fal image models vs FLORA

fal image models 77

Graded as a hosted service on the queue API. Instatus page at status.fal.ai with components for Model API, Serverless API, Official Models and the dashboards, and monthly uptime figures (20). The notice history, re-read on 1 November 2026, has two notices in the 90 days from 3 August, a 30-minute major outage of synchronous calls to fal.run on 4 September (the queue wasn't named, so partial) and 18 minutes of degraded performance on 29 September, and none in October (20). Concurrency is published, 2 for a new account rising to 40 self-serve with paid invoices over four weeks, and queued requests are never rejected (15). A 429 carries type concurrent_requests_limit and X-Fal-needs-retry: 1, the docs give backoff of 1, 2, 4 and 8 seconds, the queue requeues with no maximum and the SDK retries up to 10 times. There is no idempotency key, so a repeated submit is a second billable job, read as on fal's video and music listings (12, was 8). No SLA document is published for self-serve (0). The queue API is generally available (10). 20+20+15+12+0+10 = 77.

FLORA 46

Hosted reading, for the MCP server and the REST API. A status page at status.flora.ai is linked from the home page and the MCP page, but its robots.txt answered a client error twice on 2 November 2026, so under our rules nothing on that host was fetched and its components are unread (10 of 20, for a linked page whose content we could not check). No readable incident history, so the floor, and this is our fetch rule rather than a finding about FLORA (5). No requests-per-minute figure is published, as the cost and limits page says in so many words; batch sizes (1 to 20 generations, 20 run ids, 50 canvas nodes, 25 files), the polling cooldown (15 seconds, or 2 seconds a run) and one-at-a-time generation for new unpaid accounts are given with numbers (8 of 15). 429 rate_limited is documented with Retry-After on the API and retry_after_seconds on MCP, a 60-second fallback, exponential backoff and a retryability table, and the SDK retries 408, 429 and 5xx twice. Idempotency-Key covers every mutating REST request for two hours, but flora_create_generations over MCP has none and the docs say to read history before retrying (13 of 15). No SLA; the terms provide the service as is (0). No beta or preview label on either surface; the old beta endpoint was removed on 30 June 2026, though the registry version is 0.11.5 (10). 10+5+8+13+0+10 = 46.

fal image models 30

No x402, MPP or L402 (0). Per-model prices published per image, per megapixel or per token without a login (20). No standing free tier. Free credits are granted case by case (0). Browser sign-up and prepaid credit (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.

FLORA 53

No x402, MPP or L402 (0). Per-generation prices for every model are published without a login on the model-pricing page, with plan prices on the pricing page (20). Free gives each new workspace $2.50 of usage, which the docs and the MCP changelog (1 September 2026) say an agent can spend through MCP; the REST API answers paid_plan_required on Free, the pricing page marks MCP 'Not included' there, and no page says whether Free needs a card, so this is a one-off trial on one surface (15 of 20). A person signs up in a browser and approves OAuth, or makes a key in Settings (0). 0+20+15+0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

fal image models 91

OpenAPI for the platform APIs at api.fal.ai/v1/openapi.json, and a per-endpoint OpenAPI 3.1 document from the catalogue API with expand=openapi-3.0, read for fal-ai/flux/dev and fal-ai/nano-banana-2 on 1 November 2026 (25). Any earlier per-endpoint reading from fal.ai's ?endpoint_id= query is struck, because fal.ai's robots.txt disallows it. A docs llms.txt and a machine-readable llms.txt per model with schema, defaults and price (10). Model pages state what each model does, but quality and when-not-to-use guidance vary by model (14). Typed per-model inputs with enums and defaults, prompt the only required field on FLUX.1 dev and Nano Banana 2 (13). Examples on every model page, and a model error reference with typed errors such as image_too_large, image_too_small, unsupported_image_format and content_policy_violation, each with a docs link and structured context (14, was 8). Dated changelog, versioned endpoint ids (15). 25+10+14+13+14+15 = 91.

