Edamam vs spoonacular

Edamam 31

Closed service whose API terms of use could not be read (the page is a script shell). The plan pages state the restrictions on caching, attribution and automated requests clearly (8 of 30). The privacy policy could not be read either, so no data-handling statement was scored (0 of 30, unchecked). Retired API versions are marked on their docs pages and the recipe docs announce the end of Shopping List V1 on June 30 with no year (6 of 20). No subprocessors or data locations found (0 of 20). 8 + 0 + 6 + 0 = 14.

spoonacular 61

Closed API with terms last updated 16 April 2026 that are clear on caching, attribution and termination; the MCP server is ISC and the clients MIT (15 of 30). The privacy policy, last revised in 2023, names Stripe and unnamed third parties, gives no retention periods and no DPA, while the terms require deleting all data when access ends (10 of 30). The terms allow the API to end without notice, but the updates page records field renames and removals with six months' notice, the last in 2022 (8 of 20). Cloudflare is named on the marketing page and Stripe in the privacy policy, with no subprocessor list or data location (5 of 20). 15 + 10 + 8 + 5 = 38.

Edamam 30

Read with the hosted lines. No status page was found on the developer portal, the docs, the OpenAPI documents or the MCP page, and a search found none (0), so there is no incident history to read (5). Per-minute throttles and monthly call allowances are published for every plan, 10, 100 and 300 a minute on Recipe Search and 50 to 1,200 on the Food Database (15). No 429, Retry-After or backoff guidance was found; the OpenAPI file lists only 400, 403 and 404 (0 of 15). No SLA was found (0). The v2 APIs are generally available, with beta marked on individual fields (10). 0 + 5 + 15 + 0 + 0 + 10 = 30.

spoonacular 58

Read with the hosted lines. A status page exists at status.spoonacular.com (UptimeRobot), but on 3 November 2026 it rendered 'There was an error while fetching the data' with no components or history, so half credit (10 of 20) and no readable incident record (5). Daily point quotas and requests-per-second limits are published by plan, 60 a minute on Free and 5, 10 and 20 a second on Cook, Culinarian and Chef (15). HTTP 429 and 402 are documented with three quota headers, but there is no Retry-After, backoff guidance or idempotency key for the meal-plan writes (8 of 15). The pricing page states 99 per cent uptime on Cook and Culinarian and 99.9 per cent on Chef, and the FAQ says SLAs are sold above $250 a month (10). The API is generally available (10). 10 + 5 + 15 + 8 + 10 + 10 = 58.

Edamam 25

No x402, MPP or L402 (0 of 40). Monthly plan prices and call allowances are public for all three APIs, with per-call prices only for Vision ($0.015) and the Site Parser ($0.06 to $0.01), so plan-priced with some per-unit rates (15 of 20). No free tier; 10-day trials on Recipe Search Basic and Plus, a 30-day trial on Food Database Basic, and the pages do not say whether a card is needed (10 of 20). A person signs up in the developer portal and picks a plan in a browser (0 of 20). 0 + 15 + 10 + 0 = 25.

spoonacular 40

No x402, MPP or L402 (0 of 40). Plan prices and per-point overage rates ($0.005, $0.004 and $0.002) are public, with the point cost of every endpoint (20). The Free plan gives 50 points a day with no card (20). A person signs up in the console in a browser, and no key API exists (0 of 20). 0 + 20 + 20 + 0 = 40.

Edamam 33

Read as a closed service. No dated change was found on the API pages, which carry no changelog. The Food MCP page pins mcp-remote 0.14.3, a version npm published on 21 September 2026, so that page was written or changed within the last 90 days but not demonstrably within 30 (20 of 30). No three dated changes in 90 days (0 of 20). A support widget and form, email and phone on Core and above, no public changelog or community channel (5 of 15). No official SDK; the hosted MCP server is the vendor's but is absent from the official registry, which lists only third-party edamam servers (8 of 15). No package to assess (0 of 10). 20 + 0 + 5 + 8 + 0 = 33.

spoonacular 22

Read as a closed service. The newest dated change on the updates page is February 2026 (Nutrition by Photo, recipe extraction from video), more than 180 days before 3 November 2026, and the SDK repository's last push is 2 December 2025 (0 of 30). No dated changes in the last 90 days (0 of 20). Updates page, Discord, contact form and paid support from $99 a month; three open issues on the clients repository could not be read (8 of 15). Generated SDKs in 24 languages, last pushed December 2025, and an npm MCP server, but no vendor entry in the official MCP registry, which lists only third-party spoonacular servers (10 of 15). spoonacular-mcp has one release (1.0.0, 4 August 2025), a test script and no CI (4 of 10). 0 + 0 + 8 + 10 + 4 = 22.

Edamam 30

One app_id and app_key pair per application, documented as query parameters first and HTTP Basic second, with no scopes, expiry or rotation found; the MCP server takes the pair as a Bearer token. Plain keys (20) less 10 for the documented query string (10 of 30). The APIs are read-only for an outside caller, but there is no read-only key mode and nothing to confirm (12 of 20). Recipe titles, ingredient lines and source urls come from the public web, and no guidance on treating them as untrusted was found; the MCP page only says to present results as estimates (5 of 15). Active user tracking counts users per app for billing, but no request log was found (3 of 15). security.txt returns 404 on developer.edamam.com and no disclosure policy, bug bounty or certification was found (0 of 20). 10 + 12 + 5 + 3 + 0 = 30.

spoonacular 20

One key per account with no scopes, expiry or rotation procedure, documented first as the apiKey query parameter and also sent in the query string by the MCP server; the x-api-key header is the alternative. One all-powerful key (10) less 10 for the documented query string (0 of 30). The data endpoints are read-only and a user's meal plan is written only with that user's username and hash, but there is no read-only key mode or confirmation step (10 of 20). Recipe text, instructions and extracted pages come from third-party websites and no guidance on treating them as untrusted was found (5 of 15). The console shows quota use and the headers report it per call, but no request log was found (5 of 15). security.txt returns 404 and no disclosure policy, bug bounty or certification was found (0 of 20). 0 + 10 + 5 + 5 + 0 = 20.