Bannerbear API + MCP vs Robolly

Bannerbear API + MCP 67

Newest changelog entry 18 September 2026, 47 days before this check (20, down from 30 on time). Three dated entries since 6 August, 18 August, 9 September and 18 September (20). The MCP repository's 0.14.0 commit is dated 7 October 2026, but its npm publication couldn't be read on 4 November, so it doesn't set recency (as growthbook's unconfirmed SDK). The four SDK repositories' newest tags are from 13 August 2026 (Node and PHP v1.6.0, Python v1.1.0, Ruby v0.3.0), older than the changelog entry. Monthly public changelog. We didn't check support response or the MCP repo's issues (10). Official SDKs in four languages announced in May 2026 and @bannerbear/mcp 0.13.0 published in September 2026, but the MCP server isn't in the official MCP registry, which lists only a third-party Bannerbear server (12). The MCP repo has test scripts but no CI workflow, and depends on @modelcontextprotocol/sdk ^1.12.0 (5).

Robolly 5

No changelog, release notes or dated API change was found. The sitemap marks every docs page as modified on 4 November 2026, which reads as a site rebuild rather than a change, so it isn't counted (0). No dated changes since 8 August (0). Support by email, with chat on higher plans; not tested (5 of 15). Not in the official MCP registry and no SDKs (0). No public package or repository (0). 0 + 0 + 5 + 0 + 0 = 5.

Bannerbear API + MCP 83

OpenAPI 3.1 schema at api.bannerbear.com/v5/openapi.json, and the MCP server's tools carry typed Zod inputs (25). An llms.txt exists, but it indexes marketing pages and free tools with one link to the API reference and none to V5, MCP or the schema (7). MCP tool descriptions say when to use the tool and what to call next, such as 'call get_template for the full canvas config', and OpenAPI operations say whether they're async (16). Enums, required fields and size limits (100 to 5,000 px) in the schema, but modifications is an open object in the OpenAPI (11). Status codes listed in the docs and 4xx bodies carry a message, while the OpenAPI has no examples (9). Versioned paths (/v5) and a dated monthly changelog (15).

Robolly 57

No OpenAPI or other machine-readable contract found for the REST API, and the MCP server is closed. The MCP page lists all nine tools and get_template_modifications returns each template's keys, constraints and examples at run time (8 of 25, on that partial evidence). llms.txt indexes the docs (10). The MCP page says what each tool does, which tools change templates or spend credits, and that there is no delete tool (14 of 20). Modification keys follow {element-name}.{modification-key} with constraints from the template rather than a fixed schema (7 of 15). Request examples throughout and an error code table with eight codes (13 of 15). /v1 paths with no changelog (5 of 15). 8 + 10 + 14 + 7 + 13 + 5 = 57.

Bannerbear API + MCP 61

Closed service under published terms. The MCP server is MIT per its package.json, though the repo has no LICENSE file (15). The privacy policy and terms are both dated 29 June 2021, give no retention periods, and say nothing about the zero data retention the pricing page sells on Enterprise (8). V5 launched on 18 August 2026 with the key change stated, but V2 has no end-of-life date and there's no API deprecation policy, only 30 days' notice for material changes to the terms (8). The privacy policy names Mailchimp and Stripe and no data locations (5).

Robolly 49

Closed service under terms effective 8 April 2026 from Avantis Innovations LLC in Wyoming. The terms can change without notice (15). The privacy policy of the same date covers Google sign-in and Sheets data, says spreadsheet rows aren't kept beyond a render and account data is deleted with the account, and otherwise names no periods (10 of 30). No deprecation policy or notices (0). Hosting is described only as third-party vendors, with no processors or locations named, while the footer says Made in EU (2 of 20). 15 + 10 + 0 + 2 = 27.

Bannerbear API + MCP 57

V5 keys can be scoped per resource and action (images:write, templates:read) and pinned to browser origins, and the hosted MCP uses OAuth. Unscoped keys get full access, and we found no rotation guidance (27). A read-scoped key yields a read-only MCP tool list, but delete tools run with no confirmation step (12). The tool returns renders and records from your own account, little untrusted content (10). Audit logs are listed for the Enterprise plan at $299 a month only (8). No security.txt and /security returns 404. No bug bounty, disclosure policy or certification found. 2FA from the Scale plan, SSO on Enterprise (0).

Robolly 47

Bearer API key, signed render links, and MCP OAuth with one robolly:mcp scope limited to the organisation the user approves. Connections are listed and revoked under Connected AI Tools, and the API key is never shared with an OAuth client. No key scopes or rotation documented (22 of 30). The MCP server can create and update templates but not delete them; there's no read-only mode (10 of 20). Tools return the user's templates and public gallery designs (10 of 15). A renders list and the connected-tools view give some visibility, with no audit log documented (5 of 15). No security.txt (the path returns the site's HTML shell), disclosure policy, bug bounty or certification (0). 22 + 10 + 10 + 5 + 0 = 47.