SoldFetch vs ZenRows

SoldFetch 49

Closed service. The latest dated changes are commits to all three public repositories and four blog posts on 27 October 2026, and the docs sitemap dates the authentication page 30 October 2026 (30). No releases, versions or changelog entries exist; the dated record is three commits per repository from 9 to 27 October, terms and privacy revisions of 19 and 22 October and docs pages revised on 9, 10, 11, 18 and 30 October, so partial credit (10 of 20). No public changelog; support is a contact form and contact@soldfetch.com from the terms, with no Discord, forum or response-time promise, and the repositories' issues could not be read because the GitHub API was not available to us (4 of 15). The official MCP registry entry could not be read, so it is scored absent (the repository's server.json names io.github.ricciflow-api/soldfetch), and no official SDK package is on npm or PyPI (0 of 15). Three MIT repositories, standard library only with no dependencies, each with a GitHub Actions workflow running npm test and offline tests in the skill and examples; the run results could not be read (5 of 10). 30+10+4+0+5 = 49.

ZenRows 90

MCP v2.18.0 on 2026-10-30 (30). Seven MCP minor releases from 18 to 30 October alone (v2.12.0 to v2.18.0), and dated changelog entries on 2, 5 and 9 October (20). We couldn't read GitHub issues. PRs are merged within days and the dated changelog on zenrows.com runs to 9 October (15 of 25). In the official MCP registry as io.github.ZenRows/zenrows-mcp, with 2.18.0 published on 30 October and marked latest (15). CI runs typecheck, lint and tests on a Node matrix, and a check that server.json matches the package version (10).

SoldFetch 40

No x402, MPP or L402 on the pricing page, terms, llms.txt or docs, and no third-party machine payment route was found; the RapidAPI alias does not take RapidAPI authentication (0). Per-unit pricing is public without a login, 1 unit per successful search page or item lookup, $9 for 2,000, $29 for 10,000 and $79 for 50,000 a month, with what is and isn't charged stated (20). Basic gives 100 units once and the terms say no payment method is required (20). A person signs in through the browser and creates a key in the dashboard; no keyless API route or programmatic key creation, and the anonymous playground is a web page for people (0). 0+20+20+0 = 40.

ZenRows 80

x402 and MPP through an agent storefront at agents.zenrows.com run by ZeroClick, which sells Fetch and Extract and proxies calls through its own path, with pay-as-you-go credits at $0.50 per 1,000 (10,000 minimum) per the pricing docs. Nothing on api.zenrows.com itself (20 of 40). Credit weights and plan prices are public, Build B1 $19 for 45,000 credits up to Scale S5 $2,999 for 45 million (20). 5,000 free credits a month, no card (20). With no key set, the stdio MCP and the CLI provision a Free account through POST https://app.zenrows.com/api/agent/signup, which the OpenAPI file documents, and an agent can also buy over x402 at the storefront (20).

SoldFetch 41

Closed hosted service. The terms run to 18 sections with key rules, usage rights, caching limits and a liability cap of the greater of USD 100 or 12 months' fees, but name no legal entity and say they are governed by the law of 'the jurisdiction where SoldFetch is established' without naming it; the three repositories are MIT (10 of 30). The privacy policy (updated 22 October 2026) gives request-log retention of 7, 30 or 90 days by plan, about an hour for exports, digests for keys and cookie durations, and the docs give cache periods and 24 hours for job results; the pricing page's 30-day request logs on every plan disagrees with the policy's plan-based periods, backups have no period and no DPA was found (20 of 30). No deprecation policy or dated notices; terms 11.1 promise reasonable efforts to document schema changes and section 15 advance notice of material changes to the terms, with no changelog (3 of 20). Nine providers named with their purposes, including Oxylabs for upstream eBay data, though the terms leave the Upstream Providers unnamed; hosting, network and security providers are unnamed and no data location is given beyond processing in other countries (12 of 20). 10+20+3+12 = 45.

