Abyssale vs Photoroom API

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Photoroom API 13

The last dated changelog entry is 21 April 2026 by the 9 October reading, 197 days before 4 November. The changelog sits on a paused host and was not re-read (0, cause time). No dated changelog entry in the 90 days from 6 August by that reading, and no other dated Photoroom source was found (0). A public changelog and a Discourse community where each of the 17 topics dated 30 September to 3 October 2026 had a reply, per the 9 October check. We did not open the topics to see who replied (11). No official SDK, and the official MCP registry search for photoroom returned no entry on 4 November (0). The sample code repository's last commit is a README change on 23 April 2026 and it has no CI, per a clone on 4 November (2).

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

Photoroom API 64

Per the 9 October check, not re-read on 4 November. The response body is the image itself, so an agent saves a file and reads nothing into context. outputSize, maxWidth, maxHeight, export.format and the size presets set what comes back, and the MCP server has one tool, per Photoroom (18). Nothing to paginate. Output size, format and DPI controls (15). JSON errors with a message and a documented meaning for 400, 401, 403, 402, 429 and 500, but the two APIs use different shapes and Unauthorized covers both a missing key and an empty balance (13). No idempotency key. Calls keep no state, failed calls are not billed and background.seed repeats a generated background, but a retried success is billed again. The MCP tool's annotations were not read (10). Only the image is required and defaults are sensible. No official SDK, only sample code for four platforms (8).

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

Photoroom API 86

Per the 9 October check, not re-read on 4 November. A public OpenAPI 3.1.0 description at image-api.photoroom.com/openapi, read as embedded on the docs reference page, with four operations (25). llms.txt, a Markdown twin of every page and a page with a prompt written for coding agents (10). 86 of the 87 parameters of GET /v2/edit carry a description, the operation description lists every edit, and the agent page says when to call each of the two APIs (17). 31 of 87 parameters have enums, but booleans are strings, no field of /v2/edit is marked required, and the embedded description declares neither the x-api-key header nor the pr-* model headers (10). Curl examples on every page and 400, 402 and 500 bodies in the description. 401, 403 and 429 are documented in prose only, and the two APIs use different error shapes (11). Paths are /v1 and /v2, models are pinned by dated headers and the changelog is dated back to June 2023, but the description's version is fixed at 1.0.0 and the last changelog entry is 21 April 2026 (13).

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

Photoroom API 49

Per the 9 October check, not re-read on 4 November. A team can hold several API keys and revoke each in the dashboard, with no scopes found. The key travels in the x-api-key header only. The hosted MCP server's published OAuth metadata gives an authorisation code grant with PKCE, dynamic client registration and a revocation endpoint, per the 9 October reading, and the connector page says it creates its own key for the connection (20). No read-only key. The API stores nothing to change, a sandbox key cannot spend, and a prepaid monthly allowance bounds spend (8). Returns images, not untrusted text (10). The dashboard shows usage history, GET /v2/account returns the balance, and the security page says API access logs are kept for one year on Photoroom's side (6). The security page states a SOC 2 Type 2 attestation scoped to the API with a report of April 2026, held in a trust centre drawn by script that was not read. security.txt returns 404 and no disclosure policy or bug bounty was found, so a SOC 2 claim with no readable report or disclosure route (5).

Abyssale 35

No x402, MPP or L402 (0). Seat prices are public and the credit cost of every output is published to the format, with worked examples, but a credit's price outside the plan wasn't found (15 of 20). 14-day free trial with no card (20). A person signs up in the browser; the MCP OAuth flow needs a human login (0). 0 + 15 + 20 + 0 = 35.

Photoroom API 40

Per the 9 October check, not re-read on 4 November. No x402, MPP or L402 in the docs, the OpenAPI description or the pricing pages (0). Per-image prices are public, $0.02 for background removal and $0.10 for an Image Editing call (20). Sandbox mode gives 1,000 free watermarked calls a month and a new account 10 free production calls on the Remove Background API, with no card, per the pricing page (20). A person has to create an account and activate the API in the dashboard. The MCP server also needs a Photoroom sign-in (0).