Abyssale vs Creatomate

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

Creatomate 53

No OpenAPI file linked from the docs or llms.txt (0); the 8 October check of a guessed path on the API host is struck as a request to the product's API. The MCP tool schemas can't be read without an account. llms.txt with 50 Markdown topic links (10). Reference and topic pages state purpose and when to use dry_run, templates or raw RenderScript, with an out-of-scope page (16). Render options are typed with ranges and status is an enum, but modifications and source are open objects, and unknown names are ignored without an error (9). Examples in nine languages and a documented error body for 400, 401, 402, 404, 429 and 500 (13). /v1 and /v2 paths, no changelog (5). 0+10+16+9+13+5 = 53.

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Creatomate 54

No changelog. Dated releases since 6 August are the n8n node 0.2.0 (11 August, per the 8 October npm reading), the rebuilt n8n node v1.0.0 (11 September) and v1.0.1 (19 September, a category metadata fix, half), and @creatomate/preview 1.6.1 (3 September, removing a dependency and type definitions from the build, half). The newest release that changes code is n8n v1.0.0, 54 days before the check (20). Three counted entries in 90 days (20, cause evidence; it drops to 0 after 9 November when 0.2.0 leaves the window). Support by email, no public changelog or forum found, and two open GitHub issues across the libraries per the 8 October check (5). The Node library was last tagged 1.2.1 on 23 September 2024 and calls /v1, the PHP library was last pushed on 21 October 2024, and the Preview SDK is current (7). No CI in the Node repository (2). 20+20+5+7+2 = 54.

Abyssale 71

Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.

Creatomate 52

Closed service under published terms, with MIT client libraries (15). Render retention of 30 days is stated the same way in the docs, pricing page and llms.txt. The privacy policy is dated 27 June 2022 with no retention period for personal data, no DPA was found, and the terms let Creatomate make user Content available to other users (12). No deprecation policy, and /v1 and /v2 are documented side by side with no dates (2). The privacy policy names Paddle, AWS, DigitalOcean, Google Analytics, Cloudflare and GitLab, with no data locations (8). Terms and privacy policy re-read on 4 November, both still dated 27 June 2022. 15+12+2+8 = 37.

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

Creatomate 67

Eight MCP tools on the vendor's list, re-read on 4 November, definitions unseen, and the template list omits sources (22). A tags filter on the template list, with no pagination, limit or render list found (6). The API reference documents a hint and a documentation URL on 400, 401, 404 and 429, a hint on 402 and 500, plus advisory errors and warnings and a free dry_run (20). No idempotency key. dry_run and status polling are safe, and template delete is now described as a soft delete that an open editor can restore; MCP annotations were not readable (8). template_id alone starts a render, and the Node and PHP libraries are official but last published in 2024 (11). 22+6+20+8+11 = 67.

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

Creatomate 48

MCP uses OAuth authorisation code with PKCE S256 and dynamic client registration, one scope, with connections revocable per application. REST uses one unscoped key per project, and key rotation is not documented (22). Each MCP connection reaches one project and a project can have a monthly credit budget, but there is no read-only mode and no server-side confirmation before a render or delete (8). Returns the account's own templates and renders (10). Account Settings lists MCP connections with last use, and the dashboard has an API log of renders (8). No security.txt, disclosure policy, bounty or certification found (0). No security.txt (404 on 4 November). 22+8+10+8+0 = 48.