ZenRows 79

Closed service, with ZENROWS, S.L. named in full (Getxo, Spain, tax ID B10660298). The MCP is MIT (15 of 30). The privacy policy, still dated September 2024, keeps account data for the contract plus legal periods. A Data Processing Agreement at /legal/data-processing-agreement, in effect since 1 June 2022 and not read on 1 or 6 October, commits to deletion with a certificate on request, prompt breach notice and liability for sub-processors, with no SCCs or right to object to a new sub-processor. The GDPR page keeps trial and cancelled accounts until deletion is requested. Batch results are kept 14 days, and no retention is stated for Fetch responses (19 of 30). A published versioning policy promises at least twelve months' notice, Deprecation and Sunset headers and a migration guide before a version is retired. The 2026 renames carried no dated notices (15 of 20). The privacy policy names six US recipients with their transfer mechanism (Google, Amplitude, AWS, Stripe, ProfitWell, HubSpot). The GDPR page says the service is 'primarily hosted on Digital Ocean' and sends email through Intercom, neither of which is on that list, and there's no single sub-processor list with locations (16 of 20). 15+19+15+16 = 65.

SoldFetch 55

Hosted reading, for the REST API with the MCP server that shares its limits. SoldFetch's own status page at https://soldfetch.com/status lists ebay.com, ebay.co.uk and ebay.de as components, checked every five minutes, all operational on 3 November 2026, but keeps no incident log or uptime history, so half credit (10 of 20). No readable incident history, so the floor (5). Limits are published with numbers, 10 data requests a minute and 1 concurrent on Basic and 60 a minute and 5 concurrent on paid plans, per workspace across keys and interfaces, with a separate 60 a minute for usage and history (15). 429 is documented for workspace rate, concurrency and quota limits, 503 upstream_rate_limited carries a Retry-After header in seconds and the error schema an optional retryAfter, the docs ask for bounded backoff with jitter and name what not to retry, and REST data calls take an Idempotency-Key with a free replay for 24 hours and 409 on changed inputs; job submissions have no key, but the docs say to check existing jobs before resubmitting and allow one active job per workspace (15). No SLA on self-service plans; terms 11.2 keep uptime commitments to a signed enterprise order form (0). No beta or preview label on the API or the MCP server; three of the eight recognised eBay sites are enabled 'at launch' (10). 10+5+15+15+0+10 = 55.

ZenRows 87

Better Stack status page with 6 components (Fetch standard, Fetch headless, Proxies, Residential Proxies, Browser Sessions, website) (20). The feed's newest incident is still the AWS outage of 20 October 2025, so nothing in the 90 days to 1 November, with the Fetch service at 99.998 per cent and the website at 100 on 1 November (30). Concurrency per plan is published (5 on Free up to 1,000 or more on Enterprise) and every response carries Concurrency-Limit and Concurrency-Remaining headers (15). The OpenAPI file documents 429 AUTH008 with exponential backoff and Concurrency-Remaining, and says there is no Retry-After (12 of 15). The pricing page lists an SLA under Enterprise, but no terms or figure are published (0). Fetch is generally available. Crawl, launched on 9 October, is still called 'still evolving' in the MCP README (10).

SoldFetch 68

API reading, with the MCP server described. An OpenAPI 3.1 file is published at https://soldfetch.com/api/v1/openapi.json, under a path robots.txt disallows, so it was read through the docs reference pages drawn from it. Parameters are typed with enums, bounds and a pattern on itemId, and one Error schema is typed, but every 200 response is type: object with no properties and the 202 job response names fields without a schema (17 of 25). llms.txt on the site and the docs, llms-full.txt, and Markdown twins of the docs pages (10). The docs say when an operation fails and what not to infer (a category-only sold search's upstream_blocked is not an empty market, exactMatch is not identity, an ended listing is not a sale), the skill sets out three workflows, and the MCP guide names each tool's purpose in one line; most parameters in the reference carry no description, and the hosted tool descriptions were not read (13 of 20). ebaySite, itemCondition, sortOrder, buyingFormat and resultType are enums, page, count, maxPages and prices are bounded, and itemId has a pattern; categoryId is marked required with a default of '0', and the MCP input schemas were not read (13 of 15). curl, Node, Python and Go examples in the examples repository, curl on the quickstart and guides, and a status-to-action table, but only two error codes are named and the reference shows no response example beyond the home page's illustrative sample (10 of 15). Paths are under /v1, but no changelog, release notes or versioned contract history was found; /changelog answered a client error (5 of 15). 17+10+13+13+10+5 = 68.

