SpecStream vs Valyu

SpecStream 23

Hosted reading, for the MCP server and REST API on api.specstream.ai. No public status page was found. None is linked from the site, llms.txt or the docs, llms-full.txt mentions none, and https://specstream.ai/status returned an error (0). No readable incident history, so the floor (5). No rate limit with numbers is published in the docs, llms.txt, llms-full.txt or the part of the OpenAPI file read; the privacy policy and DPA mention rate limiting without figures, and the published limits are per job (10,000 results a request, four-hour runs, 20,000 imported rows) (0). Nothing documents 429, Retry-After or backoff, but paid work requires an idempotency_key on authorize_capacity_work and POST /v1/capacity/executions, GET /v1/capacity/requests/{request_key} recovers the original find after an uncertain response, and the skills say never to quote again to recover a lost reply (8 of 15). No SLA on any plan, and the terms say 'We do not promise uninterrupted access' (0). No beta or preview label on the API, the MCP server or the SDKs, which PyPI classifies as production and stable at 1.2 (10). 0+5+0+8+0+10 = 23.

Valyu 70

Instatus page at status.valyu.ai with separate Search, Contents, Answer and DeepResearch components and an RSS history (20). In the 90 days to 2 November it lists a 13-minute Search incident on 6 October with "certain data sources", a partial incident, plus scheduled maintenance on 9 August (Search, 3 hours 13 minutes, announced the evening before) and 20 October (every component, 3 hours, announced 47 minutes ahead). Minor only (20). Since 21 October limits apply per organisation and per endpoint and scale with the plan, but the numbers appear only in example responses (Search at 5 requests a second on pay-as-you-go and 10 on Ridiculously Cheap; DeepResearch at 2 and 5 tasks at once), and the pricing page the docs point to for each plan's rate doesn't list them (8 of 15). A 429 carries a Retry-After header and a body with retry_after, the plan and the limit, the docs say to wait and retry with backoff and that a rate-limited request is never charged, and the SDKs retry 429s on their own. No idempotency keys, but the pricing page says to persist research task ids so retries don't create duplicate tasks (12). No SLA found (0). Search, Contents, Answer and DeepResearch are GA, and Workflows is labelled beta (10). 20+20+8+12+0+10 = 70.

SpecStream 85

x402 v2 (USDC on Base, Arbitrum or Polygon, Permit2 upto for the quoted maximum, settled for the results cost) and MPP by card on SpecStream's own POST /v1/agent/lists, the route for buying a list of 1 to 500 results without an account; enrichment of imported lists, refreshes, monitors and investigations need an account, and the route was read in the docs and not exercised because api.specstream.ai's robots.txt could not be read, so partial (25). Per-result prices published without a login, 5, 15 or 100 cents a result, 5 cents an email, 15 cents a phone, rechecks at half rate or 1 cent (20). $10 of work for 30 days with no card (20). An agent can buy a list over x402 or MPP with no account, and the A2A endpoint prices a request without a key (20). 25+20+20+20 = 85.

Valyu 45

No x402, MPP or L402 in llms.txt, the pricing page or the OpenAPI file on 2 November, so there was no payment route to check live (0). Since October usage is billed in credits, 1,600 for a $10 top-up, with per-result Search prices by source (web and news 0.1 credits, arXiv and PubMed 0.05, SEC filings 1.92), Contents at 0.2 a URL and fixed DeepResearch prices by mode, all public (20). $10 of free credit ($20 with a company email), no card, valid 12 months (20). A person has to create the account, but after that an agent can log in through the CLI, headless if needed, and mint its own spend-capped keys. That's a programmatic key route after a human signup, so we gave part of the line (5). 0+20+20+5 = 45.

