Crowdin vs Localazy

Crowdin 68

Personal access tokens with an expiry date, scopes at read-only or read-and-write, per-project granular access and revocation. OAuth authorisation code grant with PKCE for public apps. No query-string token option found (30). Read-only scope levels and the MCP crowdin-read-only header. No server-side confirmation for destructive calls was found, and the MCP examples include deleting a user (15 of 20). The API returns strings, comments and translations written by contributors. No prompt-injection guidance was found in the developer or help documentation (0 of 15). A security log of account events (logins, password changes, device and IP address) with a read-only security-log scope, and AI request logs. No per-call API log found (8 of 15). security.txt valid to 31 January 2030 (re-read on 1 November), a vulnerability policy pointing to a private HackerOne programme, ISO/IEC 27001 certification and HIPAA agreements claimed on the security page. No SOC 2 report found (15 of 20).

Localazy 37

Bearer tokens in the Authorization header. A project token reaches every endpoint of one project with read and write access; a translation token reaches only the AI Translation endpoint; organisation tokens are in beta on request (20). The translation token is the only least-privilege option, and project tokens can delete keys and glossary items without a confirmation step (10). The API returns strings written by translators and contributors, with no guidance on untrusted content (5). No per-call log or audit trail for tokens found (2). localazy.com/.well-known/security.txt and /security return 404, and we found no disclosure policy or certification (0). 20+10+5+2+0 = 37.

Crowdin 80

Public OpenAPI 3.0 document for API v2, 374 operations on 218 paths in the file-based reference, with string-based and Enterprise variants (25). llms.txt links abridged and complete documentation and one text file per route (10). Operations carry a summary and the required scope, and parameters point to the call that supplies their value, but few say when to use or avoid an endpoint (12 of 20). 518 enums, required fields and numeric bounds. Edits are JSON Patch arrays and several forms are oneOf (12 of 15). 2,831 examples, with 400, 401, 403, 404 and 405 responses on most operations (13 of 15). The API is versioned at /api/v2 and the MCP server at V1 and V2. Changes appear in monthly product posts and client release notes, and no dated API changelog was found (8 of 15).

Localazy 51

No OpenAPI or other machine-readable contract was found (0). localazy.com/llms.txt is a six-link index of top-level pages, with no Markdown docs for agents (5). Each endpoint page states which token types can call it, whether write permission is needed and the minimum role, and the limits page says to use the CDN, not the API, for production fetches (14). Request bodies list required and optional fields with limits, such as 512 characters for a key and 1,000 for a comment (12). Sample requests, responses and error responses per endpoint (13). Docs pages carry 'last updated' dates and the blog posts dated release updates, but there's no API version or changelog (7). 0+5+14+12+13+7 = 51.

Crowdin 80

Closed service with published terms revised on 24 September 2026 (unchanged on 1 November) and earlier versions kept on GitHub. The CLI and clients are MIT (15). The privacy policy gives retention periods (closed-account data deleted within 60 days, backups up to two more months, billing records 7 years), the terms carry a data processing contract, and both say Crowdin does not train models on client input. For managed AI the commitment about sub-processors is commercially reasonable efforts (26 of 30). MCP V1 and 12 API operations are marked deprecated with no removal dates, and no deprecation policy was found (6 of 20). A dated sub-processor list with countries, and data centres named as the United States and Ireland (18 of 20).

Localazy 57

Editorial half only. Closed service under terms that name Localazy s.r.o. of Brno and Czech law; the CLI is BSD-3-Clause and the API client MIT (15). The privacy policy keeps data while the service is used and 24 months after, and includes a DPA, but says nothing on whether content sent to Localazy AI is used for training (15). No deprecation policy or dated notices found (0). The DPA links a list of suppliers and subprocessors on an external knowledge base we didn't read (10). 15+15+0+10 = 40.

