ConvertAPI vs PDF.co API + MCP

ConvertAPI 80

Closed service. Newest changelog entry 5 November 2026 (30). Twelve dated entries from 1 October to 5 November (20). Public changelog, support email, phone and form, and SDK repositories on GitHub; issue replies not sampled (10 of 15). Current official SDKs, npm 1.16.0 on 26 October and PyPI 2.0.1 on 20 October 2026 (15). The MCP repository's last commit is 12 May 2026 and has no LICENSE file though its README says MIT; SDK CI not checked (5 of 10). 30+20+10+15+5 = 80.

PDF.co API + MCP 34

MCP server 0.0.9 on 2026-07-28, 65 days before this check (20). Two releases in the last 90 days, 0.0.8 on 2026-07-08 and 0.0.9, and both only repoint documentation links. The API changelog's last entry is June 2026, outside the window (0). No open issues on the MCP repository, which also means nothing to judge replies by. Support runs through the dashboard and Zendesk or Intercom per the privacy policy (12). Not in the official MCP registry. The only pdfco entry there is a third-party wrapper from mcparmory (0). The only CI workflow publishes releases. No tests, and the lock file dates from June 2025 (2).

ConvertAPI 54

Hosted lines. status.convertapi.com is a Checkly dashboard drawn by script, so its components were not confirmed (10 of 20) and no history could be read (5). Concurrency per plan is published (1 to 4 concurrent conversions), with no request-rate figure (12 of 15). Under load the API answers 503 and llms.txt gives a 5, 10 and 15 second retry pattern; no 429, Retry-After or idempotency key (12 of 15). The compliance page states '99,95% monthly uptime' and says the SLA sits in the terms, but the terms read on 6 November state no uptime figure (5 of 10). Generally available (10). 10+5+12+12+5+10 = 54.

PDF.co API + MCP 20

status.pdf.co answers 302 to betterstack.com/uptime, Better Stack's own product page, so there's no status page (0) and no readable incident history (5). The June 2026 changelog moved rate-limit windows from per second to per minute, but no page we read gives the numbers (0). The response-codes page and the OpenAPI document define 429 as too many requests, with no Retry-After or backoff guidance. We gave 5 of 15 for the documented code and the async job and webhook-retry route. No SLA in the terms of 24 March 2026, which reserve the right to change or stop the service without notice (0). GA (10).

ConvertAPI 55

Tokens per environment with usage limits, JWTs with expiry and IP restriction, a separate Master Token for admin endpoints, OAuth on the hosted MCP (30), less 10 for the documented Token query parameter and its Secret and Auth aliases (20 of 30). Usage limits per token, but no read-only token, and stored files can be deleted (8 of 20). Extracted text and OCR output come from the documents, with no prompt-injection guidance (3 of 15). Usage statistics and per-environment consumption through the Master Token (10 of 15). ISO 27001 certificate linked, SOC 2 Type 2 stated with the report on request, cyber insurance; no disclosure policy, security.txt or bug bounty found (14 of 20). 20+8+3+10+14 = 55.

PDF.co API + MCP 23

One API key per account in the x-api-key header, header only per the OpenAPI document. We found no scopes, no multiple keys and no rotation guide (10). Every MCP tool also takes api_key as an argument, which invites the key into the model's context. No read-only mode, no annotations, and upload_file reads any absolute local path and uploads it to PDF.co. The SSE and HTTP transports bind 0.0.0.0 with no authentication (0). PDF text, tables and invoice fields come back as untrusted content with no injection guidance (0). Each response reports credits used and remaining, which is a per-call cost trail. We found no audit log (5). The security page claims SOC 2 Type II and cites AWS's ISO 27001, PCI and FISMA, which are the data centre's. security.txt is a 404 and we found no disclosure policy or bounty (8).

ConvertAPI 79

Four MCP tools that list, search and describe converters before one convert tool (25). StoreFile=true returns a URL and FileId instead of base64, and converters can be filtered by tag or search; nothing to paginate (14 of 20). Numbered codes such as 4014 balance exhausted and 5003 password protected an agent can act on (17 of 20). No idempotency key; a repeated conversion is billed again, and MCP tool annotations weren't found (8 of 20). SDKs in nine languages and a CLI, with one required file parameter on most converters (15). 25+14+17+8+15 = 79.

PDF.co API + MCP 49

38 MCP tools from about 78 KB of source with no toolset switch, which is the more-than-30 band (5). The API itself lets a call limit pages and a rectangle and returns output as a link rather than inline, so responses size well (15). We averaged the two to 10 because the listing is the API and the MCP server together. Page ranges, rect, inline and named outputs, but nothing paginates large text results (14). Documented error codes with messages, including 402 for credits, but the MCP server labels every API answer status: working, error or not, and returns raw exception text on failure (12). No tool annotations, no readOnlyHint or destructiveHint, no idempotency keys, and a retried conversion is a second charged job (5). Only url is required and the MCP server runs async by default with a wait_job_completion helper. We didn't confirm official SDK packages beyond code samples (8).

ConvertAPI 92

OpenAPI 3.0.4 at v2.convertapi.com/info/openapi, 333 operations with token, JWT and secret schemes, plus per-conversion documents and wildcard listings (25). A long llms.txt written for agents (10). llms.txt tells agents to discover conversions rather than assume them and explains workflows and storage; converter pages describe each parameter (16 of 20). Per-converter parameter schemas in the OpenAPI document, validated by the MCP convert tool (12 of 15). 25 numbered error codes with meanings and examples throughout (14 of 15). v2 API and a dated public changelog (15). 25+10+16+12+14+15 = 92.

PDF.co API + MCP 74

OpenAPI 3.0.1 at developer.pdf.co/openapi.json, header-only x-api-key scheme, and the 38 MCP tools carry typed JSON Schema from Pydantic (25). llms.txt and Markdown twins of every docs page (10). Tool docstrings state purpose and link the endpoint reference, and the URL field tells the model to use upload_file for local files, but none says when not to use a tool (10). No enums anywhere, since the server dropped Literal types for Gemini compatibility in May 2025. Page ranges, paper sizes and line_grouping are free strings, and the annotation and field arrays are List[Any] (6). The OpenAPI document describes errors 400, 401, 402, 403, 429 and 441 to 454 with a structured body, and every endpoint has samples (13). A monthly API changelog, but its last entry is June 2026, and the MCP server has tags and no changelog (10).

ConvertAPI 65

Closed service with terms dated 24 September 2026 naming ConvertAPI, UAB under Lithuanian law (15 of 30). Files are stored at most 3 hours or converted in memory per the compliance page, and a DPA and BAA are published, but llms.txt also says files are 'deleted immediately after processing by default', and the terms give no periods (20 of 30). The changelog dates changes, including the removal of the AiMode parameter on 22 October 2026 with no prior notice found, and the docs mark the secret as deprecated with no date; no deprecation policy (6 of 20). Subprocessors named with roles and regional endpoints listed (18 of 20). 15+20+6+18 = 59.

PDF.co API + MCP 53

The MCP server is MIT. The API is closed with dated terms, so between the two bands (20). The privacy policy (25 August 2026) names Artifex Software, Inc. and says processing happens in the US, but states no document retention. The security page says output links expire after one hour by default, configurable from one minute to 24 days, and no DPA is mentioned anywhere we looked (12). No deprecation policy, and the terms allow changes without notice (0). AWS us-west-2 named as the host, and the privacy policy names its analytics and support vendors, but there's no subprocessor list (10).