Finnhub vs Twelve Data

Finnhub 27

A closed service whose terms exist at a page that robots.txt disallows, so they were not read; the pricing page says every self-serve plan is personal use, and no legal entity or governing law was found (8 of 30). No privacy policy was found, /privacy redirecting to the home page (0 of 30). No deprecation policy or dated notices found (0 of 20). Stripe and Braintree scripts load on the site, but no processor list or data location is disclosed (0 of 20). 8 + 0 + 0 + 0 = 8.

Twelve Data 67

A closed service under terms that name the entity, define internal use, business use and redistribution, and were last updated 1 January 2026; the MCP repository is open source but ships no licence file (15 of 30). The privacy policy of 22 September 2026 states retention periods and names its processors, the terms require data deletion within 30 days of termination, and no DPA is named (20 of 30). No deprecation policy or notice period; the terms allow changes and the monthly updates record them after the fact (3 of 20). Subprocessors are named on the privacy policy and the trust centre, with no data locations beyond transfer mechanisms (12 of 20). 15 + 20 + 3 + 12 = 50.

Finnhub 48

Read with the hosted lines. No status page was found on the site, in the docs document or on the MCP page (0), so no incident history could be read (5). Limits are published with numbers, 60 calls a minute on the free key, 150 to 900 a minute by plan, and 30 calls a second on top of every plan (15). The docs say the limit answers 429 and the MCP page says to wait a minute, with no Retry-After or backoff guidance (8 of 15). The home page says 99.99 per cent uptime with an SLA available for enterprise clients (10). The API is generally available (10). 0 + 5 + 15 + 8 + 10 + 10 = 48.

Twelve Data 83

Read with the hosted lines. A public status page at twelvedata.isitup.cloud lists Price API, Fundamentals API, WebSocket and Website with uptime figures (20). Its history shows two incidents in the 90 days to 3 November 2026, 20 minutes of unavailability across the three APIs on 1 September and 16 minutes on the WebSocket on 14 October, minor only (20). Limits are published with numbers, credits a minute by plan from 8 to 10,946 and 800 a day on Basic (15). The docs document a 429 on the limit and the usage endpoint, with no Retry-After or backoff guidance; reads only (8 of 15). The terms sell a 99.9 per cent SLA with service credits, and the Enterprise plan carries 99.99 per cent (10). The REST API and MCP server are generally available (10). 20 + 20 + 15 + 8 + 10 + 10 = 83.

Finnhub 56

The REST API is the surface graded. from and to on candles and news, and symbol-scoped calls, size responses; no field selection, and the MCP server lists 70 tools (12 of 25). Date filters but no pagination on most lists (10 of 20). Only the 429 is documented; a missing key answered 401 with a JSON error field in our one test call (5 of 20). All but one operation are GET reads; the MCP annotations were not read (14 of 20). Few required parameters and official libraries in six languages (15). 12 + 10 + 5 + 14 + 15 = 56.

Twelve Data 84

The REST API is the surface graded. outputsize 1 to 5,000 with a default of 30, format=CSV, dp, date ranges and batch requests size responses, and the MCP server lists 27 tools (20 of 25). Date ranges, outputsize and exchange, country and type filters, with no cursor pagination (15 of 20). Error codes with meanings an agent can branch on, 403 for plan limits and 429 for credits (16 of 20). Every operation is a read, and the MCP source marks tools readOnlyHint (18 of 20). Few required parameters, a demo key, and official SDKs in Python, Node.js, Go, Java and R (15). 20 + 15 + 16 + 18 + 15 = 84.

Finnhub 58

A public Swagger 2.0 document covers 116 paths with a description on every operation, declaring the key as a query parameter and a 200 response only; the MCP tools were not read (20 of 25). /llms.txt returns the site's HTML shell and no Markdown docs exist (0 of 10). Each operation states its purpose, a premium marker and, on quote, advice against polling, with little on when not to use it (14 of 20). Required flags and types are set on 248 parameters, but allowed values such as news categories sit in description text and no enum is declared (8 of 15). Every operation has example URLs and sample code in five languages, while the only documented error is the 429 (9 of 15). The path carries v1 and no changelog or dated change notes were found (7 of 15). 20 + 0 + 14 + 8 + 9 + 7 = 58.

Twelve Data 83

A public OpenAPI 3.1 document covers 187 operations, every one with a description and 200, 400, 401, 403, 404, 414, 429 and 500 responses, and the MCP tools in the source carry typed inputs and annotations (25). llms.txt on the site and in the docs link Markdown pages per section, pricing.md and auth.md (10). Descriptions state purpose, plan requirement and credit cost, with little on when not to use an endpoint (16 of 20). Required parameters are marked and the Markdown lists interval, adjust and type values, but none of the 3,091 parameters in the spec declares an enum (9 of 15). Examples with a demo key on every endpoint and an error table with codes and meanings (13 of 15). No version in the path, a spec at version 0.0.1, and monthly dated product updates on the news page rather than an API changelog (10 of 15). 25 + 10 + 16 + 9 + 13 + 10 = 83.

Finnhub 32

One key per account with no scopes, documented as token= in the query string or an X-Finnhub-Token header, and the Swagger document declares only the query form. The MCP server uses OAuth with fixed public client ids and keeps the key from the assistant (20 less 10 for the query string, plus 2 for the MCP route, so 12). Every data operation is a read (15 of 20). News, transcripts and filings are third-party text and no guidance was found (5 of 15). No usage log for the key holder was found (0 of 15). security.txt redirects to the home page and no disclosure policy, bug bounty or certification was found (0 of 20). 12 + 15 + 5 + 0 + 0 = 32.

Twelve Data 54

The REST key is a plain per-account key with no scopes, accepted as a header or as ?apikey= (20 less 10 for the query string). The hosted MCP server refuses keys and uses OAuth 2.1 with PKCE, a resource indicator, refresh tokens, revocation and one scope, which lifts the credential model for that surface (18 of 30). Every operation is a read (15 of 20). Company news is third-party text and no guidance was found (5 of 15). An /api_usage endpoint and dashboard usage give the key holder a view of consumption, not a per-call log (6 of 15). A trust centre on SafeBase lists SOC 2, GDPR and CCPA and ten policies; no security.txt, disclosure process or bug bounty was found (10 of 20). 18 + 15 + 5 + 6 + 10 = 54.

Finnhub 60

Read as a closed service. The newest dated change is 2 November 2026, when finnhub-go, finnhub-ruby and finnhub-php gained a price target history endpoint; the MCP page is dated 6 August 2026 (30). Only that one dated change falls in the last 90 days, the previous library commits being 22 June 2026 (5 of 20). Support by email, with no public changelog or community channel found (5 of 15). Six official client libraries, finnhub-python at 2.4.29 of 24 June 2026 (15). The libraries are generated from the API document; no CI run was visible and the Python README names an older version than PyPI (5 of 10). 30 + 5 + 5 + 15 + 5 = 60.

Twelve Data 82

Read as a closed service. The newest dated change is the product update of 12 October 2026, with the MCP repository changed on 1 October and the world-model dataset repository on 31 October (30). Monthly updates dated 12 August, 12 September and 12 October 2026 (20). A monthly changelog, a support portal, a sales contact and a Telegram channel; replies on the MCP repository's issues were not read (10 of 15). Six official SDKs and a CLI, twelvedata-python at v1.4.0 of 27 April 2026 (15). The MCP server pins its dependencies with reasons and ships tests; the Python SDK's changelog stops at version 0.1 (7 of 10). 30 + 20 + 10 + 15 + 7 = 82.