What we shipped.

Eight fast, offline utilities for AI agents and RAG pipelines — no model to host, no extra vendor, behind the same Bearer token. The catalog is now 228 endpoints.

• Tokens & chunking: POST /v1/tokens/count (free) estimates prompt cost; POST /v1/text/chunk does token-aware splitting for RAG ingestion.
• JSON: POST /v1/json/repair fixes malformed LLM JSON; POST /v1/json/validate validates against a JSON Schema or infers one.
• Text & language: POST /v1/text/similarity (fuzzy match/rank), POST /v1/lang/detect, POST /v1/datetime/parse (messy date → ISO-8601), and POST /v1/text/diff.

All run in-process — offline, no GPU, nothing stored. They're the new Agent Tools bundle.

Two owned-compute capabilities, on our own infrastructure — free-data, no per-call vendor fee. The catalog is now 220 endpoints.

• Structured document extraction: POST /v1/extract/document — a PDF in, a structured document out: text blocks with labels, tables with cells, reading order, and page layout (plus markdown). For invoices, receipts, forms, and reports. In-memory; never stored.
• Transcription: POST /v1/transcribe — audio or a video's audio track to text with timestamped segments and auto-detected language. Provide a URL or upload bytes.

Both are in the Conversion bundle.

Four new security endpoints — all free-data, abuse-resistant, and metered like the rest of the API — plus self-serve account controls. The catalog is now 218 endpoints.

• URL reputation: POST /v1/intel/url-reputation — is a URL (or its host) a known phishing / malware URL? Matched against a reputable free feed; we never fetch the URL.
• File-hash reputation: POST /v1/intel/hash-reputation — look a SHA-256 / SHA-1 / MD5 up against a known-malware corpus. Only the hash is sent — never a file.
• Threat lookup: POST /v1/intel/threat — one indicator (IP, domain, URL, or hash) returns a combined verdict across the free threat sources.
• Malware file scanning: POST /v1/scan/file — scan an uploaded file with YARA, in-memory and never stored; built-in rules plus your own.

Plus self-serve account deletion (POST /v1/me/delete) and data export (GET /v1/me/export) for GDPR/CCPA right-to-erasure and portability.

5 vertical scraper families, 14 endpoints, priced at market by family — LinkedIn 15 credits, Amazon/Maps/Yelp 8, YouTube 5 (vs 1 for public-data actors; failed calls auto-refund). The catalog is now 212 endpoints.

• Amazon (rich): amazon/search · product · reviews — search by query, detail by ASIN, paginated reviews.
• Google Maps (rich): gmaps/search · place · reviews.
• Yelp: yelp/search · business · reviews — first cold call can take a few minutes, results cache after.
• LinkedIn: linkedin/profile · company — authorized use only; respect LinkedIn's Terms of Service.
• YouTube: youtube/search · video · channel.

See them on the actors page.

17 new actor families, all public-API-backed (tier: "public_api") — no proxy, no vendor cost, 1 credit per call, failed calls auto-refund. The catalog is now 195 endpoints.

• Developer: /v1/actors/github/*, /npm/*, /pypi/* — repos, users, issues, packages, download stats.
• Research: /openalex/*, /arxiv/search, /europepmc/search, /doi/resolve, /orcid/*, /ror/*, /zenodo/*.
• Corporate & finance: /sec/* (EDGAR filings + facts), /gleif/* (LEI registry + ownership tree).
• Security knowledge: /nvd/* (CVEs), /atlas/* (MITRE ATLAS).
• Community & models: /hackernews/*, /stackexchange/*, /huggingface/*.

See them all on the actors page. Yelp, LinkedIn, and the richer commerce scrapers stay on the roadmap pending pricing and legal review.

Two bundled PRs that triple-down on our Intelligence surface — now the deepest single category at 25 endpoints. All 11 are 1 credit, all free-data-only, no paid feeds in the path.

