Abyssale vs Robolly

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Robolly 5

No changelog, release notes or dated API change was found. The sitemap marks every docs page as modified on 4 November 2026, which reads as a site rebuild rather than a change, so it isn't counted (0). No dated changes since 8 August (0). Support by email, with chat on higher plans; not tested (5 of 15). Not in the official MCP registry and no SDKs (0). No public package or repository (0). 0 + 0 + 5 + 0 + 0 = 5.

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

Robolly 57

No OpenAPI or other machine-readable contract found for the REST API, and the MCP server is closed. The MCP page lists all nine tools and get_template_modifications returns each template's keys, constraints and examples at run time (8 of 25, on that partial evidence). llms.txt indexes the docs (10). The MCP page says what each tool does, which tools change templates or spend credits, and that there is no delete tool (14 of 20). Modification keys follow {element-name}.{modification-key} with constraints from the template rather than a fixed schema (7 of 15). Request examples throughout and an error code table with eight codes (13 of 15). /v1 paths with no changelog (5 of 15). 8 + 10 + 14 + 7 + 13 + 5 = 57.

Abyssale 71

Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.

Robolly 49

Closed service under terms effective 8 April 2026 from Avantis Innovations LLC in Wyoming. The terms can change without notice (15). The privacy policy of the same date covers Google sign-in and Sheets data, says spreadsheet rows aren't kept beyond a render and account data is deleted with the account, and otherwise names no periods (10 of 30). No deprecation policy or notices (0). Hosting is described only as third-party vendors, with no processors or locations named, while the footer says Made in EU (2 of 20). 15 + 10 + 0 + 2 = 27.

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

Robolly 75

Nine MCP tools (25). The renders list pages with a cursor, and templates are found by name (14 of 20). Errors carry errorCode and developerMessage with eight documented codes (17 of 20). Identical renders are cached for 45 days, so repeats are free and safe, the MCP server has no delete tool, and annotations couldn't be read on the closed server (12 of 20). Renders return the file synchronously by default, but there's no SDK (7 of 15). 25 + 14 + 17 + 12 + 7 = 75.

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

Robolly 47

Bearer API key, signed render links, and MCP OAuth with one robolly:mcp scope limited to the organisation the user approves. Connections are listed and revoked under Connected AI Tools, and the API key is never shared with an OAuth client. No key scopes or rotation documented (22 of 30). The MCP server can create and update templates but not delete them; there's no read-only mode (10 of 20). Tools return the user's templates and public gallery designs (10 of 15). A renders list and the connected-tools view give some visibility, with no audit log documented (5 of 15). No security.txt (the path returns the site's HTML shell), disclosure policy, bug bounty or certification (0). 22 + 10 + 10 + 5 + 0 = 47.

Abyssale 41

Hosted lines, for the REST API and the remote MCP server. No status page was linked from the site or the docs, and status.abyssale.com did not answer (0). No readable incident history (5). Rate limits published in full, 10 requests a second globally and per-workspace tiers with per-minute and per-hour budgets (15). 429s carry Retry-After and X-RateLimit headers, three 429 ids say which limit was hit, failed generations cost nothing, and webhooks carry a delivery id to deduplicate on. No idempotency key on generation requests (13 of 15). The terms promise best-effort availability and leave SLAs to Enterprise contracts, so none is published (0). Generation and the MCP server are generally available, while Design Import, the JSON authoring route, is labelled alpha (8 of 10). 0 + 5 + 15 + 13 + 0 + 8 = 41.

Robolly 48

Hosted lines. The footer links an UptimeRobot status page, but it loads its figures from /api/, which stats.uptimerobot.com's robots.txt disallows, so the page showed no monitors or history (10 of 20 for a page that exists) and no history was read (5). A hard limit of 3 renders a second is published (15). The rate-limit error code and advice to send renders one at a time, and identical renders are cached for 45 days at no cost, which makes a retry safe; there's no Retry-After or backoff interval (8 of 15). No SLA found (0). The API isn't labelled beta (10). 10 + 5 + 15 + 8 + 0 + 10 = 48.