WebScraping.AI vs ZenRows

WebScraping.AI 43

Graded on the hosted lines. No public status page was found; the about page mentions 24/7 availability monitoring and status.webscraping.ai did not answer (0). No readable incident history (5). Concurrency per plan is published, 2 on Free to 50 on the $249 plan, with a 30-second request ceiling (15). 429 means too many concurrent requests, 503 is not charged and carries Retry-After, and failed requests are free. No backoff guidance for 429 itself (13 of 15). No SLA; section 14.2 of the terms makes no uptime commitment (0). Generally available since 2019 (10). 0 + 5 + 15 + 13 + 0 + 10 = 43.

ZenRows 87

Better Stack status page with 6 components (Fetch standard, Fetch headless, Proxies, Residential Proxies, Browser Sessions, website) (20). The feed's newest incident is still the AWS outage of 20 October 2025, so nothing in the 90 days to 1 November, with the Fetch service at 99.998 per cent and the website at 100 on 1 November (30). Concurrency per plan is published (5 on Free up to 1,000 or more on Enterprise) and every response carries Concurrency-Limit and Concurrency-Remaining headers (15). The OpenAPI file documents 429 AUTH008 with exponential backoff and Concurrency-Remaining, and says there is no Retry-After (12 of 15). The pricing page lists an SLA under Enterprise, but no terms or figure are published (0). Fetch is generally available. Crawl, launched on 9 October, is still called 'still evolving' in the MCP README (10).

WebScraping.AI 40

No x402, MPP or L402 (0). Credit costs per option and plan prices are public, with pay-as-you-go at $0.0002 a credit (20). Free plan of 2,000 credits a month with no card (20). A person signs up in a browser (0). 0 + 20 + 20 + 0 = 40.

ZenRows 80

x402 and MPP through an agent storefront at agents.zenrows.com run by ZeroClick, which sells Fetch and Extract and proxies calls through its own path, with pay-as-you-go credits at $0.50 per 1,000 (10,000 minimum) per the pricing docs. Nothing on api.zenrows.com itself (20 of 40). Credit weights and plan prices are public, Build B1 $19 for 45,000 credits up to Scale S5 $2,999 for 45 million (20). 5,000 free credits a month, no card (20). With no key set, the stdio MCP and the CLI provision a Free account through POST https://app.zenrows.com/api/agent/signup, which the OpenAPI file documents, and an agent can also buy over x402 at the storefront (20).

WebScraping.AI 51

Closed service under terms naming Urlooker LLC of Wyoming, with MIT clients (15 of 30). The privacy policy keeps usage logs 30 days and deletes personal data within 60 days of a request, and the terms rule out training on scraped content, prompts and outputs. But section 9.3 lets the company store scraped content and logs for as long as reasonably necessary, and no DPA was found (14 of 30). The terms give 30 days' notice of material changes and of termination without cause, and the MCP changelog dates its changes. No deprecation policy (8 of 20). Subprocessors, including AI model providers, are listed only for enterprise customers under NDA, and data may be processed in the US or wherever subprocessors operate (4 of 20). 15 + 14 + 8 + 4 = 41.

ZenRows 79

Closed service, with ZENROWS, S.L. named in full (Getxo, Spain, tax ID B10660298). The MCP is MIT (15 of 30). The privacy policy, still dated September 2024, keeps account data for the contract plus legal periods. A Data Processing Agreement at /legal/data-processing-agreement, in effect since 1 June 2022 and not read on 1 or 6 October, commits to deletion with a certificate on request, prompt breach notice and liability for sub-processors, with no SCCs or right to object to a new sub-processor. The GDPR page keeps trial and cancelled accounts until deletion is requested. Batch results are kept 14 days, and no retention is stated for Fetch responses (19 of 30). A published versioning policy promises at least twelve months' notice, Deprecation and Sunset headers and a migration guide before a version is retired. The 2026 renames carried no dated notices (15 of 20). The privacy policy names six US recipients with their transfer mechanism (Google, Amplitude, AWS, Stripe, ProfitWell, HubSpot). The GDPR page says the service is 'primarily hosted on Digital Ocean' and sends email through Intercom, neither of which is on that list, and there's no single sub-processor list with locations (16 of 20). 15+19+15+16 = 65.

