Docling vs Reducto API + MCP

Docling 60

Self-hosted rule. Free MIT software with nothing to buy, so 20 + 20 + 20, and no payment protocol (0). 60.

Reducto API + MCP 30

No x402, MPP or L402 (0). Per-1,000-page list prices for every endpoint on the public pricing page (20). $150 of free usage (15,000 credits) on Standard, and the page doesn't say whether a card is needed (10 of 20, our call until that's confirmed). A person signs up in a browser, or completes a device-code login for the local MCP (0).

Docling 53

Framework reading. No credentials for local use; docling-serve has one optional shared key, off by default (20 of 30). Remote services are off unless explicitly enabled, local file fetch is guarded by flags, and MCP tools carry read-only and destructive annotations; manipulation tools can delete items and save files (12 of 20). Converted documents are untrusted text and no prompt-injection guidance was found (3 of 15). Logging only, no audit trail (3 of 15). A disclosure policy with private reporting, 28 advisories published in public with fixed versions, under the LF AI & Data Foundation; no bug bounty (15 of 20). 20+12+3+3+15 = 53. The advisories themselves are the deduction.

Reducto API + MCP 40

Plain bearer API key from Reducto Studio, used for the hosted MCP too. The local server adds a device-code login (20 of 30). No read-only or scoped key, and five of the nine tools start billable jobs with no confirmation step (5 of 20). Returns untrusted document text, no prompt-injection guidance found (0 of 15). get_job and list_jobs let the operator review past jobs, no audit log found (5 of 15). security.txt is valid (support@reducto.ai, expires 1 July 2027), the SDK repositories carry a SECURITY.md with a reporting address, and the data policies page says SOC 2 Type I and Type II are complete with the report on request, with HIPAA processing on Growth and Enterprise and regular penetration testing. No ISO 27001, bug bounty or public advisories found. That sits above pandadoc (8, a SOC 2 claim and public bulletins) and below oxylabs-web-scraper (14, ISO 27001 as well) (10 of 20).

Docling 89

v2.148.0 on 5 November 2026, the day before this check (30). 13 releases from 9 October to 5 November (20). Open issues and pull requests are numerous, an AI triage workflow and PR reminders run, and six maintainers are named; replies not sampled (17 of 25). docling-mcp publishes to the official MCP registry on release under io.github.docling-project, per its workflow and server.json; the registry entry itself was not read (12 of 15). CI, a dependency-update workflow and uv.lock (10). 30+20+17+12+10 = 89.

Reducto API + MCP 80

Python SDK v0.25.0, Node.js SDK v0.19.0 and Go SDK v0.2.0, all on 24 October 2026 (30). In the 90 days from 4 August, Python v0.23.0 (3 September), v0.24.0 (8 September) and v0.25.0, Node.js v0.17.0 (3 September), v0.18.0 (10 September) and v0.19.0, and Go v0.1.0 (10 September) and v0.2.0, eight SDK tags counted half (20). No public changelog for the hosted API and issue replies not sampled (5 of 15). Current SDKs in Python, Node.js and Go (15). The SDK repositories run CI, end-to-end and spec-drift workflows. The MCP server's repository, read on 1 October, no longer answers a clone (10).

Docling 85

Local-software lines, graded on the library with docling-serve and docling-mcp. Installs from PyPI (docling 2.148.0, per the PyPI release feed) for Python 3.10 and later on macOS, Linux and Windows (20). Public CI workflows for checks, tests and heavy examples; the pass state of the default branch was not read (20 of 25). About 719 open issues and 223 open pull requests on the repository page against 13 releases in four weeks, many of them fixes; replies not sampled (15 of 25). Semantic-release changelog with Feature and Fix sections and Breaking sections where they apply (15). Version 2.x since 2024 (15). 20+20+15+15+15 = 85.

Reducto API + MCP 77

incident.io status page at status.reducto.ai with API, Parsing, Extraction, Splitting, Editing and Studio components (20). Its feed lists nine incidents from 13 August to 1 October 2026 and none since, each a latency rise or partial degradation of one product (Extract on 13 August, Parse on 13 August, Parse and Extract with citations on 18 August, Deep Split for about 11 minutes on 9 September, Parse with embed_pdf_metadata on 16 September, Parse on 28 September, and Parse, then Parse in the EU region, on 1 October). The history page answered 500 on 2 November, so 4 to 12 August rests on the 1 October reading, which found only partial incidents after 23 July. All partial, read as minor (20 of 30). Edge limits of 1,000 requests a second per key and 300 on job polling (15). 429 bodies carry a code and say to back off or use webhooks, and the SDKs retry 429s with exponential backoff. No Retry-After and no idempotency key (12 of 15). Custom SLA on Enterprise only (0). GA (10).

Docling 77

About 25 MCP tools in the default groups (15), selectable as conversion, generation and manipulation groups, with anchor tools to read one part of a document (22 of 25). max_num_pages, max_file_size and page ranges on conversion, Markdown or JSON export (15 of 20). Errors are exceptions with messages, such as an unknown document key listing the valid ones (12 of 20). readOnlyHint and destructiveHint on the MCP tools, and conversions are repeatable (18 of 20). Sensible defaults and one call to convert; Python only, with a docling-client package for docling-serve (10 of 15). 22+15+12+18+10 = 77.

Reducto API + MCP 84

Nine MCP tools with short descriptions (25). page_range, chunk_mode, return_images, URL results for large outputs, and list_jobs (18 of 20). Errors say what to do next, and 429 bodies name the fix (18 of 20). jobid:// reuse avoids paying to parse twice, but there's no idempotency key and no readOnlyHint or destructiveHint annotations (8 of 20). parse_document needs only document_url. SDKs in Python, Node.js and Go (15).

Docling 65

MIT, an OSI licence, with model licences noted as separate (30). Runs locally, remote services off by default and air-gapped use documented; no privacy statement is needed for local use, but model downloads from Hugging Face on first run are only partly described (22 of 30). Breaking changes are marked in the changelog, with no deprecation policy or dated notices (10 of 20). No telemetry found in the source; nothing to opt out of (15 of 20). 30+22+10+15 = 77.

Reducto API + MCP 59

Closed service under published terms (effective 17 April 2026). The MCP server's MIT repository no longer answers a clone (15). The data policies page gives zero data retention on Growth and above, purging API-submitted artifacts within 24 hours except Studio jobs and persist_results, and says Growth and above data is never used for training. Standard gets neither promise, the deletion docs give no retention period for it, and the terms grant Reducto a licence to use uploaded content to develop and improve the Services and for its other business purposes. The privacy policy dates from 21 January 2024 (10 of 30). The 1 September pricing change has a dated migration page, and we found no deprecation policy (5 of 20). The MCP server sends PostHog usage telemetry by default, disclosed in the docs with REDUCTO_TELEMETRY=0 to opt out. Subprocessors sit in the JavaScript-only trust centre, with EU and AU endpoints on Growth and an EU data residency page (8 of 20).