Bria API vs FLORA

Bria API 83

Read with the hosted lines. Atlassian Statuspage at status.bria.ai with API components and history (20). history.atom, read on 2 November, has one incident from 4 August to 2 November 2026, "API Outage for Image Editing, Increase Resolution and Image generation" on 22 September, resolved in 18 minutes with no cause given. The incident page lists two affected components, Image Generation (API) and Image Editing (API), and not the Tailored Generation, Product Shot, Ad Generation, Video Editing or AI Search APIs, so it reads as partial and minor (20). The 8 October reading came from the page's /api/v2/incidents.json, which the host's robots.txt disallows, so that source is struck; the feed gives the same record. Limits published per plan, 10, 60 and 1,000 requests a minute per endpoint (15). The docs tell callers to back off with jitter and honour Retry-After on 429, and the SDKs retry status polls only so a job is not started twice. No idempotency key (13). The site states a 99.9 per cent uptime SLA for managed cloud, but no SLA document was found and the online terms supply the products as is, so half credit (5), per the 8 October check, not re-read on 2 November. The REST API is generally available (10). 20+20+15+13+5+10 = 83.

FLORA 46

Hosted reading, for the MCP server and the REST API. A status page at status.flora.ai is linked from the home page and the MCP page, but its robots.txt answered a client error twice on 2 November 2026, so under our rules nothing on that host was fetched and its components are unread (10 of 20, for a linked page whose content we could not check). No readable incident history, so the floor, and this is our fetch rule rather than a finding about FLORA (5). No requests-per-minute figure is published, as the cost and limits page says in so many words; batch sizes (1 to 20 generations, 20 run ids, 50 canvas nodes, 25 files), the polling cooldown (15 seconds, or 2 seconds a run) and one-at-a-time generation for new unpaid accounts are given with numbers (8 of 15). 429 rate_limited is documented with Retry-After on the API and retry_after_seconds on MCP, a 60-second fallback, exponential backoff and a retryability table, and the SDK retries 408, 429 and 5xx twice. Idempotency-Key covers every mutating REST request for two hours, but flora_create_generations over MCP has none and the docs say to read history before retrying (13 of 15). No SLA; the terms provide the service as is (0). No beta or preview label on either surface; the old beta endpoint was removed on 30 June 2026, though the registry version is 0.11.5 (10). 10+5+8+13+0+10 = 46.

Bria API 52

Closed hosted API under the Online AI General Terms and Conditions, a PDF linked from the website terms (read on 8 October as the March 2025 version, V1.1; the linked file is titled August 2025, v1.2 on 2 November). SDKs and the MCP server are MIT. Model weights are source-available for non-commercial use (15). The terms warrant no training on customer content without written consent and deletion within 30 days of termination. The docs give 3 days for image results and say inputs are not kept beyond processing. The privacy policy has no date and no retention periods, and does not name Google, whose Gemini 2.5 Flash handles prompts on the standard generate endpoint (20). No deprecation policy. One endpoint is marked deprecated without a date (3). The privacy policy lists recipient categories only, with vendor names on request by email. Data locations not stated (4).

FLORA 68

Closed service under terms of service (17 November 2025) that name FLORA AND FAUNA FLOWERSHOP, INC., give the user all rights in output and limit FLORA's licence in user data to running the service; the SDK is Apache-2.0 and the skills MIT (15 of 30). The terms, the data, security and IP page and the MCP security page agree that FLORA does not train on user data or let model providers train on it. The privacy notice (1 June 2026) is silent on training, names only Google Analytics and an unnamed session replay tool, and gives no retention period beyond the life of the account; a DPA is for Enterprise and paid workspaces with client data (18 of 30). The MCP changelog dates deprecations with replacements (a beta endpoint deprecated 28 May and removed 30 June 2026, execute deprecated 11 September and retired 8 October 2026) and a retired-tools page lists five, but there is no written notice period, and flora_comments forwards with no end date (12 of 20). The sub-processors page (2 June 2026) names 23 services with their locations, including India, the UK, China and Singapore, with no commitment to notice of changes (16 of 20). 15+18+12+16 = 61.

Bria API 53

Model reading of the checklist (credential, training, retention, operator visibility, programme). Several named, revocable organisation keys with no scopes, plus OAuth 2.1 with PKCE on the hosted MCP server, where the scopes are identity only (20). Less 10 because the streaming background removal WebSocket takes api_token (or an OAuth token) as a URL query parameter, re-read on 2 November (10 of 30). The Online AI General Terms and Conditions warrant no training on customer content without written consent, per the 8 October check, not re-read on 2 November. The website terms of use, re-read on 2 November, limit the licence Bria takes in customer data to providing the Services (20 of 20). The asset retention page (re-read 2 November) says inputs are not retained beyond processing, image results expire after 3 days by default and can be changed per organisation, video results don't expire by default and legacy /v1/product/* results last 1 hour. The privacy policy states no periods (10 of 15). Each response has a request_id. Audit logs are listed for Enterprise only (5 of 15). The site states ISO 27001 certification and SOC 2 attestation with no report, auditor or trust centre linked. No security.txt (404 on 2 November), disclosure policy or bug bounty found (8 of 20). The 8 October score (33) used the tool lines (read-only modes 0, injection posture 10); this run reads model listings on the model lines. 10+20+10+5+8 = 53.

