Contentdrips API and MCP vs Shotstack

Contentdrips API and MCP 23

Hosted lines. No status page found on the site, the developer docs or the footers (0). No readable incident history (5). No rate limit is given in numbers, only monthly call allowances by plan (6,000 on Pro, 25,000 on Ultimate), which earn a little (5 of 15). The troubleshooting note says to check /queue/stats and retry after a short delay when rate limited, with no status code or Retry-After. Render jobs are asynchronous, so polling is safe (3 of 15). No SLA found (0). The MCP server is v1.0.0 and the render API is not labelled beta (10). 0 + 5 + 5 + 3 + 0 + 10 = 23.

Shotstack 95

Hosted lines. Public status page at status.shotstack.io with monitors, the Edit API in production among them (20). Its feed and incident pages hold no incident in the 90 days from 4 August 2026. The newest incident, number 8 (range parameters in render payloads causing failures, 21 July 2026), left the window on 20 October, /incidents/9 answers 404, and the window holds only two completed maintenance windows (11 August, rendering stayed available; 4 and 5 September, billing, with the API fully available). A readable page that posts incidents, none in the window, is a clean record (30, was 20). Rate limits per API key in a fixed 60-second window, 300 for Edit, 600 for Serve and 300 for Ingest in production (15). A 429 returns rate_limit_error with advice to wait for the window and retry with exponential backoff, and POST /generate takes an Idempotency-Key, but POST /render has none and no Retry-After is documented for rate limits (10). Schedule 2 of the terms is an SLA of 99.9 per cent with a 10 per cent credit, free plans excluded (10). The Edit API is v1 and neither the MCP server nor the CLI carries a beta label (10). 20 + 30 + 15 + 10 + 10 + 10 = 95.

Contentdrips API and MCP 15

The newest dated change to the agent surface is the MCP page, published 25 May 2026 and modified 27 May, 163 days before this check (10). No three dated changes since 8 August were found (0). No public changelog. Email support at hello@contentdrips.com, which we didn't test (5 of 15). Not in the official MCP registry and no official SDKs (0). No public package or repository (0). 10 + 0 + 5 + 0 + 0 = 15.

Shotstack 73

API definition 1.23.3 (@shotstack/schemas) tagged on 27 October 2026, six days before the check, after 1.23.0 on 15 October added a source file on generation assets (30). 21 definition tags and 13 CLI tags (0.8.x to 0.15.2, the last on 22 October) since 4 August 2026, and the skill repository synced from CLI 0.16.0 to 0.17.0 between 25 and 30 October (20). Dated changelog for the definition in its repository, in-app support on every plan and a GitHub issue template for the CLI. Issue threads were not read (8). @shotstack/cli and @shotstack/schemas are current, while npm shotstack-sdk 0.2.9 dates from July 2024 per the 8 October check; the PyPI release date came from a path pypi.org's robots.txt disallows and is struck, and pypi.org didn't resolve on 2 November. The MCP registry entry was not checked (7). The definition repository runs build, smoke and example tests on pull requests. Since 25 October the CLI repository holds only the agent skill and says the CLI's source isn't published there, so its release tests can no longer be read (8). 30 + 20 + 8 + 7 + 8 = 73.

Contentdrips API and MCP 48

No OpenAPI or other machine-readable contract for the REST API, and the MCP server is closed, so its schemas weren't read. The MCP page names every tool's parameters (10 of 25, on that partial evidence). The marketing site's llms.txt is generated by Yoast and lists blog posts, with no link to the API or MCP docs; the developer site has none (2 of 10). The MCP page labels each tool Read, Write or Destructive, says get_template_structure is needed before filling or editing, and gives confirmation rules for publishing and deleting (15 of 20). Enums for output, type, AI method and formats, but content_update and carousel_content are open structures keyed by template labels (9 of 15). Request examples and an error table (400, 401, 404, 500) with an error body, while the result section contradicts its own example and some examples omit a required value (9 of 15). Docs marked v1.0.0 and last updated January 2025, with no changelog (3 of 15). 10 + 2 + 15 + 9 + 9 + 3 = 48.

