CloudConvert API vs PDFMonkey

CloudConvert API 71

API keys are created with any of six scopes and can be revoked, and OAuth 2.0 issues tokens for third-party clients, though the implicit grant is still supported and no key rotation is documented. Signed URLs carry an HMAC signature, not the key (27). A key limited to task.read is read-only, and the MCP server asks for three scopes, one of them task.write, plus the two webhook scopes for its webhook tools. No confirmation step for deletes (12). Results come back as download links, and the metadata and capture-website operations handle untrusted content. The MCP page tells users to connect only the official URL, with no prompt-injection guidance (6). The security page says all access is logged and reviewable by the customer in activity logs, and jobs can be filtered by API key (11). ISO 27001 from TÜV Süd, and a valid security.txt (re-read on 1 November, Expires 2027-05-01) with a disclosure policy and rewards only at CloudConvert's discretion, so no formal bounty. No public advisories and nothing on OSV for the SDK packages. That's above ahasend's 12 (ISO 27001 and a disclosure route, no security.txt) (15). 27 + 12 + 6 + 11 + 15 = 71.

PDFMonkey 36

One secret key per account with the whole account's privileges, sent as a Bearer header; it can be rotated with a 2-day overlap and the old key revoked at once, but there are no scopes, no second key and no read-only key (12). No least-privilege mode; the MCP server exposes delete_document, the CLI asks before deletions unless -y, and the MCP docs say most clients ask before running a delete (6). The tools return the account's own templates, documents and quota, not third-party content (10). Each document carries generation logs and the dashboard shows usage, but no audit log or per-key activity view was found (3). No security.txt (404), no disclosure policy and no bug bounty; the compliance page says there is no SOC 2 or ISO 27001, and sets against that EU hosting, encrypted payloads and a DPA dated 15 October 2026 (5). 12 + 6 + 10 + 3 + 5 = 36.

CloudConvert API 58

cloudconvert-cli 3.0.2 was published to npm on 21 October 2026 and adds an ai/agent command for the new AI tasks, which the privacy policy's dated entry of 19 October also records (30). In the 90 days from 3 August, the MCP server launch post (3 September), and Java 1.2.5, Ruby 1.2.0 (both 24 August) and CLI 3.0.2, the package tags counted half, so 2.5. The privacy policy's dated entry of 19 October records a policy text, not a release, and the ai/agent launch it describes is already counted through CLI 3.0.2 (0). No changelog. Support is a contact form and email, and dependency pull requests on the Java and CLI repositories were merged on 5 October and 23 October 2026. Issue replies were not read (8 of 15). Six official SDKs, four released in 2026. The Node.js SDK's last tag is still April 2025 (3.0.0) and the Python SDK's March 2022, and the MCP server is not in the official registry, searched on 1 November (12). Every SDK repository has a test workflow (8). 30 + 0 + 8 + 12 + 8 = 58.

PDFMonkey 81

Read as a closed service with open-source clients. pdfmonkey-mcp-server 1.0.1 on 26 October 2026, @pdfmonkey/cli 2.1.0 on 15 October and docs pages updated 2 November (30). Node SDK 1.1.0 to 1.4.0 between 2 and 5 October, CLI 2.0.0 and 2.1.0 on 13 and 15 October, MCP 1.0.1 on 26 October (20). Blog posts announce changes, and support answers by in-app chat and email within a few hours in CET business hours per the docs; GitHub issue replies couldn't be read (10 of 15). io.github.pdfmonkey/pdfmonkey-mcp in the official registry, 1.0.1 latest (15). The MCP server has unit tests, a release workflow on tags and a prepublish test step, but no CI on pull requests and a loose ^1.0.4 pin on the MCP SDK (6). 30 + 20 + 10 + 15 + 6 = 81.

