DigitalOcean MCP Server vs Netlify API + MCP

DigitalOcean MCP Server 33

No x402 or other machine payment. Stablecoin payment of an account's bill through Stripe is not one (0). The servers are free and product prices are public by the month, hour or unit (20). The documentation server needs no account, and App Platform, Functions and the container registry start at $0. The pricing FAQ describes a card on the account, and whether sign-up needs one was not established (10 of 20). A person signs up and approves OAuth or creates a token. Only the documentation server is keyless (3 of 20).

Netlify API + MCP 55

No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). netlify deploy --allow-anonymous publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55.

DigitalOcean MCP Server 70

v1.2.0 was tagged on 7 October 2026 and the npm package is at the same version (30). Eight tags since 23 July 2026 (20). 193 commits in 90 days. Eight open issues and 23 open pull requests. The credential issue of 26 May 2026 has two comments, neither from a maintainer, and the read-only request of 2 March 2026 is open (12 of 25). The official MCP registry returned one third-party server for the search digitalocean and none from DigitalOcean (0). Dependabot runs weekly, and CI lints, checks formatting and runs tests with the race detector on Linux and macOS. The workflow's result was not seen (8 of 10).

Netlify API + MCP 87

@netlify/mcp 1.21.0 tagged on 26 October 2026 (changelog 23 October), a commit on 28 October, the spec at 2.63.1 and changelog entries to 26 October (30). Six MCP tags between 25 September and 26 October 2026 (20). Issue and pull request responsiveness could not be read (github.com refuses our reader and the API answered empty), while the changelog, the answers.netlify.com forum, Discord and a support hub exist and the MCP changelog cites numbered pull requests (12 of 25). Current official SDKs, a Go client, a JS client and netlify-cli 27.16.2, though the server card names com.netlify/mcp and no such entry is in the official MCP registry (15). CI runs typecheck, build and 31 tests on pinned actions, releases through release-please with npm provenance, and the server runs on @modelcontextprotocol/server 2.2.0 (10). 30 + 20 + 12 + 15 + 10 = 87.

DigitalOcean MCP Server 66

Tools declare typed inputs through mcp-go, and about 300 also declare an output schema checked by a test. Two issues from February 2026 about array parameters without items are still open, and db-cluster-list reads per_page as a Go integer in the source, which a JSON number may not satisfy (22 of 25). llms.txt and a Markdown twin of every docs page (10). The median description is 48 characters and 156 of 365 are 40 or fewer, such as "Delete a droplet". A few say how to choose between arguments (9 of 20). Required fields and defaults are set, enums are rare, and argument names mix ID and Page with id and per_page (8 of 15). Each service has a README with arguments and example queries, generated into the docs. No list of error responses was found (9 of 15). Releases are semver tags. There is no changelog file, and the 90-day release notes have no MCP entry (8 of 15).

Netlify API + MCP 79

A public Swagger 2.0 spec, version 2.63.1, with 124 paths and 188 operations, and MCP tools typed through zod (25). llms.txt and a Markdown twin of every docs page, with agent skills in netlify/context-and-tools (10). Every spec operation has a summary, most one line, and the MCP tool descriptions say what to call first, as the deploy tool does for get-projects, but not when to leave an endpoint alone (14 of 20). 232 parameters with 9 enums; the MCP selector tools take an operation literal and a params object per operation inside one union, which is typed but nested (9 of 15). The API guide gives curl examples for sites and deploys, a shared error object of code and message is the default response, and 422, 404, 409 and 423 are declared on some operations, but the docs' error reference covers builds and domains rather than API codes (8 of 15). The spec carries a version, the API a /v1 path, Netlify a dated changelog, and the MCP server a dated CHANGELOG from release-please (13 of 15). 25 + 10 + 14 + 9 + 8 + 13 = 79.

