Crowdin vs TranslatePlus

Crowdin 82

@crowdin/crowdin-api-client 1.59.2 on 22 October 2026 (scope annotations on every method), 10 days before 1 November, after @crowdin/cli 5.5.0 on 21 October and 5.4.0 on 16 October (30). In the 90 days from 3 August, ten CLI tags (4.15.1, the 5.0.0-next.6 pre-release and 5.0.0 on 26 August to 5.5.0), seven JavaScript client releases (1.56.3 on 6 August to 1.59.2) and three Python client releases (1.28.0, 1.29.0 and 1.30.0), none with a breaking change marked in a minor release (20). Monthly dated product updates and a support contact. The CLI and JavaScript client repositories each showed 2 open issues per the GitHub API on 8 October. We did not read the issue threads (12 of 15). Seven current official clients (15). CI and dependency state were not inspected, though the CLI began attesting build provenance for release binaries on 13 October, so half credit (5 of 10).

TranslatePlus 10

The newest dated change found is translateplus-python 2.0.7 and translateplus-js 2.0.1 on 11 January 2026, about ten months before this check, and the API changelog stops at 9 December 2024 (0). No release or dated change in the last 90 days (0). Support by email and a support portal; the status page hasn't updated since January (3). SDKs exist for four languages but haven't changed since January (5). Weekly downloads of 4 (PyPI) and 6 (npm) (2). 0+0+3+5+2 = 10.

Crowdin 78

Hosted reading. The surface graded is the REST API v2, with the hosted MCP server noted where it differs. status.crowdin.com is a Statuspage site with ten components, three of them for the API (Crowdin API, Crowdin API Enterprise, Crowdin API Enterprise EU) (20). Its history feed, read on 1 November 2026 (the host's robots.txt disallows /api/, so the feed and incident pages stand in for incidents.json), lists one incident in the 90 days from 3 August, a 12-minute slowdown on 22 October (11:13 to 11:25 UTC) that named only the Crowdin Enterprise and Crowdin Enterprise EU web components. No incident named an API component, so the line reads clean, as intercom's non-API incidents were read (30). The reference states 20 simultaneous requests an account across all tokens (15). A 429 is returned above that, with no Retry-After header, backoff guidance or idempotency keys found. Long jobs have a documented start, status and download sequence (3 of 15). No SLA found in the terms or the help centre (0). API v2 and MCP V2 are presented as current, with no beta label (10).

TranslatePlus 45

Hosted lines. status.translateplus.io is the vendor's own page; on 6 November 2026 it showed 'All systems unknown' and a last update of 22 January 2026, with data loading by script (5). No incident history to read (5). The rate-limits guide gives 100,000 requests a minute and 100,000,000 an hour per key, while llms.txt gives 50 requests a second on the Free plan, so limits are published but inconsistent (10). 429 returns a JSON detail message, responses carry X-RateLimit-Limit, -Remaining and -Reset, and the guide shows waiting for the reset with capped retries (15). No SLA. The terms say TranslatePlus strives for 99.9% uptime 'but do not guarantee uninterrupted service' (0). API v2 is the current, non-beta version (10). 5+5+10+15+0+10 = 45.

Crowdin 68

Personal access tokens with an expiry date, scopes at read-only or read-and-write, per-project granular access and revocation. OAuth authorisation code grant with PKCE for public apps. No query-string token option found (30). Read-only scope levels and the MCP crowdin-read-only header. No server-side confirmation for destructive calls was found, and the MCP examples include deleting a user (15 of 20). The API returns strings, comments and translations written by contributors. No prompt-injection guidance was found in the developer or help documentation (0 of 15). A security log of account events (logins, password changes, device and IP address) with a read-only security-log scope, and AI request logs. No per-call API log found (8 of 15). security.txt valid to 31 January 2030 (re-read on 1 November), a vulnerability policy pointing to a private HackerOne programme, ISO/IEC 27001 certification and HIPAA agreements claimed on the security page. No SOC 2 report found (15 of 20).

