# SpecStream vs You.com APIs (slim)

> You.com scores 76.1 (BB) to SpecStream's 64.4 (B) for research search. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/specstream-vs-you-com-api.md (~5,500 tokens) · this version ~3,280 tokens · JSON https://www.anchorterminal.com/compare/specstream-vs-you-com-api.json · canonical https://www.anchorterminal.com/compare/specstream-vs-you-com-api
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

You.com APIs scores 76.1 (BB) on agent readiness against SpecStream's 64.4 (B), and leads in 6 of 7 scored categories. SpecStream leads on security & auth. Both do research search. SpecStream accepts x402. You.com APIs doesn't.

- SpecStream: B 64.4, rank #399 of 1272 · https://www.anchorterminal.com/tools/specstream.min.md
- You.com APIs: BB 76.1, rank #39 of 1272 · https://www.anchorterminal.com/tools/you-com-api.min.md
- SpecStream, good for Agents that need a list of companies, places, grants, tenders, papers or packages matching stated conditions, with a source page on every value and a price approved before anything runs, and teams that want the same list rechecked on a schedule and sent to a sheet or CRM. Ahead on Security & auth, 73 against 59. Also An agent can pay per call over x402, with no account; No incidents deducted, where You.com APIs loses 3 points for them.
- You.com APIs, good for An unattended agent that needs search, page text and cited answers and wants to pay per call without an account. Ahead on Reliability, 80 against 23; Schema & documentation, 92 against 80; Agent ergonomics, 83 against 65. Also Agent-ready, a grade of BB or better; Runs on your own machine.

| Category | SpecStream | You.com APIs |
| --- | --- | --- |
| Reliability (16%) | 23 | 80 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 80 | 92 |
| Agent ergonomics (13%) | 65 | 83 |
| Security & auth (14%) | 73 | 59 |
| Payments & pricing (10%) | 85 | 88 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 85 |
| Transparency & trust (7%) | 66 | 67 |

| Fact (where they differ) | SpecStream | You.com APIs |
| --- | --- | --- |
| Kind | Platform | HTTP API |
| Vendor | SpecStream SAS | You.com |
| Hosted endpoint | `https://api.specstream.ai/mcp` | `https://api.you.com/v1/search` |
| Transports | Streamable HTTP, HTTP | HTTP, Streamable HTTP, stdio |
| Pricing | Pay per use | Freemium |
| Price for research search | not published | $50 per 1,000 requests |
| x402 | yes | payer tooling only |
| Licence | Proprietary hosted service under SpecStream SAS's terms of use (updated 3 November 2026, French law). The client code in specstream/specstream-tools (SDKs, the stdio bridge, framework packages, plugins, skills and integrations) is MIT, copyright SpecStream SAS | none |
| Tools exposed | 128 | 6 |
| MCP registry | `ai.specstream/specstream` | `io.github.youdotcom-oss/mcp` |
| Last release | 2026-11-03 | 2026-10-28 |
| Terms last updated | not read yet | 2024-08-27 |
| Privacy policy last updated | not read yet | 2026-09-22 |
| Customer content may train models | not read yet | yes |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | none | 4.4k npm/wk, 92k PyPI/wk |
| Agent reviews | none | 3.8/5 (8) |

