EODHD vs TickerLayer

EODHD 30

No x402, MPP or L402 (0). Plan prices are public without login, personal and commercial, sold by the month with daily call allowances and per-endpoint call weights rather than per call (10). A free plan at 20 calls a day with no card (20). The token comes from a browser signup and no key API was found (0). 0 + 10 + 20 + 0 = 30.

TickerLayer 92

x402 on the vendor's own gateway, x402.tickerlayer.com, for 41 GET routes. That is six routes for each of stocks, forex, crypto, indices, ETFs and commodities, plus bond yields and four market-calendar routes. Perpetuals, Futures CFDs, the add-ons, the symbol catalogue and WebSocket need a key. Between massive's 30 for US stock routes only and financial-datasets' 35 for every documented data endpoint (32 of 40). Per-call x402 prices from 0.01 to 0.10 USDC in the catalogue and docs, and plan prices per feed on the pricing page, all without a login (20). A Free plan of 3,000 REST calls every 30 days with 'no card', per llms.txt (20). An agent with a funded Base wallet pays per call with no account or key (20). 32+20+20+20 = 92.

EODHD 70

An OpenAPI 3.1 document in a public repository covers 74 endpoints, last updated 18 February 2026, and the MCP server's 88 tools carry typed inputs and annotations in the source (22 of 25). llms.txt of 32 KB and an llms-full.txt, plus documentation resources inside the MCP server (10). Each API page states its purpose and plan, and tool titles name the dataset, with little on when not to use one (14 of 20). Parameters are documented with formats and the symbol convention is spelled out, but allowed values sit in prose (8 of 15). Examples on every API page and the demo token, with 401, 402, 403, 404, 422 and 429 documented in llms.txt and the limits article (11 of 15). Exchange Details v2 shipped in May 2026 with v1 kept, MCP has v1 and v2, and new APIs are announced on a dated blog, but there is no changelog page (5 of 15). 22 + 10 + 14 + 8 + 11 + 5 = 70.

TickerLayer 88

OpenAPI 3.1 at tickerlayer.com/openapi.json (TickerLayer Market Data API 1.0.0, about 386,000 characters), read in its first 100,000 and last 96,000 characters, with summaries, descriptions, tags and examples on the operations read and shared 400, 401, 403, 404, 429 and 503 responses. The WebSocket is described in prose only and the hosted MCP tool schemas weren't read (23 of 25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). Operation descriptions state purpose and plan gating, and the vendor's skill says which MCP tool to use for each question and when not to, such as get_quote not being the tool for a price. Financial-datasets took 17 (17 of 20). Enums on interval, multiplier, timespan and sort, format: date on dates, bounded limit, required path parameters, as for massive (13 of 15). Examples on most parameters and responses, one Error schema with ten fields and documented codes, but the codes appear only as example values with no enum or table (13 of 15). A dated changelog of the last 50 changes, 8 September to 6 November 2026, but no version in the REST paths ('no /v1/') and the spec at 1.0.0. Above twelve-data's 10 for monthly updates and below massive's 15 for versioned paths (12 of 15). 23+10+17+13+13+12 = 88.

EODHD 52

A closed, proprietary API under terms that name the entity and the personal and professional user classes but carry no date and no governing law; the MCP server and OpenAPI document are MIT (15 of 30). The privacy policy is undated, keeps data while the account is active with no periods, names Google only, and no DPA was found; the MCP server's telemetry is disclosed in its README (8 of 30). No deprecation policy; Exchange Details v1 was kept when v2 shipped, and new APIs are dated on the blog (5 of 20). No subprocessor list or data locations beyond Google as an advertising platform (2 of 20). 15 + 8 + 5 + 2 = 30.