Crowdin 78

Hosted reading. The surface graded is the REST API v2, with the hosted MCP server noted where it differs. status.crowdin.com is a Statuspage site with ten components, three of them for the API (Crowdin API, Crowdin API Enterprise, Crowdin API Enterprise EU) (20). Its history feed, read on 1 November 2026 (the host's robots.txt disallows /api/, so the feed and incident pages stand in for incidents.json), lists one incident in the 90 days from 3 August, a 12-minute slowdown on 22 October (11:13 to 11:25 UTC) that named only the Crowdin Enterprise and Crowdin Enterprise EU web components. No incident named an API component, so the line reads clean, as intercom's non-API incidents were read (30). The reference states 20 simultaneous requests an account across all tokens (15). A 429 is returned above that, with no Retry-After header, backoff guidance or idempotency keys found. Long jobs have a documented start, status and download sequence (3 of 15). No SLA found in the terms or the help centre (0). API v2 and MCP V2 are presented as current, with no beta label (10).

Localazy 68

Hosted lines, for the REST API at api.localazy.com. Better Stack status page with Web, API, Public API, Payments and Connect API components and 30, 60 and 90-day uptime (20). The incidents page reports none for September, October or November 2026, but the Public API shows 99.805% uptime in one 30-day bucket, roughly an hour and a half of downtime with no incident posted, so the line is held below clean (25). Limits per plan of 100 requests a minute and 10 a second, plus daily import and fetch caps per project (15). No 429 or retry guidance found in the API docs (0). No SLA found on the pricing page or in the terms (0). The core API is GA; the AI Translation endpoint is marked beta (8). 20+25+15+0+0+8 = 68.

Crowdin 69

The MCP V2 server has 33 tool sets, all loaded by default. We could not list the tools without an account, so the count is read as more than 30 (5), with 10 added back for the tool-set, project-type and wildcard filters and the read-only mode (15 of 25). limit up to 500, offset, orderBy and CroQL filters on the API, and crowdin:// resources on MCP (20). Errors are JSON with a message and code, or per-field string codes. The 429 has no recovery guidance (15 of 20). No idempotency keys. The MCP read-only header helps, and tool annotations could not be read (6 of 20). Seven official clients and a CLI, though a file upload takes two calls through storage (13 of 15).

Localazy 62

API reading. List endpoints return whole projects, files and keys with few output controls (13). Filtering by file, language and tags, and batch imports of up to 1,000 keys and 50 files a request (14). Error responses are documented per endpoint, with HTTP codes and messages (12). No idempotency keys, and the docs warn against parallel imports into the same new file (8). Official TypeScript API client, a CLI and Android and iOS libraries, with few required fields (15). 13+14+12+8+15 = 62.

Crowdin 82

@crowdin/crowdin-api-client 1.59.2 on 22 October 2026 (scope annotations on every method), 10 days before 1 November, after @crowdin/cli 5.5.0 on 21 October and 5.4.0 on 16 October (30). In the 90 days from 3 August, ten CLI tags (4.15.1, the 5.0.0-next.6 pre-release and 5.0.0 on 26 August to 5.5.0), seven JavaScript client releases (1.56.3 on 6 August to 1.59.2) and three Python client releases (1.28.0, 1.29.0 and 1.30.0), none with a breaking change marked in a minor release (20). Monthly dated product updates and a support contact. The CLI and JavaScript client repositories each showed 2 open issues per the GitHub API on 8 October. We did not read the issue threads (12 of 15). Seven current official clients (15). CI and dependency state were not inspected, though the CLI began attesting build provenance for release binaries on 13 October, so half credit (5 of 10).

Localazy 75

@localazy/api-client 2.3.2 on 26 October 2026 (30). Releases 2.3.0 (12 August), 2.3.1 (29 September) and 2.3.2 (26 October) in the last 90 days (20). Support by email, blog release updates, and public GitHub repositories, but we didn't read issue reply times (7). The TypeScript client and the CLI (2.0.12 on 31 July 2026) are current (13). The client repository shows coverage badges; we didn't confirm CI runs (5). 30+20+7+13+5 = 75.