Shotstack 88

Public OpenAPI 3.0.1 definition of the Edit API with 14 operations and 122 schemas. The MCP tool schemas need a signed-in account and were not read (25). llms.txt, llms-full.txt and a Markdown twin of every guide page (10). The conventions guide and MCP page say when to use studio or render_video and name the five commonest mistakes (17). 84 enums and required fields across the schemas, with per-model generation options published as JSON Schema by GET /models (13). 367 examples in the definition. Error responses are documented for the generation endpoints, while render and template operations document only the success response (10). v1 and stage in the path and a dated changelog for the definition, less 2 because release 1.22.0 removed a response field in a minor version (13).

Contentdrips API and MCP 25

No x402, MPP or L402 (0). No per-call price. The API page shows $0 on paid cards, a $39 starting price and $359 a month for unlimited calls, and the pricing page shows $15 and $26 plans without API, so the public pricing can't be relied on (5 of 20). The API page says 10 API calls to test with and no card for the free plan (20). A person signs up and generates the key in the dashboard (0). 0 + 5 + 20 + 0 = 25.

Shotstack 45

No x402, MPP or L402 (0). Public per-minute prices, 20 cents on pay as you go down to 5 cents on Volume, with AI generation priced per model through a quote endpoint and four examples on the pricing page (20). 10 credits for 30 days with no card, and a free watermarked sandbox (20). Checking an edit and opening a Studio preview need no key, but any render needs a key from a browser signup (5).

Contentdrips API and MCP 31

API keys from the dashboard, with no scopes, expiry or rotation documented. The MCP server also runs OAuth 2.0 with PKCE and dynamic client registration, but its one mcp scope authorises the same full key (18 of 30). No read-only key or endpoint. publish_post needs confirmed: true and the docs ask for confirmation before deletes (10 of 20). Tools read blog, YouTube and TikTok links and download external images, and no prompt-injection guidance was found (3 of 15). No audit log or per-call record documented (0). No security.txt, disclosure policy, bug bounty or certification found (0). 18 + 10 + 3 + 0 + 0 = 31.

Shotstack 48

The MCP server uses OAuth authorisation code with PKCE S256 and dynamic client registration, with one scope, mcp:tools. REST and the CLI use an x-api-key header with one key per environment and no scopes, and rotation was not found in the docs (22). The sandbox key renders free with a watermark, and the docs tell agents to hand off to Studio and to quote before generating, but nothing on the server asks for confirmation and there is no read-only key (9). Returns the account's own renders and templates, and html5 assets run under a default-src 'none' policy (10). Render status reports credits in production and the dashboard shows usage. No audit log was found (4). No security.txt, disclosure policy, bounty or certification of Shotstack's own. The DPA lists technical measures and relies on AWS's audit reports (3).

Contentdrips API and MCP 60

Closed service under terms of use dated 11 December 2024, governed by the laws of Pakistan (15). The privacy policy of 9 August 2026 states retention while the account is active, deletion of content as soon as the account is deleted apart from short-lived backups, deletion of social tokens on disconnect, and no training of Contentdrips' own models on user content (22 of 30). No deprecation policy. The legacy carousel input is 'still supported' with no end date (3 of 20). The policy names OpenAI, OpenRouter, Google Gemini and TinyPopups and has an international transfers section, without a full subprocessor list or hosting locations (12 of 20). 15 + 22 + 3 + 12 = 52.

Shotstack 73

Closed service under published terms, with the schemas and SDKs under MIT. The CLI was Apache-2.0 in its last public source (0.15.2, 22 October 2026); since 25 October its source isn't published and the repository keeps only the agent skill (15). A DPA and sub-processor list updated 6 October 2026, and terms that say customer data is not used to train AI models. The privacy policy is dated 21 December 2021 and says ingested media is deleted after rendering, while the Ingest guide says sources are stored until deleted, and the DPA gives 24 hours for outputs while the hosting guide calls CDN hosting permanent by default (18). The terms promise reasonable notice before a feature is retired and 30 days before material changes to the terms, and deprecated asset types keep working, but no dated deprecation policy was found (8). Five sub-processors named with purposes and locations, AWS in Sydney and the United States, with seven days' notice of additions (20).