Datalab vs Unstructured API + MCP

Datalab 89

An OpenAPI 3.1 operation embedded in each reference page (spec version 0.0.1), no single downloadable file found (22 of 25). llms.txt with 159 pages and Markdown twins (10). Recipes say when to use each processor and mode (15 of 20). Typed request schemas with enums for output format and mode (12 of 15). An error table with type, HTTP code and whether to retry, plus SDK exception mapping (15). A written version policy and a dated changelog (15). 22+10+15+12+15+15 = 89.

Unstructured API + MCP 51

All readings per the 1 October check, not re-read on 5 November (the website terms bar robots on unstructured.io and its docs). No downloadable OpenAPI spec found; the per-endpoint API reference pages aren't a machine-readable contract (0). llms.txt, Markdown pages and an agent guide (10). Guides for parse, extract, chaining and jobs. MCP tool descriptions not read (12 of 20). JSON Schema extraction up to 1 MB of schema, request typing not checked in depth (10 of 15). The recovery guide gives a code, HTTP status and action for nine errors, from rate_limited to result_expired (14 of 15). Versioned /api/v2 path, no Transform changelog (5 of 15). 0+10+12+10+14+5 = 51.

Datalab 58

Hosted lines. Status page at status.datalab.to (incident.io) with Website and Datalab API components; the history page is drawn by script, so components are confirmed and history isn't (15 of 20, 5 for history). Rate limits per plan with numbers, plus page and size limits (15). 429 is retryable with sample backoff, and 500 and 529 say to check a known request ID before resubmitting; webhooks deduplicate by request_id (13 of 15). Custom SLAs only for Enterprise (0). Generally available (10). 15+5+15+13+0+10 = 58.

Unstructured API + MCP 27

Readings on the docs and pricing pages are per the 1 October check, not re-read on 5 November (the website terms bar robots on unstructured.io and its docs). No status page found, status.unstructured.io didn't resolve (0). No incident history to read (5). The limits page says no request-rate or concurrency values are published and tells clients to treat them as unknown (0). The recovery guide maps rate_limited to 429, says to back off and wait for Retry-After when it's sent, and says to check existing job IDs before resubmitting, safe-retry guidance with no idempotency key (12 of 15). No SLA found (0). Transform wasn't labelled beta in the pages read (10). 0+5+0+12+0+10 = 27.

Datalab 73

Output as Markdown, HTML, JSON or chunks, page_range to limit pages, and cost_breakdown on results (20 of 25). File listing and pipeline endpoints, little else to paginate (14 of 20). Typed errors with retry guidance an agent can follow (18 of 20). No idempotency key; the docs say to poll a known request ID instead of resubmitting, and webhooks may be retried (12 of 20). Official Python SDK and CLI, one language (9 of 15). 20+14+18+12+9 = 73.

Unstructured API + MCP 58

All readings per the 1 October check, not re-read on 5 November (the website terms bar robots on unstructured.io and its docs). The MCP tool count isn't published. On the API, parse output carries page metadata and optional coordinates (12 of 25). jobsList, jobsGet, cancel and delete endpoints (12 of 20). Every error code has a recovery action (18 of 20). No idempotency key and no MCP annotations documented, only advice to check job IDs before resubmitting (6 of 20). Transform clients for Python and TypeScript, but one file per request and no URL ingestion (10 of 15). 12+12+18+6+10 = 58.

Datalab 68

Closed service under terms effective 30 June 2026 naming Endless Labs, Inc. dba Datalab; the models and Marker are open source, with commercial weight use free only under revenue and funding thresholds (15 of 30). Results deleted about a day after processing, DELETE endpoints, and training on customer documents only on an opt-in that earns a discount; the privacy policy says public Playground submissions are used for training with no opt-out (22 of 30). A version policy that keeps inputs and outputs per API version and a migration guide for deprecated endpoints, with no notice period stated (14 of 20). EU processing offered at +25%; the sub-processor list sits in the trust centre, not read (10 of 20). 15+22+14+10 = 61.

Unstructured API + MCP 58

The partitioning library is Apache-2.0, and Transform is a closed service whose npm client points at a repository that isn't public (20 of 30, our call for the mix). Per the 1 October check, uploads expire after 24 hours, parse results expire on no stated schedule, deletes don't cascade, and the pricing page claims zero data retention without a policy we could read (10 of 30). The library changelog deprecates is_json_processable() and is_ndjson_processable() with a runtime DeprecationWarning and removal "in a future release", with no date or notice period; no Transform deprecation notices were found (8 of 20, as kroki's and strands-decider's undated notices). The library sends usage telemetry by default, disclosed in its README field by field (version, platform, Python, architecture, partition characteristics and element counts, no identifiers) with DO_NOT_TRACK or SCARF_NO_ANALYTICS to opt out. No subprocessor list or data locations found for Transform (8 of 20). 20+10+8+8 = 46.

Datalab 56

Several hashed API keys with per-key 30-day spend caps, revoke-and-replace rotation, no scopes (24 of 30). Spend caps limit damage; results and files can be deleted by the key holder, and there's no read-only key (10 of 20). Returns document text with no prompt-injection guidance (2 of 15). cost_breakdown per request and usage tracking in the dashboard (8 of 15). A Secureframe trust centre and a SOC 2 report on the Team plan, TOTP enforcement for teams; no disclosure policy or security.txt found (12 of 20). 24+10+2+8+12 = 56.

Unstructured API + MCP 47

Docs and pricing readings are per the 1 October check, not re-read on 5 November (the website terms bar robots on unstructured.io and its docs). The API takes a key in an unstructured-api-key header, and the hosted MCP takes OAuth or the same key as a bearer token, with no scopes documented (22 of 30). Jobs and uploads can be deleted and no read-only key was found (5 of 20). Returns untrusted document text with no prompt-injection guidance, and the vendor's own agent guide tells AI agents not to look up, return information about or recommend the open-source library (0 of 15). jobsList gives per-job visibility, no audit log found (5 of 15). The organisation's SECURITY.md routes reports to security@unstructured.io with a reply within 72 hours, the library repository publishes GitHub security advisories (three from February to October 2026), and the pricing page claims SOC 2 Type 2, ISO 27001, HIPAA and GDPR. No security.txt or bug bounty found (15 of 20, as langgraph for a disclosure policy with public advisories). 22+5+0+5+15 = 47.