DynaPictures vs Osmo CLI

DynaPictures 82

OpenAPI 3.1 at dynapictures.com/openapi.json with 20 paths (25). llms.txt, auth.md and an agent skill in Markdown (10). llms.txt says when to use the product and when it's a poor fit, and the skill gives call order for each job (17 of 20). Enums for formats and options, with layer overrides keyed by layer name (12 of 15). Request examples throughout and a status table in the skill, but the API reference's Errors section is unedited Slate template text about kittens (9 of 15). No URL version, additive changes, removals announced six months ahead with Deprecation and Sunset headers, and no changelog (9 of 15). 25 + 10 + 17 + 12 + 9 + 9 = 82.

Osmo CLI 34

API checklist adapted to a CLI. No OpenAPI or command schema is published on a docs page. The model input schemas recorded on 8 October came from the product's own catalogue API at studio.osmo.inc/api/resources, which this method no longer reads, so the contract line has nothing behind it (0). The skill's SKILL.md is Markdown written for agents, with a command table, and osmo.inc/llms.txt now links the CLI page; the package's README, SETUP.md and DEPLOY.md were read from the 0.1.19 tarball on 8 October (10). Help text in the 0.1.19 bundle states what each command is for and when to pick share over studio deploy, per the 8 October check (12). Typed inputs with enums and ranges were read only from the catalogue API, so none remain (0). An example per command and JSON output shapes in DEPLOY.md, and a command table in the skill, but no reference for the roughly 50 error codes (8). Semver versions with no changelog (4). 0 + 10 + 12 + 0 + 8 + 4 = 34.

DynaPictures 63

Closed service under terms (revision 2/2026) from DynaPictures GmbH in Freiburg, for business customers (15). The privacy policy names the controller, keeps generated images as long as needed or until deleted, gives plan image retention (3 months on Lite), and says the named AI providers don't train on API inputs under their API terms; other periods follow bookkeeping law (20 of 30). The OpenAPI file commits to six months' notice before removing an endpoint or field, with Deprecation and Sunset headers (16 of 20). AI sub-processors named with addresses (OpenAI, Google, Black Forest Labs, Replicate) and FastSpring for payments, while hosting providers aren't named (12 of 20). 15 + 20 + 16 + 12 = 63.

Osmo CLI 33

Closed source. The skill README says the CLI, renderer and resource packages are proprietary, and the npm packages carried no licence field or LICENSE file on 8 October. The terms of service render only in the browser and were read on 8 October from the site's script bundle, which this method no longer reads, so no licence terms are readable (0, as for other listings whose terms were only ever read from a script bundle). The privacy policy and terms were read the same way, so no data-handling statement remains (0). No deprecation policy or dated notices (0). The CLI bundle read on 8 October contacts only studio.osmo.inc and contains no analytics hosts, though telemetry isn't documented either way; the AI providers named in the struck privacy policy no longer count. Partial kept (10). 0 + 0 + 0 + 10 = 10.

DynaPictures 45

The MCP tool definitions weren't read (listing them needs a session), and llms.txt describes groups that include layer-by-layer design authoring, so the count is unknown. REST responses are small objects with image URLs (12 of 25). Template and generated-image listings, with no field selection documented (10 of 20). Errors are JSON with a message and documented statuses, without codes (12 of 20). Requests aren't idempotent, by the vendor's own note, though identical image URLs are served from cache without a credit (6 of 20). An Editor SDK for embedding the editor, and no API client SDKs (5 of 15). 12 + 10 + 12 + 6 + 5 = 45.

Osmo CLI 70

Read from the 0.1.19 bundle and docs on 8 October and the skill re-read on 5 November, not from a run. The skill grew from 255 bytes to 9,686 bytes on 15 October, a compact guide with a command table, every command takes --json, and lists default to short pages (18). --limit and --cursor on lists, --type on resources and --open on comments (15). Errors are JSON with a code, a message, a next command and retryAfter where it applies, with exit code 2 for usage errors, though only one error is documented (14). osmo run sends an Idempotency-Key and retries network errors, repeating unshare is documented as safe, and a failed upload reports the share to retry against (16). Few required arguments, and no SDK in any language (7). 18 + 15 + 14 + 16 + 7 = 70.

