Bannerbear API + MCP vs DynaPictures

Bannerbear API + MCP 67

Newest changelog entry 18 September 2026, 47 days before this check (20, down from 30 on time). Three dated entries since 6 August, 18 August, 9 September and 18 September (20). The MCP repository's 0.14.0 commit is dated 7 October 2026, but its npm publication couldn't be read on 4 November, so it doesn't set recency (as growthbook's unconfirmed SDK). The four SDK repositories' newest tags are from 13 August 2026 (Node and PHP v1.6.0, Python v1.1.0, Ruby v0.3.0), older than the changelog entry. Monthly public changelog. We didn't check support response or the MCP repo's issues (10). Official SDKs in four languages announced in May 2026 and @bannerbear/mcp 0.13.0 published in September 2026, but the MCP server isn't in the official MCP registry, which lists only a third-party Bannerbear server (12). The MCP repo has test scripts but no CI workflow, and depends on @modelcontextprotocol/sdk ^1.12.0 (5).

DynaPictures 4

No changelog, release notes or dated API change was found, and the MCP server card gives version 1.0.0 with no date (0). No dated changes since 8 August (0). Support by email and contact form, not tested (4 of 15). Not in the official MCP registry and no API SDKs (0). No public package or repository (0). 0 + 0 + 4 + 0 + 0 = 4.

Bannerbear API + MCP 57

V5 keys can be scoped per resource and action (images:write, templates:read) and pinned to browser origins, and the hosted MCP uses OAuth. Unscoped keys get full access, and we found no rotation guidance (27). A read-scoped key yields a read-only MCP tool list, but delete tools run with no confirmation step (12). The tool returns renders and records from your own account, little untrusted content (10). Audit logs are listed for the Enterprise plan at $299 a month only (8). No security.txt and /security returns 404. No bug bounty, disclosure policy or certification found. 2FA from the Scale plan, SSO on Enterprise (0).

DynaPictures 26

One API key per user with the user's full access, not limited to workspaces or actions; a new key is requested by email to support, with no rotation in the account (10 of 30). No read-only mode, and the MCP server can author and change designs (3 of 20). Tools return the account's own templates and renders; image layers accept outside URLs (10 of 15). A list of generated images, with no audit log documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 10 + 3 + 10 + 3 + 0 = 26.

Bannerbear API + MCP 71

The hosted server picks tool groups by path. The default set is 30 and /workflows is 8, and a scoped key hides tools it can't use (15 for 11 to 30, plus 8 for profiles and scope filtering). The docs say 63 tools on /all, and the MCP source at 0.14.0 (7 October 2026) adds four media tools outside the default set. Lists take page and limit up to 100, with no field selection (15). Status codes from 400 to 429 documented, 402 for spent quota, and the MCP rejects contradictory inputs with a plain message before the call (15). No idempotency key, no readOnlyHint or destructiveHint in the source, and five tools delete permanently. Polling a 202 job by GET is safe (3). Official SDKs for Ruby, Node, Python and PHP, and the MCP polls renders for you by default (15).

DynaPictures 45

The MCP tool definitions weren't read (listing them needs a session), and llms.txt describes groups that include layer-by-layer design authoring, so the count is unknown. REST responses are small objects with image URLs (12 of 25). Template and generated-image listings, with no field selection documented (10 of 20). Errors are JSON with a message and documented statuses, without codes (12 of 20). Requests aren't idempotent, by the vendor's own note, though identical image URLs are served from cache without a credit (6 of 20). An Editor SDK for embedding the editor, and no API client SDKs (5 of 15). 12 + 10 + 12 + 6 + 5 = 45.

Bannerbear API + MCP 35

No x402, MPP or L402 in the docs or the OpenAPI (0). Plans are public and the pricing page states credit costs per unit (1 credit per image per format and scale step, 2 credits a second of animation, 1 to 4 per media tool), between plan-only and per-unit pricing (15). Trial with 30 API credits and no card (20). A person signs up in a browser to get a key (0).

DynaPictures 30

No x402, MPP or L402 (0). Image allowances per plan and AI credit packs ($20 for 1,000 credits) are public, but plan prices are filled in by the FastSpring script and weren't readable (10 of 20). Free plan and a 14-day trial with 30 API credits, no card (20). auth.md says a person has to copy the key; there is no OAuth or programmatic key (0). 0 + 10 + 20 + 0 = 30.