Docling vs Mistral OCR API

Docling 85

Local-software lines, graded on the library with docling-serve and docling-mcp. Installs from PyPI (docling 2.148.0, per the PyPI release feed) for Python 3.10 and later on macOS, Linux and Windows (20). Public CI workflows for checks, tests and heavy examples; the pass state of the default branch was not read (20 of 25). About 719 open issues and 223 open pull requests on the repository page against 13 releases in four weeks, many of them fixes; replies not sampled (15 of 25). Semantic-release changelog with Feature and Fix sections and Breaking sections where they apply (15). Version 2.x since 2024 (15). 20+20+15+15+15 = 85.

Mistral OCR API 53

Hosted reading. status.mistral.ai on Rootly has an OCR API component with 90-day uptime bars, per the 1 October check (20), the reading the other Mistral listings keep. The page has answered every request with a Cloudflare bot check since 8 October, robots.txt included on 4 November, so the host is treated as blocked and the 90 days from 6 August were not re-read. The 1 October reading of August and September OCR incidents is not credited either way (5, unread and not a finding against the vendor), as mistral-voxtral-transcribe reads the same page. The usage and limits page says OCR limits can include pages per minute, with the numbers shown only in the Admin Panel (3 of 15, as the other Mistral listings). The error glossary tells callers to back off exponentially on 429, 500, 502, 503 and 504 and to check the Retry-After header, and the official SDKs retry with backoff. OCR is a stateless call with no write, read as the transcription listing's (15). No SLA found (0). OCR 4.1 is GA per its model card (10). 20+5+3+15+0+10 = 53.

Docling 89

v2.148.0 on 5 November 2026, the day before this check (30). 13 releases from 9 October to 5 November (20). Open issues and pull requests are numerous, an AI triage workflow and PR reminders run, and six maintainers are named; replies not sampled (17 of 25). docling-mcp publishes to the official MCP registry on release under io.github.docling-project, per its workflow and server.json; the registry entry itself was not read (12 of 15). CI, a dependency-update workflow and uv.lock (10). 30+20+17+12+10 = 89.

Mistral OCR API 58

Model reading, on the lines mistral-api uses. OCR 4.0 was retired on 30 September 2026 and the last OCR release, OCR 4.1's GA, was on 31 August, both within 90 days of 4 November. The changelog has no OCR entry since 29 September (20). The lifecycle page promises 6 months' notice for GA models and 1 month for Public Preview. OCR 4.0 (mistral-ocr-4-0, released 23 June 2026) was deprecated on 29 September and retired on 30 September, one day, per its model card and the changelog. Earlier OCR retirements gave 29 days (mistral-ocr-2503) and 93 days (mistral-ocr-2505) (0 of 12). One OCR shutdown date in the 90 days to 4 November, and it didn't keep the published notice (0 of 8). Dated release notes several times a month, read as mistral-api reads the same changelog (10 of 15). SDK repository replies not sampled (5 of 10). mistralai 3.7.0 and @mistralai/mistralai 3.5.0 on 1 November per each repository's RELEASES.md (15). Both SDKs are generated from the OpenAPI document and run custom-code tests and example scripts in CI (8 of 10). 20+0+0+10+5+15+8 = 58.

Docling 60

Self-hosted rule. Free MIT software with nothing to buy, so 20 + 20 + 20, and no payment protocol (0). 60.

Mistral OCR API 40

No x402, MPP or L402 (0). $4 per 1,000 pages for OCR 4.1 and $5 with Document AI annotations, and $2 and $3 for OCR 3, on the public pricing page, which moved to docs.mistral.ai/inference/pricing (20). Free Experiment tier with no card, though it needs a phone number and its data may be used for training, per the 1 October check (20). Browser sign-up and phone verification (0). 0+20+20+0 = 40.

