DocRaptor vs PDF.co API + MCP

DocRaptor 68

Read with the hosted lines. status.docraptor.com is an Atlassian Statuspage with components (20). Its front page reported no incidents on any of the days it lists, the history page needs JavaScript our reader lacks, and history.rss redirects to an inactive feed, so the record is clean for the days we could read and unread beyond them (20). The limits page gives numbers, 60 seconds synchronous, 600 asynchronous, 30 simultaneous requests and 100 MB hosted output (15). Too many simultaneous requests answer 403 with no Retry-After or backoff guidance, callbacks are retried up to three times, and there is no idempotency key (3). No SLA found; the about page's 99.99 per cent uptime is a marketing figure and the terms are unread (0). GA (10). 20 + 20 + 15 + 3 + 0 + 10 = 68.

PDF.co API + MCP 20

status.pdf.co answers 302 to betterstack.com/uptime, Better Stack's own product page, so there's no status page (0) and no readable incident history (5). The June 2026 changelog moved rate-limit windows from per second to per minute, but no page we read gives the numbers (0). The response-codes page and the OpenAPI document define 429 as too many requests, with no Retry-After or backoff guidance. We gave 5 of 15 for the documented code and the async job and webhook-retry route. No SLA in the terms of 24 March 2026, which reserve the right to change or stop the service without notice (0). GA (10).

DocRaptor 41

One API key per account with no scopes, sent as the HTTP Basic username, and the docs offer user_credentials in the query string as a second method, which costs the 10 points for a secret in a URL (0 of 30). Test mode limits spend but there is no read-only key, and the destructive action, expiring a hosted document, needs no confirmation (6). The API renders the caller's HTML and returns a PDF or spreadsheet, not text for the model to read (10). The dashboard's document log records each job with input, output and log when the account's retention allows, and an IP listing API exists; no per-key audit log (8). SOC 2 Type II, HIPAA BAAs, annual third-party penetration tests, a vulnerability disclosure policy with security@docraptor.com and DPF registration, but no security.txt (17). 0 + 6 + 10 + 8 + 17 = 41.

PDF.co API + MCP 23

One API key per account in the x-api-key header, header only per the OpenAPI document. We found no scopes, no multiple keys and no rotation guide (10). Every MCP tool also takes api_key as an argument, which invites the key into the model's context. No read-only mode, no annotations, and upload_file reads any absolute local path and uploads it to PDF.co. The SSE and HTTP transports bind 0.0.0.0 with no authentication (0). PDF text, tables and invoice fields come back as untrusted content with no injection guidance (0). Each response reports credits used and remaining, which is a per-call cost trail. We found no audit log (5). The security page claims SOC 2 Type II and cites AWS's ISO 27001, PCI and FISMA, which are the data centre's. security.txt is a 404 and we found no disclosure policy or bounty (8).

DocRaptor 69

Closed service; the terms render through a script and were not read, the client libraries are MIT (12). The security FAQ states retention options, that logs hold metadata only, that content isn't used for model training and that metadata may be used for analytics, and the privacy policy on artifex.com of 19 November 2025 names the entities; the sub-processor list is a help-centre page that rendered empty for our reader (18). Pipelines 1 to 7 were deprecated with a dated notice in 2020 and pipeline versions are selectable, but there is no written notice period (12). AWS us-east-1 is named as the processing location and the FAQ says customers are emailed when the sub-processor list changes, though the list itself was unread (12). 12 + 18 + 12 + 12 = 54.

PDF.co API + MCP 53

The MCP server is MIT. The API is closed with dated terms, so between the two bands (20). The privacy policy (25 August 2026) names Artifex Software, Inc. and says processing happens in the US, but states no document retention. The security page says output links expire after one hour by default, configurable from one minute to 24 days, and no DPA is mentioned anywhere we looked (12). No deprecation policy, and the terms allow changes without notice (0). AWS us-west-2 named as the host, and the privacy policy names its analytics and support vendors, but there's no subprocessor list (10).

DocRaptor 35

No x402, MPP or L402 (0). Plan prices are public and the plans page says overage is a per-document price by plan, with the per-document figures shown through a plan selector that our reader saw only for the Free plan (15). The Free plan has 5 documents a month and unlimited watermarked test documents, but the signup form shows card fields and no page says whether the Free plan needs a card (10). A person signs up in a browser (0). 0 + 15 + 10 + 0 = 35.

PDF.co API + MCP 20

No x402, MPP or L402 (0). Plan prices are public and the credit cost of each endpoint is published per page or per call, so per-unit cost is readable without a login (20). A sign-up trial exists per the 30 September check, but neither the pricing page nor the terms state its size or whether a card is needed, so we scored it absent (0). A person signs up in a browser to get a key (0).

DocRaptor 63

Responses are the document bytes or a small JSON status, with X-DocRaptor-Num-Pages on PDFs, and test mode avoids spending quota (18). The document listing takes page and per_page (default 100); there is nothing else to page (12). XML error messages state the cause, the status-code page maps 400, 401, 403 and 422 to causes, and JavaScript errors are returned with the failure (14). No idempotency key and no safe-retry guidance; a retried POST makes a second document, and only test documents are free (4). Two parameters make a document, defaults are sensible, and official clients exist in Ruby, Python, Node, PHP, Java and C# (15). 18 + 12 + 14 + 4 + 15 = 63.

PDF.co API + MCP 49

38 MCP tools from about 78 KB of source with no toolset switch, which is the more-than-30 band (5). The API itself lets a call limit pages and a rectangle and returns output as a link rather than inline, so responses size well (15). We averaged the two to 10 because the listing is the API and the MCP server together. Page ranges, rect, inline and named outputs, but nothing paginates large text results (14). Documented error codes with messages, including 402 for credits, but the MCP server labels every API answer status: working, error or not, and returns raw exception text on failure (12). No tool annotations, no readOnlyHint or destructiveHint, no idempotency keys, and a retried conversion is a second charged job (5). Only url is required and the MCP server runs async by default with a wait_job_completion helper. We didn't confirm official SDK packages beyond code samples (8).

DocRaptor 21

Read as a closed service with open-source clients. The last dated product change found is the changelog entry of 5 September 2023, and the client libraries were last tagged in 2023 (docraptor-python 3.1.0 on 19 July 2023, npm docraptor 1.0.1 on 28 December 2023); the about and security pages were rewritten after the October 2025 acquisition but carry no dated API change (0). No releases in the last 90 days (0). Support by email, site chat and a help centre with stated hours, and a per-document help request from the dashboard; GitHub issue replies couldn't be read (8 of 15). Official clients in six languages exist and still match the API, but none has shipped since 2023 (10). The Python client pins 2023 dependencies and its test suite runs through tox with no CI workflow in the repository (3). 0 + 0 + 8 + 10 + 3 = 21.

PDF.co API + MCP 34

MCP server 0.0.9 on 2026-07-28, 65 days before this check (20). Two releases in the last 90 days, 0.0.8 on 2026-07-08 and 0.0.9, and both only repoint documentation links. The API changelog's last entry is June 2026, outside the window (0). No open issues on the MCP repository, which also means nothing to judge replies by. Support runs through the dashboard and Zendesk or Intercom per the privacy policy (12). Not in the official MCP registry. The only pdfco entry there is a third-party wrapper from mcparmory (0). The only CI workflow publishes releases. No tests, and the lock file dates from June 2025 (2).