Docling vs OpenDocRouter

Docling 60

Self-hosted rule. Free MIT software with nothing to buy, so 20 + 20 + 20, and no payment protocol (0). 60.

OpenDocRouter 30

No x402, MPP or L402 (0). Token prices for every model, an average and a maximum charge per page, the layout price and the 5% top-up fee are public on the models page and in the docs (20). New accounts get $5 of promotional credit. Whether a card is needed at sign-up isn't stated and the dashboard needs a sign-in (10 of 20, our call until that's confirmed). A person signs in through a browser to create a key (0).

Docling 85

Local-software lines, graded on the library with docling-serve and docling-mcp. Installs from PyPI (docling 2.148.0, per the PyPI release feed) for Python 3.10 and later on macOS, Linux and Windows (20). Public CI workflows for checks, tests and heavy examples; the pass state of the default branch was not read (20 of 25). About 719 open issues and 223 open pull requests on the repository page against 13 releases in four weeks, many of them fixes; replies not sampled (15 of 25). Semantic-release changelog with Feature and Fix sections and Breaking sections where they apply (15). Version 2.x since 2024 (15). 20+20+15+15+15 = 85.

OpenDocRouter 68

Read with the hosted lines. The site still links no status page. LlamaIndex's Statuspage at llamaindex.statuspage.io lists LlamaParse Docs, API and UI components and none for OpenDocRouter. A vendor status page with no component for the product takes 15 in this run, as sentry-mcp and honeycomb-mcp do (15). Its history shows no incident in October or November 2026 and none naming OpenDocRouter. The service launched on 7 October 2026, so the record covers 28 days, read as a short record (15). Limits are published with numbers, 300 parse calls and 60 polls a minute and 10 requests running at once per account (15). 429 and 503 carry Retry-After per the docs, each page error is marked as worth retrying or not, and cache: true makes a repeated request free. There is no idempotency key, and without the cache a resend is charged again. Kept at 13 as partly met (13). No SLA found, and the terms allow changes with or without notice (0). The API is version 1 with 1.0.0 SDKs and no beta or preview label (10). 15+15+15+13+0+10 = 68.

Docling 65

MIT, an OSI licence, with model licences noted as separate (30). Runs locally, remote services off by default and air-gapped use documented; no privacy statement is needed for local use, but model downloads from Hugging Face on first run are only partly described (22 of 30). Breaking changes are marked in the changelog, with no deprecation policy or dated notices (10 of 20). No telemetry found in the source; nothing to opt out of (15 of 20). 30+22+10+15 = 77.

OpenDocRouter 49

Closed service under the LlamaIndex terms with an OpenDocRouter addendum, SDKs MIT (15). The docs, the OpenAPI document and the addendum agree that nothing is stored without cache: true, cached results are encrypted and kept 24 hours, uploads are deleted once read or after an hour, and request records are kept for billing. The terms say LlamaIndex trains no models on user content. No DPA or retention period for request records was found, and the privacy notice dates from March 2024 and doesn't mention the service (22 of 30). No deprecation policy. Recipe and price versions are dated, and the terms allow changes and price changes without notice (3 of 20). The addendum names Anthropic, Google and OpenAI as examples of model providers that receive pages, leaves its infrastructure providers unnamed and gives no data location beyond processing in the United States (5 of 20).

Docling 89

v2.148.0 on 5 November 2026, the day before this check (30). 13 releases from 9 October to 5 November (20). Open issues and pull requests are numerous, an AI triage workflow and PR reminders run, and six maintainers are named; replies not sampled (17 of 25). docling-mcp publishes to the official MCP registry on release under io.github.docling-project, per its workflow and server.json; the registry entry itself was not read (12 of 15). CI, a dependency-update workflow and uv.lock (10). 30+20+17+12+10 = 89.

OpenDocRouter 75

A closed service read on its dated changes. The models page now lists 19 models, and the newest recipe versions are dated 21 October (nvidia/nemotron-3.5-parse) and 22 October 2026 (llamaindex/ocria-1), 13 days before this check (30). Recipe versions dated from 25 September to 22 October, including 8 and 13 October after launch, plus the 1.0.0 SDKs of 7 October, give three or more dated entries in the 90 days (20). No public changelog or community channel found, support is by email, and GitHub issues weren't readable (3 of 15). Current official SDKs in Python and TypeScript, both still at 1.0.0 with no commit since 7 October (15). The SDK repositories have CI workflows for lint and build, release-please and lock files. Run results weren't readable (7 of 10). 30+20+3+15+7 = 75.

Docling 53

Framework reading. No credentials for local use; docling-serve has one optional shared key, off by default (20 of 30). Remote services are off unless explicitly enabled, local file fetch is guarded by flags, and MCP tools carry read-only and destructive annotations; manipulation tools can delete items and save files (12 of 20). Converted documents are untrusted text and no prompt-injection guidance was found (3 of 15). Logging only, no audit trail (3 of 15). A disclosure policy with private reporting, 28 advisories published in public with fixed versions, under the LF AI & Data Foundation; no bug bounty (15 of 20). 20+12+3+3+15 = 53. The advisories themselves are the deduction.

OpenDocRouter 41

Bearer API keys created in the dashboard, and the terms say a key can be revoked. No scopes, expiry or rotation were found, and the dashboard needs a sign-in we didn't have (20 of 30). No read-only or restricted key found. One key can spend credit and read cached results, with spending bounded by the prepaid balance (6 of 20). The API returns untrusted document text and no prompt-injection guidance was found. Document URLs must be public HTTPS on the default port (0 of 15). GET /v1/parse/{id} shows what each request did and cost, and the docs mention a usage log keyed by X-Request-Id. No audit log found (8 of 15). SECURITY.md in both SDK repositories asks for private reports to security@runllama.ai, covering the SDK and the APIs it calls, with no acknowledgement time, which this run scores 7. No security.txt per the 8 October check, no advisories in OSV, and LlamaIndex's SOC 2 statement (read for llamaparse on 4 November) names the LlamaParse Platform, so no certification is confirmed for this service (7). 20+6+0+8+7 = 41.

Docling 77

No OpenAPI file is published; docling-serve is a FastAPI app that serves its schema when run, and docling-mcp's tools carry typed inputs with Field descriptions from Pydantic (20 of 25). No llms.txt on the docs site; Markdown docs and AGENTS.md in the repository (5 of 10). MCP tool docstrings say what each tool returns and which other tool supplies its key, with little on when not to use one (14 of 20). Pydantic types with descriptions, few enums (12 of 15). Many runnable examples in docs/examples, with errors raised as Python exceptions that name the fix, such as OperationNotAllowed and unknown document keys listing valid ones (11 of 15). Changelog per release (15). 20+5+14+12+11+15 = 77.

OpenDocRouter 85

Public OpenAPI 3.1 document at /v1/openapi.json covering all six operations (25). No llms.txt (404), but the docs page is served as Markdown at /docs.md (10). The parse, get, delete and upload operations say when to use sync or async, when the cache is needed and what is charged. The credits and models operations have no description, per the 8 October reading of the OpenAPI document, which wasn't re-read because it sits on the API path (16 of 20). mode and mime_type are enums, expand has a pattern and required fields are marked, while pages is a free string and model isn't enumerated (12 of 15). Examples in curl, Python and TypeScript, a table of 15 request errors and a table of 12 page errors (14 of 15). Models carry dated recipe versions and responses a price_version, and the SDKs have changelogs on GitHub, but there is no changelog for the service (8 of 15).