Docling 53

Framework reading. No credentials for local use; docling-serve has one optional shared key, off by default (20 of 30). Remote services are off unless explicitly enabled, local file fetch is guarded by flags, and MCP tools carry read-only and destructive annotations; manipulation tools can delete items and save files (12 of 20). Converted documents are untrusted text and no prompt-injection guidance was found (3 of 15). Logging only, no audit trail (3 of 15). A disclosure policy with private reporting, 28 advisories published in public with fixed versions, under the LF AI & Data Foundation; no bug bounty (15 of 20). 20+12+3+3+15 = 53. The advisories themselves are the deduction.

Mistral OCR API 70

Model reading, as mistral-api and mistral-voxtral-transcribe read the same pages. Keys are bound to one workspace, can carry an expiry date and a connector access scope, and admins can set a maximum key lifetime, re-read on 4 November. A key can't be limited to OCR or to read-only use (26 of 30). The commercial terms say Mistral won't train on customer data unless the customer opted in, or didn't opt out where a product defaults to opt-in, without naming the API's default, and free-tier data may train models (10 of 20). Inputs and outputs are kept 30 days for abuse monitoring. The zero data retention page lists /v1/ocr for paid plans, granted per request after review, and excludes /v1/files, the route the OCR guide gives for private uploads (12 of 15). Audit logs cover API key actions on Enterprise plans only, per the 2 October check on mistral-api (10 of 15). security.txt re-read on 4 November (expires 5 May 2027, HackerOne policy link), and the docs publish three dated security advisories for 2026. No certification or bounty confirmed (12 of 20). 26+10+12+10+12 = 70.

Docling 77

No OpenAPI file is published; docling-serve is a FastAPI app that serves its schema when run, and docling-mcp's tools carry typed inputs with Field descriptions from Pydantic (20 of 25). No llms.txt on the docs site; Markdown docs and AGENTS.md in the repository (5 of 10). MCP tool docstrings say what each tool returns and which other tool supplies its key, with little on when not to use one (14 of 20). Pydantic types with descriptions, few enums (12 of 15). Many runnable examples in docs/examples, with errors raised as Python exceptions that name the fix, such as OperationNotAllowed and unknown document keys listing valid ones (11 of 15). Changelog per release (15). 20+5+14+12+11+15 = 77.

Mistral OCR API 89

Model reading. Public OpenAPI document at docs.mistral.ai/openapi.yaml covering /v1/ocr (25). llms.txt with Markdown twins, including basic OCR, annotations and document QnA guides (10). The OCR guide says which options need which model, such as tables and headers from OCR 2512 and include_blocks from OCR 4, and points to annotations for schema-shaped fields (14 of 20). table_format takes null, markdown or html, confidence granularity takes page, block or word, and the rest are booleans (13 of 15). Code examples on each guide and the shared error glossary (12 of 15). Dated model ids and a dated changelog (15). Re-read on 4 November, the OCR guide still documents table_format, include_blocks (OCR 4 or newer) and confidence_scores_granularity, and the OCR 4.1 and OCR 3 cards give dated model ids.

Docling 65

MIT, an OSI licence, with model licences noted as separate (30). Runs locally, remote services off by default and air-gapped use documented; no privacy statement is needed for local use, but model downloads from Hugging Face on first run are only partly described (22 of 30). Breaking changes are marked in the changelog, with no deprecation policy or dated notices (10 of 20). No telemetry found in the source; nothing to opt out of (15 of 20). 30+22+10+15 = 77.

Mistral OCR API 76

Closed models under commercial terms with a French legal entity, SDKs Apache-2.0 (15). The terms, the DPA, the zero data retention page and the 30-day abuse window agree with each other, but the terms leave the paid API's training default unnamed, read as mistral-api (18 of 30). The lifecycle page gives notice periods per stage and a 404 after retirement, but OCR 4.0 was retired one day after its deprecation notice, short of every period the page promises (12 of 20). EU hosting by default with opt-in regional endpoints and a published subprocessor list, per the moderation listing's check (15 of 20). 15+18+12+15 = 60.