SERPHouse vs TinyFish Search

SERPHouse 23

Read for a closed service, with its repositories read as code. No changelog or dated API change was found. The newest release is MCP server 1.1.0 on 6 July 2026, 123 days before 6 November, and the last commit in its repository was on 22 July (10). No release or dated change in the 90 days from 8 August; the about page's 2026 entry (Forums, Place Details and Scraper APIs) is undated (0). No changelog; support by email. Issues weren't read, since the GitHub API refused us for its rate limit (5 of 25). Not in the official MCP registry, though the repository's server.json names io.github.SERPHouse/serphouse-mcp. Node.js SDK last changed 24 June 2026, PHP SDK 10 May 2024, and no Python SDK repository was found under the SERPHouse organisation (5 of 15). The MCP repository has an npm publish workflow and no tests (3 of 10). 10 + 0 + 5 + 5 + 3 = 23.

TinyFish Search 80

The Python SDK tinyfish 0.11.0 was published on 24 October 2026 and 0.10.0 on 21 October, per the TinyFish platform listing's 1 November reading of PyPI's release feed; PyPI couldn't be read on 2 November (30). Eight Python SDK releases from 4 August (0.5.0) to 24 October, counted half as SDK tags, still more than three (20). A Discord server and a support address are listed, the public MCP proxy repository has commits to 31 October, and the Pulse changelog has no entry after the week of 22 June 2026. We could not read reply times (8 of 15, as the platform listing). Current official SDKs in two languages, and the MCP server is in the official registry as ai.tinyfish.agent/web-agent (15). The SDK packages name no source repository, so their CI is not visible. The MIT MCP proxy repository runs CI, Renovate and OSV and secrets scanners, cleared 11 OSV dependency findings on 6 October and publishes through npm trusted publishing (7, as the platform listing). 30 + 20 + 8 + 15 + 7 = 80.

SERPHouse 11

One key per account, one account per user, no scopes or rotation found (10). The REST API documents api_token in the query string and the hosted MCP server takes the key only in its URL path, less 10 (0 of 30). Searches only read, with no read-only or restricted key (8 of 20). Results are third-party snippets and AI Overview text, with no prompt-injection guidance (0). An account tool shows plan and credit usage; no per-call log was found (3 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). 0 + 8 + 0 + 3 + 0 = 11.

TinyFish Search 57

Revocable API keys shown once, with several keys allowed per account, sent in the X-API-Key header. No scopes were found, and one key covers every TinyFish API including the ones that spend wallet funds. The MCP server uses OAuth 2.1 (20). Search is read-only, but a key or MCP connection cannot be limited to Search (8). Search snippets are untrusted. TinyFish's Fireworks integration guide says search snippets "can contain prompt injection" and its sample system prompt says never to follow instructions found in them, but the Search reference and overview carry no such guidance. Guidance in one guide reads 6, as the TinyFish platform listing, openai-realtime and gusto read it (6). GET /usage lists each search with its status, and responses carry X-Request-ID. Audit logs are listed under Enterprise (10). Valid security.txt (expires 1 September 2027), a disclosure policy of 15 September 2026 with safe harbour and discretionary rewards (not a bounty), and ISO 27001 cited in the terms and on the pricing page. The trust centre could not be read. Read as the TinyFish platform listing reads the same programme (13). 20 + 8 + 6 + 10 + 13 = 57.

SERPHouse 40

Read with the hosted lines. No status page is linked from the site or docs, and status.serphouse.com did not answer on 6 November 2026 (0). No readable incident history (5). Rate limits published, 60 requests a minute and 60 concurrent on every self-serve plan (15). 429 is documented as 'slow down', and a 200 can carry "status": "error" with 'Please try again', with no Retry-After or backoff guidance. Failed requests aren't charged (5 of 15). The pricing page lists a 99.99% uptime SLA on Basic and Regular and the docs a 99.95% one, but no SLA terms or credits were found in the terms (5 of 10). Generally available (10). 0 + 5 + 15 + 5 + 5 + 10 = 40.

TinyFish Search 65

Graded as a hosted service, on the Search REST API. TinyFish's own status page at agent.tinyfish.ai/status has five components, Search among them, with 90 daily bars each and no incident write-ups (15 of 20), read as the TinyFish platform listing reads it; the 8 October check of this listing missed it. Since 1 November agent.tinyfish.ai answers robots.txt with a redirect to its sign-in page, which we treat as a blocked host, so the page wasn't re-read. Per the 8 October reading, the Search API showed 1,500 minutes of downtime across seven days from 11 July to 8 October, 420 of them on 7 August, Only 7 August is dated inside the 90 days from 4 August, the other six days aren't dated in that reading, and the weeks from 9 October are unread, so the record in the window can't be counted. 5 of 30, the value for a history that can't be read, as the platform listing holds it. Rate limits are published with numbers, 30 requests a minute per person or per organisation contract, 500 an hour and 12,000 a day (15). 429 responses carry Retry-After and X-RateLimit-* headers, the error reference gives backoff guidance, and Search is a read-only GET (15). The pricing page names a 99.99% uptime SLA for Enterprise, but no SLA document was found (5). Search has been generally available since the week of 8 June 2026 per the Pulse page (10). 15 + 5 + 15 + 15 + 5 + 10 = 65.