SpecStream 73

API keys ss_live_... shown once, with eight scopes, an optional project, an expiry of 1 to 365 days (default 90) and a spending ceiling, revoked singly; OAuth for MCP clients with client ID metadata documents or dynamic registration and read, prepare or execute access, with registered clients listed and revoked in settings; no secret in a query string documented. The authorisation server metadata on api.specstream.ai was not read and rotation is not described beyond expiry (28 of 30). Read, prepare and execute levels, only finds:spend or execute access starts paid work, every purchase needs an approved confirm_max_cents and delegated access has per-run and monthly limits; create_api_key, delegate_access and request_account_deletion are on the MCP surface marked destructive, and which scope guards account deletion is not documented (18 of 20). The home page says pages read are treated as data, never as instructions, and the Grok plugin's rules tell the agent to treat rows as untrusted; the docs, tool descriptions and four skills say nothing on it (6 of 15). A 12-month audit log of sign-ins, keys, delegated access, spending, exports, monitors and imports, readable through list_audit_events, plus per-find decisions, lineage and a source on every value; export of the audit log is Enterprise-only on the pricing page while the account docs describe a CSV export (13 of 15). security.txt is valid until October 2027 with support@specstream.ai, and SECURITY.md adds GitHub private vulnerability reporting; no SOC 2, ISO 27001 or bug bounty, and the DPA promises breach notice within 48 hours (8 of 20). 28+18+6+13+8 = 73.

Valyu 44

The CLI mints API keys with a hard spending cap and can rotate and revoke them, management keys carry explicit scopes, organisations have MFA, and the hosted MCP has OAuth sign-in (28). The MCP docs lead with ?valyuApiKey= in the URL (minus 10). Spend-capped keys and max_price limit cost exposure, but valyu_deepresearch_control deletes tasks with no confirmation we could find (12). Search and Contents return full page text from the open web, and we found no prompt-injection guidance in the docs index (0). No per-call log or audit trail found for the operator (0). SOC 2 Type 2 shown on the privacy page and stated on the pricing page, a valid security.txt (security@valyu.ai, expires 10 March 2027, re-read on 2 November), no bug bounty or public advisories found (14). The MCP docs still give ?valyuApiKey= for every client on 2 November. 28-10+12+0+0+14 = 44.

SpecStream 65

MCP reading. 128 tools at about 143,700 characters of names, descriptions and schemas (more than 30, 5), with no server-side toolsets or dynamic loading; the framework packages for LangChain, LlamaIndex, CrewAI and the Vercel AI SDK and the Open WebUI tool expose two to four tools with the price cap held in code, and results default to short evidence (5 back, 10 of 25). Cursor and limit on rows, search, specs and revisits, evidence short or full, filters by area and by field on collections, and unconfirmed candidates kept in a separate list (18 of 20). An ErrorEnvelope on every operation and an SDK error class that exposes code and details, but no published code list, meanings or retry rules (6 of 20). Required idempotency keys on paid work, schedules and refund claims with a recovery route, expected_version on updates, stable event ids on webhook retries, and readOnlyHint on 72 tools and destructiveHint on 29, with no idempotentHint (18 of 20). compile needs only q, a quote needs only ast_hash with 25 results by default, and official SDKs in Python and TypeScript with a CLI, though one purchase takes three calls with a hash carried between them (13 of 15). 10+18+6+18+13 = 65.

Valyu 83

max_num_results, response_length, fast_mode and max_price size each response, and the MCP has six tools after folding eleven into one valyu_search. We couldn't read the hosted tool definitions, since the server isn't open source (22). Source include and exclude lists, per-source biases, dates, country and a relevance threshold. No pagination found (18). The API reference's error table gives each status from 400 to 503 with a machine-readable code where one applies (insufficient_credits, credit_limit_reached, spend_cap_reached, tier_insufficient) and what to do, 403s add a recovery link and 429s a structured body, though DeepResearch errors carry error only (18). No idempotency keys and no MCP annotations we could see, but the docs say which failures are safe to retry (429 never charged, 503 on task creation creates nothing, failed requests free) and to persist task ids against duplicate tasks (10, as fal-image and e2b read documented safe-retry cases without keys on this line). Only query is required, with Python and TypeScript SDKs plus a Rust SDK in alpha (15). 22+18+18+10+15 = 83.

