SpecStream vs You.com APIs

SpecStream 23

Hosted reading, for the MCP server and REST API on api.specstream.ai. No public status page was found. None is linked from the site, llms.txt or the docs, llms-full.txt mentions none, and https://specstream.ai/status returned an error (0). No readable incident history, so the floor (5). No rate limit with numbers is published in the docs, llms.txt, llms-full.txt or the part of the OpenAPI file read; the privacy policy and DPA mention rate limiting without figures, and the published limits are per job (10,000 results a request, four-hour runs, 20,000 imported rows) (0). Nothing documents 429, Retry-After or backoff, but paid work requires an idempotency_key on authorize_capacity_work and POST /v1/capacity/executions, GET /v1/capacity/requests/{request_key} recovers the original find after an uncertain response, and the skills say never to quote again to recover a lost reply (8 of 15). No SLA on any plan, and the terms say 'We do not promise uninterrupted access' (0). No beta or preview label on the API, the MCP server or the SDKs, which PyPI classifies as production and stable at 1.2 (10). 0+5+0+8+0+10 = 23.

You.com APIs 80

Rootly status page at status.you.com with Search/Index, Live News and AI Search API components (20). Its robots.txt loaded on 1 November, but incident pages still answered with a Cloudflare challenge, so we read the history RSS feed as before. In the 90 days to 1 November it lists one incident, an 'Authentication Outage' on the AI Search API component posted on 5 October, and nothing after it. The feed gives no duration, so we couldn't establish the outage as a major. Minor only (20). 10 requests a second per API and 5 for Finance Research on self-serve accounts, re-read on 1 November (15). 429 carries Retry-After, the docs give exponential backoff capped at 60 seconds, and X-RateLimit-* headers allow client-side throttling (15). No SLA found for the search APIs. The pricing page banner claims an uptime SLA of at least 99.9% for the new Inference Router, but we found no SLA document (0). GA (10).

SpecStream 65

MCP reading. 128 tools at about 143,700 characters of names, descriptions and schemas (more than 30, 5), with no server-side toolsets or dynamic loading; the framework packages for LangChain, LlamaIndex, CrewAI and the Vercel AI SDK and the Open WebUI tool expose two to four tools with the price cap held in code, and results default to short evidence (5 back, 10 of 25). Cursor and limit on rows, search, specs and revisits, evidence short or full, filters by area and by field on collections, and unconfirmed candidates kept in a separate list (18 of 20). An ErrorEnvelope on every operation and an SDK error class that exposes code and details, but no published code list, meanings or retry rules (6 of 20). Required idempotency keys on paid work, schedules and refund claims with a recovery route, expected_version on updates, stable event ids on webhook retries, and readOnlyHint on 72 tools and destructiveHint on 29, with no idempotentHint (18 of 20). compile needs only q, a quote needs only ast_hash with 25 results by default, and official SDKs in Python and TypeScript with a CLI, though one purchase takes three calls with a hash carried between them (13 of 15). 10+18+6+18+13 = 65.

You.com APIs 83

Six MCP tools per the docs, which state there is no you-answer tool, with ?tools= or X-Allowed-Tools to load a subset, a default allow-list of four, and a free profile that exposes two. Web Search returns up to 100 results with extraction opt-in (25). Result count, domain include, exclude and boost lists, safesearch, and since 9 October a total_max_tokens budget of 1,024 to 8,192 on highlights, which the changelog says brings a 10-result response under 1,000 tokens (20). Each error code says what to do next, and 402 says whether to add credits or pay the challenge (20). Search is read-only and a 402 can be retried once paid. We couldn't see MCP annotations, since the hosted server's source isn't public (8). Few required parameters, but Web Search and Contents live on ydc-index.io while Answer and Research run only on api.you.com, and the only current SDK is Python. The TypeScript @youdotcom-oss/sdk has been deprecated on npm since 3 March 2026 in favour of the MCP package (10 of 15).

