ArcGIS Location Platform vs NextBillion.ai

ArcGIS Location Platform 70

Graded as a hosted service on the REST location services, which are generally available. Esri runs its own status page at status.location.arcgis.com with current status and an event history (20). The history is drawn by script, so we read the platform's RSS feed at /admin/api/rss/all.rss, titled ArcGIS Location Platform Services Status. The page's own "all services RSS feed" link (location_platform.rss) answered 404 on 2 November. On 2 November its newest entry is still an intermittent basemap tile slowdown on 16 June 2026, outside the 90 days to 2 November. A readable feed that posts incidents, with none touching the product in the window, is a clean record (30). The 8 October check gave 25 and held back 5 for the feed's unknown depth, which isn't a checklist value. No request rate limits with numbers were found in the geocoding, places or routing reference (0, per the 8 October check, not re-read on 2 November). No 429 or backoff guidance was found. The geocoding output page says only that a timeout after 60 seconds may be retried later (0). The SLA of 23 December 2025 commits to 99.9 per cent monthly uptime for ten services (10). The REST services are generally available, and the MCP server is a beta (10). Total 70.

NextBillion.ai 45

Hosted lines, for the REST APIs at api.nextbillion.io and the hosted MCP server. A status page at status.nextbillion.io, 'NextBillion.AI API Status', renders only in a browser, and its Statuspage-style JSON paths return 404, so we couldn't see its components (10) or read any history. That's our limit, not a finding, and the rubric gives 5 (5). The API reference states 2,400 queries a minute, or 40 a second, for continuous requests (15). Each endpoint's error table lists 429 as 'QPM or API request count quota reached', with no Retry-After or backoff guidance (5). No SLA found; the terms say access isn't warranted to be uninterrupted (0). The REST APIs are GA. The MCP server is at version 0.5.3 (10). 10+5+15+5+0+10 = 45.

ArcGIS Location Platform 40

No x402, MPP or L402 (0). Unit prices for every service are public without a login (20). A monthly free tier of 20,000 geocodes, 20,000 routes and 500 place searches, and the billing help says a payment method is needed only to turn on pay-as-you-go. The sign-up form is drawn by script and we couldn't read it, so the no-card reading rests on the billing help (20). An account is created by a person in a browser (0). Total 40.

NextBillion.ai 20

No x402, MPP or L402 (0). Pricing is by quote, with annual licences per order, asset or API call and no published unit price (0). A 7-day free trial with an API key and 'No credit card required' (20). A person signs up through the console or emails support for a key (0). 0+0+20+0 = 20.

ArcGIS Location Platform 64

API key credentials carry selected privileges, an expiry date of at most one year, optional referrer limits and two tokens for rotation, and OAuth 2.0 user and app authentication are supported, which earns 30. Less 10 because the documented examples send the token as a token request parameter, although headers are accepted and recommended (20). Privileges are chosen per key, down to stored or unstored geocoding and simple or optimised routing, and the MCP server filters tools by them (16 of 20). Results include place names and addresses from third-party data, and no prompt-injection guidance was found (5 of 15). The dashboard shows usage by service and by credential per day, with no per-call log found (10 of 15). The trust centre has a coordinated disclosure programme with a safe harbour statement and a PGP key, and says Online Services are covered by FedRAMP moderate and ISO 27001, without naming ArcGIS Location Platform. No security.txt (404 on developers.arcgis.com and location.arcgis.com on 2 November) and no bug bounty were found (13 of 20). Total 64.

NextBillion.ai 46

The REST APIs take a single key query parameter, so a plain key that travels in URLs, which earns 20 less 10. The MCP server adds OAuth 2.1 with PKCE, seals the key into tokens with AES-256-GCM, accepts a Bearer header and stores nothing server-side, so 5 back (15). Every tool is read-only, and keys can carry an IP allowlist (12). Places results are POI and address text with no prompt-injection guidance (7). Usage alerts at 50, 75 and 90 per cent of credits, per the pricing FAQ. No per-call log found (5). /.well-known/security.txt returns 404, and we found no disclosure policy or bug bounty. The about page says the company follows ISO 27001 standards, without naming a certificate (7). 15+12+7+5+7 = 46.

