ScrapeAtlas

# Fix list: ScrapeAtlas

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/scrapeatlas, the October 2026 research run, assessed 30 October 2026. Grade B, 63 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on ScrapeAtlas: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Reliability, 42 out of 100, up to 11.6 more on the total

Why it scored 42: Hosted reading, for the REST API with the MCP server described. No public status page was found. https://scrapeatlas.com/status/ answers 404 and neither the docs nor the footer links one (0). No readable incident history, so 5 by the rubric (5). Limits are published with numbers on the authentication page, 120 requests a minute and 4 concurrent requests per account, with per-worker deadlines and byte caps on the platform pages (15). A 429 is documented for account and upstream limits with a retry-after to respect, 503 busy for full capacity, and the responses page says to retry only on upstream_rate_limited, timeout or busy. No Retry-After header is declared in the OpenAPI file and the CLI does no automatic retries. Writes don't exist, the 12 POST operations are batch reads, so idempotency keys aren't needed (12 of 15). No SLA. The terms (29 September 2026) say no particular uptime, throughput or continued availability is promised unless a separate signed agreement says otherwise (0). The API is sold and listed as available on every platform page, with 15 of 386 operations saying preview in their descriptions; the MCP server is labelled Preview and scored under the API (10). 0+5+15+12+0+10 = 42.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 2. Security & auth, 55 out of 100, up to 7.9 more on the total

Why it scored 55: Customer keys with prefix sa_live_, several per account, each with an expiry date, revoked within 60 seconds and stored as hashes per the privacy policy, and keys can't start a checkout or create keys. No scopes or per-platform keys. The MCP server adds an authorization-code flow with PKCE S256, dynamic client registration, refresh-token rotation and revocation, but a single scope, scrapeatlas. No documented option to send a secret in a query string, and the MCP page says never to put the key in a prompt, argument or URL (22 of 30). The whole surface is read-only retrieval of public pages with no destructive action, and an OAuth grant covers retrieval plus the account's usage records only; nothing restricts a key to some platforms (16 of 20). Every response is third-party page content, and the only guidance found concerns keeping secrets out of tool arguments, nothing on treating returned text as untrusted (2 of 15). GET /v1/activity returns per-request metadata (endpoint, time, status, duration) newest first with filters, GET /v1/usage daily totals, responses carry x-credits-charged and x-credits-remaining, and the dashboard shows a credit history (13 of 15). No security.txt (404), no disclosure policy, bug bounty, SOC 2 or ISO 27001; the privacy policy describes access controls and incident notices and gives an abuse address (2 of 20). 22+16+2+13+2 = 55.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 3. Payments & pricing, 55 out of 100, up to 5.6 more on the total

Why it scored 55: No x402, MPP or L402 on ScrapeAtlas's own endpoints. The vendor's eight Actors on the Apify Store, covering TikTok, Instagram, Meetup and Couchsurfing at $1.98 per 1,000 successful requests, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-unit prices are on the home page without a login, 1 credit per successful request and packs at $1.90, $1.78 and $1.25 per 1,000, with the 2-credit endpoints named (20). 100 free credits at signup, no card (20). A person signs up in a browser and creates a key; the Apify route reaches four platforms without a ScrapeAtlas account (5 of 20). 10+20+20+5 = 55.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 4. Agent ergonomics, 76 out of 100, up to 3.9 more on the total

Why it scored 76: API reading. Responses are bounded by limit on 93 operations, by per-body caps, by format on 19 and view on 14 operations, and by since and until on about 60; Instagram and Twitch have reduced basic-profile endpoints. No field selection was found. The MCP server loads 373 tool definitions with no documented subset, which on the MCP reading would score 5 (15 of 25). Cursor pagination on 130 operations, sort on 28, date windows, and coverage.order reported on every list since 2 October 2026 (20). One failure object with code and message, a requestId on every response, retryable codes named, and an HTTP status table (19 of 20). All data reads are GET, failed requests aren't charged, and the docs say which codes to retry; no idempotency key on the 12 POST batch reads and MCP annotations weren't read (14 of 20). Median one required parameter and defaults on limits, but no official SDK in any language. The npm CLI, the n8n node and six-language samples stand in (8 of 15). 15+20+19+14+8 = 76.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 5. Transparency & trust, 61 out of 100, up to 3.4 more on the total

Made of editorial 54, provenance 67.

Why it scored 61: Closed service with clear terms dated 29 September 2026 naming the legal entity, governing law and liability cap; the CLI is MIT on npm with no source published (15 of 30). The privacy policy (19 October 2026) gives retention periods, 90 days for raw usage records, 30 days for inactive key metadata, 10 minutes to 30 days for OAuth artefacts, and says workers keep no archive of results, which the terms and the Public Data Notice repeat. Providers are named with their roles. No DPA is published; the terms say to arrange one before submitting such a workload (22 of 30). The terms promise reasonable notice of material changes when practicable, and the changelog records a Reddit retirement on 29 September and kept paths on 14 October, but there is no deprecation policy with periods and nothing in the OpenAPI file is marked deprecated (7 of 20). Supabase, Tinybird, PostHog, Stripe, Google, OpenAI and Affonso are named with purposes, but the only location statement is that the operator is in the UAE and infrastructure can process in other countries (10 of 20). 15+22+7+10 = 54.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Domain age: scrapeatlas.com, registered 2026-09-10 (under a year) (0 of 15)
- Status page: not found (0 of 10)
- security.txt: not found (0 of 10)
- People named: 2 named with their role, none with a public profile (7 of 10)