FLORA 68

OAuth with the authorisation code grant, PKCE (the metadata lists plain and S256, the docs S256), dynamic client registration, refresh tokens and revocation at the token endpoint, with no named scopes, no documented token lifetimes and no list of OAuth connections in FLORA's settings; API keys ak_ scoped to chosen workspaces with Read, Write and Billing permissions, shown once, five at a time and revoked at once, with no expiry or rotation feature. Only the header form is documented (24 of 30). Read-only keys and per-workspace scoping, roles that cap what an agent can do, guests who cannot generate, spending caps per member, workspace, organisation and overage, and a quote-first rule; flora_run_canvas_nodes spends with no confirmation step (16 of 20). Agents read canvas prompts, comments, Techniques and files written by others; the security page says to treat them as data, to review the quote after reading shared content and to use least-privilege keys for unattended accounts, with no technical filtering described (11 of 15). Operators see spend by member in the app and through flora_get_usage, organisation usage exports through the API, charged_cost per run and failed webhook deliveries; FLORA's own MCP logs are not exposed to the operator (9 of 15). The trust centre lists SOC 2 Type 2, GDPR and CCPA (published 26 October 2026) with no report shown; no security.txt was found on flora.ai, and no disclosure policy or bug bounty for the service. The SDK's SECURITY.md points SDK reports at Stainless while its README says the SDK is generated by Fern (8 of 20). 24+16+11+9+8 = 68.

Bria API 69

Model reading (notice and churn in place of release counts). bria-client 0.3.1 was tagged on 25 October 2026 (changelog dated 22 October, Pillow 13 and an endpoint-path fix), and Bria's MCP server was listed in the official MCP registry as com.bria-api/bria-mcp on 15 October (30). FIBO, FIBO Lite and the v1 product endpoints are all still served and one v1 endpoint is marked deprecated with its v2 replacement named, but no notice policy or dated notice was found (10). No API changelog. Support is by email and a Discord community, not tested, and GitHub's pages refused us so SDK issues were not read (6). Current official SDKs, bria-client 0.3.1 (Python) and @bria-ai/client 0.2.0 (TypeScript, 28 September 2026). The MCP server is now in the official MCP registry (15). The SDK repository has CI, release automation (release-please) and a lock file. The SDKs are 0.x and bria-mcp is classified beta, per the 8 October check (8). 30+10+6+15+8 = 69.

FLORA 83

Closed service with a dated changelog. The newest MCP changelog entry is 23 October 2026, and flora.ai/updates has product entries to 28 October (30). 31 dated MCP changelog entries between 4 August and 23 October 2026 (20). Support at support@florafauna.ai, bug and feature forms, a Discord linked from the home page, weekly training sessions, and GitHub issues on the skills repository as its support URL (2 open); no response times stated (10 of 15). ai.flora/flora 0.11.5 is in the official MCP registry under a DNS-verified namespace since 16 October 2026 (15). The TypeScript SDK @flora-ai/flora 0.21.1 (14 October 2026, 157 downloads in the week to 1 November) has CI, release-please and an npm publish workflow; the skills repository was last pushed on 18 October 2026 (8 of 10). 30+20+10+15+8 = 83.

Bria API 76

Results come back as URLs, with a seed and the full structured prompt. The MCP server has 18 tools and returns a JPEG preview of up to 0.7 MB inline (18). Resolution, aspect ratio, output type and a sync or async choice, with nothing to paginate (15). One error shape with request_id, a status table and messages the MCP server passes through as Bria API error <status code>: <reason> (18). No idempotency key. Webhooks carry Bria-Webhook-Id for deduplication. The MCP tools carry annotations, but all 18 are marked read-only and idempotent although each call is billed (10). Only a prompt is required, and there are official Python and TypeScript SDKs (15).

FLORA 68

MCP reading for context cost. 59 tools (56 callable by the model) with no toolsets or read-only subset; since 23 September 2026 the list is filtered to the account's access and flora_list_tools returns what the connection has (7 of 25). Cursor pagination with limit 1 to 100 on 10 REST list endpoints, history filters by workspace, project and status, include_inputs off by default, per-node and per-slide document reads, and up to 20 runs read in one call (17 of 20). One REST error envelope with code, message and field errors, retryability per code, a Flora-Request-Id, MCP failures grouped into retry now, retry later, change input and report, and retired tool names answering with their replacement (18 of 20). Idempotency-Key on every mutating REST request and a body key on Technique runs; every MCP tool carries readOnlyHint and destructiveHint annotations and spending tools are marked destructive; quote: true prices before running; the MCP create call has no idempotency key (16 of 20). Few required parameters (project_id, type, prompt, with the workspace resolved from the project) and an official TypeScript SDK and a Go CLI, but no SDK in a second language (10 of 15). 7+17+18+16+10 = 68.

Bria API 60

No x402, MPP or L402 (0). Per-image, per-call and per-second prices published without a login, from $0.018 to $0.05 an image on 2 November (20). 100 free generations with no card (20). A person has to sign up in the console to get a key. The MCP OAuth flow has dynamic client registration but still needs a Bria account sign-in (0). 0+20+20+0 = 40. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 40 is 60.

FLORA 53

No x402, MPP or L402 (0). Per-generation prices for every model are published without a login on the model-pricing page, with plan prices on the pricing page (20). Free gives each new workspace $2.50 of usage, which the docs and the MCP changelog (1 September 2026) say an agent can spend through MCP; the REST API answers paid_plan_required on Free, the pricing page marks MCP 'Not included' there, and no page says whether Free needs a card, so this is a one-off trial on one surface (15 of 20). A person signs up in a browser and approves OAuth, or makes a key in Settings (0). 0+20+15+0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.