SoldFetch vs Zyte API

SoldFetch 55

Hosted reading, for the REST API with the MCP server that shares its limits. SoldFetch's own status page at https://soldfetch.com/status lists ebay.com, ebay.co.uk and ebay.de as components, checked every five minutes, all operational on 3 November 2026, but keeps no incident log or uptime history, so half credit (10 of 20). No readable incident history, so the floor (5). Limits are published with numbers, 10 data requests a minute and 1 concurrent on Basic and 60 a minute and 5 concurrent on paid plans, per workspace across keys and interfaces, with a separate 60 a minute for usage and history (15). 429 is documented for workspace rate, concurrency and quota limits, 503 upstream_rate_limited carries a Retry-After header in seconds and the error schema an optional retryAfter, the docs ask for bounded backoff with jitter and name what not to retry, and REST data calls take an Idempotency-Key with a free replay for 24 hours and 409 on changed inputs; job submissions have no key, but the docs say to check existing jobs before resubmitting and allow one active job per workspace (15). No SLA on self-service plans; terms 11.2 keep uptime commitments to a signed enterprise order form (0). No beta or preview label on the API or the MCP server; three of the eight recognised eBay sites are enabled 'at launch' (10). 10+5+15+15+0+10 = 55.

Zyte API 85

Graded as a hosted API. status.zyte.com runs on Atlassian Statuspage with ten components and incident history (20). In the 90 days to 1 November 2026 its history feed lists two Zyte API incidents, both degraded browser rendering with higher latency and 520 errors, on 10 to 11 September and 13 September, neither marked as an outage, and three incidents outside the API, Scrapy Cloud periodic jobs on 17 August and the web dashboard and Scrapy Cloud periodic jobs down from 28 to 30 October, which Zyte says affected no other product. All partial, so minor (20 of 30). Rate limits are published as 3,000 requests a minute per key on standard plans and a custom limit on Enterprise, though per-site limits aren't (15). 429, 503 and 520 carry Retry-After, and the docs give a backoff table and say which responses to retry, per the 9 October check (15). Enterprise plans list service level agreements for support response times. No uptime SLA is published (5 of 10). Zyte API is generally available, and Zyte MCP carries no beta label on 1 November (10).

SoldFetch 49

Closed service. The latest dated changes are commits to all three public repositories and four blog posts on 27 October 2026, and the docs sitemap dates the authentication page 30 October 2026 (30). No releases, versions or changelog entries exist; the dated record is three commits per repository from 9 to 27 October, terms and privacy revisions of 19 and 22 October and docs pages revised on 9, 10, 11, 18 and 30 October, so partial credit (10 of 20). No public changelog; support is a contact form and contact@soldfetch.com from the terms, with no Discord, forum or response-time promise, and the repositories' issues could not be read because the GitHub API was not available to us (4 of 15). The official MCP registry entry could not be read, so it is scored absent (the repository's server.json names io.github.ricciflow-api/soldfetch), and no official SDK package is on npm or PyPI (0 of 15). Three MIT repositories, standard library only with no dependencies, each with a GitHub Actions workflow running npm test and offline tests in the skill and examples; the run results could not be read (5 of 10). 30+10+4+0+5 = 49.

Zyte API 77

The Agentic Web Data plugin (zytedata/skills) released 0.4.1 on 26 October 2026, 6 days before 1 November (30). Every dated source counted. In the 90 days from 3 August the plugin released 0.3.0, 0.3.1, 0.4.0 and 0.4.1 (17 and 22 September, 5 and 26 October) and scrapy-zyte-api 0.36.0 on 20 August. python-zyte-api 0.11.0 of 23 July has left the window, and its main branch holds unreleased work since (a CVE floor for brotli, Python 3.15 support), with no release by 1 November (20). There is no public API changelog. Support runs through tickets and a Discord server, and we did not read GitHub issues (8 of 15 for a closed service). python-zyte-api 0.11.0 is current, with Python 3.10 or later, and covers one language. The official MCP registry lists only a third-party Zyte entry (io.github.pipeworx-io/zyte), none from Zyte (12 of 15). The client repository has test and publish workflows and merged dependency updates on 20 and 26 October 2026. We did not see CI results (7 of 10).

SoldFetch 41

Closed hosted service. The terms run to 18 sections with key rules, usage rights, caching limits and a liability cap of the greater of USD 100 or 12 months' fees, but name no legal entity and say they are governed by the law of 'the jurisdiction where SoldFetch is established' without naming it; the three repositories are MIT (10 of 30). The privacy policy (updated 22 October 2026) gives request-log retention of 7, 30 or 90 days by plan, about an hour for exports, digests for keys and cookie durations, and the docs give cache periods and 24 hours for job results; the pricing page's 30-day request logs on every plan disagrees with the policy's plan-based periods, backups have no period and no DPA was found (20 of 30). No deprecation policy or dated notices; terms 11.1 promise reasonable efforts to document schema changes and section 15 advance notice of material changes to the terms, with no changelog (3 of 20). Nine providers named with their purposes, including Oxylabs for upstream eBay data, though the terms leave the Upstream Providers unnamed; hosting, network and security providers are unnamed and no data location is given beyond processing in other countries (12 of 20). 10+20+3+12 = 45.