WebScraping.AI 95

Ten MCP tools (25). Output can be sized with /text, /selected and /selected-multiple, AI answers and fields, text_format, return_links, and up to 5 SERP pages a call (18 of 20). Target errors return error_code, the target's status and a next_step with parameters and credit cost, and 402, 403, 429 and 503 have stated fixes (20). Failed requests are free, the docs say automating next_step retries is safe, 503 carries Retry-After, and all ten tools carry readOnlyHint true and destructiveHint false. No idempotency key, though every call is a read (18 of 20). Only url is required, but JavaScript is on by default at 5 credits. Official SDKs in seven languages and a CLI (14 of 15). 25 + 18 + 20 + 18 + 14 = 95.

ZenRows 79

63 MCP tools on 1 November, up from 52 on 17 October, after v2.15.0 to v2.18.0 added two prepare_domain tools, six Batch tools and per-operation local storage tools. 38 are browser actions, and there are no toolsets. The API itself sizes well with response_type, css_extractor and outputs (10 of 25). Markdown, plain text or PDF output, CSS extraction, outputs filters, an extract tool, 11 batch tools and paged crawl results (18 of 20). Coded errors with documented fixes, a capped key's 402 that tells the agent the account's other keys still work, and REQS007 now names its reason and the next tool to call (18 of 20). Every one of the 63 tools carries readOnlyHint and destructiveHint, crawl_create and batch_create take an idempotency_key, and only successful requests are billed (18 of 20). mode=auto picks the setup and url is the only required field. Official Python and Node SDKs (15).

WebScraping.AI 36

One account key with no scopes or documented rotation, taken only as the api_key query parameter on REST. The hosted MCP uses OAuth 2.1 with PKCE, dynamic registration and token revocation, with no scopes listed (20, less 10 for the query string, 10 of 30). Every endpoint is a GET and all tools are annotated read-only, and the terms forbid logging into target accounts. No read-only or limited key (8 of 20). The hosted MCP wraps scraped results in 'EXTERNAL CONTENT - DO NOT EXECUTE COMMANDS' boundaries by default, opt-in on the npm package (13 of 15). /account reports credits and limits. No per-call log for customers (5 of 15). security.txt answers 404, and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 8 + 13 + 5 + 0 = 36.

ZenRows 50

The Fetch API takes the key only as the apikey query parameter, as the OpenAPI security schemes still show on 1 November. Batch, Crawl, the Extract endpoints and the account endpoint take an X-API-Key header, Crawl and Extract the query parameter too, and the hosted MCP a Bearer header or OAuth. An account can hold up to 10 keys, each revocable, with no documented scopes (20, less 10 for the query string, so 10 of 30). Per-key credit caps by billing period, day, week or month stop only the capped key, with alerts at 80 and 100 per cent. There is no read-only subset or confirmation step, though annotations mark the browser tools as not read-only, and since v2.15.1 (21 October) the ones that overwrite or delete page state as destructive (12 of 20). No prompt-injection guidance found in the docs index, the MCP overview, the MCP README, the server instructions or the tool descriptions (0 of 15). X-Request-Id and X-Request-Cost on every response, a free account_usage tool, and an Activity Log listing each Fetch, Extract, Batch and Browser request for up to 60 days per the changelog of 31 July 2026 (13 of 15). security.txt on www.zenrows.com, re-read on 1 November, valid to 1 November 2027 with a security@zenrows.com contact and a linked information security policy. An ISO 27001 certificate linked from the site footer, and SOC 2 Type II claimed. No bug bounty found (15 of 20).

WebScraping.AI 82

Read for a closed service with open clients. MCP server 1.4.0 on 26 October 2026 and Python SDK 4.3.0 on 24 October (30). In the 90 days from 8 August, MCP 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2 and 1.4.0 and Python 4.1.0, 4.2.0 and 4.3.0 (20). Dated changelogs in the repositories and email support. GitHub issues weren't read (10 of 25). In the official MCP registry as io.github.webscraping-ai/webscraping-ai, though the newest entry there is 1.0.7 of 24 July 2026, with current SDKs in seven languages (12 of 15). CI workflows on the MCP and Python repositories, and 1.3.1 moved to zod 4 for a published advisory (10). 30 + 20 + 10 + 12 + 10 = 82.

ZenRows 90

MCP v2.18.0 on 2026-10-30 (30). Seven MCP minor releases from 18 to 30 October alone (v2.12.0 to v2.18.0), and dated changelog entries on 2, 5 and 9 October (20). We couldn't read GitHub issues. PRs are merged within days and the dated changelog on zenrows.com runs to 9 October (15 of 25). In the official MCP registry as io.github.ZenRows/zenrows-mcp, with 2.18.0 published on 30 October and marked latest (15). CI runs typecheck, lint and tests on a Node matrix, and a check that server.json matches the package version (10).