+8 = 73.

Serper 40

No x402, MPP or L402. Card or PayPal only, per the 30 September check (0). Per-1,000 prices published without a login, from $1.00 on the $50 pack to $0.30 on the $3,750 pack (20). 2,500 free queries on sign-up with no card, confirmed on the home page (20). A person signs up in a browser (0).

SpecStream 85

x402 v2 (USDC on Base, Arbitrum or Polygon, Permit2 upto for the quoted maximum, settled for the results cost) and MPP by card on SpecStream's own POST /v1/agent/lists, the route for buying a list of 1 to 500 results without an account; enrichment of imported lists, refreshes, monitors and investigations need an account, and the route was read in the docs and not exercised because api.specstream.ai's robots.txt could not be read, so partial (25). Per-result prices published without a login, 5, 15 or 100 cents a result, 5 cents an email, 15 cents a phone, rechecks at half rate or 1 cent (20). $10 of work for 30 days with no card (20). An agent can buy a list over x402 or MPP with no account, and the A2A endpoint prices a request without a key (20). 25+20+20+20 = 85.

Serper 32

Closed service. The terms exist (last updated 29 May 2024, UK law) but name no legal entity, only 'Serper' (8). The privacy policy (5 November 2025) says the service 'should normally not lead to the processing of personal data' and keeps account data for the life of the account, but states no retention period for queries or results (10). No deprecation policy or dated notices (0). Subprocessors are described by category (payments, email, hosting) without names, with transfers outside the EEA under Standard Contractual Clauses (5).

SpecStream 66

Closed hosted service under terms of 3 November 2026 naming SpecStream SAS, French law and a liability cap of the greater of 12 months' fees or 100 euros; the client code is MIT (20 of 30). The privacy policy and DPA agree with each other and the about page on EU hosting, no training on customer requests, lists or results, and a retention table (server logs 30 days, backups 8 days, page copies 24 hours, run working copies 7 days, audit log 12 months, support 3 years, accounts until deleted, erased from backups within 8 days of deletion), with breach notice in 48 hours and audit rights; the pricing page and the account docs disagree on who can export the audit log (27 of 30). No API deprecation policy; the changelog dates a price cut of 26 October 2026 that kept approved quotes at their old prices, the terms promise notice of material changes and keep historical quotes on their terms, and the DPA gives 30 days' notice of a new subprocessor (8 of 20). Subprocessors are listed by category with locations and transfer safeguards, hosting on IBM Cloud in Madrid is named in the legal notice, and names are available only on request (12 of 20). 20+27+8+12 = 67.

Serper 35

Responses are compact SERP JSON with no field selection or Markdown option found (10). Country and language parameters per the 30 September check, and ten separate verticals. We couldn't confirm pagination or result-count parameters from the docs (8). No documented error responses (0). Searches are read-only and only successful queries use credits, per the 30 September check of the home page (10). One required field (q) and no official SDK (7).

SpecStream 65

MCP reading. 128 tools at about 143,700 characters of names, descriptions and schemas (more than 30, 5), with no server-side toolsets or dynamic loading; the framework packages for LangChain, LlamaIndex, CrewAI and the Vercel AI SDK and the Open WebUI tool expose two to four tools with the price cap held in code, and results default to short evidence (5 back, 10 of 25). Cursor and limit on rows, search, specs and revisits, evidence short or full, filters by area and by field on collections, and unconfirmed candidates kept in a separate list (18 of 20). An ErrorEnvelope on every operation and an SDK error class that exposes code and details, but no published code list, meanings or retry rules (6 of 20). Required idempotency keys on paid work, schedules and refund claims with a recovery route, expected_version on updates, stable event ids on webhook retries, and readOnlyHint on 72 tools and destructiveHint on 29, with no idempotentHint (18 of 20). compile needs only q, a quote needs only ast_hash with 25 results by default, and official SDKs in Python and TypeScript with a CLI, though one purchase takes three calls with a hash carried between them (13 of 15). 10+18+6+18+13 = 65.