CloudConvert API 80

Graded as a hosted service. Status page at status.cloudconvert.com (Better Stack) with nine components and 90-day bars (20). The incident list and RSS feed, re-read on 1 November, add one incident since 9 October, "iWork and Web are down" on 12 October. iWork recovered within two minutes and Web, the web interface rather than the API, recovered at 11:51 UTC on 13 October. With the EU Central slowdown on 8 October (from about 15:25 to 16:45 UTC), the US East, iWork and EU Central alert on 14 September and the other short incidents since 3 August, each touched one region, one conversion type or one component, so minor incidents only (20). Limits on creating jobs and tasks are described as dynamic, with X-RateLimit-Limit and X-RateLimit-Remaining headers and a free-plan cap of 5 concurrent tasks. The new ai/agent tasks have a fixed 6 requests a minute and 60 an hour, but the main endpoints have no fixed number per plan (8). A 429 carries Retry-After in seconds and the docs say CloudConvert retries retryable errors itself. No idempotency key (12). The terms promise 99.9 per cent monthly uptime with refunds on paid plans, re-read on 1 November (10). API v2 is generally available and the MCP server carries no beta label. Only the new ai/agent task is marked beta (10). 20 + 20 + 8 + 12 + 10 + 10 = 80.

PDFMonkey 60

Read with the hosted lines. status.pdfmonkey.io is an updown.io page with six checks (API, dashboard, preview, website, generation latency, queue size) and one month of rolling uptime per check, but no incident write-ups (15). The readable record is the uptime figures (API 99.98 per cent and queue 99.97 per cent since 3 October 2026) and the one incident the vendor wrote up, a slowdown of a little under an hour on 29 September 2026 with a post-mortem on 1 October; the 90-day list itself isn't published, so minor incidents only (20). The docs say there is no hard rate limit, only the monthly quota, so no request-rate numbers (5 for the quota numbers). The Node.js SDK retries 408, 429 and 5xx with backoff and honours Retry-After, and the webhook docs say delivery is at least once and to make handlers idempotent, but document creation has no idempotency key (10). No SLA found in the terms or pricing (0). GA (10). 15 + 20 + 5 + 10 + 0 + 10 = 60.

CloudConvert API 61

The MCP docs, re-read on 1 November, list 34 tools, up from 24, adding docs lookup, task cancel, retry and delete, job and task deletion, metadata writing and three webhook tools. That's above 30 and the tools have no toolsets or read-only subset, and the API returns links and status objects with an include parameter for the larger parts (6). List endpoints take per_page (100 by default, 1,000 at most), page, and filters by status, tag, operation and API key (17). Errors carry a code and a message, validation errors name the field, and failed tasks report codes such as OPEN_FAILED and, for AI tasks, AGENT_DECLINED and AI_RATE_LIMIT_EXCEEDED (15). No idempotency key. Jobs take a tag, a retry endpoint creates a new task, only successful conversions are charged, and the docs ask callers not to retry automatically. MCP annotations were not read (8). A job needs three short tasks, and there are official SDKs in six languages and a CLI (15). 6 + 17 + 15 + 8 + 15 = 61.

PDFMonkey 75

11 compact MCP tools from a 17 KB tools.ts, and API responses are cards without payload or logs on list and sync endpoints, while a full template fetch is large and the SDK docs warn about it (22). page[number], q[status], q[document_template_id], q[updated_since] and q[search] on document cards, q[folders] on templates and snippets, a meta block with pagination, and the CLI's --json (18). 401 and 422 bodies name the problem, 403 on an expired download URL is explained, and a quota overrun rejects the create rather than making a draft; the MCP server returns the API's error text (14). No idempotency key on create, so a retried create queues and bills a second document; webhooks are at least once with idempotency guidance; the MCP server sets no readOnlyHint or destructiveHint and delete_document is permanent, which the docs leave to the client to confirm (6). Only document_template_id and payload are needed, and official SDKs exist in two languages (Node.js and Ruby) plus the CLI (15). 22 + 18 + 14 + 6 + 15 = 75.

CloudConvert API 35

No x402, MPP or L402 (0). The credit cost of each conversion type is published (1, 2 or 4 credits, plus 1 a minute), and the API page says prices start at $0.008 a file at 10,000 files, but the price per credit is drawn by a script and was not read, per the 9 October check, so 15 of 20. Free plan of 10 credits a day with no card (20). A person signs up in a browser to create a key or approve OAuth (0). 0 + 15 + 20 + 0 = 35.

PDFMonkey 40

No x402, MPP or L402 (0). Plan prices in euros, per-document pay-as-you-go rates and the Boost Pack price are on the public pricing page and in the docs (20). A Free plan of 20 documents a month and a 30-day Pro trial of 300 documents, no card (20). Signup is a browser flow and the key is minted in the dashboard (0). 0 + 20 + 20 + 0 = 40.