SpecStream 66

Closed hosted service under terms of 3 November 2026 naming SpecStream SAS, French law and a liability cap of the greater of 12 months' fees or 100 euros; the client code is MIT (20 of 30). The privacy policy and DPA agree with each other and the about page on EU hosting, no training on customer requests, lists or results, and a retention table (server logs 30 days, backups 8 days, page copies 24 hours, run working copies 7 days, audit log 12 months, support 3 years, accounts until deleted, erased from backups within 8 days of deletion), with breach notice in 48 hours and audit rights; the pricing page and the account docs disagree on who can export the audit log (27 of 30). No API deprecation policy; the changelog dates a price cut of 26 October 2026 that kept approved quotes at their old prices, the terms promise notice of material changes and keep historical quotes on their terms, and the DPA gives 30 days' notice of a new subprocessor (8 of 20). Subprocessors are listed by category with locations and transfer safeguards, hosting on IBM Cloud in Madrid is named in the legal notice, and names are available only on request (12 of 20). 20+27+8+12 = 67.

Valyu 78

Closed service with terms that name Valyu.Network Ltd, company 14436543 in England and Wales, per the 30 September check (15). The privacy policy (20 October 2025) says queries are deleted within 24 to 72 hours, security logs kept 90 days, performance logs 30 days and billing records 7 years, and that query data isn't used to train models. No DPA referenced (26). Dated notice for the legacy MCP tools, hidden now and removed on 1 December 2026, but no general deprecation policy (12). Processing in the UK, EU and US is disclosed. Subprocessors are named by category only (12). The privacy policy is unchanged on 2 November (last updated 20 October 2025), and the pricing page now lists zero data retention on request for Enterprise. 15+26+12+12 = 65.

SpecStream 80

MCP reading, with the REST API described. The tool list shipped in specstream-mcp-stdio 1.2.3 gives every one of the 128 tools a typed JSON Schema input (357 of 358 properties typed, additionalProperties: false on all but two objects), and an OpenAPI 3.1 file at https://specstream.ai/openapi.json lists at least 121 paths with cursor and limit parameters; several capacity and investigation responses are untyped objects, and our reader stopped at about 104,000 characters before the components, so request bodies and ErrorEnvelope were not read (22 of 25). llms.txt, llms-full.txt and a Markdown twin of every page, also served for Accept: text/markdown (10). Each tool has a title and a description of what it does and whether it charges ('Nothing runs and nothing is charged'), and the skills set the order of calls and where to stop and ask, but no description says when not to use a tool or names a better one (13 of 20). 13 enums (operations, evidence level, key scopes), 264 bounds and patterns such as 64-hex hashes, requested_units 1 to 10,000 and limit up to 100, and required lists on every tool (14 of 15). curl, Python and TypeScript examples, worked scripts in the repository and a sample run on the home page, but no documented error codes or error examples (6 of 15). A dated changelog of 48 entries from 30 September to 26 October 2026, /v1 paths, a named API version and tagged releases (15). 22+10+13+14+6+15 = 80.

Valyu 90

Valid OpenAPI 3.0.3 (info version 2.3.0) with 24 paths and 29 operations across Search, Contents, Answer, DeepResearch, Batches, Workflows and Datasources on 2 November, matching the endpoint pages in llms.txt (25). llms.txt with a 'Guidance for agents' section (10). The MCP tools carry one-line purposes such as 'Read one or more URLs as clean markdown', and the docs explain source presets, but say little about when not to use a tool (13). search_type is an enum, max_num_results runs 1 to 20, relevance_threshold 0 to 1, source_biases -5 to 5 and instructions caps at 500 characters, with only query required (14). 200, 206 partial success and 400 to 503 documented, with examples across the docs (13). Versioned paths (/v1) and two dated changelogs, the platform changelog to 31 October 2026 and the SDK and API changelog to 26 October (15). 25+10+13+14+13+15 = 90.