TranslatePlus 35

One API key per account in the X-API-KEY header, which the docs say 'carries full access to your account's resources', and can be revoked in the dashboard (15). No scopes or read-only keys (5). Translations return the caller's own text, so little untrusted content (10). llms.txt claims request logging and an analytics dashboard, which we couldn't see without an account (5). translateplus.io/.well-known/security.txt returns 404 and no disclosure policy was found; llms.txt says 'SOC 2 compliant' and 'SOC 2 Type II certified infrastructure' with no report or auditor named (0). 15+5+10+5+0 = 35.

Crowdin 80

Public OpenAPI 3.0 document for API v2, 374 operations on 218 paths in the file-based reference, with string-based and Enterprise variants (25). llms.txt links abridged and complete documentation and one text file per route (10). Operations carry a summary and the required scope, and parameters point to the call that supplies their value, but few say when to use or avoid an endpoint (12 of 20). 518 enums, required fields and numeric bounds. Edits are JSON Patch arrays and several forms are oneOf (12 of 15). 2,831 examples, with 400, 401, 403, 404 and 405 responses on most operations (13 of 15). The API is versioned at /api/v2 and the MCP server at V1 and V2. Changes appear in monthly product posts and client release notes, and no dated API changelog was found (8 of 15).

TranslatePlus 52

No OpenAPI or other machine-readable contract found in the docs or either llms.txt (0). llms.txt on the site and on docs.translateplus.io (10). Endpoint pages say what each call does, with little on when to choose HTML, email or i18n jobs over plain text (10). Required fields and per-plan character limits per request are documented, without enums for language codes beyond a supported-languages call (10). Code examples in several languages and an error-handling guide with status codes (12). Versioned /v1 and /v2 paths and a changelog, whose newest entry is 2.0.0 on 9 December 2024 (10). 0+10+10+10+12+10 = 52.

Crowdin 80

Closed service with published terms revised on 24 September 2026 (unchanged on 1 November) and earlier versions kept on GitHub. The CLI and clients are MIT (15). The privacy policy gives retention periods (closed-account data deleted within 60 days, backups up to two more months, billing records 7 years), the terms carry a data processing contract, and both say Crowdin does not train models on client input. For managed AI the commitment about sub-processors is commercially reasonable efforts (26 of 30). MCP V1 and 12 API operations are marked deprecated with no removal dates, and no deprecation policy was found (6 of 20). A dated sub-processor list with countries, and data centres named as the United States and Ireland (18 of 20).

TranslatePlus 52

Editorial half only. Closed service under terms last updated 18 December 2024 that name PetaBytes, Inc. as a US corporation but give no address, governing law or courts (10). The terms say translation requests aren't permanently stored 'unless required by law', the privacy policy says 'unless required for caching or service improvement purposes', and the terms allow using anonymised usage data to improve the service (8). API v1 is kept as legacy, with no dated deprecation notice (5). No subprocessor list or data location found (0). 10+8+5+0 = 23.

Crowdin 69

The MCP V2 server has 33 tool sets, all loaded by default. We could not list the tools without an account, so the count is read as more than 30 (5), with 10 added back for the tool-set, project-type and wildcard filters and the read-only mode (15 of 25). limit up to 500, offset, orderBy and CroQL filters on the API, and crowdin:// resources on MCP (20). Errors are JSON with a message and code, or per-field string codes. The 429 has no recovery guidance (15 of 20). No idempotency keys. The MCP read-only header helps, and tool annotations could not be read (6 of 20). Seven official clients and a CLI, though a file upload takes two calls through storage (13 of 15).

TranslatePlus 61

API reading. Batch translation of up to 100 texts a call and separate HTML, email, subtitle and i18n job endpoints (16). Few output controls or filters (10). Errors are a detail string with HTTP status codes (12). No idempotency key for i18n jobs, though text translation is stateless (8). Official SDKs listed for Python, JavaScript and TypeScript, Java and PHP, with few required fields (15). 16+10+12+8+15 = 61.