Amazon Location Service vs NextBillion.ai

Amazon Location Service 95

Hosted reading. AWS Health Dashboard with a feed per service and region (20). The Amazon Location feeds for us-east-1 and eu-west-1 held no events on 1 November 2026 (last built 31 October), and the dashboard's event history, re-read on 1 November, names Amazon Location in no event. Its oldest event is the us-east-1 one of 28 October 2025, the open Middle East events of March 2026 don't list it, and the newest update is the API Gateway us-west-2 event of 30 October 2026. The public dashboard lists only broad events, so a clean feed says less than a small vendor's detailed page (30). Default rates published per operation, re-read on 1 November, 100 a second for each Places call, 20 for CalculateRoutes, isolines and SnapToRoads, 5 for CalculateRouteMatrix and OptimizeWaypoints, with a burst of 80 per cent (the burst rule per the 8 October check) (15). Throttling returns ThrottlingException with HTTP 429, marked retryable in the service model, and every v2 call is a read, but the guide gives no backoff or Retry-After guidance (10 of 15). Amazon Location SLA at 99.9 per cent monthly uptime per region (last updated 5 May 2022, re-read on 1 November) (10). GA (10). 20 + 30 + 15 + 10 + 10 + 10 = 95.

NextBillion.ai 45

Hosted lines, for the REST APIs at api.nextbillion.io and the hosted MCP server. A status page at status.nextbillion.io, 'NextBillion.AI API Status', renders only in a browser, and its Statuspage-style JSON paths return 404, so we couldn't see its components (10) or read any history. That's our limit, not a finding, and the rubric gives 5 (5). The API reference states 2,400 queries a minute, or 40 a second, for continuous requests (15). Each endpoint's error table lists 429 as 'QPM or API request count quota reached', with no Retry-After or backoff guidance (5). No SLA found; the terms say access isn't warranted to be uninterrupted (0). The REST APIs are GA. The MCP server is at version 0.5.3 (10). 10+5+15+5+0+10 = 45.

Amazon Location Service 76

Three credential routes, SigV4 with IAM, Amazon Cognito, and API keys limited to named actions and resources with optional expiry and referrer or app restrictions, which earns 30 (the API key page re-read on 1 November). Less 10 because the API key is sent in the key query parameter, the only documented way to present it (20). API keys reach only read calls on Maps, Places and Routes, and IAM policies scope each action and resource (18 of 20). Results carry place names and third-party map data, and no prompt-injection guidance was found in the reviewed documentation (5 of 15). CloudTrail records management events by default and data events on request, and CloudWatch reports usage by ApiKeyName (15). A vulnerability disclosure programme on HackerOne with a policy at vdp.aws.security, public security bulletins (none from 17 October to 1 November names Amazon Location), audit reports in AWS Artifact, Amazon Location Service in SOC 1, 2 and 3 scope on the list updated 11 August 2026 (per the 17 October check), and a FedRAMP High announcement of 28 October 2024. The aws.amazon.com security.txt, re-read on 1 November, expires on 16 October 2027. No paid bug bounty was found, so 2 points stay held back, as on the S3, SES, Polly and Secrets Manager re-checks of 17 October and the S3 re-check of 1 November (18 of 20). 20 + 18 + 5 + 15 + 18 = 76.

NextBillion.ai 46

The REST APIs take a single key query parameter, so a plain key that travels in URLs, which earns 20 less 10. The MCP server adds OAuth 2.1 with PKCE, seals the key into tokens with AES-256-GCM, accepts a Bearer header and stores nothing server-side, so 5 back (15). Every tool is read-only, and keys can carry an IP allowlist (12). Places results are POI and address text with no prompt-injection guidance (7). Usage alerts at 50, 75 and 90 per cent of credits, per the pricing FAQ. No per-call log found (5). /.well-known/security.txt returns 404, and we found no disclosure policy or bug bounty. The about page says the company follows ISO 27001 standards, without naming a certificate (7). 15+12+7+5+7 = 46.

Amazon Location Service 77

Closed service under the AWS Service Terms (last updated 30 October 2026, re-read on 1 November), whose section 82 sets out storage, caching and attribution rules in detail (15 of 30). The guide says device positions are kept 30 days, geofences until deleted, and that queries are stripped of customer metadata before they go to data providers (per the 8 October check). Section 82.1 agrees and adds that providers may process requests outside the chosen region. No retention period was found for Places and Routes requests (20 of 30). Section 82.3 still allows AWS to change or drop a provider or feature on notice "where practicable", and no dated deprecation notice or end date for the v1 APIs was found (5 of 20). AWS's sub-processor page, re-read on 1 November (last updated 30 October 2026), lists Esri for Amazon Location in Australia, Germany and the USA and Grabtaxi Holdings and HERE North America in Ireland, Japan, Singapore and the USA, says processing happens in the customer's selected Regions and the providers' locations, and promises 30 days' notice of a new sub-processor. The region is chosen per request (20 of 20, as for S3, SES and Secrets Manager). 15 + 20 + 5 + 20 = 60.

