Abyssale vs Shotstack

Abyssale 41

Hosted lines, for the REST API and the remote MCP server. No status page was linked from the site or the docs, and status.abyssale.com did not answer (0). No readable incident history (5). Rate limits published in full, 10 requests a second globally and per-workspace tiers with per-minute and per-hour budgets (15). 429s carry Retry-After and X-RateLimit headers, three 429 ids say which limit was hit, failed generations cost nothing, and webhooks carry a delivery id to deduplicate on. No idempotency key on generation requests (13 of 15). The terms promise best-effort availability and leave SLAs to Enterprise contracts, so none is published (0). Generation and the MCP server are generally available, while Design Import, the JSON authoring route, is labelled alpha (8 of 10). 0 + 5 + 15 + 13 + 0 + 8 = 41.

Shotstack 95

Hosted lines. Public status page at status.shotstack.io with monitors, the Edit API in production among them (20). Its feed and incident pages hold no incident in the 90 days from 4 August 2026. The newest incident, number 8 (range parameters in render payloads causing failures, 21 July 2026), left the window on 20 October, /incidents/9 answers 404, and the window holds only two completed maintenance windows (11 August, rendering stayed available; 4 and 5 September, billing, with the API fully available). A readable page that posts incidents, none in the window, is a clean record (30, was 20). Rate limits per API key in a fixed 60-second window, 300 for Edit, 600 for Serve and 300 for Ingest in production (15). A 429 returns rate_limit_error with advice to wait for the window and retry with exponential backoff, and POST /generate takes an Idempotency-Key, but POST /render has none and no Retry-After is documented for rate limits (10). Schedule 2 of the terms is an SLA of 99.9 per cent with a 10 per cent credit, free plans excluded (10). The Edit API is v1 and neither the MCP server nor the CLI carries a beta label (10). 20 + 30 + 15 + 10 + 10 + 10 = 95.

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

Shotstack 63

15 MCP tools by the vendor's list, with the authoring guide loaded on demand through get_shotstack_guide and skill references read only when relevant (18). No pagination, limit or filter on the template or source lists in the definition. The CLI prints JSON with --output json (6). Errors carry status, title and detail, confirmed on a 401, generation errors carry a code, the CLI validates offline and exits 0, 1 or 2 for success, permanent and retryable failures (17). Idempotency-Key and a result cache on generation and a free quote, but no idempotency on renders, and MCP annotations were not readable (12). Smart clip lengths and a default v1 environment keep requests short. Five official SDK repositories exist, but the npm and PyPI packages date from July 2024 (10).

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Shotstack 73

API definition 1.23.3 (@shotstack/schemas) tagged on 27 October 2026, six days before the check, after 1.23.0 on 15 October added a source file on generation assets (30). 21 definition tags and 13 CLI tags (0.8.x to 0.15.2, the last on 22 October) since 4 August 2026, and the skill repository synced from CLI 0.16.0 to 0.17.0 between 25 and 30 October (20). Dated changelog for the definition in its repository, in-app support on every plan and a GitHub issue template for the CLI. Issue threads were not read (8). @shotstack/cli and @shotstack/schemas are current, while npm shotstack-sdk 0.2.9 dates from July 2024 per the 8 October check; the PyPI release date came from a path pypi.org's robots.txt disallows and is struck, and pypi.org didn't resolve on 2 November. The MCP registry entry was not checked (7). The definition repository runs build, smoke and example tests on pull requests. Since 25 October the CLI repository holds only the agent skill and says the CLI's source isn't published there, so its release tests can no longer be read (8). 30 + 20 + 8 + 7 + 8 = 73.

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

Shotstack 88

Public OpenAPI 3.0.1 definition of the Edit API with 14 operations and 122 schemas. The MCP tool schemas need a signed-in account and were not read (25). llms.txt, llms-full.txt and a Markdown twin of every guide page (10). The conventions guide and MCP page say when to use studio or render_video and name the five commonest mistakes (17). 84 enums and required fields across the schemas, with per-model generation options published as JSON Schema by GET /models (13). 367 examples in the definition. Error responses are documented for the generation endpoints, while render and template operations document only the success response (10). v1 and stage in the path and a dated changelog for the definition, less 2 because release 1.22.0 removed a response field in a minor version (13).

Abyssale 35

No x402, MPP or L402 (0). Seat prices are public and the credit cost of every output is published to the format, with worked examples, but a credit's price outside the plan wasn't found (15 of 20). 14-day free trial with no card (20). A person signs up in the browser; the MCP OAuth flow needs a human login (0). 0 + 15 + 20 + 0 = 35.

Shotstack 45

No x402, MPP or L402 (0). Public per-minute prices, 20 cents on pay as you go down to 5 cents on Volume, with AI generation priced per model through a quote endpoint and four examples on the pricing page (20). 10 credits for 30 days with no card, and a free watermarked sandbox (20). Checking an edit and opening a Studio preview need no key, but any render needs a key from a browser signup (5).

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

Shotstack 48

The MCP server uses OAuth authorisation code with PKCE S256 and dynamic client registration, with one scope, mcp:tools. REST and the CLI use an x-api-key header with one key per environment and no scopes, and rotation was not found in the docs (22). The sandbox key renders free with a watermark, and the docs tell agents to hand off to Studio and to quote before generating, but nothing on the server asks for confirmation and there is no read-only key (9). Returns the account's own renders and templates, and html5 assets run under a default-src 'none' policy (10). Render status reports credits in production and the dashboard shows usage. No audit log was found (4). No security.txt, disclosure policy, bounty or certification of Shotstack's own. The DPA lists technical measures and relies on AWS's audit reports (3).