Autodesk Platform Services vs Zoo

Autodesk Platform Services 53

Read for a closed service with open SDK sources. The aps-sdk-openapi repository's last commit is 16 September 2026 (Data Management spec), with Model Derivative on 12 August (20 of 30). Two dated spec changes in the last 90 days; SDK package release dates on npm and NuGet were not read (10 of 20). Stack Overflow tags, a fortnightly expert call, a bookable onboarding call and paid ADN support; GitHub issue response was not read because the API refused us (10 of 25). No APS server in the official MCP registry was looked for because the Autodesk MCP servers page could not be read; official SDKs on npm and NuGet are current per the README badges (10 of 15). SDK CI and dependency health unread (3 of 10). 20 + 10 + 10 + 10 + 3 = 53.

Zoo 90

Read for a hosted service with open-source clients. zoo-mcp v0.33.0 on 30 October 2026, the CLI v0.2.209 on 28 October and kittycad 1.8.0 on 15 October (30). Nine zoo-mcp tags from 24 to 30 October alone, with CLI and SDK releases through October (20). Commits land daily across the KittyCAD organisation, with a Discord and a community forum; issue response times were not read because GitHub's issue pages refused us (15 of 25). io.github.KittyCAD/zoo-mcp is in the official MCP registry under a GitHub-verified namespace, though at version 0.10.0 of 27 January 2026 (15). pytest across Python 3.11 to 3.14, ruff, ty, a security workflow and Dependabot, with the scheduled run on main passing on 3 November (10). 30 + 20 + 15 + 15 + 10 = 90.

Autodesk Platform Services 0

No x402, MPP or L402 in the specs or pages read (0). Pricing is on www.autodesk.com/products/autodesk-platform-services/overview#pricing, where aps.autodesk.com/pricing redirects; www.autodesk.com/robots.txt answered 403, so no price was read and the line scores as absent (0). A free trial is referred to on the developer pages, but its terms and whether a card is needed were on the unread pages (0). A person signs in to the developer portal to create the app that holds the client id and secret (0). 0 + 0 + 0 + 0 = 0, the reading contentful, personio and coupa took on 7 October 2026 when their pricing pages were unreadable.

Zoo 35

No x402, MPP or L402 (0). The per-second rate ($0.0083) and plan allowances are public in the pricing JSON the site loads and on the blog, with the FAQ stating rounding and free GETs (20). The Free plan carries $10 of usage a month with no plan fee; whether sign-up asks for a card was not established, and pay-as-you-go needs a payment method (15 of 20). A person signs in with SSO in a browser and mints the token; service accounts come only after an organisation exists (0). 0 + 20 + 15 + 0 = 35.

Autodesk Platform Services 34

Closed service. The APS terms of service are on www.autodesk.com and were not read, so terms clarity scores as absent (5 of 30). Privacy policy, data processing and retention statements are on the same host and unread (0 of 30). No deprecation policy or dated notices were readable; the docs pages that would carry them rendered empty (0 of 20). The status page names regional variants for the data APIs, which is the only location disclosure read; no subprocessor list was read (5 of 20). 5 + 0 + 0 + 5 = 10. These scores reflect what our reader could load, not a finding that the documents don't exist.

Zoo 69

The API is closed, with terms last updated 15 April 2026 under California law; the MCP server, CLI, SDKs and Design Studio are MIT (22 of 30). The terms licence inputs and outputs for model training with an opt-out only where the tier allows it, the pricing JSON states the behaviour per plan, and the security page says team and enterprise data is excluded by default; the privacy policy of 9 September 2026 is silent on training and gives no retention periods, and the enterprise page says Zoo trains on customer CAD data without naming the opt-out (15 of 30). No deprecation policy; billing changes were announced on the blog with dates (6 of 20). The trust centre names OpenAI, Cockroach Labs, Google Cloud and AWS as subprocessors, the security page names a US Regulated region, and the privacy policy says data may be processed anywhere in the world (14 of 20). 22 + 15 + 6 + 14 = 57.

Autodesk Platform Services 47

OAuth 2.0 with client credentials and authorisation code flows and named scopes (data:read, data:write, data:create, bucket scopes, code:all) in the published Authentication v2 spec, plus Secure Service Accounts for server workloads (30). Read-only scopes exist; no confirmation step before destructive calls was found (12 of 20). The engines execute add-ins and scripts on uploaded design files, and no prompt-injection guidance for agents was found on the pages read (5 of 15). No audit log or per-call visibility was found on the pages read (0 of 15). Autodesk's trust and security pages are on www.autodesk.com, unread, and aps.autodesk.com/.well-known/security.txt answered 406, and no disclosure policy, bug bounty or certification was established from the pages read (0 of 20). 30 + 12 + 5 + 0 + 0 = 47.

