Docling vs Invofox

Docling 89

v2.148.0 on 5 November 2026, the day before this check (30). 13 releases from 9 October to 5 November (20). Open issues and pull requests are numerous, an AI triage workflow and PR reminders run, and six maintainers are named; replies not sampled (17 of 25). docling-mcp publishes to the official MCP registry on release under io.github.docling-project, per its workflow and server.json; the registry entry itself was not read (12 of 15). CI, a dependency-update workflow and uv.lock (10). 30+20+17+12+10 = 89.

Invofox 20

No changelog or versioned release of the API was found. The self-serve launch on 5 October 2026 opened sign-up and API keys to new users but changed no documented API behaviour, and a service start isn't a recency source in this run; the docs sitemap date of 7 October 2026 records no change. No dated API change was found on the docs, the site's llms.txt or the blog, whose newest post is from 7 August 2026. The vendor's newest dated release is its n8n community node n8n-nodes-invofox 0.1.0, tagged on 3 July 2026, 125 days before 5 November (10). No three dated releases in the last 90 days (0). Community support on Free and email support on Starter, replies not sampled, no public changelog (3 of 15). No official SDK, and the n8n node is the vendor's only package (3 of 15). That repository has CI and publish workflows and no commit since 3 July (4 of 10). 10 + 0 + 3 + 3 + 4 = 20.

Docling 85

Local-software lines, graded on the library with docling-serve and docling-mcp. Installs from PyPI (docling 2.148.0, per the PyPI release feed) for Python 3.10 and later on macOS, Linux and Windows (20). Public CI workflows for checks, tests and heavy examples; the pass state of the default branch was not read (20 of 25). About 719 open issues and 223 open pull requests on the repository page against 13 releases in four weeks, many of them fixes; replies not sampled (15 of 25). Semantic-release changelog with Feature and Fix sections and Breaking sections where they apply (15). Version 2.x since 2024 (15). 20+20+15+15+15 = 85.

Invofox 25

No public status page found. status.invofox.com still doesn't resolve on 5 November and neither the site nor the docs link to one (0 of 20). No readable incident history (5 of 30). No rate limit numbers, and the vendor's AI briefing still says rate limits are not publicly documented (0 of 15). The main OpenAPI file documents 429 with RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and Retry-After headers, and the docs ask for exponential backoff, but uploads take no idempotency key (10 of 15). The pricing page lists a 99.9% uptime SLA on Starter, but no SLA document was found, and this run scores a pricing-page SLA figure with no document 0 (0 of 10). The API is in production use and self-serve since 5 October 2026 (10). 0 + 5 + 0 + 10 + 0 + 10 = 25.

Docling 60

Self-hosted rule. Free MIT software with nothing to buy, so 20 + 20 + 20, and no payment protocol (0). 60.

Invofox 30

No x402, MPP or L402 (0). Plan prices are public, Free at $0 for 500 pages and Starter from $500 a month billed annually for up to 5,000 pages, but no per-page or overage rate is published and Scale and Enterprise are custom (10 of 20). The free plan needs no card (20). A person signs up in a browser at app.invofox.com and creates the key in the dashboard (0).

Docling 77

About 25 MCP tools in the default groups (15), selectable as conversion, generation and manipulation groups, with anchor tools to read one part of a document (22 of 25). max_num_pages, max_file_size and page ranges on conversion, Markdown or JSON export (15 of 20). Errors are exceptions with messages, such as an unknown document key listing the valid ones (12 of 20). readOnlyHint and destructiveHint on the MCP tools, and conversions are repeatable (18 of 20). Sensible defaults and one call to convert; Python only, with a docling-client package for docling-serve (10 of 15). 22+15+12+18+10 = 77.

Invofox 64

The document list accepts select with dot-notation field paths, and OCR geometry and plain text sit on separate endpoints, so responses can be kept small (20 of 25). skip, limit up to 500 (default 50), sort and a filter with seven operators, including on clientData (18 of 20). ERR_ codes for request errors, file rejections and field validation, though several error schemas hold only a code string (14 of 20). No idempotency key on uploads. clientData carries a caller id, webhook events have an id for deduplication, and delivery retries up to three times (6 of 20). An upload needs a file and a Document Type id that comes from the dashboard, or the classifier flag. No official SDK was found, and the testdrive repository describes one as coming soon (6 of 15).

Docling 53

Framework reading. No credentials for local use; docling-serve has one optional shared key, off by default (20 of 30). Remote services are off unless explicitly enabled, local file fetch is guarded by flags, and MCP tools carry read-only and destructive annotations; manipulation tools can delete items and save files (12 of 20). Converted documents are untrusted text and no prompt-injection guidance was found (3 of 15). Logging only, no audit trail (3 of 15). A disclosure policy with private reporting, 28 advisories published in public with fixed versions, under the LF AI & Data Foundation; no bug bounty (15 of 20). 20+12+3+3+15 = 53. The advisories themselves are the deduction.

Invofox 45

API keys in an x-api-key header, created in the dashboard and scoped to one environment, which is either TEST or PRODUCTION. Revocation and rotation are not described in the docs we read (20 of 30). Environment scoping is the only least-privilege control found. The same key reaches the delete endpoints for users, companies, providers and clients, with no read-only key or confirmation (6 of 20). The API returns text taken from untrusted documents and no prompt-injection guidance was found (0 of 15). Document and import lists record channel and creator, and no audit log is documented (5 of 15). security.txt is valid until 1 June 2027 with security@invofox.com. The site states SOC 2 Type II, ISO 27001:2022, GDPR and HIPAA compliance and links a Vanta trust centre we could not read without JavaScript. No bug bounty found (14 of 20).

Docling 65

MIT, an OSI licence, with model licences noted as separate (30). Runs locally, remote services off by default and air-gapped use documented; no privacy statement is needed for local use, but model downloads from Hugging Face on first run are only partly described (22 of 30). Breaking changes are marked in the changelog, with no deprecation policy or dated notices (10 of 20). No telemetry found in the source; nothing to opt out of (15 of 20). 30+22+10+15 = 77.

Invofox 57

Closed service. The published terms are a website legal notice, and the General Terms and Conditions that the DPA cites were not found on the site. The DPA and NDA are public (12 of 30). The zero-retention page says the standard pipeline keeps documents and that real documents tune the model, with no default retention period stated. Zero retention is opt-in for Scale and Enterprise. The DPA allows three months of access after termination and gives 48 hours for breach notice (15 of 30). Five operations and several fields are marked deprecated in the OpenAPI files with replacements named and no removal dates (5 of 20). The DPA points to a sub-processor list in the trust centre, which we could not read, with 15 days' notice of changes. The site states EU and US processing regions (8 of 20).