DNS forensics (5 endpoints, all pure dnspython):

• POST /v1/intel/dnssec — DNSKEY + DS + AD-flag posture. Reports the three discrete observations rather than a single 'valid/not' bit, because chain validation has too many edge cases (NSEC3, sig expiry, CDS) to compress honestly.
• POST /v1/intel/nameservers — Authoritative NS + each resolved to A/AAAA, with a diversified flag (false → all NS sit in one /16, single point of failure).
• POST /v1/intel/caa — Which CAs may issue certs for the domain. Parses issue / issuewild / iodef + detects the issue ';' deny-all token.
• POST /v1/intel/reverse-dns — PTR lookup via dns.reversename. Log enrichment, abuse handling.
• POST /v1/dns/over-https — Forward query through Cloudflare 1.1.1.1 or Google 8.8.8.8 (RFC 8484 JSON). Resolver is a whitelist, no SSRF via the parameter.

HTTP intel (6 endpoints):

• POST /v1/intel/security-txt — Fetches RFC 9116 /.well-known/security.txt (or legacy /security.txt), parses fields, flags rfc9116_minimum_compliant (Contact + Expires).
• POST /v1/intel/social-tags — Open Graph + Twitter Card + canonical + title + description + icons + lang + theme color, in one fetch.
• POST /v1/intel/cookies — Set-Cookie response headers parsed per RFC 6265. Header-only by design; JS-set cookies need a browser and we document the limit.
• POST /v1/intel/waf — Detects Cloudflare, Akamai, Fastly, AWS WAF, Imperva, Sucuri, F5, ModSecurity, BunnyCDN, StackPath, DDoS-Guard, Wallarm, Varnish, Barracuda from response headers and (on 403/429/503) body fingerprints.
• POST /v1/intel/sri-audit — Lists every external <script src> and <link rel=stylesheet|preload> and reports Subresource Integrity coverage. Supply-chain hygiene check.
• POST /v1/intel/wayback — First and most-recent Wayback Machine snapshots via the Availability API. Surfaces rate_limited cleanly when Wayback throttles.

Catalog is now 145 endpoints across 8 families. Built from a deep-dive of the open-source MyIP and web-check projects, filtered to free data sources only.

Two single-call diagnostics that replace 5+ separate lookups.

• New: GET /v1/intel/whoami. What the public internet sees about your caller in one billed call: public IP (cf-connecting-ip / x-forwarded-for aware), IP family, geoIP, ASN + ISP, datacenter/Tor/cloud-range reputation, parsed User-Agent, and a curated echo of the request headers we observed at the edge. Aggregates /v1/intel/geoip + /v1/intel/asn + /v1/intel/ip-reputation + /v1/parse/useragent. Authorization and Cookie are explicitly never echoed. 1 credit.
• New: POST /v1/intel/http-versions. Detect which HTTP versions a URL serves — HTTP/1.1 (HEAD), HTTP/2 (negotiated via TLS ALPN), and HTTP/3 (advertised via the Alt-Svc header). Returns the negotiated ALPN protocol, TLS version, cipher, and full HSTS posture (max-age, includeSubDomains, preload). Useful for origin audits and CDN readiness checks. 1 credit, refund on error.
• The endpoint catalog is now 145 operations across 8 capability families. (As of 2026-06-10 this is up to 105 — see the newer entry.)

Two fixes worth calling out and three new endpoints.

• /v1/scrape/llm-ready now handles SPAs correctly. Anthropic, Linear, Vercel, Shopify and other modern marketing sites server-render minimal HTML and hydrate everything client-side. The endpoint was returning one chunk of 9–65 tokens of “Loading…” shell text on these pages. It now detects under-rendering, retries through a JS-capable residential pool, and falls back to plain-text extraction when Readability can’t find an article block. Same sites now return 3–5 chunks and 1,200–2,700 tokens. The response carries rendered_with_js and rendered_via for diagnostics.
• New: /v1/convert/ocr. Send a base64 image (PNG / JPEG / WebP / BMP / TIFF), get back text. Optionally bounding boxes and per-region scores. Proxies to a dedicated OCR backend — CPU-only, no GPU on your side. 1 credit per call.
• New: /v1/intel/subdomain-enumerate. Certificate-transparency-log enumeration via crt.sh. Returns the deduplicated SAN list for a domain. Passive recon — no DNS brute force, no paid feeds.
• New: /v1/enrich/company. Lite company profile from a single page: name, description, logo, socials, address, contact patterns. Built from JSON-LD Organization, OpenGraph, and an anchor scan. No paid company-data feed in the path.
• Marketing site cleanup. Killed two fake auth forms that silently dropped credentials, rewrote the AEO and MCP pages to describe real API capabilities (no more mockup dashboards), regenerated the full Postman collection from the live OpenAPI spec, and stripped lingering promises for endpoints we don’t ship.

