Abyssale vs Templated API + MCP

Abyssale 41

Hosted lines, for the REST API and the remote MCP server. No status page was linked from the site or the docs, and status.abyssale.com did not answer (0). No readable incident history (5). Rate limits published in full, 10 requests a second globally and per-workspace tiers with per-minute and per-hour budgets (15). 429s carry Retry-After and X-RateLimit headers, three 429 ids say which limit was hit, failed generations cost nothing, and webhooks carry a delivery id to deduplicate on. No idempotency key on generation requests (13 of 15). The terms promise best-effort availability and leave SLAs to Enterprise contracts, so none is published (0). Generation and the MCP server are generally available, while Design Import, the JSON authoring route, is labelled alpha (8 of 10). 0 + 5 + 15 + 13 + 0 + 8 = 41.

Templated API + MCP 65

Better Stack status page with API, App and Website components over 30, 60 and 90 days (20). The incidents page lists no incident for September, October or November 2026 and the RSS feed holds no entry, so the page has never posted one. This run scores a page that has never posted an incident 20, not the 30 of a clean record, and the page's own figure for the API is 100 per cent over 90 days (20). Rate limits per plan in the Markdown price list, 60, 150 and 300 requests a minute (15). No 429 behaviour, Retry-After or retry advice in the API docs or llms-full.txt. MCP 1.9.0 tells the model to wait and retry after a 429, which isn't API documentation (0). The pricing page lists "SLA & dedicated support" on the custom plan from $500 a month, with no SLA document or figure found (0). The render API is GA. Video launched on 7 January 2026 as "now live" (10). 20 + 20 + 15 + 0 + 0 + 10 = 65.

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

Templated API + MCP 74

No OpenAPI. All 25 MCP tools carry typed JSON Schema inputs, and server.json is published to the MCP registry, so partial credit (18). llms.txt, llms-small.txt, llms-full.txt, pricing.md and a Markdown version of every page (10). Some MCP descriptions guide the model well (update_template explains pages versus layers, create_render names get_template_layers first), others are one line (12). Format and layer type enums and a required template field, and MCP 1.9.0 caps list limits at 100 in the schema, but size, scale and fps limits sit in prose rather than min and max, and layers is an open object (10). Request and response examples per endpoint. Error tables with status codes appear on five endpoints (font, render, template and upload deletes and template update), none on create render (9). Versioned /v1 path, a dated changelog now at templated.io/changelog/ and tagged MCP releases (15). 18 + 10 + 12 + 10 + 9 + 15 = 74.

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

Templated API + MCP 70

25 MCP tools (15), plus results passed through field allowlists, and MCP 1.9.0 prunes JSON results (get_template_layers about 78 per cent smaller by the release note) (3). Lists take page and limit, default 25 and at most 100 in the MCP, and the MCP can filter to one folder or external ID (17). The API docs give status tables on five endpoints. MCP 1.9.0 (8 October 2026) turns each status into an instruction, such as calling the list tool for a missing ID, reconnecting on 401 or waiting for Retry-After on 429, and rejects unknown layer names before rendering (12). Every tool carries readOnlyHint and destructiveHint, with deletes and template updates marked destructive. No idempotency key (15). Only template is required and renders are synchronous by default, but there are no official SDKs, only code samples in JavaScript, Python and PHP (8). 18 + 17 + 12 + 15 + 8 = 70.

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

Templated API + MCP 42

The REST key has full account access by the docs' own words, and the privacy policy says it can be regenerated. The hosted MCP is an OAuth 2.1 resource server since MCP 1.6.0 (18). The MCP setup guide still documents ?apiKey= in the server URL for automations, less 10 (8). Folder and external ID scoping is enforced server side, and destructive tools are annotated so clients can ask first. No read-only key (12). Tool results pass through allowlists, and the docs describe server-side scoping as a guard against prompt injection (12). No audit log or per-call log found for the customer beyond the render list (3). A valid security.txt since 28 October 2026 (Last-Modified), sending reports to support@templated.io and expiring 8 October 2027, and 2FA since September 2026. No certification or bug bounty found (7, as a valid security.txt to a support address with nothing else). 8 + 12 + 12 + 3 + 7 = 42.

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Templated API + MCP 80

mcp-server-templated v1.9.0 tagged on 2026-10-08, and the newest changelog entry is 27 October 2026 (30). Six MCP tags in the 90 days from 4 August (v1.4.0 and v1.4.1 on 5 August, v1.7.0 and v1.7.1 on 8 September, v1.8.0 on 6 October, v1.9.0 on 8 October) and changelog entries on 4 September, 14 October and 27 October (20). Dated public changelog and support by email. GitHub issue response wasn't checked (github.com refuses our requests) (10). Listed in the official MCP registry as io.github.templated-io/mcp-server-templated, with 1.9.0 published on 8 October by GitHub OIDC from CI (15). @modelcontextprotocol/sdk 1.32.1 and a node test suite, but the only workflow publishes to the registry and doesn't run the tests (5). 30 + 20 + 10 + 15 + 5 = 80.

Abyssale 71

Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.

Templated API + MCP 76

MCP server MIT with a LICENSE file. The rendering service is closed under published terms (18). Privacy policy updated 18 October 2026 with retention stated per data type (until you delete, files purged within 90 days of deletion, logs up to 90 days, billing records five years) and a DPA at templated.io/dpa, though it doesn't say whether customer content trains models (25). No deprecation policy or dated deprecation notices found (0). Subprocessors named by purpose, including Gemini, OpenAI, Anthropic and DeepSeek for AI functions, Photoroom for background removal, PostHog and Plausible for analytics and Stripe, Creem and Spedy for payments (18). 18 + 25 + 0 + 18 = 61.