Spider vs WebScraping.AI

Spider 96

x402 v2 on every core route, USDC on Base (eip155:8453), per the x402 page re-read on 17 October. Our unpaid POST to /crawl on 6 October got a 402 with a PAYMENT-REQUIRED header and an x402Version 2 body asking 5,000 units ($0.005), not re-run on 17 October because api.spider.cloud's robots.txt disallows every path (40). Bytes, CPU minutes and credit prices are public (20). Keyless POST /scrape, documented in llms.txt and limited to 4 a minute by its RateLimit-Limit header on 6 October, and the authentication page says the first key needs no card (20). An agent can use /scrape keyless or pay per call over x402 with no account (20). 100 less 4 because AI Studio routes need a plan from $6 a month.

WebScraping.AI 40

No x402, MPP or L402 (0). Credit costs per option and plan prices are public, with pay-as-you-go at $0.0002 a credit (20). Free plan of 2,000 credits a month with no card (20). A person signs up in a browser (0). 0 + 20 + 20 + 0 = 40.

Spider 85

Statuspage at spidercloud.statuspage.io with API and HTTP Proxy components (20). The history feed, re-read on 1 November (robots.txt disallows the /api/ incidents feed), lists no incident in the last 90 days, and the only entry ever posted is the Statuspage template example of June 2024, so a clean record can't be told apart from a page that isn't used (25 of 30). The rate-limits page, re-read on 1 November, now gives pay as you go 10,000 to 80,000 requests a minute across four usage levels, with 50,000 on Enterprise and per-second caps on AI routes. Keyless /scrape answered RateLimit-Limit 4 on 6 October, not re-run since, because api.spider.cloud's robots.txt disallows every path (15). RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers, Retry-After on 429 per llms.txt, and an exponential backoff example on the rate-limits page (15). No SLA found (0). Generally available (10). 20 + 25 + 15 + 15 + 0 + 10 = 85.

WebScraping.AI 43

Graded on the hosted lines. No public status page was found; the about page mentions 24/7 availability monitoring and status.webscraping.ai did not answer (0). No readable incident history (5). Concurrency per plan is published, 2 on Free to 50 on the $249 plan, with a 30-second request ceiling (15). 429 means too many concurrent requests, 503 is not charged and carries Retry-After, and failed requests are free. No backoff guidance for 429 itself (13 of 15). No SLA; section 14.2 of the terms makes no uptime commitment (0). Generally available since 2019 (10). 0 + 5 + 15 + 13 + 0 + 10 = 43.

Spider 70

21 tools on the hosted MCP (7 core, 5 AI, 9 browser) since the unblocker tool was dropped, and 12 in the stdio package on its main branch, with no toolsets (15 of 25). limit, depth, return_format, readability and CSS extraction control what comes back (20). Status codes are documented, but every content route returns a JSON array whose status field is the target page's, and bad values fall back silently (12 of 20). No tool annotations, and llms.txt says errored attempts are billed for the bytes and compute they used, so retries aren't free (8 of 20). request defaults to smart and only url is required. Official clients in Python, JavaScript, Rust and Go plus a CLI (15).

WebScraping.AI 95

Ten MCP tools (25). Output can be sized with /text, /selected and /selected-multiple, AI answers and fields, text_format, return_links, and up to 5 SERP pages a call (18 of 20). Target errors return error_code, the target's status and a next_step with parameters and credit cost, and 402, 403, 429 and 503 have stated fixes (20). Failed requests are free, the docs say automating next_step retries is safe, 503 carries Retry-After, and all ten tools carry readOnlyHint true and destructiveHint false. No idempotency key, though every call is a read (18 of 20). Only url is required, but JavaScript is on by default at 5 credits. Official SDKs in seven languages and a CLI (14 of 15). 25 + 18 + 20 + 18 + 14 = 95.

Spider 70

The spider crawler and the clients and MCP are MIT. The hosted API is closed, run by BAGELMEN LLC under the EULA (25 of 30). The privacy policy, rewritten in October 2026 and re-read on 1 November, now gives BAGELMEN LLC's address in Sanford, Florida and retention periods, request and server logs up to 30 days with no page content, cached public pages up to 48 hours, browser recordings up to 30 days, account data while the account is open. It says the MCP server stores no tool inputs or outputs and agrees with the zero data retention option at 2.5 times credits. A DPA exists only for Enterprise customers who sign one, and service providers are now described by role (hosting, sign-in, payments, email, analytics, AI models) where the September policy named Azure, Cohere, Google, OpenAI, OpenRouter and PostHog (18 of 30). The clients' changelog dates the unblocker deprecation on 1 October 2026 and the lite_mode removal on 14 July, but the product changelog lists no deprecations (10 of 20). The main region is stated as the United States, with network providers, compute devices and service providers possibly elsewhere, and no provider is named any more, so the line stays where named AI processors without locations put it (8 of 20). 25 + 18 + 10 + 8 = 61.