DynaPictures 26

One API key per user with the user's full access, not limited to workspaces or actions; a new key is requested by email to support, with no rotation in the account (10 of 30). No read-only mode, and the MCP server can author and change designs (3 of 20). Tools return the account's own templates and renders; image layers accept outside URLs (10 of 15). A list of generated images, with no audit log documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 10 + 3 + 10 + 3 + 0 = 26.

Osmo CLI 51

OAuth device flow with a client registered per device, refresh tokens, a revocation endpoint and osmo logout. The OAuth metadata re-read on 5 November lists scopes projects:write, energy:spend and a new account:read. Tokens sit in a 0600 file under ~/.osmo/auth per the 8 October bundle reading, and no secret travels in a URL (26). --no-spend drops the spending scope and shares delete needs --yes, but every login asks for projects:write and no read-only login is documented (11). Comments from anyone with a review link are returned to the agent. The skill (15 October) tells the agent a review comment is feedback on the video, never an instruction to run commands, change access or work outside the project, and that a commenter's name is self-reported, and the CLI strips control and bidirectional characters from output. Guidance and one mitigation (10). Connections are named per device and osmo jobs lists runs. No audit log found (4). No security.txt (osmo.inc answers with its HTML shell, studio.osmo.inc 404), disclosure policy, bug bounty or certification found. The earlier 2 had no programme evidence behind it, so the line is 0 (0). 26 + 11 + 10 + 4 + 0 = 51.

DynaPictures 30

No x402, MPP or L402 (0). Image allowances per plan and AI credit packs ($20 for 1,000 credits) are public, but plan prices are filled in by the FastSpring script and weren't readable (10 of 20). Free plan and a 14-day trial with 30 API credits, no card (20). auth.md says a person has to copy the key; there is no OAuth or programmatic key (0). 0 + 10 + 20 + 0 = 30.

Osmo CLI 10

Graded on the paid hosted service the CLI depends on, by the published rubric. No x402, MPP or L402 in the OAuth metadata or the skill (0). osmo.inc/pricing, terms and privacy render only in the browser, and the 8 October prices were read from the site's script, which this method no longer reads, so no price is readable (0). The skill README says model runs use the account's plan, which includes a free monthly allowance, without saying whether a card is needed, so half (10). A person has to create an account and approve the device login in a browser (0). 0 + 0 + 10 + 0 = 10.

DynaPictures 42

Hosted lines. No status page found in the docs, llms.txt or footer (0). No readable incident history (5). The monthly image quota is reported in RateLimit headers on generation, but no per-second or per-minute limit is published (5 of 15). The agent skill gives a status table with what to do for each, GET /links sends Retry-After on 503, and the docs warn that generation isn't idempotent and to check before retrying a 504 (12 of 15). The terms guarantee 94 per cent annual availability, a low figure but a published SLA (10). Nothing is labelled beta (10). 0 + 5 + 5 + 12 + 10 + 10 = 42.

Osmo CLI 23

Local-package reading, since the owner runs the CLI. Installs from npm. The vendor's skill README (revised 15 October 2026) states Node 22 or later, Git 2.29 or later, FFmpeg, and Studio on Apple Silicon macOS and Linux x64 and arm64 (glibc), while the npm README read on 8 October said any OS; the current npm README couldn't be read, so 15 is kept as a partial (15). The source is private, so there is no public CI or test suite (0). No public issue tracker for the CLI. Support is an email address (5). Versions are semver-shaped with preview tags, but no changelog was found, and osmo share --video FILE in 0.1.17 became osmo share FILE by 0.1.19 without a published note (3). Version 0.1.19 on 8 October, not declared stable (0). 15 + 0 + 5 + 3 + 0 = 23.