Edamam vs fatsecret Platform API

Edamam 30

One app_id and app_key pair per application, documented as query parameters first and HTTP Basic second, with no scopes, expiry or rotation found; the MCP server takes the pair as a Bearer token. Plain keys (20) less 10 for the documented query string (10 of 30). The APIs are read-only for an outside caller, but there is no read-only key mode and nothing to confirm (12 of 20). Recipe titles, ingredient lines and source urls come from the public web, and no guidance on treating them as untrusted was found; the MCP page only says to present results as estimates (5 of 15). Active user tracking counts users per app for billing, but no request log was found (3 of 15). security.txt returns 404 on developer.edamam.com and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 12 + 5 + 3 + 0 = 30.

fatsecret Platform API 51

OAuth 2.0 client credentials with seven scopes gating capabilities (basic, premier, barcode, localization, nlp, image-recognition and feedback), tokens of 86,400 seconds, a Client Secret that stays on the server, and token requests limited to IP addresses or CIDR ranges registered on the key; OAuth 1.0 with HMAC-SHA1 remains for delegated calls. The scopes gate capabilities rather than read or write, and no rotation procedure was found (26 of 30). Per-user data is reached only through a delegated profile token, and the shared data methods are reads, but there is no read-only scope and no confirmation step for diary writes (14 of 20). Food and brand names are verified by fatsecret and recipes are its own content, with no guidance on treating them as untrusted (8 of 15). No request log or per-call visibility was found beyond the dashboard (3 of 15). The security.txt path answered the site's generic error page, and no disclosure policy, bug bounty or certification was found (0 of 20). 26 + 14 + 8 + 3 + 0 = 51.

Edamam 33

Read as a closed service. No dated change was found on the API pages, which carry no changelog. The Food MCP page pins mcp-remote 0.14.3, a version npm published on 21 September 2026, so that page was written or changed within the last 90 days but not demonstrably within 30 (20 of 30). No three dated changes in 90 days (0 of 20). A support widget and form, email and phone on Core and above, no public changelog or community channel (5 of 15). No official SDK; the hosted MCP server is the vendor's but is absent from the official registry, which lists only third-party edamam servers (8 of 15). No package to assess (0 of 10). 20 + 0 + 5 + 8 + 0 = 33.

fatsecret Platform API 13

Read as a closed service. No dated API change could be read first-hand. The blog that carries the 'What's new' notes sits behind a robots.txt that answered 403, the method pages are undated, and the official Postman repository's last push is 1 July 2025, more than 180 days before 3 November 2026 (0 of 30). No three dated changes in 90 days established (0 of 20). A developer forum on Google Groups, a contact form, and email, phone, Slack and video support on Premier, with no public changelog on the platform site (8 of 15). No official SDK; an official Postman collection (5 of 15). No package to assess (0 of 10). 0 + 0 + 8 + 5 + 0 = 13.

Edamam 66

Public OpenAPI 3.0.3 documents for Recipe Search v2 (four operations) and the Food Database, and the Food MCP's two tools take typed arguments (25). No llms.txt (404) and no Markdown docs (0 of 10). Operation and parameter descriptions state purpose, and the by-uri description warns that missing recipes are not flagged, but there is little on when not to use an operation (12 of 20). Enums for type, diet, health, cuisineType, mealType, dishType, imageSize, co2EmissionsClass and 31 field names, required flags, a 1 to 20 bound on uris, and the MCP arguments are required lists and strings (14 of 15). Examples on the docs page, an Errors schema of errorCode, message and params, but no example error body and no code list (9 of 15). v2 in the path and retired versions marked, but no changelog and a Shopping List V1 end date with no year (6 of 15). 25 + 0 + 12 + 14 + 9 + 6 = 66.

fatsecret Platform API 52

No OpenAPI or similar document was found; the official Postman collection is the only machine-readable contract (8 of 25). No llms.txt (a redirect) and no Markdown docs (0 of 10). Each method page states purpose, parameters, response fields and Premier status, with little on when not to use a method (12 of 20). Parameters are typed with defaults and allowed values, max_results is capped at 50, but the field tables mistype allergen names as Long and leave food_images out of the food-level fields (11 of 15). Example responses in XML and JSON on each method, a central error code list with the body shape, and per-method error codes (13 of 15). Methods carry versions (v1 to v5) and older versions stay documented, but no changelog is on the platform site and the blog's 'What's new' could not be read (8 of 15). 8 + 0 + 12 + 11 + 13 + 8 = 52.

Edamam 71

field selects any of 31 response fields, results a call are capped by plan at 100 or 1,000, and the MCP server lists two compact tools (22 of 25). _links.next paging with diet, health, cuisine, dish, meal, time, calorie and about 40 nutrient range filters (20 of 20). An error schema with errorCode, message and params, but the codes are not enumerated (10 of 20). Every recipe operation is a read and safe to repeat; the shopping-list POST aggregates quantities and stores nothing; the MCP tools' annotations were not read (12 of 20). type and q are the only required search parameters, with no official SDK in any language (7 of 15). 22 + 20 + 10 + 12 + 7 = 71.

fatsecret Platform API 64

max_results up to 50 (default 20), format=json, and include_* switches add sub-categories, images and attributes only when asked, but there is no field selection and each food carries every serving (15 of 25). Zero-based page_number, food_type generic or brand, region and language filters (18 of 20). Numeric error codes with messages, for OAuth, parameters and application errors, but limit errors come as codes 11 and 12 with no HTTP status or retry hint (13 of 20). Food and recipe methods are reads and safe to repeat; diary and saved-meal writes have no idempotency key (10 of 20). No parameter is required on foods.search, but there is no official SDK in any language (8 of 15). 15 + 18 + 13 + 10 + 8 = 64.

Edamam 30

Read with the hosted lines. No status page was found on the developer portal, the docs, the OpenAPI documents or the MCP page, and a search found none (0), so there is no incident history to read (5). Per-minute throttles and monthly call allowances are published for every plan, 10, 100 and 300 a minute on Recipe Search and 50 to 1,200 on the Food Database (15). No 429, Retry-After or backoff guidance was found; the OpenAPI file lists only 400, 403 and 404 (0 of 15). No SLA was found (0). The v2 APIs are generally available, with beta marked on individual fields (10). 0 + 5 + 15 + 0 + 0 + 10 = 30.

fatsecret Platform API 35

Read with the hosted lines. No status page was found on the platform site, the guides, the editions page or the about page (0), so there is no incident history to read (5). The limit is published with a number, 5,000 calls a day on Basic in the terms and on the editions page, and Premier is unlimited (15). Limits surface as error codes 11 and 12 in the body; no HTTP 429, Retry-After or backoff guidance was found, and diary writes have no idempotency key (5 of 15). Premier carries a month-by-month SLA with service credits, named on the editions page without figures, and every edition claims more than 99.9 per cent uptime (5 of 10). The API is generally available, with versioned methods (10). 0 + 5 + 15 + 5 + 5 + 10 = 35.