Abyssale vs Layerre

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

Layerre 69

13 MCP tools (15 for 11 to 30), with no toolsets or read-only subset (15). Template and variant lists take skip and limit, and templates filter by tag and q and can leave out layers (16 of 20). 422 validation bodies and a JSON 429 with retry_after (17 of 20). Every tool is annotated, read tools with readOnlyHint and idempotentHint, updates idempotent, no tool destructive, and the server has no delete tool. The REST API has no idempotency keys for variant creation (16 of 20). Few required fields, but no official SDK; a Postman collection and the MCP package only (5 of 15). 15 + 16 + 17 + 16 + 5 = 69.

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

Layerre 87

Public OpenAPI 3.1 at layerre.com/openapi.json with 16 operations, and zod schemas on all 13 MCP tools in the open-source server (25). llms.txt, auth.md and Markdown mirrors of the pricing, FAQ and integration pages (10). Every operation has a description, and tool descriptions note costs such as 'an expensive operation that may take 10-30 seconds', without saying when not to use a tool (15 of 20). Layer properties have minimums, maximums and enums such as text_align, and list calls cap limit at 1,000 (14 of 15). 88 examples in the spec, and 404, 422 and 429 responses documented on most operations (13 of 15). Versioned /v1 paths and dated What's New pages, read from the sitemap since the pages are drawn by script; the API itself is version 0.1.0 (10 of 15). 25 + 10 + 15 + 14 + 13 + 10 = 87.

Abyssale 35

No x402, MPP or L402 (0). Seat prices are public and the credit cost of every output is published to the format, with worked examples, but a credit's price outside the plan wasn't found (15 of 20). 14-day free trial with no card (20). A person signs up in the browser; the MCP OAuth flow needs a human login (0). 0 + 15 + 20 + 0 = 35.

Layerre 25

No x402, MPP or L402 (0). Plan prices are public with render counts, and one import or one variant is one render, so the price a render follows from the plan (about $0.03 on Starter, $0.005 on Pro) without being published per unit (15 of 20). Free plan of 50 renders a month with API access; the pricing page doesn't say whether a card is needed (10 of 20, half as with an unstated card rule). A person signs up and creates the key, or approves OAuth in a browser (0). 0 + 15 + 10 + 0 = 25.

Abyssale 71

Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.

Layerre 63

The MCP server is MIT. The service is closed under terms of 13 August 2026 that name a sole proprietorship in Ontario (20 of 30). The privacy policy and DPA of the same date agree. Data is kept while the account is active and deleted from production on account deletion, with limited backups. Design files aren't used to train public AI models. Google Analytics runs on accepted cookies (24 of 30). No deprecation policy or notice period (0). Ten subprocessors listed with purpose and location in both documents, including Supabase, Stripe, Cloudflare, Google, Resend, Canva and Slack (20). 20 + 24 + 0 + 20 = 64.

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

Layerre 48

OAuth 2.1 with PKCE for MCP through a Supabase authorisation server, and revocable lyr_ API keys with rotation in the dashboard. No scopes documented for either, and auth.md says the REST API has no OAuth yet (22 of 30). The MCP server cannot delete templates, change billing or manage API keys, but there is no read-only key or endpoint (12 of 20). Tools return the user's own templates and renders; template import fetches a Canva link the user gives (10 of 15). The open-source server emits audit log lines for each tool call for whoever runs it, and nothing per call is documented for the hosted service (4 of 15). No security.txt (the path returns the site's HTML shell), disclosure policy, bug bounty or certification (0). 22 + 12 + 10 + 4 + 0 = 48.

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Layerre 78

@layerre/mcp-server 0.1.0 published to npm on 29 October 2026, 8 days before this check (30). MCP server commits from 19 to 24 October, the registry entry of 29 October, and What's New entries dated 21 August and 18 October in the sitemap (20). The repository is a week old with no issues to judge; support by email and in-app chat (5 of 25). com.layerre/layerre is in the official MCP registry under a domain-verified namespace (15). CI runs the vitest suite on push and pull requests to main on Node 22 (8 of 10). 30 + 20 + 5 + 15 + 8 = 78.