NextBillion.ai 58

Editorial half only. Closed service under terms that name NextBillion.ai Pte. Ltd. and Singapore law, and an Apache-2.0 MCP server (18). The privacy policy keeps personal data while a legitimate business need exists, with no periods given. The MCP README says only tool arguments are sent to the API and nothing is retained between requests (14). No deprecation policy or dated notices found. The terms promise 10 days' notice of material changes to the terms (3). Data is mainly processed in Singapore, with transfers abroad under standard clauses. No sub-processor list found (8). 18+14+3+8 = 43.

Amazon Location Service 87

The Smithy service models for geo-places, geo-routes, geo-maps and location (API version 2020-11-19) are public in aws/api-models-aws and in every AWS SDK, a machine-readable contract in the role OpenAPI plays (25). llms.txt for the developer guide, a Markdown twin of each page and the whole guide as full.md (10). A choose-an-API page and per-operation pages with use cases say when each call fits, with less on when not to use one (15 of 20). Inputs carry enums and ranges, such as MaxResults 1 to 100 and QueryText up to 200 characters (15). How-to pages give sample requests, responses, cURL and CLI commands, and each action lists its errors with HTTP codes, but the ValidationException fields are documented as "Test stub" (12 of 15). Versioned paths (/v2/), yet the document history, re-read on 1 November, still has one entry, dated 31 October 2024, and changes are announced only in AWS What's New posts (10 of 15).

NextBillion.ai 73

No OpenAPI document for the REST APIs was found in llms.txt or the docs. The hosted MCP server's 27 tools are defined with Zod schemas, so they carry typed JSON Schema inputs (15 of 25). llms.txt, llms-full.txt and a Markdown file for each docs page (10). Endpoint pages explain each parameter, and MCP tool descriptions say when not to use a tool, such as the geometry tools being straight-line rather than road distance (16). Parameter tables give types, allowed values and defaults, such as types and limit (default 10), though in packs several filters into one string (12). curl examples and a per-endpoint error table with causes (13). The MCP server has a dated changelog. No API changelog or versioned path was found (7). 15+10+16+12+13+7 = 73.

Amazon Location Service 60

Read as a closed service, by the listing's own service models, as the S3 re-check of 1 November read models/s3. The newest API change is still the geo-maps model on 17 August 2026 (point-of-interest density and category filters on maps), 76 days before the check. The models repository had commits to 30 October, none touching the geo-places, geo-routes, geo-maps or location models (20 of 30). In the last 90 days we found that one model change plus two releases of the agent context package, v1.1.0 on 6 August and v1.2.0 on 11 September 2026, with no later tag. The two package releases are agent guidance for the service, not changes to it, so half, as manifold-mcp's skills releases were read (10 of 20). AWS What's New posts for the service run to 2 April 2026 (none in the feed's 100 items from 20 to 30 October), re:Post and paid support exist, and the agent context repository had no open issues on 8 October (10 of 15). Official SDKs are current, the aws-sdk-js-v3 release v3.1161.0 and boto3 1.43.123, both tagged 30 October 2026 (15). SDKs regenerate from the model on AWS's release train, CI not checked (5 of 10). 20 + 10 + 10 + 15 + 5 = 60.

NextBillion.ai 73

MCP server 0.5.3 on 30 October 2026 (30). Eleven tagged MCP releases between 7 October and 30 October, adding hosted mode, truck routing and geometry tools (20). Support by email, a public MCP repository with a changelog, but no public API changelog (8). The MCP server isn't in the official MCP registry, and we didn't check the mobile SDK versions (7). The MCP repository runs CI with unit and end-to-end tests (8). 30+20+8+7+8 = 73.

Amazon Location Service 88

API reading of the checklist. Places responses stay at the core fields unless AdditionalFeatures asks for more, and MaxResults caps the count, but there is no field selection and route responses can reach the 6 MB limit (20 of 25). MaxResults on six of seven Places calls, NextToken on SearchText and SearchNearby, and filters by country, bounding box and place type (18 of 20). Four typed errors per API, with a reason and field list on ValidationException (17 of 20). Every v2 operation is marked read-only in the model, so retries are safe. No hints apply to a plain API (18 of 20). One required field or none on most calls, an API key that avoids SigV4 signing, and SDKs on npm and PyPI among others (15).

NextBillion.ai 77

MCP reading, since the hosted server is the agent surface. 27 tools, four of them for documentation and seven local geometry tools, with shapes simplified to a 500-vertex budget to save context (18). limit, types, country, bbox and circle filters, and batch geocoding of up to 100 queries (16). The error table explains each code, and the MCP masks the key in error text (15). Every API tool is marked readOnlyHint, idempotentHint and not destructive in the source (18). Few required parameters and explicit latitude and longitude objects, but no official server-side SDK, only mobile and web map SDKs (10). 18+16+15+18+10 = 77.