ArcGIS Location Platform 61

No OpenAPI description was found for geocoding, places or routing. The geocoding service description at GeocodeServer?f=pjson lists each parameter with its type, allowed values and supported operations, which earns 8 of 25. /llms.txt returns 404 on developers.arcgis.com and location.arcgis.com (0). The reference explains when to use a direct request or a job, and stored or unstored geocoding (16 of 20). Parameters carry types, defaults, allowed values and maximums, such as maxLocations up to 50 and pageSize up to 20 (12 of 15). Each operation has request and response examples, and the geocoding output page lists error codes with extended codes and causes (13 of 15). Geocoding has dated release notes back to 2023 and the platform has release notes by month, but the geocoding path carries no version while places uses /v1 (12 of 15). Total 61.

NextBillion.ai 73

No OpenAPI document for the REST APIs was found in llms.txt or the docs. The hosted MCP server's 27 tools are defined with Zod schemas, so they carry typed JSON Schema inputs (15 of 25). llms.txt, llms-full.txt and a Markdown file for each docs page (10). Endpoint pages explain each parameter, and MCP tool descriptions say when not to use a tool, such as the geometry tools being straight-line rather than road distance (16). Parameter tables give types, allowed values and defaults, such as types and limit (default 10), though in packs several filters into one string (12). curl examples and a per-endpoint error table with causes (13). The MCP server has a dated changelog. No API changelog or versioned path was found (7). 15+10+16+12+13+7 = 73.

ArcGIS Location Platform 69

A closed service with a dated agreement that states what may be stored, cached and shared, and an Apache-2.0 client library (15 of 30). The privacy statement was revised on 31 July 2026, the Products & Services supplement on 9 September 2025 and the Data Processing Addendum on 12 March 2024. None states a retention period, and neither the supplement nor the addendum names ArcGIS Location Platform (14 of 30). The agreement promises 90 days' notice for deprecations, and the July 2026 release notes record the retirement of legacy API keys (16 of 20). The addendum names four sub-processors as examples and the GDPR page says information is stored in the United States, with no list specific to this product (9 of 20). Total 54.

NextBillion.ai 58

Editorial half only. Closed service under terms that name NextBillion.ai Pte. Ltd. and Singapore law, and an Apache-2.0 MCP server (18). The privacy policy keeps personal data while a legitimate business need exists, with no periods given. The MCP README says only tool arguments are sent to the API and nothing is retained between requests (14). No deprecation policy or dated notices found. The terms promise 10 days' notice of material changes to the terms (3). Data is mainly processed in Singapore, with transfers abroad under standard clauses. No sub-processor list found (8). 18+14+3+8 = 43.

ArcGIS Location Platform 83

The latest dated change is MCP server 1.0.0-beta.1.9 on 27 October 2026, which added stored and unstored geocoding and a service area tool (30). Dated entries in the 90 days to 2 November include MCP releases on 10 August, 1, 15 and 29 September, 9 and 27 October, the September 2026 platform and geocoding release notes, ArcGIS REST JS 4.11.0 on 7 August and 4.11.1 on 12 August, and the ArcGIS API for Python tag v2.4.4 on 22 September (20). Public release notes and the Esri Community forum exist, technical support is a paid extra, and we didn't read reply times. The 8 October check counted 60 open issues on the ArcGIS REST JS repository; github.com pages weren't readable on 2 November, and the clone's main branch was last changed on 7 August 2026 (10 of 15). Official SDKs are current, ArcGIS REST JS 4.11.1 and the ArcGIS API for Python 2.4.4 (15). The JS repository has pull-request test and release workflows, and we didn't check that they pass (8 of 10). Total 83.

NextBillion.ai 73

MCP server 0.5.3 on 30 October 2026 (30). Eleven tagged MCP releases between 7 October and 30 October, adding hosted mode, truck routing and geometry tools (20). Support by email, a public MCP repository with a changelog, but no public API changelog (8). The MCP server isn't in the official MCP registry, and we didn't check the mobile SDK versions (7). The MCP repository runs CI with unit and end-to-end tests (8). 30+20+8+7+8 = 73.