WebScraping.AI 51

Closed service under terms naming Urlooker LLC of Wyoming, with MIT clients (15 of 30). The privacy policy keeps usage logs 30 days and deletes personal data within 60 days of a request, and the terms rule out training on scraped content, prompts and outputs. But section 9.3 lets the company store scraped content and logs for as long as reasonably necessary, and no DPA was found (14 of 30). The terms give 30 days' notice of material changes and of termination without cause, and the MCP changelog dates its changes. No deprecation policy (8 of 20). Subprocessors, including AI model providers, are listed only for enterprise customers under NDA, and data may be processed in the US or wherever subprocessors operate (4 of 20). 15 + 14 + 8 + 4 = 41.

Spider 75

The newest dated change is the unblocker's removal from the hosted MCP and the client sources on 1 October 2026, 31 days before 1 November, and the product changelog's newest entry is still 10 September (provider router), so within 90 days but not 30 (20, cause time, 30 on 17 October). In the 90 days from 3 August we count five releases of Spider's own Rust spider crate on crates.io (2.53.5 on 17 August, 2.53.6 on 18 August, 2.53.7 on 1 September, 2.53.8 on 3 September and 2.53.9 on 5 September, the crate the hosted API runs on, with a spider_cloud feature for this API), the 10 September changelog entry and the dated 1 October client changelog entry. The @spider-cloud/spider-client 0.2.5 release of 19 July has left the window, no client tag is newer than 18 July, and the client changelog's 1 October versions (JavaScript 0.3.0, Python 0.2.0) have no release tags in the repository on 1 November. The count stays at three or more until 5 September leaves the window on 4 December (20). We couldn't read GitHub issues. Dated changelog and support by email (12 of 25). In the official MCP registry as cloud.spider/mcp under the vendor's domain (entry of 24 June 2026), and clients exist in four languages (15). The clients repo runs CI for Node, Python and Rust. The MCP repo has no CI (8 of 10). 20 + 20 + 12 + 15 + 8 = 75.

WebScraping.AI 82

Read for a closed service with open clients. MCP server 1.4.0 on 26 October 2026 and Python SDK 4.3.0 on 24 October (30). In the 90 days from 8 August, MCP 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2 and 1.4.0 and Python 4.1.0, 4.2.0 and 4.3.0 (20). Dated changelogs in the repositories and email support. GitHub issues weren't read (10 of 25). In the official MCP registry as io.github.webscraping-ai/webscraping-ai, though the newest entry there is 1.0.7 of 24 July 2026, with current SDKs in seven languages (12 of 15). CI workflows on the MCP and Python repositories, and 1.3.1 moved to zod 4 for a published advisory (10). 30 + 20 + 10 + 12 + 10 = 82.

Spider 42

Bearer keys in the Authorization header only. Several keys per account, regenerable at any time. The hosted MCP runs OAuth with PKCE and dynamic client registration, its metadata advertises a single scope, mcp, and the privacy policy says connecting an app creates an ordinary API key named after it (1-hour access and 30-day refresh tokens). No documented key scopes or spend limits (25 of 30). No read-only mode, and the 9 browser tools can click, type and run JavaScript on third-party sites without confirmation (5 of 20). No prompt-injection guidance in the docs, llms.txt or MCP docs (0 of 15). Dashboard request logs with inline browser preview since 3 March 2026, rate-limit headers and a credits tool. Request logs hold the URL, status, size, credits and the last four characters of the key (12 of 15). spider.cloud/.well-known/security.txt and /security.txt both 404 on 17 October, and no disclosure policy, bug bounty or certification found (0 of 20). 25 + 5 + 0 + 12 + 0 = 42.

WebScraping.AI 36

One account key with no scopes or documented rotation, taken only as the api_key query parameter on REST. The hosted MCP uses OAuth 2.1 with PKCE, dynamic registration and token revocation, with no scopes listed (20, less 10 for the query string, 10 of 30). Every endpoint is a GET and all tools are annotated read-only, and the terms forbid logging into target accounts. No read-only or limited key (8 of 20). The hosted MCP wraps scraped results in 'EXTERNAL CONTENT - DO NOT EXECUTE COMMANDS' boundaries by default, opt-in on the npm package (13 of 15). /account reports credits and limits. No per-call log for customers (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 8 + 13 + 5 + 0 = 36.