Why the edge:
- Reliability, You.com APIs +57: SpecStream 23 (Hosted reading, for the MCP server and REST API on api.specstream.ai. No public status page was found. None is linked from the site, llms.txt or the docs, llms-full.txt mentions none, and https://specstream.ai/status returned an error (0). No readable incident history, so the floor (5). No rate limit with numbers is published in the docs, llms.txt, llms-full.txt or the part of the OpenAPI file read; the privacy policy and DPA mention rate limiting without figures, and the published limits are per job (10,000 results a request, four-hour runs, 20,000 imported rows) (0). Nothing documents 429, Retry-After or backoff, but paid work requires an `idempotency_key` on `authorize_capacity_work` and `POST /v1/capacity/executions`, `GET /v1/capacity/requests/{request_key}` recovers the original find after an uncertain response, and the skills say never to quote again to recover a lost reply (8 of 15). No SLA on any plan, and the terms say 'We do not promise uninterrupted access' (0). No beta or preview label on the API, the MCP server or the SDKs, which PyPI classifies as production and stable at 1.2 (10). 0+5+0+8+0+10 = 23.); You.com APIs 80 (Rootly status page at status.you.com with Search/Index, Live News and AI Search API components (20). Its robots.txt loaded on 1 November, but incident pages still answered with a Cloudflare challenge, so we read the history RSS feed as before. In the 90 days to 1 November it lists one incident, an 'Authentication Outage' on the AI Search API component posted on 5 October, and nothing after it. The feed gives no duration, so we couldn't establish the outage as a major. Minor only (20). 10 requests a second per API and 5 for Finance Research on self-serve accounts, re-read on 1 November (15). 429 carries `Retry-After`, the docs give exponential backoff capped at 60 seconds, and `X-RateLimit-*` headers allow client-side throttling (15). No SLA found for the search APIs. The pricing page banner claims an uptime SLA of at least 99.9% for the new Inference Router, but we found no SLA document (0). GA (10).)
- Agent ergonomics, You.com APIs +18: SpecStream 65 (MCP reading. 128 tools at about 143,700 characters of names, descriptions and schemas (more than 30, 5), with no server-side toolsets or dynamic loading; the framework packages for LangChain, LlamaIndex, CrewAI and the Vercel AI SDK and the Open WebUI tool expose two to four tools with the price cap held in code, and results default to short evidence (5 back, 10 of 25). Cursor and `limit` on rows, search, specs and revisits, `evidence` short or full, filters by area and by field on collections, and unconfirmed candidates kept in a separate list (18 of 20). An `ErrorEnvelope` on every operation and an SDK error class that exposes `code` and `details`, but no published code list, meanings or retry rules (6 of 20). Required idempotency keys on paid work, schedules and refund claims with a recovery route, `expected_version` on updates, stable event ids on webhook retries, and readOnlyHint on 72 tools and destructiveHint on 29, with no idempotentHint (18 of 20). `compile` needs only `q`, a quote needs only `ast_hash` with 25 results by default, and official SDKs in Python and TypeScript with a CLI, though one purchase takes three calls with a hash carried between them (13 of 15). 10+18+6+18+13 = 65.); You.com APIs 83 (Six MCP tools per the docs, which state there is no `you-answer` tool, with `?tools=` or `X-Allowed-Tools` to load a subset, a default allow-list of four, and a free profile that exposes two. Web Search returns up to 100 results with extraction opt-in (25). Result count, domain include, exclude and boost lists, `safesearch`, and since 9 October a `total_max_tokens` budget of 1,024 to 8,192 on highlights, which the changelog says brings a 10-result response under 1,000 tokens (20). Each error code says what to do next, and 402 says whether to add credits or pay the challenge (20). Search is read-only and a 402 can be retried once paid. We couldn't see MCP annotations, since the hosted server's source isn't public (8). Few required parameters, but Web Search and Contents live on ydc-index.io while Answer and Research run only on api.you.com, and the only current SDK is Python. The TypeScript `@youdotcom-oss/sdk` has been deprecated on npm since 3 March 2026 in favour of the MCP package (10 of 15).)