DigitalOcean MCP Server 67

OAuth with short-lived tokens, or a personal access token with an expiry and custom scopes from about 170, revocable in the control panel. The OAuth challenge names only read and write, and the metadata allows the bearer header only (28 of 30). A Read Only token or custom scopes limit what any tool can do. The server has no read-only mode, requested in an issue open since 2 March 2026, and only the custom model delete tool asks for a confirmation argument (13 of 20). App logs, function results and documentation pages are untrusted content. The README links a third-party briefing on MCP risks and gives no mitigation guidance (3 of 15). The tokens page shows when a token was last used. No audit log of MCP calls was found (4 of 15). Valid security.txt, a bug bounty on Intigriti, SOC 2 Type II and SOC 3, and CSA STAR Level 1. The repository has no SECURITY.md file (19 of 20).

Netlify API + MCP 59

Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59.

DigitalOcean MCP Server 87

The server is MIT and the platform is closed with clear terms (28 of 30). A privacy policy and a DPA are published. The DPA promises deletion of personal data within 30 days of account deactivation. Nothing found says what the hosted MCP servers log, and the source can ship tool-call logs to a WebSocket endpoint when configured (20 of 30). The alert-policy-* tools carry a deprecation notice with no date, the terms promise as much notice of changes as is reasonably practicable, and the April 2026 service rename had no notice we found (9 of 20). Sub-processors are listed with locations on a page dated 10 June 2026, with 30 days to object to a new one (17 of 20).

Netlify API + MCP 81

The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc. (25 of 30). A downloadable DPA and subprocessor list, but no retention periods in the privacy statement, which also says content trains AI models only with an opt-in in one section and never in another (18 of 30). Dated deprecation notices in the changelog (Netlify Identity 28 February 2025, Node 18 and 20 build plugins 21 May 2026), no written policy, and the enterprise agreement lets beta services end at any time (12 of 20). Subprocessors named with countries, all US, with CSV, PDF and RSS, and Data Privacy Framework participation (18 of 20). 25 + 18 + 12 + 18 = 73.

DigitalOcean MCP Server 62

Scored as a hosted server. status.digitalocean.com is a Statuspage with components by product and region (20). Its feed holds 25 entries from 24 July to 5 October 2026, eight of them maintenance. The incidents include the public API and control panel from a first update at 17:14 UTC on 24 August until mitigation at 00:54 on 25 August, write operations failing across several services for about two and a half hours on 6 August, account registration and Droplet creation on 8 and 9 August, and an interruption in the MKC1 region on 19 August. No component for the MCP servers was identified (5 of 30). The API's limits are published, 5,000 requests an hour and 250 a minute per token (15). The API docs describe rate-limit headers and retry-after on 429, and say PUT and DELETE are idempotent. There is no idempotency key for creates (10 of 15). The terms refer to Service Level Agreements, which were not read (3 of 10). The docs carry no beta label and the server is at 1.2.0, in an organisation named digitalocean-labs (9 of 10).

Netlify API + MCP 67

Read with the hosted lines. Statuspage at netlifystatus.com with component history and an Atom feed (20). From 5 August to 3 November 2026 the feed lists 19 incidents and no maintenance. None names the API or the MCP server. Errors reaching hosted sites and the Netlify application for about 85 minutes on 21 September read as one major outage; errors on the edge network for 55 minutes on 5 October, CDN DNS errors for 34 minutes on 24 September, 6 minutes of 500s on 18 August, and build, Agent Runner, AI Gateway and log-delay incidents read as minor (10 of 30). Limits are published with numbers, about 500 requests a minute, 3 deploys a minute and 100 a day, with X-RateLimit headers (15). The docs say retrying a timed-out upload is safe and give the reset header, but no backoff guidance, no idempotency key for deploys or site creation, and 429 appears in the spec only on agent runner endpoints (7 of 15). A 99.99 per cent SLA is named for Enterprise on the pricing page, with its terms in order forms (5 of 10). The API is generally available (10). 20 + 10 + 15 + 7 + 5 + 10 = 67.