Zyte API 67

A closed service with terms last updated on 22 September 2026 (unchanged on 1 November) that name Zyte Group Limited and contain a Zyte API section. The Python client is BSD 3-Clause (15 of 30). The privacy policy (30 August 2024), a DPA and a sub-processor list are public, with retention stated for support tickets (4 years) and invoices (7 years). Retention of request data and scraped content isn't stated, and the terms let Zyte use Service Data for product development and product training (17 of 30). Site tier changes get two weeks' notice and the Smart Proxy Manager retirement was announced with a date, but there is no standing API deprecation policy and the terms allow changes with or without notice (10 of 20). The sub-processor list names 36 companies with addresses and purposes, and the privacy policy names the United States and Ireland as processing locations (16 of 20).

SoldFetch 68

API reading, with the MCP server described. An OpenAPI 3.1 file is published at https://soldfetch.com/api/v1/openapi.json, under a path robots.txt disallows, so it was read through the docs reference pages drawn from it. Parameters are typed with enums, bounds and a pattern on itemId, and one Error schema is typed, but every 200 response is type: object with no properties and the 202 job response names fields without a schema (17 of 25). llms.txt on the site and the docs, llms-full.txt, and Markdown twins of the docs pages (10). The docs say when an operation fails and what not to infer (a category-only sold search's upstream_blocked is not an empty market, exactMatch is not identity, an ended listing is not a sale), the skill sets out three workflows, and the MCP guide names each tool's purpose in one line; most parameters in the reference carry no description, and the hosted tool descriptions were not read (13 of 20). ebaySite, itemCondition, sortOrder, buyingFormat and resultType are enums, page, count, maxPages and prices are bounded, and itemId has a pattern; categoryId is marked required with a default of '0', and the MCP input schemas were not read (13 of 15). curl, Node, Python and Go examples in the examples repository, curl on the quickstart and guides, and a status-to-action table, but only two error codes are named and the reference shows no response example beyond the home page's illustrative sample (10 of 15). Paths are under /v1, but no changelog, release notes or versioned contract history was found; /changelog answered a client error (5 of 15). 17+10+13+13+10+5 = 68.

Zyte API 85

The reference prints an OpenAPI 3.0.3 document for POST /v1/extract, though the Search API's /v1/search is documented in tables outside it (25). docs.zyte.com has an llms.txt and Markdown twins of its pages (10). The operation description states which output fields can be combined and which can't, and field descriptions give defaults (17 of 20). Inputs are typed, with 51 enums and required fields marked. customAttributes takes a free-form schema (13 of 15). The spec has a dozen request examples, and each error status has a problem+json example (15). The path is versioned /v1 and the spec says 1.0.0, but we found no dated changelog for the API in the docs sitemap of 150 pages (5 of 15).

SoldFetch 62

Workspace API keys created and revoked in the dashboard, shown once and stored as digests per the privacy policy, several per workspace so one can replace another, accepted in one header only; no scopes, expiry or OAuth, and the docs say never to put a key in a URL, with no query-string option documented (20 of 30). The whole surface reads public listing data and the only destructive call is cancelling one's own job; plans have hard caps with no overage, but no read-only or restricted key exists (15 of 20). Every response carries third-party listing text. The AI agents guide, the MCP README, SECURITY.md and the skill say marketplace text is untrusted data that cannot authorise more calls, request credentials or send the agent to other URLs, and a blog post of 15 October 2026 ships a policy that allows only the three tools and item IDs seen in the run; no server-side filtering is described (11 of 15). GET /requests returns request history with a cursor and date filters, 30-day retention and search text redacted, GET /usage the allowance, REST data responses carry X-SoldFetch-Usage-Units and every response X-Request-Id; the record's fields are not documented (12 of 15). No security.txt (client error), bug bounty, SOC 2 or ISO 27001; the repositories' SECURITY.md files give a reporting route to contact@soldfetch.com (4 of 20). 20+15+11+12+4 = 62.

Zyte API 55

API keys are revocable, an organisation can hold several, and none travels in a URL. Keys carry no permission scopes. Zyte MCP signs in over OAuth and works through its own key, mcp_access_key (22 of 30). An owner can set a blocking spending limit per key. We found no read-only mode, and the MCP docs warn that the agent can delete schedules and collections with no undo, leaving approval to the MCP client (8 of 20). The API returns untrusted web content, and the only guidance found is to review what the agent asks to do (2 of 15). The Stats API and dashboard break usage down by key, domain and request type, requests can be tagged, and each response has a request-id. No per-request log for the operator was found (10 of 15). ISO 27001 certification per the trust centre, a responsible disclosure programme with a hall of fame and no rewards, penetration test reports under NDA, and no security.txt (www.zyte.com/.well-known/security.txt answered 404 on 1 November) (13 of 20).