Datalab vs Veryfi API + MCP

Datalab 89

An OpenAPI 3.1 operation embedded in each reference page (spec version 0.0.1), no single downloadable file found (22 of 25). llms.txt with 159 pages and Markdown twins (10). Recipes say when to use each processor and mode (15 of 20). Typed request schemas with enums for output format and mode (12 of 15). An error table with type, HTTP code and whether to retry, plus SDK exception mapping (15). A written version policy and a dated changelog (15). 22+10+15+12+15+15 = 89.

Veryfi API + MCP 50

llms.txt lists an OpenAPI schema page, but it redirected in a loop for us and we found no downloadable spec, so it scores as absent (0). llms.txt (10). Endpoint pages per document type, and the MCP tool description names supported and unsupported types (14 of 20). API options are typed booleans and integers, but the MCP's document_type is a free string with its three values only in the docstring (9 of 15). An error table with 12 cases from 400 to 503 (12 of 15). Versioned v8 path, no public changelog (5 of 15). Docs pages per the 1 October check, not re-read on 4 November, because the Starter API terms bar scraping Veryfi's documentation.

Datalab 58

Hosted lines. Status page at status.datalab.to (incident.io) with Website and Datalab API components; the history page is drawn by script, so components are confirmed and history isn't (15 of 20, 5 for history). Rate limits per plan with numbers, plus page and size limits (15). 429 is retryable with sample backoff, and 500 and 529 say to check a known request ID before resubmitting; webhooks deduplicate by request_id (13 of 15). Custom SLAs only for Enterprise (0). Generally available (10). 15+5+15+13+0+10 = 58.

Veryfi API + MCP 70

Better Stack status page at status.veryfi.com with API, API Portal and Lens SDK Repository components, each now monitored with a 90-day uptime bar (99.984, 100 and 99.957 per cent on 4 November) and linked incidents (20). The bars cover 7 August to 4 November, so 6 August is unread. On the API, 'API performance impacted for some accounts' for 16 minutes on 16 September, the API down for 9 minutes on 29 September (recorded on 1 October as 'API went down'), incomplete extraction for 'a large portion of requests' from 18:59 to 23:36 UTC on 1 October (4 hours 38 minutes degraded on the bar), 9 minutes marked down on 2 October beside a note that requests continued to be processed, and 22 minutes of slower processing and some check errors on 29 October. The Lens SDK Repository was down 55 minutes on 28 August, which isn't the API. Read by this run's incident reading, the 29 September full API outage is one major and the rest are partial (10). Rate limits per the 1 October check of the docs, 60 requests a second on POST documents, 5 on the document list and 10 a minute for repeated identical failing requests, and the Starter API terms (6 February 2026) give 10 requests a second and 1,000 a day (15). 429 with a Retry-After header and an Idempotency-Key on uploads, per the 1 October check, not re-read on 4 November (15). SLA options on Growth and Enterprise and a 99.9 per cent uptime aim in the terms, no SLA document (0). GA (10). Total 70.

Datalab 56

Several hashed API keys with per-key 30-day spend caps, revoke-and-replace rotation, no scopes (24 of 30). Spend caps limit damage; results and files can be deleted by the key holder, and there's no read-only key (10 of 20). Returns document text with no prompt-injection guidance (2 of 15). cost_breakdown per request and usage tracking in the dashboard (8 of 15). A Secureframe trust centre and a SOC 2 report on the Team plan, TOTP enforcement for teams; no disclosure policy or security.txt found (12 of 20). 24+10+2+8+12 = 56.

Veryfi API + MCP 44

Every request carries CLIENT-ID and an apikey USERNAME:API_KEY header, and requests are signed with HMAC-SHA256 using the client secret, valid for 30 minutes. Keys can be created, removed or reset through the partner API. Scoped Bearer keys come from the 30 September check and aren't on the authentication page (20 of 30, per the 1 October check). Some actions are admin-only, no read-only key found (5 of 20). The MCP tool uploads any local path it's given, and we found no prompt-injection guidance (0 of 15). The document list shows past submissions, no audit log found (5 of 15). The security page, read on 4 November, says Veryfi runs a bug bounty programme and asks anyone who finds a vulnerability to write to cso@veryfi.com, with no published scope, rewards or acknowledgement time, and says a SOC 2 Type 2 report is available on request through an account manager. No security.txt (404 on www.veryfi.com) and no public advisories. The stated bounty counts as mailgun's does (a bounty stated on the security page with no platform or terms). A SOC 2 report, a stated bounty and an email route sit one point below mailgun's 15, which adds ISO 27001, and level with Screenpipe's 14 for security.txt, a disclosure policy and a SOC 2 report with no bounty (14 of 20). Total 44.

Datalab 79

Closed hosted service. Python SDK 0.9.1 on 6 November 2026 and a changelog entry on 4 November (30). Over twenty dated changelog entries since 8 August (20). Support by email, a Discord and public GitHub repositories for the open-source models; replies not sampled (12 of 15). An official Python SDK, current, no other languages (12 of 15). Package health not checked beyond release dates (5 of 10). 30+20+12+12+5 = 79.

Veryfi API + MCP 68

Node.js SDK v1.5.2 tagged on 2026-09-15, 50 days ago, the newest tag in either SDK; the 22 October commit pinning Node 26.12.1 is untagged (20). In the 90 days from 6 August, v1.5.0 (20 August, new API operations), v1.5.0.1 (21 August, publishing scripts only, half), v1.5.1 (25 August, test dependencies moved, half) and v1.5.2 (15 September, axios swapped for native fetch), so 3 (20). No public changelog, and the MCP server's last commit was 2025-09-26. Issue replies not sampled (5 of 15). Python SDK 5.1.0 (13 May 2026) and Node.js 1.5.2 are current (15). Both SDK repositories run test workflows. The MCP server has tests but no CI (8 of 10). Total 68.

Datalab 68

Closed service under terms effective 30 June 2026 naming Endless Labs, Inc. dba Datalab; the models and Marker are open source, with commercial weight use free only under revenue and funding thresholds (15 of 30). Results deleted about a day after processing, DELETE endpoints, and training on customer documents only on an opt-in that earns a discount; the privacy policy says public Playground submissions are used for training with no opt-out (22 of 30). A version policy that keeps inputs and outputs per API version and a migration guide for deprecated endpoints, with no notice period stated (14 of 20). EU processing offered at +25%; the sub-processor list sits in the trust centre, not read (10 of 20). 15+22+14+10 = 61.

Veryfi API + MCP 59

Closed service under published terms, SDKs and MCP server MIT (15). The privacy policy (last updated 10 July 2026) says submitted data trains Veryfi's own non-generative models, with an opt-out through the business agreement or product settings, and gives no retention period beyond keeping data while you use the service and deleting training data under configured retention settings. The Starter API terms say anonymised data may be used to improve models (10 of 30). No deprecation policy or dated notices found (0 of 20). Published subprocessor list and AWS hosting named (15 of 20).