Creatomate vs Pixelixe

Creatomate 54

No changelog. Dated releases since 6 August are the n8n node 0.2.0 (11 August, per the 8 October npm reading), the rebuilt n8n node v1.0.0 (11 September) and v1.0.1 (19 September, a category metadata fix, half), and @creatomate/preview 1.6.1 (3 September, removing a dependency and type definitions from the build, half). The newest release that changes code is n8n v1.0.0, 54 days before the check (20). Three counted entries in 90 days (20, cause evidence; it drops to 0 after 9 November when 0.2.0 leaves the window). Support by email, no public changelog or forum found, and two open GitHub issues across the libraries per the 8 October check (5). The Node library was last tagged 1.2.1 on 23 September 2024 and calls /v1, the PHP library was last pushed on 21 October 2024, and the Preview SDK is current (7). No CI in the Node repository (2). 20+20+5+7+2 = 54.

Pixelixe 19

No dated release or API change was found. The newest dated items are the MCP registry entry of 26 March 2026 and the privacy policy of 7 April 2026, more than 180 days before this check (0). No three dated changes since 8 August (0). No changelog. Support by email at inquiries@pixelixe.com, not tested (4 of 15). com.pixelixe/pixelixe-mcp is in the official MCP registry under a domain-verified namespace; there are no official SDKs (15). No public package or repository (0). 0 + 0 + 4 + 15 + 0 = 19.

Creatomate 40

Hosted lines. No status page found. status.creatomate.com still has no DNS record and no page we read links to one (0). No readable incident history (5). 30 requests per 10 seconds per account, documented in the API reference for agents (15). The same page documents X-RateLimit-* headers on every response and Retry-After on 429 with "wait that long, do not retry immediately", but no idempotency key for renders, which are writes (10). The 8 October first-hand header reading came from a request to the product's API and is struck; the docs carry the same facts. No SLA found (0). The REST API and MCP server carry no beta label (10). 0+5+15+10+0+10 = 40.

Pixelixe 15

Hosted lines. No status page found on the site or in the docs (0). No readable incident history (5). No rate limit is published; the terms only forbid circumventing them (0). No 429, Retry-After or backoff guidance. Every error, a wrong key and exhausted credits included, is a 400 with a message (0). No SLA found; the terms supply the service as is (0). API v2 is current and not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Creatomate 67

Eight MCP tools on the vendor's list, re-read on 4 November, definitions unseen, and the template list omits sources (22). A tags filter on the template list, with no pagination, limit or render list found (6). The API reference documents a hint and a documentation URL on 400, 401, 404 and 429, a hint on 402 and 500, plus advisory errors and warnings and a free dry_run (20). No idempotency key. dry_run and status polling are safe, and template delete is now described as a soft delete that an open editor can restore; MCP annotations were not readable (8). template_id alone starts a render, and the Node and PHP libraries are official but last published in 2024 (11). 22+6+20+8+11 = 67.

Pixelixe 49

Seven compact MCP tools (25). Document and design-set search filters, with no pagination documented (10 of 20). All errors are 400 with free-text messages, so an agent can't branch on a code (6 of 20). No idempotency keys, and annotations couldn't be read on the closed server. The MCP tools only read and create, with nothing that deletes (5 of 20). Few required fields, but no official SDK (3 of 15). 25 + 10 + 6 + 5 + 3 = 49.

Creatomate 53

No OpenAPI file linked from the docs or llms.txt (0); the 8 October check of a guessed path on the API host is struck as a request to the product's API. The MCP tool schemas can't be read without an account. llms.txt with 50 Markdown topic links (10). Reference and topic pages state purpose and when to use dry_run, templates or raw RenderScript, with an out-of-scope page (16). Render options are typed with ranges and status is an enum, but modifications and source are open objects, and unknown names are ignored without an error (9). Examples in nine languages and a documented error body for 400, 401, 402, 404, 429 and 500 (13). /v1 and /v2 paths, no changelog (5). 0+10+16+9+13+5 = 53.

Pixelixe 66

OpenAPI 3.1 (version 2.0.0) at pixelixe.com/pixelixe-openapi.json, but it covers four endpoints, authentication, document search, graphic automation and photo effects, and leaves out the JSON-to-graphic and image processing APIs (18 of 25). llms.txt exists but routes readers to marketing pages; the MCP reference is written for LLMs (7 of 10). The MCP reference says what each of the seven tools maps to, that pixelixe_generate_graphic_variant 'is not a free-form layout API', lists common mistakes and how to present outputs (17 of 20). The MCP layer documents canonical field names and refuses legacy aliases; the REST modifications are open structures keyed by element name (10 of 15). Request examples throughout, but errors are one table of message strings all returning 400 (8 of 15). /v2 paths and a deprecated V1, with no changelog (6 of 15). 18 + 7 + 17 + 10 + 8 + 6 = 66.

Creatomate 52

Closed service under published terms, with MIT client libraries (15). Render retention of 30 days is stated the same way in the docs, pricing page and llms.txt. The privacy policy is dated 27 June 2022 with no retention period for personal data, no DPA was found, and the terms let Creatomate make user Content available to other users (12). No deprecation policy, and /v1 and /v2 are documented side by side with no dates (2). The privacy policy names Paddle, AWS, DigitalOcean, Google Analytics, Cloudflare and GitLab, with no data locations (8). Terms and privacy policy re-read on 4 November, both still dated 27 June 2022. 15+12+2+8 = 37.

Pixelixe 41

Closed service under terms of 19 March 2026 that choose French law but name no company (12 of 30). The privacy policy of 7 April 2026 keeps account data while the account is active and 'as long as reasonably necessary' after, with no periods, and says nothing about AI processing or training (10 of 30). V1 is marked deprecated in the docs with no dates or notice period (5 of 20). Processors are described only by category, with Google Analytics named, and data processed in France, the EEA and other vendor countries (5 of 20). 12 + 10 + 5 + 5 = 32.

Creatomate 48

MCP uses OAuth authorisation code with PKCE S256 and dynamic client registration, one scope, with connections revocable per application. REST uses one unscoped key per project, and key rotation is not documented (22). Each MCP connection reaches one project and a project can have a monthly credit budget, but there is no read-only mode and no server-side confirmation before a render or delete (8). Returns the account's own templates and renders (10). Account Settings lists MCP connections with last use, and the dashboard has an API log of renders (8). No security.txt, disclosure policy, bounty or certification found (0). No security.txt (404 on 4 November). 22+8+10+8+0 = 48.

Pixelixe 38

A bearer API key per account, plus a public key for the embedded editor. The MCP server accepts the key or an OAuth token from studio.pixelixe.com/oauth/mcp with one pixelixe.mcp scope. No key scopes, rotation or revocation documented (18 of 30). No read-only mode, though the MCP tools can't delete or change account settings (10 of 20). Tools return the account's own templates and renders (10 of 15). No audit log or per-call record documented (0). No security.txt, disclosure policy, bug bounty or certification found (0). 18 + 10 + 10 + 0 + 0 = 38.