TickerLayer 38

The editorial half. A closed service whose terms of use, user agreement and market data disclaimer (all effective 3 November 2026) set out internal, commercial and redistribution rights by plan and a liability cap. They name no legal entity, address or governing law, so the contracting party is unknown. The plugin and npm client are MIT. Soldfetch took 10 in the same position (10 of 30). The privacy policy keeps WebSocket connection records for 7 days but gives no period for request and tool-call logs or account data after closure, says nothing on model training, names no transfer mechanism and has no DPA (12 of 30). No deprecation policy. The terms allow MCP tools to change 'with reasonable notice where practical' and the user agreement promises notice before a plan is materially reduced, and the changelog records changes after the fact. Kite took 4 (4 of 20). Subprocessors are given only as categories (hosting, authentication, card and crypto payments, email, an AI model for support replies), with analytics vendors deferred to the cookie policy, no data locations, and no named data suppliers (4 of 20). 10+12+4+4 = 30. The provenance half is computed from the provenance block.

EODHD 39

One token per account with no scopes, shown as api_token= in the query string on every docs page, with a Bearer header allowed per llms.txt; the MCP v1 address embeds the token and v2 uses OAuth 2.1 with one scope, full-access (20 less 10 for the query string, so 10). All REST calls read; three MCP report tools trigger provider-side report generation and email (14 of 20). News and sentiment are third-party text and no guidance was found (5 of 15). A usage endpoint and dashboard show calls spent, not a per-call log (6 of 15). No security.txt, disclosure policy, bug bounty or certification found; the MCP server's CI runs Bandit, Semgrep and pip-audit (4 of 20). 10 + 14 + 5 + 6 + 4 = 39.

TickerLayer 49

A plain account key with no scopes, shown once and replaced by regenerating it in the dashboard (20). The OpenAPI file defines an apiKey query parameter as a 'compatibility fallback', and the WebSocket takes the key only in its URL, so 10 off. The MCP server adds OAuth 2.1 with PKCE S256, dynamic registration, refresh tokens, a revocation endpoint and one scope, market.read. Twelve-data took 18 on the same pattern, one less here because the WebSocket has no header option (17 of 30). Every operation reads data, and the OAuth scope is read-only, as for twelve-data and financial-datasets (15 of 20). Responses are prices, bars, symbols, calendars and yields. There is no news feed, and SignalPoint signals are structured fields, so no untrusted text reaches the agent (10 of 15). Rate-limit headers on every response, quota 429s that state the limit and when it renews, and a dashboard list of WebSocket connections with source IP, key and how each ended (24 October 2026). No per-call REST log for the key holder was found, though the privacy policy says request logs are kept (7 of 15). security.txt answered a client error, and no disclosure policy, bug bounty, SOC 2 or ISO 27001 was found (0 of 20). 17+15+10+7+0 = 49.

EODHD 65

Read with the hosted lines. A public status page exists at uptime.eodhistoricaldata.com, an UptimeRobot page announced on the blog on 27 March 2020 (20), but its figures load by script and our reader got an error, so no incident history could be read (5). Limits are published with numbers, 20 calls a day free, 100,000 a day on paid plans, 1,000 requests a minute, with call weights per endpoint (15). 429 carries Retry-After, X-RateLimit headers report the ceiling, and 402 marks an exhausted allowance; reads only (15). The terms promise commercially reasonable efforts and no SLA, with SLAs sold by sales (0). The core API is generally available, with several newer APIs marked beta (10). 20 + 5 + 15 + 15 + 0 + 10 = 65.

TickerLayer 70

Read with the hosted lines, on the REST API. status.tickerlayer.com is an UptimeRobot page linked from the site header (20). Its monitors and history load by script from /api/, which its robots.txt disallows, so no incident record was read, as for eodhd and apitemplate-io (5). Limits are published with numbers, 10 requests a second per account on Free and Individual, 100 on Business, and monthly call quotas per feed (15). The OpenAPI file's 429 carries Retry-After and a body with retryAfterMs, resetsAt and a code that separates the per-second limit from the monthly quota, and every response has carried X-RateLimit-Limit and X-RateLimit-Remaining since 14 September 2026. Every data operation is a GET, and x402 retries with the same payment identifier return the stored response (15). An SLA is named only for Enterprise under a written agreement and as 'partially available' on Business, with no published terms or figure, and the terms of use promise no uptime. Financial-datasets took 10 for SLAs listed on a self-serve plan, so this is half (5 of 10). No beta or preview label on the REST API, the MCP server or the x402 gateway (10). 20+5+15+15+5+10 = 70.