ZenRows 93

OpenAPI 3.1 at www.zenrows.com/openapi.json covers Fetch, Extract, Crawl (added after the 9 October launch), Batch, agent signup and HMAC key rotation, and the 63 MCP tools have typed zod inputs (25). llms.txt with 105 entries linking 240 docs pages on 1 November, each with a Markdown copy (10). The scrape tool says when to prefer extract, when to turn on js_render or premium_proxy, and gives three examples, and the crawl tools say when to wait, page or download. The browser tools are terser (18 of 20). Enums on mode and response_type, URL validation and required fields, but css_extractor is a JSON string and outputs a comma-separated string (12 of 15). Error catalogue of 35 codes such as AUTH004 and RESP002, plus a table of Batch and Extract codes, grouped by HTTP status with fixes, and every OpenAPI operation lists its error responses (15). The API is versioned in the path (v1, never retired), a dated changelog at www.zenrows.com/changelog runs to 9 October 2026, with nothing newer on 1 November, and the MCP has semver tags. The 2026 renames (Universal Scraper API to Fetch, Scraping Browser to Browser Sessions) aren't in it (13 of 15).

SoldFetch 62

Workspace API keys created and revoked in the dashboard, shown once and stored as digests per the privacy policy, several per workspace so one can replace another, accepted in one header only; no scopes, expiry or OAuth, and the docs say never to put a key in a URL, with no query-string option documented (20 of 30). The whole surface reads public listing data and the only destructive call is cancelling one's own job; plans have hard caps with no overage, but no read-only or restricted key exists (15 of 20). Every response carries third-party listing text. The AI agents guide, the MCP README, SECURITY.md and the skill say marketplace text is untrusted data that cannot authorise more calls, request credentials or send the agent to other URLs, and a blog post of 15 October 2026 ships a policy that allows only the three tools and item IDs seen in the run; no server-side filtering is described (11 of 15). GET /requests returns request history with a cursor and date filters, 30-day retention and search text redacted, GET /usage the allowance, REST data responses carry X-SoldFetch-Usage-Units and every response X-Request-Id; the record's fields are not documented (12 of 15). No security.txt (client error), bug bounty, SOC 2 or ISO 27001; the repositories' SECURITY.md files give a reporting route to contact@soldfetch.com (4 of 20). 20+15+11+12+4 = 62.

ZenRows 50

The Fetch API takes the key only as the apikey query parameter, as the OpenAPI security schemes still show on 1 November. Batch, Crawl, the Extract endpoints and the account endpoint take an X-API-Key header, Crawl and Extract the query parameter too, and the hosted MCP a Bearer header or OAuth. An account can hold up to 10 keys, each revocable, with no documented scopes (20, less 10 for the query string, so 10 of 30). Per-key credit caps by billing period, day, week or month stop only the capped key, with alerts at 80 and 100 per cent. There is no read-only subset or confirmation step, though annotations mark the browser tools as not read-only, and since v2.15.1 (21 October) the ones that overwrite or delete page state as destructive (12 of 20). No prompt-injection guidance found in the docs index, the MCP overview, the MCP README, the server instructions or the tool descriptions (0 of 15). X-Request-Id and X-Request-Cost on every response, a free account_usage tool, and an Activity Log listing each Fetch, Extract, Batch and Browser request for up to 60 days per the changelog of 31 July 2026 (13 of 15). security.txt on www.zenrows.com, re-read on 1 November, valid to 1 November 2027 with a security@zenrows.com contact and a linked information security policy. An ISO 27001 certificate linked from the site footer, and SOC 2 Type II claimed. No bug bounty found (15 of 20).