Two weeks of work landed in one push. Headlines:

• Residential proxy is now the default outbound for every URL-fetching endpoint. Targets that were 403-ing us (FT, NYT, Bloomberg-class) now succeed transparently — proxy_used in the response carries the diagnostic. A second proxy network stays as a permanent fallback.
• PDF reader, properly fixed. /v1/convert/pdf-to-markdown now routes to a layout-aware convert backend by default. IRS forms that the legacy extractor rendered backwards (literally — ".epyt ro tnirP" instead of "Print or type") read forwards now. Layout-aware extraction, table detection, OCR fallback for scans. The legacy path still runs as a fallback when the backend's down.
• New: /v1/scrape/llm-ready. Single call: scrape → readability → tokenizer-aware recursive chunks (cl100k_base, 512 tokens default, 15% overlap). Drop the result straight into Pinecone, Weaviate, Chroma, anything. 1 credit.
• 10 new AEO/SEO/Intel endpoints, all 1 credit: /v1/aeo/freshness-signal, /v1/aeo/snippet-format-detect, /v1/aeo/heading-hierarchy-score, /v1/seo/redirect-chain-map, /v1/seo/broken-links-audit, /v1/seo/anchor-text-audit, /v1/seo/schema-validate, /v1/seo/mixed-content, /v1/intel/cert-transparency-history, /v1/seo/keyword-extract.
• Removed /v1/pdf (URL-to-PDF rendering). It hadn't worked since a legacy rendering library was dropped, and the marketing site never advertised it. Different product from PDF reading (/v1/convert/pdf-to-markdown) which is live and now better than ever.

All changes verified end-to-end with Playwright against live api.ollagraph.com. No customer code changes needed.

We rebranded from Qcrawl to Ollagraph. The reason is honest: "Qcrawl" said we were a scraping API. We aren't. Web scraping is one of eight capability families on the platform. The tagline is now "Web infrastructure for AI agents" because that's what we actually are.

What this means for you:

• Marketing site moves to ollagraph.com
• Dashboard moves to app.ollagraph.com
• API at api.ollagraph.com (api.qcrawl.com still resolves during the rebrand window)
• Your API keys (osk_*) still work. No code change needed today.
• Your credit balance, plan, webhook secret, and usage history are unchanged.

Eight capability families, 145 endpoints, one MCP server. See the new capabilities page for the full layout.

Behind the scenes, /v1/scrape and four AEO/SEO endpoints now try an internal browser-render backend before falling back to our existing provider. No customer-facing change. Same response shape. Same credit cost.

What does change: success rates go up on hard-to-fetch sites. The proxy_used field in responses now reports direct, render, or residential so you can see which path served your request.

Four endpoints that accept use_residential_proxy=true (/v1/aeo/citation-readiness, /v1/aeo/schema-coverage, /v1/seo/meta-audit, /v1/seo/snippet-candidates) now auto-refund the +3 credit surcharge when the residential fetch fails.

Previously, a Bloomberg or FT request that came back 403 still charged you 4 credits (1 base + 3 surcharge). Now: 0 credits net. Refund events are logged to your usage history.

Five new endpoints under /v1/convert/: PDF, DOCX, XLSX, PPTX, CSV → Markdown. All built on MIT-licensed open-source converters. 1 credit per call. 1 MB body cap.

Image-only PDFs are flagged in the response (likely_scanned_pdf: true) so your agent knows to use a different path. Layout-aware extraction now handles forms, multi-column papers, and scanned docs — and /v1/convert/ocr covers plain images.