Abyssale vs Pictify

Abyssale 71

Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.

Pictify 52

The MCP server is MIT. The service is closed under terms of 18 July 2024 that name only Pictify.io (20 of 30). The privacy policy of the same date keeps data 'for as long as necessary' with no periods, names no processors and doesn't mention that the MCP server sends tool arguments, results and the account email to PostHog (6 of 30). The changelog records retirements, Workflows in September 2026 and MCP tools on 19 September, with no notice period or deprecation policy (5 of 20). MCP analytics are on by default and disclosed with an opt-out in the README only, and no subprocessors or data locations are listed (8 of 20). 20 + 6 + 5 + 8 = 39.

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Pictify 68

@pictify/mcp-server 2.0.0 published on 20 September 2026, 47 days before this check, with the changelog's newest entry dated September 2026 (20). Since 8 August, MCP versions 1.5.0 (8 August), 1.5.1 (11 August) and 2.0.0 (20 September), and changelog entries for August and September (20). GitHub issues weren't read, and the repository has one committer (5 of 25, unchecked). io.github.pictify-io/mcp is in the official MCP registry under the GitHub-verified namespace at 2.0.0, and official SDKs exist in four languages (15). CI builds and runs tests on push and pull requests (8 of 10). 20 + 20 + 5 + 15 + 8 = 68.

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

Pictify 74

25 MCP tools in the 2.0.0 source (15 for 11 to 30), with no toolsets or read-only subset (15). List endpoints page with page and limit (16 of 20). Error bodies carry code slugs such as quota_exceeded, template_limit_reached and invalid_variable, and the docs say which are retryable (18 of 20). Generation is safe to retry and failed calls bill nothing, but the MCP source sets no readOnlyHint or destructiveHint, and the delete tools for templates and video templates run without a confirmation step (10 of 20). Official SDKs for Node.js, Python, Go and Ruby, sensible defaults such as 1200 x 630 PNG (15). 15 + 16 + 18 + 10 + 15 = 74.

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

Pictify 88

Public OpenAPI 3.1 at docs.pictify.io/openapi/v1.yaml with 20 paths (25). llms.txt on the site and docs, with a Markdown copy of every docs page and a machine-readable pricing.md (10). Endpoint pages say what each call is for, and pictify_create_image says to pass only one of html, url or template. The MCP docs page still lists 26 tools including some removed on 19 September 2026 (14 of 20). Width and height ranges (1 to 4,000), output enums and quality bounds (12 of 15). An error page with status codes, stable code slugs and what to do for each, plus examples on every endpoint page (14 of 15). Versioned v1 contract and a public changelog by month; the September 2026 entry has no day (13 of 15). 25 + 10 + 14 + 12 + 14 + 13 = 88.

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

Pictify 45

Prefixed API keys that can be rotated or revoked at once in the dashboard, with no scopes. The hosted MCP endpoint's metadata names api.pictify.io as authorisation server with one mcp:tools scope, not described in the docs (22 of 30). No read-only key or mode, and delete tools need no confirmation (5 of 20). The URL screenshot and render tools return images and URLs rather than page text, and an SSRF protection page documents how fetches are limited (10 of 15). A dashboard usage view and webhook events for renders, with no per-call audit log (5 of 15). No security.txt, disclosure policy, bug bounty or certification found; docs pages on key handling and SSRF only (3 of 20). 22 + 5 + 10 + 5 + 3 = 45.

Abyssale 35

No x402, MPP or L402 (0). Seat prices are public and the credit cost of every output is published to the format, with worked examples, but a credit's price outside the plan wasn't found (15 of 20). 14-day free trial with no card (20). A person signs up in the browser; the MCP OAuth flow needs a human login (0). 0 + 15 + 20 + 0 = 35.

Pictify 40

No x402, MPP or L402 (0). Overage prices per render published without login, $0.02 on Basic, $0.01 on Pro and $0.005 on Business, with plan prices (20). Free plan of 50 renders a month, marked no card and no watermark (20). A person signs up and creates the key in the dashboard (0). 0 + 20 + 20 + 0 = 40.