Zoo 67

Bearer API tokens minted in the account, several per user, listed and deleted at /user/api-tokens, organisation service accounts on Team and Enterprise, and OAuth 2.0 apps with PKCE and a device grant; no scopes were found on tokens and no rotation guidance (22 of 30). No read-only token or MCP subset; the Team plan's admin console and auditing give oversight after the fact, and the MCP client's own file permissions govern writes to main.kcl (8 of 20). Zookeeper carries a web_search tool and the MCP server returns KCL samples and docs, with no prompt-injection guidance found (5 of 15). Organisation admins get an API activity log and /user/api-calls lists each call with its cost (12 of 15). security.txt with a GitHub advisory contact and a policy committing to a 72-hour reply and severity-based rewards, SOC 2 Type II on the trust centre, and two Trail of Bits reviews published in 2024 and 2026 (20 of 20). 22 + 8 + 5 + 12 + 20 = 67.

Autodesk Platform Services 52

Data Management lists support filter and page parameters and Model Derivative returns per-object properties, so responses can be narrowed on the APIs with specs; the Automation API's job outputs are files (15 of 25). Pagination and filtering on the data APIs (15 of 20). Error responses are typed in the specs with reasons and the OSS spec explains 429, though the Automation API's error catalogue was unread (12 of 20). No idempotency key or safe-retry guidance was found; WorkItems are submitted and polled (0 of 20). Official SDKs in TypeScript (npm) and .NET (NuGet), but a Design Automation job needs an AppBundle, an Activity and a WorkItem and the add-in compiled against the desktop product (10 of 15). 15 + 15 + 12 + 0 + 10 = 52.

Zoo 44

zoo-mcp lists 42 tools in one process with no toolset switch, read-only subset or dynamic loading, and their docstrings total about 30,000 characters (5 of 25). List endpoints take limit, page_token and sort_by (31 paginated operations), with no field selection or filtering (15 of 20). Errors are a generic object with a message and request_id, no error codes, and MCP tools return a string on failure (8 of 20). No idempotency keys, no readOnlyHint or destructiveHint in the tool source, and the websocket needs a ping every 5 seconds to stay open (4 of 20). Few required parameters, official SDKs in Python, TypeScript, Rust and Go, but one modeling session per MCP process and a websocket protocol an agent has to drive by hand (12 of 15). 5 + 15 + 8 + 4 + 12 = 44.

Autodesk Platform Services 59

OpenAPI 3.0 specs for Authentication v2, Data Management, Model Derivative v2, OSS, Webhooks, Secure Service Accounts and Construction are public in the aps-sdk-openapi repository with every operation described; the Design Automation v3 API, the one the audit led with, has none there and its reference did not render (18 of 25). No llms.txt found and the docs are not served as Markdown (0). The specs state purpose per operation and the product pages explain the engines and workflow; the Automation API's own guide was unread (12 of 20). Typed schemas, enums and required fields in the specs read (11 of 15). The specs carry 429 and error responses with descriptions; examples in the guides were unread (8 of 15). APIs are versioned in the path (v2, v3), the specs carry versions 1.0 and 2.0 with dated commits, and the blog has a changelog topic, but no changelog page was readable (10 of 15). 18 + 0 + 12 + 11 + 8 + 10 = 59.

Zoo 65

OpenAPI 3.0.3 served at the root of api.zoo.dev, 174 paths and 226 operations each with a summary, and MCP tools whose inputs are typed Python signatures that the SDK turns into JSON Schema (25). No llms.txt (404) and no Markdown twin of the docs (0). The MCP docstrings average about 725 characters and say what each tool is for and when to use another, with snapshot at 3,500 characters; the OpenAPI summaries are one line and the websocket page lists one client message type (14 of 20). 583 schemas with 976 enum lists and required fields, and the file conversion path takes typed format parameters (12 of 15). Each docs endpoint page carries a request example, but errors are one generic object with request_id and message, and the websocket's server messages are not enumerated in the docs (9 of 15). The document reports version 0.1.0, there is no API changelog page, and changes are announced per repository release or on the blog, as the per-second billing change of 30 September 2025 was (5 of 15). 25 + 0 + 14 + 12 + 9 + 5 = 65.