- Security & auth, SpecStream +14: SpecStream 73 (API keys `ss_live_...` shown once, with eight scopes, an optional project, an expiry of 1 to 365 days (default 90) and a spending ceiling, revoked singly; OAuth for MCP clients with client ID metadata documents or dynamic registration and read, prepare or execute access, with registered clients listed and revoked in settings; no secret in a query string documented. The authorisation server metadata on api.specstream.ai was not read and rotation is not described beyond expiry (28 of 30). Read, prepare and execute levels, only `finds:spend` or execute access starts paid work, every purchase needs an approved `confirm_max_cents` and delegated access has per-run and monthly limits; `create_api_key`, `delegate_access` and `request_account_deletion` are on the MCP surface marked destructive, and which scope guards account deletion is not documented (18 of 20). The home page says pages read are treated as data, never as instructions, and the Grok plugin's rules tell the agent to treat rows as untrusted; the docs, tool descriptions and four skills say nothing on it (6 of 15). A 12-month audit log of sign-ins, keys, delegated access, spending, exports, monitors and imports, readable through `list_audit_events`, plus per-find decisions, lineage and a source on every value; export of the audit log is Enterprise-only on the pricing page while the account docs describe a CSV export (13 of 15). security.txt is valid until October 2027 with support@specstream.ai, and SECURITY.md adds GitHub private vulnerability reporting; no SOC 2, ISO 27001 or bug bounty, and the DPA promises breach notice within 48 hours (8 of 20). 28+18+6+13+8 = 73.); You.com APIs 59 (Several keys per organisation in the `X-API-Key` header, revoked immediately on delete, rotation by create-then-delete, and roles where developers see only their own keys. The hosted MCP takes OAuth 2.1. No per-key scopes documented. No secret in a URL (22). Tool allow-lists on the MCP, a two-tool free profile and no tool that writes or deletes. Since 5 October a key can carry a spending cap per billing period, and a capped key answers 429 `spend_cap_exceeded` when it's reached, which bounds what a leaked or runaway key can spend, as kagi-search's per-key cap does (18). Search and Contents return untrusted page text. The only content control we found is `safesearch`, and no prompt-injection guidance (2). The key list shows a last-used date and each capped key's spend, and the troubleshooting page says Platform Logs list recent requests with error messages, response details and a request ID. No retention period, logs API or audit log of key actions was found, so 9, between numeral's 8 for a dashboard Logs tab and deepgram-stt's 10 for console and API logs (9). trust.you.com, a Vanta trust centre, links a vulnerability disclosure page and a subprocessor list but rendered only with JavaScript on 1 November, security.txt returned 404 on you.com, and the MCP repo runs Semgrep in CI (8).)
- Schema & documentation, You.com APIs +12: SpecStream 80 (MCP reading, with the REST API described. The tool list shipped in specstream-mcp-stdio 1.2.3 gives every one of the 128 tools a typed JSON Schema input (357 of 358 properties typed, `additionalProperties: false` on all but two objects), and an OpenAPI 3.1 file at https://specstream.ai/openapi.json lists at least 121 paths with cursor and limit parameters; several capacity and investigation responses are untyped objects, and our reader stopped at about 104,000 characters before the components, so request bodies and `ErrorEnvelope` were not read (22 of 25). llms.txt, llms-full.txt and a Markdown twin of every page, also served for `Accept: text/markdown` (10). Each tool has a title and a description of what it does and whether it charges ('Nothing runs and nothing is charged'), and the skills set the order of calls and where to stop and ask, but no description says when not to use a tool or names a better one (13 of 20). 13 enums (operations, evidence level, key scopes), 264 bounds and patterns such as 64-hex hashes, `requested_units` 1 to 10,000 and `limit` up to 100, and required lists on every tool (14 of 15). curl, Python and TypeScript examples, worked scripts in the repository and a sample run on the home page, but no documented error codes or error examples (6 of 15). A dated changelog of 48 entries from 30 September to 26 October 2026, `/v1` paths, a named API version and tagged releases (15). 22+10+13+14+6+15 = 80.); You.com APIs 92 (Public OpenAPI, one specification per API from the index at you.com/docs/openapi.json (25). llms.txt with Markdown twins of every page (10). A 'Choose the right API' page and MCP docs say which endpoint fits which job, and the MCP docs say there is no `you-answer` tool (15). Typed parameters in the OpenAPI, and the MCP rejects conflicting domain filters, such as `include_domains` with `exclude_domains` (12). The error reference covers 400, 401, 402, 403, 404, 422, 429 and 500 with guidance per code, body examples and the host-split pitfall (15). Versioned paths (/v1) and a dated public API changelog at you.com/docs/changelog, linked from llms.txt, with entries from 15 July to 26 October 2026 (15).)