FLORA 79

Platform with an MCP server and an API, read with the API and MCP lines. The API reference is generated from version 5.10.2 of FLORA's OpenAPI document and reproduces each operation's fields with types, enums, patterns and limits in Markdown, but the document itself is not published and the SDK's README says the generated code comes from it; MCP tool inputs are documented with types and constraints and were not seen live (15 of 25). llms.txt and a Markdown twin of every docs page (10). The tools reference says what each tool does and labels it read-only, writes, destructive, spends money or async, and the cost, runs and security pages say when not to call (flora_run_canvas_nodes spends with no confirmation, never re-fire a partial batch, stop on billing errors); per-tool descriptions are one line (16 of 20). Typed inputs with enums for type and status, prefixed id formats (ws_, prj_, run_, tech_), item and length limits and unknown keys rejected, but params is a free-form object whose names come from flora_list_models (11 of 15). An example call per tool, a REST error table with 13 codes and their retryability, the MCP failure shapes and run error codes, and the skills repository's failure-codes reference (14 of 15). Versioned path /v1 with the API version in the SDK changelog, a dated MCP changelog with entries from 28 May to 23 October 2026 and a retired-tools page; no version numbers on the MCP changelog and no written versioning policy (13 of 15). 15+10+16+11+14+13 = 79.

fal image models 80

The hosted MCP server has 11 tools (15), and search, schema and pricing tools let an agent load one model's definition only when it needs it (5). Outputs come back as CDN URLs, with per-model size and count controls and a header for CDN retention (17). Errors carry a machine-readable type, a docs URL and structured context, with guidance on which to retry, read as on fal's video listing (18, was 12). No idempotency key. Server-side retries, a cancel endpoint and no charge for 5xx failures reduce the cost of a failed call, but a repeated submit is a second billable job, and the MCP docs don't mention readOnlyHint or destructiveHint, read as on fal's video and music listings (10, was 8). Official Python and JavaScript clients, few required parameters per model (15). 20+17+18+10+15 = 80.

FLORA 68

MCP reading for context cost. 59 tools (56 callable by the model) with no toolsets or read-only subset; since 23 September 2026 the list is filtered to the account's access and flora_list_tools returns what the connection has (7 of 25). Cursor pagination with limit 1 to 100 on 10 REST list endpoints, history filters by workspace, project and status, include_inputs off by default, per-node and per-slide document reads, and up to 20 runs read in one call (17 of 20). One REST error envelope with code, message and field errors, retryability per code, a Flora-Request-Id, MCP failures grouped into retry now, retry later, change input and report, and retired tool names answering with their replacement (18 of 20). Idempotency-Key on every mutating REST request and a body key on Technique runs; every MCP tool carries readOnlyHint and destructiveHint annotations and spending tools are marked destructive; quote: true prices before running; the MCP create call has no idempotency key (16 of 20). Few required parameters (project_id, type, prompt, with the workspace resolved from the project) and an official TypeScript SDK and a Go CLI, but no SDK in a second language (10 of 15). 7+17+18+16+10 = 68.

fal image models 61

Closed platform with published terms (8 September 2026) and API Services supplemental terms. The clients are MIT and the catalogue marks each model's license_type. The terms warrant nothing about rights in output, and output rights come from each upstream model's licence, read as on fal's video and music listings (13, was 15). Data handling is documented and mostly agrees. The API Services terms say fal will not use client content to create, train or develop its products, except on models marked Pending Enterprise Ready, request payloads are kept 30 days with an opt-out header and a delete API (per fal's video listing), and the privacy policy of 22 July 2026 deletes account data 30 days after closure. Content sent to a third-party model goes to that third party (22, was 12). fal's model pages carry 19 dated deprecation notices across the catalogue (video and audio endpoints on 22 and 25 October, 17 November and 15 December 2026), with named replacements, but no written policy; none yet names an image endpoint, and the 38 deprecated text-to-image endpoints in the catalogue carry no date. For the image endpoints this listing grades, that is deprecation marked with no dates and no written policy, read as on ElevenLabs' text-to-speech and speech-to-text listings, where its voice-cloning listing's dated entries score higher (5, was 0). The DPA of 31 July 2026 names a subprocessor list with 15 days' notice of new subprocessors, but trust.fal.ai renders only in a browser, and the privacy policy says processing is in the United States and other countries (10, was 5). 13+22+5+10 = 50.