SpecStream 73

API keys ss_live_... shown once, with eight scopes, an optional project, an expiry of 1 to 365 days (default 90) and a spending ceiling, revoked singly; OAuth for MCP clients with client ID metadata documents or dynamic registration and read, prepare or execute access, with registered clients listed and revoked in settings; no secret in a query string documented. The authorisation server metadata on api.specstream.ai was not read and rotation is not described beyond expiry (28 of 30). Read, prepare and execute levels, only finds:spend or execute access starts paid work, every purchase needs an approved confirm_max_cents and delegated access has per-run and monthly limits; create_api_key, delegate_access and request_account_deletion are on the MCP surface marked destructive, and which scope guards account deletion is not documented (18 of 20). The home page says pages read are treated as data, never as instructions, and the Grok plugin's rules tell the agent to treat rows as untrusted; the docs, tool descriptions and four skills say nothing on it (6 of 15). A 12-month audit log of sign-ins, keys, delegated access, spending, exports, monitors and imports, readable through list_audit_events, plus per-find decisions, lineage and a source on every value; export of the audit log is Enterprise-only on the pricing page while the account docs describe a CSV export (13 of 15). security.txt is valid until October 2027 with support@specstream.ai, and SECURITY.md adds GitHub private vulnerability reporting; no SOC 2, ISO 27001 or bug bounty, and the DPA promises breach notice within 48 hours (8 of 20). 28+18+6+13+8 = 73.

You.com APIs 59

Several keys per organisation in the X-API-Key header, revoked immediately on delete, rotation by create-then-delete, and roles where developers see only their own keys. The hosted MCP takes OAuth 2.1. No per-key scopes documented. No secret in a URL (22). Tool allow-lists on the MCP, a two-tool free profile and no tool that writes or deletes. Since 5 October a key can carry a spending cap per billing period, and a capped key answers 429 spend_cap_exceeded when it's reached, which bounds what a leaked or runaway key can spend, as kagi-search's per-key cap does (18). Search and Contents return untrusted page text. The only content control we found is safesearch, and no prompt-injection guidance (2). The key list shows a last-used date and each capped key's spend, and the troubleshooting page says Platform Logs list recent requests with error messages, response details and a request ID. No retention period, logs API or audit log of key actions was found, so 9, between numeral's 8 for a dashboard Logs tab and deepgram-stt's 10 for console and API logs (9). trust.you.com, a Vanta trust centre, links a vulnerability disclosure page and a subprocessor list but rendered only with JavaScript on 1 November, security.txt returned 404 on you.com, and the MCP repo runs Semgrep in CI (8).

SpecStream 80

MCP reading, with the REST API described. The tool list shipped in specstream-mcp-stdio 1.2.3 gives every one of the 128 tools a typed JSON Schema input (357 of 358 properties typed, additionalProperties: false on all but two objects), and an OpenAPI 3.1 file at https://specstream.ai/openapi.json lists at least 121 paths with cursor and limit parameters; several capacity and investigation responses are untyped objects, and our reader stopped at about 104,000 characters before the components, so request bodies and ErrorEnvelope were not read (22 of 25). llms.txt, llms-full.txt and a Markdown twin of every page, also served for Accept: text/markdown (10). Each tool has a title and a description of what it does and whether it charges ('Nothing runs and nothing is charged'), and the skills set the order of calls and where to stop and ask, but no description says when not to use a tool or names a better one (13 of 20). 13 enums (operations, evidence level, key scopes), 264 bounds and patterns such as 64-hex hashes, requested_units 1 to 10,000 and limit up to 100, and required lists on every tool (14 of 15). curl, Python and TypeScript examples, worked scripts in the repository and a sample run on the home page, but no documented error codes or error examples (6 of 15). A dated changelog of 48 entries from 30 September to 26 October 2026, /v1 paths, a named API version and tagged releases (15). 22+10+13+14+6+15 = 80.

You.com APIs 92

Public OpenAPI, one specification per API from the index at you.com/docs/openapi.json (25). llms.txt with Markdown twins of every page (10). A 'Choose the right API' page and MCP docs say which endpoint fits which job, and the MCP docs say there is no you-answer tool (15). Typed parameters in the OpenAPI, and the MCP rejects conflicting domain filters, such as include_domains with exclude_domains (12). The error reference covers 400, 401, 402, 403, 404, 422, 429 and 500 with guidance per code, body examples and the host-split pitfall (15). Versioned paths (/v1) and a dated public API changelog at you.com/docs/changelog, linked from llms.txt, with entries from 15 July to 26 October 2026 (15).