Datalab vs Reducto API + MCP

Datalab 58

Hosted lines. Status page at status.datalab.to (incident.io) with Website and Datalab API components; the history page is drawn by script, so components are confirmed and history isn't (15 of 20, 5 for history). Rate limits per plan with numbers, plus page and size limits (15). 429 is retryable with sample backoff, and 500 and 529 say to check a known request ID before resubmitting; webhooks deduplicate by request_id (13 of 15). Custom SLAs only for Enterprise (0). Generally available (10). 15+5+15+13+0+10 = 58.

Reducto API + MCP 77

incident.io status page at status.reducto.ai with API, Parsing, Extraction, Splitting, Editing and Studio components (20). Its feed lists nine incidents from 13 August to 1 October 2026 and none since, each a latency rise or partial degradation of one product (Extract on 13 August, Parse on 13 August, Parse and Extract with citations on 18 August, Deep Split for about 11 minutes on 9 September, Parse with embed_pdf_metadata on 16 September, Parse on 28 September, and Parse, then Parse in the EU region, on 1 October). The history page answered 500 on 2 November, so 4 to 12 August rests on the 1 October reading, which found only partial incidents after 23 July. All partial, read as minor (20 of 30). Edge limits of 1,000 requests a second per key and 300 on job polling (15). 429 bodies carry a code and say to back off or use webhooks, and the SDKs retry 429s with exponential backoff. No Retry-After and no idempotency key (12 of 15). Custom SLA on Enterprise only (0). GA (10).

Datalab 56

Several hashed API keys with per-key 30-day spend caps, revoke-and-replace rotation, no scopes (24 of 30). Spend caps limit damage; results and files can be deleted by the key holder, and there's no read-only key (10 of 20). Returns document text with no prompt-injection guidance (2 of 15). cost_breakdown per request and usage tracking in the dashboard (8 of 15). A Secureframe trust centre and a SOC 2 report on the Team plan, TOTP enforcement for teams; no disclosure policy or security.txt found (12 of 20). 24+10+2+8+12 = 56.

Reducto API + MCP 40

Plain bearer API key from Reducto Studio, used for the hosted MCP too. The local server adds a device-code login (20 of 30). No read-only or scoped key, and five of the nine tools start billable jobs with no confirmation step (5 of 20). Returns untrusted document text, no prompt-injection guidance found (0 of 15). get_job and list_jobs let the operator review past jobs, no audit log found (5 of 15). security.txt is valid (support@reducto.ai, expires 1 July 2027), the SDK repositories carry a SECURITY.md with a reporting address, and the data policies page says SOC 2 Type I and Type II are complete with the report on request, with HIPAA processing on Growth and Enterprise and regular penetration testing. No ISO 27001, bug bounty or public advisories found. That sits above pandadoc (8, a SOC 2 claim and public bulletins) and below oxylabs-web-scraper (14, ISO 27001 as well) (10 of 20).

Datalab 73

Output as Markdown, HTML, JSON or chunks, page_range to limit pages, and cost_breakdown on results (20 of 25). File listing and pipeline endpoints, little else to paginate (14 of 20). Typed errors with retry guidance an agent can follow (18 of 20). No idempotency key; the docs say to poll a known request ID instead of resubmitting, and webhooks may be retried (12 of 20). Official Python SDK and CLI, one language (9 of 15). 20+14+18+12+9 = 73.

Reducto API + MCP 84

Nine MCP tools with short descriptions (25). page_range, chunk_mode, return_images, URL results for large outputs, and list_jobs (18 of 20). Errors say what to do next, and 429 bodies name the fix (18 of 20). jobid:// reuse avoids paying to parse twice, but there's no idempotency key and no readOnlyHint or destructiveHint annotations (8 of 20). parse_document needs only document_url. SDKs in Python, Node.js and Go (15).

Datalab 40

No x402, MPP or L402 (0). Per-1,000-page rates for every processor and add-on on the public pricing page (20). A $10 to $20 monthly allowance with no card (20). A person signs up in a browser (0). 0+20+20+0 = 40.

Reducto API + MCP 30

No x402, MPP or L402 (0). Per-1,000-page list prices for every endpoint on the public pricing page (20). $150 of free usage (15,000 credits) on Standard, and the page doesn't say whether a card is needed (10 of 20, our call until that's confirmed). A person signs up in a browser, or completes a device-code login for the local MCP (0).

Datalab 89

An OpenAPI 3.1 operation embedded in each reference page (spec version 0.0.1), no single downloadable file found (22 of 25). llms.txt with 159 pages and Markdown twins (10). Recipes say when to use each processor and mode (15 of 20). Typed request schemas with enums for output format and mode (12 of 15). An error table with type, HTTP code and whether to retry, plus SDK exception mapping (15). A written version policy and a dated changelog (15). 22+10+15+12+15+15 = 89.

Reducto API + MCP 80

OpenAPI spec at docs.reducto.ai/openapi.json per the 30 September check, and the SDK repositories run a spec-drift workflow against it (25). llms.txt per the same check (10). Each MCP tool description says when to use it and how to chain results through jobid:// and get_job, though none says when not to (17 of 20). MCP parameters are plain strings checked against enums at run time, and options takes a free-form dict or JSON string (8 of 15). Validation errors carry a 'What to do' line, and 429 codes 1000 and 2000 are documented (12 of 15). SDK changelogs live on GitHub, but the docs changelog is the password-protected on-prem one. The 1 September pricing migration has a dated page (8 of 15).

Datalab 68

Closed service under terms effective 30 June 2026 naming Endless Labs, Inc. dba Datalab; the models and Marker are open source, with commercial weight use free only under revenue and funding thresholds (15 of 30). Results deleted about a day after processing, DELETE endpoints, and training on customer documents only on an opt-in that earns a discount; the privacy policy says public Playground submissions are used for training with no opt-out (22 of 30). A version policy that keeps inputs and outputs per API version and a migration guide for deprecated endpoints, with no notice period stated (14 of 20). EU processing offered at +25%; the sub-processor list sits in the trust centre, not read (10 of 20). 15+22+14+10 = 61.

Reducto API + MCP 59

Closed service under published terms (effective 17 April 2026). The MCP server's MIT repository no longer answers a clone (15). The data policies page gives zero data retention on Growth and above, purging API-submitted artifacts within 24 hours except Studio jobs and persist_results, and says Growth and above data is never used for training. Standard gets neither promise, the deletion docs give no retention period for it, and the terms grant Reducto a licence to use uploaded content to develop and improve the Services and for its other business purposes. The privacy policy dates from 21 January 2024 (10 of 30). The 1 September pricing change has a dated migration page, and we found no deprecation policy (5 of 20). The MCP server sends PostHog usage telemetry by default, disclosed in the docs with REDUCTO_TELEMETRY=0 to opt out. Subprocessors sit in the JavaScript-only trust centre, with EU and AU endpoints on Growth and an EU data residency page (8 of 20).