ArcGIS Location Platform vs Nominatim

ArcGIS Location Platform 83

The latest dated change is MCP server 1.0.0-beta.1.9 on 27 October 2026, which added stored and unstored geocoding and a service area tool (30). Dated entries in the 90 days to 2 November include MCP releases on 10 August, 1, 15 and 29 September, 9 and 27 October, the September 2026 platform and geocoding release notes, ArcGIS REST JS 4.11.0 on 7 August and 4.11.1 on 12 August, and the ArcGIS API for Python tag v2.4.4 on 22 September (20). Public release notes and the Esri Community forum exist, technical support is a paid extra, and we didn't read reply times. The 8 October check counted 60 open issues on the ArcGIS REST JS repository; github.com pages weren't readable on 2 November, and the clone's main branch was last changed on 7 August 2026 (10 of 15). Official SDKs are current, ArcGIS REST JS 4.11.1 and the ArcGIS API for Python 2.4.4 (15). The JS repository has pull-request test and release workflows, and we didn't check that they pass (8 of 10). Total 83.

Nominatim 60

Release 5.3.3 on 14 October 2026, 23 days before this check (30). Only one release in the 90 days from 8 August, against 106 commits on the default branch; commits aren't counted as releases (0). Commits from the lead maintainer and seven or more contributors since August, but we couldn't read issue reply times (12). The nominatim-api Python library is current with the server (10). CI on every push, current PostgreSQL and Python versions (8). 30+0+12+10+8 = 60.

ArcGIS Location Platform 40

No x402, MPP or L402 (0). Unit prices for every service are public without a login (20). A monthly free tier of 20,000 geocodes, 20,000 routes and 500 place searches, and the billing help says a payment method is needed only to turn on pay-as-you-go. The sign-up form is drawn by script and we couldn't read it, so the no-card reading rests on the billing help (20). An account is created by a person in a browser (0). Total 40.

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

ArcGIS Location Platform 64

API key credentials carry selected privileges, an expiry date of at most one year, optional referrer limits and two tokens for rotation, and OAuth 2.0 user and app authentication are supported, which earns 30. Less 10 because the documented examples send the token as a token request parameter, although headers are accepted and recommended (20). Privileges are chosen per key, down to stored or unstored geocoding and simple or optimised routing, and the MCP server filters tools by them (16 of 20). Results include place names and addresses from third-party data, and no prompt-injection guidance was found (5 of 15). The dashboard shows usage by service and by credential per day, with no per-call log found (10 of 15). The trust centre has a coordinated disclosure programme with a safe harbour statement and a PGP key, and says Online Services are covered by FedRAMP moderate and ISO 27001, without naming ArcGIS Location Platform. No security.txt (404 on developers.arcgis.com and location.arcgis.com on 2 November) and no bug bounty were found (13 of 20). Total 64.

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.

ArcGIS Location Platform 70

Graded as a hosted service on the REST location services, which are generally available. Esri runs its own status page at status.location.arcgis.com with current status and an event history (20). The history is drawn by script, so we read the platform's RSS feed at /admin/api/rss/all.rss, titled ArcGIS Location Platform Services Status. The page's own "all services RSS feed" link (location_platform.rss) answered 404 on 2 November. On 2 November its newest entry is still an intermittent basemap tile slowdown on 16 June 2026, outside the 90 days to 2 November. A readable feed that posts incidents, with none touching the product in the window, is a clean record (30). The 8 October check gave 25 and held back 5 for the feed's unknown depth, which isn't a checklist value. No request rate limits with numbers were found in the geocoding, places or routing reference (0, per the 8 October check, not re-read on 2 November). No 429 or backoff guidance was found. The geocoding output page says only that a timeout after 60 seconds may be retried later (0). The SLA of 23 December 2025 commits to 99.9 per cent monthly uptime for ten services (10). The REST services are generally available, and the MCP server is a beta (10). Total 70.

Nominatim 82

Read with the local-software lines, since the listing is the Nominatim server an operator runs. The public instance at nominatim.openstreetmap.org belongs to the OpenStreetMap Foundation and its usage policy caps it at one request a second, so it isn't graded as a hosted service. Official packages nominatim-db and nominatim-api on PyPI (5.3.3 on 14 October 2026, Python 3.9 or later) and installation guides for Ubuntu 22 and 24 (20). A public CI workflow runs unit and BDD tests on every push across Ubuntu 24 and 26 with PostgreSQL 13 to 18, and Windows unit tests. We couldn't see run results (20). Issue counts and reply times couldn't be read because the GitHub API was rate-limited for us; Sarah Hoffmann made 76 of the 106 commits since 8 August (12). A ChangeLog per release and semantic version numbers (15). Version 5.3.3 (15). 20+20+12+15+15 = 82.

ArcGIS Location Platform 61

No OpenAPI description was found for geocoding, places or routing. The geocoding service description at GeocodeServer?f=pjson lists each parameter with its type, allowed values and supported operations, which earns 8 of 25. /llms.txt returns 404 on developers.arcgis.com and location.arcgis.com (0). The reference explains when to use a direct request or a job, and stored or unstored geocoding (16 of 20). Parameters carry types, defaults, allowed values and maximums, such as maxLocations up to 50 and pageSize up to 20 (12 of 15). Each operation has request and response examples, and the geocoding output page lists error codes with extended codes and causes (13 of 15). Geocoding has dated release notes back to 2023 and the platform has release notes by month, but the geocoding path carries no version while places uses /v1 (12 of 15). Total 61.

Nominatim 51

No OpenAPI or machine-readable contract (0). nominatim.org/llms.txt returns 404, and the manual is HTML, though its Markdown sources sit in the repository's docs folder (0). The API reference explains each endpoint and parameter and when not to use one, such as the details endpoint being for debugging (14). Types, enums and limits are documented, such as format, layer and limit (at most 40), but there's no schema to validate against (12). Example queries and outputs per endpoint, with errors described in prose (10). A versioned manual per release, a ChangeLog and a migration guide (15). 0+0+14+12+10+15 = 51.

ArcGIS Location Platform 69

A closed service with a dated agreement that states what may be stored, cached and shared, and an Apache-2.0 client library (15 of 30). The privacy statement was revised on 31 July 2026, the Products & Services supplement on 9 September 2025 and the Data Processing Addendum on 12 March 2024. None states a retention period, and neither the supplement nor the addendum names ArcGIS Location Platform (14 of 30). The agreement promises 90 days' notice for deprecations, and the July 2026 release notes record the retirement of legacy API keys (16 of 20). The addendum names four sub-processors as examples and the GDPR page says information is stored in the United States, with no list specific to this product (9 of 20). Total 54.

Nominatim 59

Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.