FLORA 68

Closed service under terms of service (17 November 2025) that name FLORA AND FAUNA FLOWERSHOP, INC., give the user all rights in output and limit FLORA's licence in user data to running the service; the SDK is Apache-2.0 and the skills MIT (15 of 30). The terms, the data, security and IP page and the MCP security page agree that FLORA does not train on user data or let model providers train on it. The privacy notice (1 June 2026) is silent on training, names only Google Analytics and an unnamed session replay tool, and gives no retention period beyond the life of the account; a DPA is for Enterprise and paid workspaces with client data (18 of 30). The MCP changelog dates deprecations with replacements (a beta endpoint deprecated 28 May and removed 30 June 2026, execute deprecated 11 September and retired 8 October 2026) and a retired-tools page lists five, but there is no written notice period, and flora_comments forwards with no end date (12 of 20). The sub-processors page (2 June 2026) names 23 services with their locations, including India, the UK, China and Singapore, with no commitment to notice of changes (16 of 20). 15+18+12+16 = 61.

fal image models 73

Keys take one of seven permission presets (API, SERVERLESS, DEPLOY, COMPUTE, BILLING, READONLY, FULL) or a custom permission list, can be limited to named models and can expire, since 9 October 2026. Legacy ADMIN and API keys still work. The MCP server also takes OAuth for ChatGPT and web clients (30, was 25). A READONLY preset grants no write access and a model limit narrows a key to the image endpoints it calls; there's no approval step before a paid generation (15, was 10). Returns generated media and fal's own catalogue text (10). Usage page filters by API key and user (10). https://fal.ai/.well-known/security.txt returned 404 on 1 November 2026 and no disclosure policy or bug bounty was found. The enterprise page mentions SOC 2 and the DPA of 31 July 2026 has a data security exhibit, but the trust centre at trust.fal.ai renders only in a browser, so the report and its scope were unread. Read as on fal's video and music listings (8, was 10). 30+15+10+10+8 = 73.

FLORA 68

OAuth with the authorisation code grant, PKCE (the metadata lists plain and S256, the docs S256), dynamic client registration, refresh tokens and revocation at the token endpoint, with no named scopes, no documented token lifetimes and no list of OAuth connections in FLORA's settings; API keys ak_ scoped to chosen workspaces with Read, Write and Billing permissions, shown once, five at a time and revoked at once, with no expiry or rotation feature. Only the header form is documented (24 of 30). Read-only keys and per-workspace scoping, roles that cap what an agent can do, guests who cannot generate, spending caps per member, workspace, organisation and overage, and a quote-first rule; flora_run_canvas_nodes spends with no confirmation step (16 of 20). Agents read canvas prompts, comments, Techniques and files written by others; the security page says to treat them as data, to review the quote after reading shared content and to use least-privilege keys for unattended accounts, with no technical filtering described (11 of 15). Operators see spend by member in the app and through flora_get_usage, organisation usage exports through the API, charged_cost per run and failed webhook deliveries; FLORA's own MCP logs are not exposed to the operator (9 of 15). The trust centre lists SOC 2 Type 2, GDPR and CCPA (published 26 October 2026) with no report shown; no security.txt was found on flora.ai, and no disclosure policy or bug bounty for the service. The SDK's SECURITY.md points SDK reports at Stainless while its README says the SDK is generated by Fern (8 of 20). 24+16+11+9+8 = 68.