Databento vs Finnhub

Databento 61

Named API keys, up to 100 per account, rotated or deleted in the portal, with per-member permissions, sent only as the Basic auth username; no scopes per key and no expiry (25 of 30). Every API call is a read, and a monthly historical limit caps what a leaked key can spend; live usage is not capped (14 of 20). The API returns market data and reference records, not free text from third parties (10). A data usage page in the portal and a billing page per cycle, with no per-key call log documented (8 of 15). The vendor revokes keys it finds in public and documents key hygiene; security.txt returns 404 and no bounty, SOC 2 or ISO 27001 was found on readable pages (4 of 20). Total 61.

Finnhub 32

One key per account with no scopes, documented as token= in the query string or an X-Finnhub-Token header, and the Swagger document declares only the query form. The MCP server uses OAuth with fixed public client ids and keeps the key from the assistant (20 less 10 for the query string, plus 2 for the MCP route, so 12). Every data operation is a read (15 of 20). News, transcripts and filings are third-party text and no guidance was found (5 of 15). No usage log for the key holder was found (0 of 15). security.txt redirects to the home page and no disclosure policy, bug bounty or certification was found (0 of 20). 12 + 15 + 5 + 0 + 0 = 32.

Databento 80

limit, time ranges to the nanosecond, schema choice from trades to daily bars, encoding choice and metadata.get_cost to size a request before paying (20 of 25). Symbol, date and schema filters, batch jobs listed and fetched by id, no cursor pagination because ranges are split by time (16 of 20). Errors carry an HTTP code, a named identifier, a message and a docs link, with 206 for partially resolved symbols (17 of 20). Reads only on the historical and reference APIs; a duplicate streaming request is charged twice, batch is billed once, and the portal can cap monthly spend (12 of 20). Few required parameters, and official clients in Python, C++ and Rust (15). Total 80.

Finnhub 56

The REST API is the surface graded. from and to on candles and news, and symbol-scoped calls, size responses; no field selection, and the MCP server lists 70 tools (12 of 25). Date filters but no pagination on most lists (10 of 20). Only the 429 is documented; a missing key answered 401 with a JSON error field in our one test call (5 of 20). All but one operation are GET reads; the MCP annotations were not read (14 of 20). Few required parameters and official libraries in six languages (15). 12 + 10 + 5 + 14 + 15 = 56.

Databento 84

Python 0.89.0 on 28 October 2026 and data release notes dated 20 October (30). Python 0.85.0 (25 August), 0.86.0 (1 September), 0.87.0 (22 September), 0.88.0 (21 October) and 0.89.0, plus Rust 0.64.0 and C++ 0.69.0 on 27 October and four dated data notes since 8 August (20). A Slack community, Intercom chat, support@databento.com, a public roadmap and a public issue tracker linked from the release notes; GitHub issue replies were not read because the GitHub API rate limit was reached (12 of 15). Official clients in Python, C++ and Rust released the same week as each other (15). The Python client is Apache-2.0 with releases on GitHub and PyPI; CI and dependency pins were not checked (7 of 10). Total 84.

Finnhub 60

Read as a closed service. The newest dated change is 2 November 2026, when finnhub-go, finnhub-ruby and finnhub-php gained a price target history endpoint; the MCP page is dated 6 August 2026 (30). Only that one dated change falls in the last 90 days, the previous library commits being 22 June 2026 (5 of 20). Support by email, with no public changelog or community channel found (5 of 15). Six official client libraries, finnhub-python at 2.4.29 of 24 June 2026 (15). The libraries are generated from the API document; no CI run was visible and the Python README names an older version than PyPI (5 of 10). 30 + 5 + 5 + 15 + 5 = 60.

Databento 49

A closed service whose terms could not be read, because databento.com/legal and its /terms and /privacy pages are drawn by script; the client libraries are Apache-2.0 (10 of 30). The privacy policy was unread for the same reason, and the docs say nothing about retention of account data (0 of 30, unchecked). Dated release notes carry deprecations, and the versioning policy keeps a prior major version for a year after the next (18 of 20). No subprocessor list or data location statement was found on readable pages; the architecture docs name the company's own data centres (0 of 20). Total 28.

Finnhub 27

A closed service whose terms exist at a page that robots.txt disallows, so they were not read; the pricing page says every self-serve plan is personal use, and no legal entity or governing law was found (8 of 30). No privacy policy was found, /privacy redirecting to the home page (0 of 30). No deprecation policy or dated notices found (0 of 20). Stripe and Braintree scripts load on the site, but no processor list or data location is disclosed (0 of 20). 8 + 0 + 0 + 0 = 8.

Databento 75

No OpenAPI document was found. The contract is the per-endpoint reference with typed parameters, the DBN schemas with field tables and enums, and a .http.md variant of every page (8 of 25). llms.txt and a Markdown twin of every page with language variants (10). Endpoint pages say what each call returns and the basics pages say when to use streaming against batch (15 of 20). Typed parameters with enums for schema, encoding, symbology type and split duration (13 of 15). Code in Python, C++, Rust and curl on every page, and an error table with codes, named error identifiers and a docs link in each body (14 of 15). Semantic versioning with dated release notes per component, breaking changes and deprecations called out (15). Total 75.

Finnhub 58

A public Swagger 2.0 document covers 116 paths with a description on every operation, declaring the key as a query parameter and a 200 response only; the MCP tools were not read (20 of 25). /llms.txt returns the site's HTML shell and no Markdown docs exist (0 of 10). Each operation states its purpose, a premium marker and, on quote, advice against polling, with little on when not to use it (14 of 20). Required flags and types are set on 248 parameters, but allowed values such as news categories sit in description text and no enum is declared (8 of 15). Every operation has example URLs and sample code in five languages, while the only documented error is the 429 (9 of 15). The path carries v1 and no changelog or dated change notes were found (7 of 15). 20 + 0 + 14 + 8 + 9 + 7 = 58.

Databento 22

No x402, MPP or L402 (0). Plans are public ($199, $1,750 and $4,500 a month) and historical data is metered per GB, but the per-dataset rates are in the portal catalogue behind a login and the pricing page's estimator shows only an example (12 of 20). $125 of credits for every new user, expiring after six months; whether a card is needed at signup was not found on the pricing, credits or billing pages (10 of 20). A person signs up in a browser and creates keys in the portal; no key API (0). Total 22.

Finnhub 30

No x402, MPP or L402 (0). Plan prices are public without login, read from the pricing page's script data, sold per dataset by the month with calls a minute rather than per call (10). A free key at 60 calls a minute with no card, which the pricing FAQ says can be used forever (20). The key comes from a browser signup and no key API was found (0). 0 + 10 + 20 + 0 = 30.