Abyssale vs Placid API + MCP

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Placid API + MCP 7

We found no dated release or API change. The Headway changelog has no dates, its entries mention Integromat and a v2.0 launch, and /changelog on placid.app returns 404 (0). No dated entries in the last 90 days (0). Support by email named in the error docs, public changelog stale (4). Official PHP and Laravel libraries were last tagged v1.0.1 on 2022-07-20 and still call placid.app/api/rest (3). No CI on either library (0).

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

Placid API + MCP 34

No OpenAPI or other machine-readable contract, and the MCP tool definitions aren't published (0). /llms.txt returns 404 (0). Endpoint pages state purpose and warn that create_now may fail under high load (12). template_uuid is the one required field and status is an enum, but layers and modifications are open objects keyed by layer name (8). Request and response examples per endpoint, and an error page with six codes but no body format (9). Docs are versioned 2.0, but the changelog on Headway carries no dates and its newest entries predate the MCP server (5).

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

Placid API + MCP 40

Image, PDF and video objects are small and the MCP can be limited to chosen templates and creative types (15). We found no pagination or filter parameters on the pages we read (5). Six status codes documented without an error body format (10). No idempotency key, no MCP tool annotations we could see, and DELETE removes an image for good. Polling the polling_url is safe (3). Only template_uuid is required, but the official libraries are PHP and Laravel only, both last tagged v1.0.1 on 2022-07-20 (7).

Abyssale 41

Hosted lines, for the REST API and the remote MCP server. No status page was linked from the site or the docs, and status.abyssale.com did not answer (0). No readable incident history (5). Rate limits published in full, 10 requests a second globally and per-workspace tiers with per-minute and per-hour budgets (15). 429s carry Retry-After and X-RateLimit headers, three 429 ids say which limit was hit, failed generations cost nothing, and webhooks carry a delivery id to deduplicate on. No idempotency key on generation requests (13 of 15). The terms promise best-effort availability and leave SLAs to Enterprise contracts, so none is published (0). Generation and the MCP server are generally available, while Design Import, the JSON authoring route, is labelled alpha (8 of 10). 0 + 5 + 15 + 13 + 0 + 8 = 41.

Placid API + MCP 75

Hyperping status page at status.placid.app with separate App and API components and 90-day bars (20). No incidents are posted. The page's own figure for the API is 99.963 per cent over 90 days, roughly 48 minutes of recorded downtime with no write-up, so minor rather than clean (20). 60 requests a minute and 10 simultaneous create_now requests, documented (15). X-RateLimit-Limit, -Remaining and -Reset headers and exponential backoff advice on 429, but no idempotency key or safe-retry note for renders, which are writes (10). No SLA found on the pricing page or in the docs (0). REST API 2.0 is GA (10).

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

Placid API + MCP 34

One bearer token per project, no scopes, and the docs say nothing on revoking or rotating it (15). The MCP setup guide documents ?api_token= in the server URL for clients that can't set headers, less 10 (5). MCP settings restrict which templates and which output types (image, PDF, video, docs only) the server can use (14). Returns renders from your own templates (10). A dashboard activity log is mentioned in the changelog, nothing per call documented (5). No security.txt (404), no certification in the privacy policy and no disclosure policy found (0).

Abyssale 71

Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.

Placid API + MCP 58

Closed service under published terms, per the 30 September check (15). Privacy policy updated 18 November 2024, a DPA on request, and raw request data kept 'for a limited amount of time' with no period stated (12). No deprecation policy or dated notices. The old changelog says v1 remains functional (3). Subprocessor categories only, with 'We don't publish further details of our data processors', and no hosting location (3).