Alpha Vantage vs Twelve Data

Alpha Vantage 30

Graded as a hosted service. No status page was found. The site links none and status.alphavantage.co has no valid certificate (0). With no page there is no incident history to read (5). Limits are published with numbers, 25 requests a day on a free key and 75 to 1,200 a minute on premium plans (15). No 429, Retry-After or backoff guidance was found, and in our test calls a missing key and an unknown function both returned HTTP 200 with a text field (0). No SLA was found, and the terms supply the service as is (0). The REST API is generally available (10). Total 30.

Twelve Data 83

Read with the hosted lines. A public status page at twelvedata.isitup.cloud lists Price API, Fundamentals API, WebSocket and Website with uptime figures (20). Its history shows two incidents in the 90 days to 3 November 2026, 20 minutes of unavailability across the three APIs on 1 September and 16 minutes on the WebSocket on 14 October, minor only (20). Limits are published with numbers, credits a minute by plan from 8 to 10,946 and 800 a day on Basic (15). The docs document a 429 on the limit and the usage endpoint, with no Retry-After or backoff guidance; reads only (8 of 15). The terms sell a 99.9 per cent SLA with service credits, and the Enterprise plan carries 99.99 per cent (10). The REST API and MCP server are generally available (10). 20 + 20 + 15 + 8 + 10 + 10 = 83.

Alpha Vantage 46

The surface graded is the REST API, with the official MCP server noted. No OpenAPI document was found for the API. The MCP server's tools carry typed inputs generated from Python signatures (10 of 25). /llms.txt returns 404, and the only Markdown is the MCP README (3 of 10). Each function has a purpose statement, a parameter list and a premium marker, with little on when not to use it (13 of 20). Required and optional parameters are marked and allowed values listed in prose, while MCP inputs such as interval are plain strings with no enums (8 of 15). Every function has demo URLs and code in four languages, but no error responses are documented (8 of 15). The API has no version and no changelog. The MCP repository's changelog stops at 0.3.2 on 27 February 2026 with later changes under Unreleased (4 of 15). Total 46.

Twelve Data 83

A public OpenAPI 3.1 document covers 187 operations, every one with a description and 200, 400, 401, 403, 404, 414, 429 and 500 responses, and the MCP tools in the source carry typed inputs and annotations (25). llms.txt on the site and in the docs link Markdown pages per section, pricing.md and auth.md (10). Descriptions state purpose, plan requirement and credit cost, with little on when not to use an endpoint (16 of 20). Required parameters are marked and the Markdown lists interval, adjust and type values, but none of the 3,091 parameters in the spec declares an enum (9 of 15). Examples with a demo key on every endpoint and an error table with codes and meanings (13 of 15). No version in the path, a spec at version 0.0.1, and monthly dated product updates on the news page rather than an API changelog (10 of 15). 25 + 10 + 16 + 9 + 13 + 10 = 83.

Alpha Vantage 54

outputsize=compact returns the latest 100 points, datatype=csv shortens long series, and the MCP server previews anything over 32,000 tokens with a link to the full data. No field selection (15 of 25). limit and time filters on news and a month parameter for intraday history, with no pagination elsewhere (10 of 20). Errors and limit notices arrive as HTTP 200 with free text under Error Message or Information, undocumented (5 of 20). Every call is a GET read, and all MCP tools carry readOnlyHint true and destructiveHint false (16 of 20). Few required parameters and sensible defaults. No official SDK, only a Python CLI and community libraries (8 of 15). Total 54.

Twelve Data 84

The REST API is the surface graded. outputsize 1 to 5,000 with a default of 30, format=CSV, dp, date ranges and batch requests size responses, and the MCP server lists 27 tools (20 of 25). Date ranges, outputsize and exchange, country and type filters, with no cursor pagination (15 of 20). Error codes with meanings an agent can branch on, 403 for plan limits and 429 for credits (16 of 20). Every operation is a read, and the MCP source marks tools readOnlyHint (18 of 20). Few required parameters, a demo key, and official SDKs in Python, Node.js, Go, Java and R (15). 20 + 15 + 16 + 18 + 15 = 84.