## 6. Maintenance & community, 70 out of 100, up to 2.6 more on the total

Why it scored 70: The newest change is CLI 0.26.0 on 28 October 2026, after the StockX endpoints on 27 October (30). 15 dated release days between 21 September and 27 October, 58 updates (20). Closed service with a public changelog. Support in the dashboard is for customers with a credit purchase, the contact form takes buying questions and privacy requests, and no Discord, forum or issue tracker was found; the careers page lists a customer support role (7 of 15). io.github.OnlineDopamine/scrapeatlas is in the official MCP registry under a GitHub-verified personal namespace, at 1.0.0 since 5 October and describing about 40 platforms against 49 now. The CLI is current on npm and an n8n node exists, but there are no SDKs (10 of 15). The CLI package has no repository field, no public source and no visible CI; it needs Node 22 or newer (3 of 10). 30+20+7+10+3 = 70.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 7. Schema & documentation, 88 out of 100, up to 2 more on the total

Why it scored 88: An OpenAPI 3.1.0 file (version 0.1.0, 34 MB) is public at scrapeatlas.com/docs/openapi.json with 384 paths and 386 operations, a per-platform x-api-key security scheme on each, response schemas for 200 and every documented error, and 931 component schemas (25). llms.txt at scrapeatlas.com/docs/llms.txt lists all 373 endpoints with one-line descriptions and schema links, and endpoint pages carry a copy-as-Markdown action (10). 386 operations have a summary and 373 a description, median 39 words, saying what public page is read, what the response holds, how to page and what it costs. llms.txt says not to assume one normalised JSON shape. Guidance on when not to call an endpoint is thin, with 9 descriptions using only and 2 instead (14 of 20). 1,390 parameters, 304 with enums, most with minLength, maxLength or a pattern, 232 operations needing one required parameter and 143 none; the 12 POST bodies are typed (14 of 15). A response example on 373 operations and examples on 508 parameters, HTTP 400 to 504 mapped to one failure object with 33 codes, per-endpoint error tables and code samples in six languages; no Retry-After header declared (14 of 15). Paths are under /v1 and a dated public changelog started on 24 September 2026 with 58 updates, but nothing is marked deprecated in the file, breaking changes aren't flagged, and the 14 October GitHub entry says former paths keep working without saying for how long (11 of 15). 25+10+14+14+14+11 = 88.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: MCP tool annotations (readOnlyHint and the rest), the tool list's size in tokens and whether tools/list is paged. No MCP session was opened, so the 373-tool count is the MCP page's figure, which matches the 371 platform and 2 account operations in the OpenAPI file.
- unchecked: whether the Apify Store Actors are Pay Per Event Actors payable by direct x402, and whether Apify's prepaid token covers them. The payments score gives 10 of 40 for that third-party route on the vendor's own Apify profile, which says no ScrapeAtlas account or key is needed.
- unchecked: the OAuth consent flow in practice. The MCP page says OAuth-only connectors are unsupported in the preview, while llms.txt and the privacy policy describe browser OAuth consent for ChatGPT and other clients, and the authorization server metadata publishes registration, authorization, token and revocation endpoints with PKCE S256.
- The 200,000-credit pack at $249 is on the home page, but the OpenAPI checkout operation and the affiliate page name only the 10,000 and 50,000 packs. Recorded, not deducted.
- No Retry-After header is declared in the OpenAPI file; the docs say to respect retry-after and the CLI envelope has a retryAfter field. Whether the header is sent wasn't observed.
- The Apify profile reports 15 total users and 84.9 per cent of runs succeeded, read on 30 October 2026; no success rate for the API itself is published.
- The vendor's 373 endpoint tools and 50 catalogued platforms on the MCP page count the two account operations and the account-usage group; the home page says 49 platforms and 371 endpoints, and both agree with the OpenAPI file. The registry entry's 'about 40 platforms' is stale.
- firstReleased is set to 21 September 2026, the changelog's first entry and the day CLI 0.10.0 shipped every endpoint as a command and an MCP tool. The domain was registered on 10 September and the 11 September capture says self-service access wasn't open, so a signup date between 11 and 21 September is possible but not shown.
- The product is about five weeks old, so the maintenance and transparency scores rest on a short record by the checklist, not on guesswork about where it goes.
- The MCP registry namespace and the npm packages are published from a personal GitHub account rather than a company organisation. Recorded in provenance notes; no deduction.
- ScrapeAtlas doesn't do LocalGhost's or letme's job. It returns platform data for an agent to use; it neither hides an agent's identity nor chooses tools for a task.

## Weaknesses

- No status page or incident history was found, and the terms promise no uptime, throughput or continued availability of an endpoint
- API keys have no scopes, and the MCP OAuth flow has a single scope, `scrapeatlas`
- No security.txt, disclosure policy, bug bounty or certification was found; keys are stored hashed per the privacy policy
- The MCP server is a preview that loads 373 tool definitions with no documented subset, and the registry entry under a personal GitHub namespace is at 1.0.0 from 5 October
- No official SDKs; the npm CLI has no public source repository, and support in the dashboard is for customers with a credit purchase
- Every response is third-party page content and the docs carry no guidance on treating it as untrusted

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Send the key as `x-api-key` on https://api.scrapeatlas.com and check `status` on every HTTP 200; `partial` is usable data with `coverage.warnings`, `failed` and `challenged` carry `failure.code`.
- Retry only on `upstream_rate_limited`, `timeout` and `busy`, after the `retry-after` on a 429. Stay under 120 requests a minute and 4 concurrent per account.
- Pass the returned `cursor` back unchanged for the next page, and use `since` and `until` (ISO 8601 or Unix seconds) where listed; each page costs another credit.
- Each platform has its own response schema, so read the endpoint's response fields before mapping; unknown values are `null`, never 0.
- For MCP, connect to https://api.scrapeatlas.com/mcp over Streamable HTTP with `Authorization: Bearer` and expect 373 tools; the two account tools and failed calls cost 0 credits.

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.