SERPHouse 66

No OpenAPI or similar contract for the REST API. The MCP server's tools carry typed Zod schemas, published in the source and a static server card (18 of 25). llms.txt at the site and the docs, and every docs page as Markdown (10). MCP tool descriptions say which tool to use for what, such as serphouse_google_web when device or num_result is needed, while the docs pages lead with marketing lines such as 'Unlock captivating Google video content' (12 of 20). Enums for device, SERP type, engine and video duration, defaults and 37 described parameters (11 of 15). A status code table and request examples per engine, with a generic error body (12 of 15). No changelog or API versioning; only the MCP server has tags (3 of 15). 18 + 10 + 12 + 11 + 12 + 3 = 66.

TinyFish Search 82

A public OpenAPI 3.0 document for Search at agent.tinyfish.ai/v1/openapi/search, with two operations, per the 8 October check, not re-read on 2 November because that host now redirects robots.txt to sign-in (25). llms.txt, llms-full.txt and a Markdown twin of each docs page (10). The docs say when to use Search and when to use Fetch, Agent or Browser, and the MCP search description says when to skip it. That description also tells the model to prefer it over native search tools (17). domain_type is an enum and integers have bounds, but dates, country and language are plain strings, domain lists are comma-separated strings and fetch is a JSON-encoded string (10). An examples page, and an error reference with a JSON body for each code (14). The OpenAPI document is version 1.0.0 and the Search host has no version in its path. The Pulse changelog's newest entry is the week of 22 June 2026 and docs.tinyfish.ai/changelog returns 404 (6). 25 + 10 + 17 + 10 + 14 + 6 = 82.

SERPHouse 64

23 MCP tools with no toolsets or filtering (15 of 25). num_result, max_pages, paging, device, location, language, date and video filters (16 of 20). Status codes are tabulated, but a 200 can also mean an error and the body carries only 'Please try again' (10 of 20). Searches only read and failed requests aren't charged, but the MCP tools carry no readOnlyHint or other annotations (10 of 20). serphouse_search needs only q and defaults to the US; most other tools need loc or loc_id. Official Node.js, PHP and Python SDKs are documented (13 of 15). 15 + 16 + 10 + 10 + 13 = 64.

TinyFish Search 78

Results are compact (position, site name, title, snippet, URL) and thumbnails are opt-in, but no parameter sets how many results come back. The hosted MCP server's docs page lists 35 tools on 2 November (the repository reference still lists 28), with no documented search-only subset (15). page from 0 to 10, domain include and exclude lists, date and recency windows, country, language and domain_type, with no result-count control (16). Stable error codes with messages, a details object on account rate limits and a request_id on every error (19). Search is a GET that is safe to repeat and the docs give retry guidance. No read-only annotations appear in the published MCP tool reference (13). Only query is required, and there are official Python and TypeScript SDKs (15). 15 + 16 + 19 + 13 + 15 = 78.

SERPHouse 50

Closed service under terms naming Patoliya Infotech LLP in India, and the MCP server is MIT (18 of 30). The terms give retention periods (JSON results up to 6 months, HTML up to 1 month, search history indefinitely) and say personal data sits on DigitalOcean in India, and they advise EEA users not to use the service. The privacy policy is generic and neither document carries a date (15 of 30). No deprecation policy, and the terms allow products to be discontinued without notice (0 of 20). DigitalOcean in India named for account data; no sub-processor list (6 of 20). 18 + 15 + 0 + 6 = 39.

TinyFish Search 60

The service is closed with published terms effective 17 August 2026. The MCP proxy is MIT and the SDK packages carry no licence metadata (15). The terms allow customer data to be used to train TinyFish's AI models. The privacy policy, effective 14 December 2025, gives no retention period and says data is kept as long as necessary. No DPA was found on the pages we read (10). No deprecation policy was found. The terms give 30 days' notice of changes to the terms and 14 days for rate increases, and the reference marks site: operators as deprecated with no date (5, as the TinyFish platform listing reads the same terms). No sub-processor list or hosting location was found on readable pages. The enterprise page says data residency is agreed in the contract, and the trust centre is drawn by script and was not read (3, as the platform listing). 15 + 10 + 5 + 3 = 33.