Alpha Vantage 32

One key per account with no scopes, documented only as apikey= in the query string, and replaced by emailing support. The hosted MCP server adds OAuth 2 with PKCE, dynamic client registration and one read scope (20 less 10 for the query string, so 10). Every function is read-only (15 of 20). News, sentiment and earnings transcripts are third-party text, and no guidance on treating them as untrusted was found (5 of 15). No usage log or per-call record for the key holder was found (0 of 15). security.txt returns 404, and no disclosure policy, bug bounty or certification was found. A report of keys in plain-text logs, GitHub issue 13, was closed within three days in April 2026 (2 of 20). The server source still writes the key and tool arguments into its own analytics records. Total 32.

Twelve Data 54

The REST key is a plain per-account key with no scopes, accepted as a header or as ?apikey= (20 less 10 for the query string). The hosted MCP server refuses keys and uses OAuth 2.1 with PKCE, a resource indicator, refresh tokens, revocation and one scope, which lifts the credential model for that surface (18 of 30). Every operation is a read (15 of 20). Company news is third-party text and no guidance was found (5 of 15). An /api_usage endpoint and dashboard usage give the key holder a view of consumption, not a per-call log (6 of 15). A trust centre on SafeBase lists SOC 2, GDPR and CCPA and ten policies; no security.txt, disclosure process or bug bounty was found (10 of 20). 18 + 15 + 5 + 6 + 10 = 54.

Alpha Vantage 63

The MCP server repository, which a workflow deploys to the hosted server, had its last commit on 3 October 2026, and the site footer says it was updated in October 2026 (30). No tags, and the newest PyPI release is 17 March 2026, so there are no dated releases in the last 90 days, though the repository shows over 30 commits since 21 July (8 of 20). Pull requests 14 and 18 were merged within a day and issue 16 closed in a day, while issue 17, a reported startup crash, has been open since 4 September. Support is by email (10 of 25). The server sits in the official MCP registry under the vendor's GitHub namespace, with no official SDKs (12 of 15). The published package leaves its mcp dependency unpinned, and the workflows deploy and publish without a visible test run (3 of 10). Total 63.

Twelve Data 82

Read as a closed service. The newest dated change is the product update of 12 October 2026, with the MCP repository changed on 1 October and the world-model dataset repository on 31 October (30). Monthly updates dated 12 August, 12 September and 12 October 2026 (20). A monthly changelog, a support portal, a sales contact and a Telegram channel; replies on the MCP repository's issues were not read (10 of 15). Six official SDKs and a CLI, twelvedata-python at v1.4.0 of 27 April 2026 (15). The MCP server pins its dependencies with reasons and ships tests; the Python SDK's changelog stops at version 0.1 (7 of 10). 30 + 20 + 10 + 15 + 7 = 82.

Alpha Vantage 50

A closed service under short terms that are clear on scope, personal and non-commercial by default, with the MCP server under MIT (15 of 30). The privacy policy of 25 August 2025 describes the website, keeps personal data 'only for as long as is necessary' with no periods, and no DPA was found. It does not describe the request analytics visible in the MCP server source (8 of 30). No deprecation policy. The MCP README marks the key-in-URL connection deprecated with no date, and the changelog flags breaking changes (3 of 20). Google Analytics, Mixpanel, GitHub, GitLab, PayPal or Braintree and Stripe are named, and data is processed in the United States (10 of 20). Total 36.

Twelve Data 67

A closed service under terms that name the entity, define internal use, business use and redistribution, and were last updated 1 January 2026; the MCP repository is open source but ships no licence file (15 of 30). The privacy policy of 22 September 2026 states retention periods and names its processors, the terms require data deletion within 30 days of termination, and no DPA is named (20 of 30). No deprecation policy or notice period; the terms allow changes and the monthly updates record them after the fact (3 of 20). Subprocessors are named on the privacy policy and the trust centre, with no data locations beyond transfer mechanisms (12 of 20). 15 + 20 + 3 + 12 = 50.