FLORA vs Qwen-Image 2.1 (Model Studio)

FLORA 46

Hosted reading, for the MCP server and the REST API. A status page at status.flora.ai is linked from the home page and the MCP page, but its robots.txt answered a client error twice on 2 November 2026, so under our rules nothing on that host was fetched and its components are unread (10 of 20, for a linked page whose content we could not check). No readable incident history, so the floor, and this is our fetch rule rather than a finding about FLORA (5). No requests-per-minute figure is published, as the cost and limits page says in so many words; batch sizes (1 to 20 generations, 20 run ids, 50 canvas nodes, 25 files), the polling cooldown (15 seconds, or 2 seconds a run) and one-at-a-time generation for new unpaid accounts are given with numbers (8 of 15). 429 rate_limited is documented with Retry-After on the API and retry_after_seconds on MCP, a 60-second fallback, exponential backoff and a retryability table, and the SDK retries 408, 429 and 5xx twice. Idempotency-Key covers every mutating REST request for two hours, but flora_create_generations over MCP has none and the docs say to read history before retrying (13 of 15). No SLA; the terms provide the service as is (0). No beta or preview label on either surface; the old beta endpoint was removed on 30 June 2026, though the registry version is 0.11.5 (10). 10+5+8+13+0+10 = 46.

Qwen-Image 2.1 (Model Studio) 72

Alibaba Cloud runs its own status page at status.alibabacloud.com (20). The page is drawn by script (2,034 bytes of HTML on 2 November, robots.txt a plain 404) and shows no incident history to a reader, so 5 for no readable history. The model page lists 20 requests a minute in all six regions, re-read on 2 November (15). The rate-limit guide documents 429 for throttling and 403 for an exhausted free quota, and Model Studio's rate-limiting best-practices page gives exponential backoff with random jitter on 429 and 5xx errors and a server-side queuing header for bursts. No Retry-After header or idempotency key, so safe-retry guidance without keys (12). The Model Studio inference SLA, last updated 8 September 2026, promises 99.9 per cent monthly uptime with service credits on paid inference, per the 10 October check (10). The model carries no preview label (10). 20+5+15+12+10+10 = 72.

FLORA 53

No x402, MPP or L402 (0). Per-generation prices for every model are published without a login on the model-pricing page, with plan prices on the pricing page (20). Free gives each new workspace $2.50 of usage, which the docs and the MCP changelog (1 September 2026) say an agent can spend through MCP; the REST API answers paid_plan_required on Free, the pricing page marks MCP 'Not included' there, and no page says whether Free needs a card, so this is a one-off trial on one surface (15 of 20). A person signs up in a browser and approves OAuth, or makes a key in Settings (0). 0+20+15+0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

Qwen-Image 2.1 (Model Studio) 30

No x402, MPP or L402 in llms.txt or the model pages on 2 November (0). Per-image prices for every region are published without a login, $0.04 in Singapore and $0.035333 elsewhere for qwen-image-2.1-pro, and $0.016 and $0.014133 for qwen-image-2.1-turbo (20). New Singapore users get a 90-day free quota, but the quota page's model list on 2 November names no qwen-image-2.1 model, and the international sign-up asks for payment details first, as read for alibaba-wan (0). A person signs up in a browser and creates the key (0). 0+20+0+0 = 20. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.

FLORA 79

Platform with an MCP server and an API, read with the API and MCP lines. The API reference is generated from version 5.10.2 of FLORA's OpenAPI document and reproduces each operation's fields with types, enums, patterns and limits in Markdown, but the document itself is not published and the SDK's README says the generated code comes from it; MCP tool inputs are documented with types and constraints and were not seen live (15 of 25). llms.txt and a Markdown twin of every docs page (10). The tools reference says what each tool does and labels it read-only, writes, destructive, spends money or async, and the cost, runs and security pages say when not to call (flora_run_canvas_nodes spends with no confirmation, never re-fire a partial batch, stop on billing errors); per-tool descriptions are one line (16 of 20). Typed inputs with enums for type and status, prefixed id formats (ws_, prj_, run_, tech_), item and length limits and unknown keys rejected, but params is a free-form object whose names come from flora_list_models (11 of 15). An example call per tool, a REST error table with 13 codes and their retryability, the MCP failure shapes and run error codes, and the skills repository's failure-codes reference (14 of 15). Versioned path /v1 with the API version in the SDK changelog, a dated MCP changelog with entries from 28 May to 23 October 2026 and a retired-tools page; no version numbers on the MCP changelog and no written versioning policy (13 of 15). 15+10+16+11+14+13 = 79.

Qwen-Image 2.1 (Model Studio) 66

No OpenAPI or other machine-readable contract for the Qwen image endpoints. The OpenAI-compatible mode follows part of the OpenAI Images protocol but publishes no schema of its own (0). llms.txt at docs.modelstudio.console.alibabacloud.com with Markdown copies of every page (10). The API reference says when to use each of the three access methods and which parameters each model accepts, though little on when not to use the model (15 of 20). Typed parameters with ranges for n, size, seed and input images, an enum for prompt_extend_mode, and stated defaults. Some limits differ by model in prose rather than in types, such as negative_prompt for the 3.0 series only (13 of 15). curl, Python and Java examples for each access method, an error format with type, param and code, and a linked error-code page (15). A dated model release page and v1 paths. No dated snapshot of qwen-image-2.1-pro exists yet (13 of 15). The API reference, re-read on 2 November, now lists qwen-image-2.1-turbo beside qwen-image-2.1-pro and the 3.0 models. 0+10+15+13+15+13 = 66.

FLORA 68

OAuth with the authorisation code grant, PKCE (the metadata lists plain and S256, the docs S256), dynamic client registration, refresh tokens and revocation at the token endpoint, with no named scopes, no documented token lifetimes and no list of OAuth connections in FLORA's settings; API keys ak_ scoped to chosen workspaces with Read, Write and Billing permissions, shown once, five at a time and revoked at once, with no expiry or rotation feature. Only the header form is documented (24 of 30). Read-only keys and per-workspace scoping, roles that cap what an agent can do, guests who cannot generate, spending caps per member, workspace, organisation and overage, and a quote-first rule; flora_run_canvas_nodes spends with no confirmation step (16 of 20). Agents read canvas prompts, comments, Techniques and files written by others; the security page says to treat them as data, to review the quote after reading shared content and to use least-privilege keys for unattended accounts, with no technical filtering described (11 of 15). Operators see spend by member in the app and through flora_get_usage, organisation usage exports through the API, charged_cost per run and failed webhook deliveries; FLORA's own MCP logs are not exposed to the operator (9 of 15). The trust centre lists SOC 2 Type 2, GDPR and CCPA (published 26 October 2026) with no report shown; no security.txt was found on flora.ai, and no disclosure policy or bug bounty for the service. The SDK's SECURITY.md points SDK reports at Stainless while its README says the SDK is generated by Fern (8 of 20). 24+16+11+9+8 = 68.

Qwen-Image 2.1 (Model Studio) 80

Model reading of the checklist (credential, training, retention, operator visibility, programme). API keys belong to a workspace, can be limited to chosen models and an IP allow-list of up to 20 entries, can be reset, and temporary keys are documented, per the 10 October check (30). The Model Studio privacy notice, re-read on 2 November, says Alibaba Cloud will never use customer data for model training (20). Result URLs, task data and images are purged after 24 hours (5). No retention period for prompts or input images was found (0). The audit log records model calls and monitoring filters by API key, per the 10 October check (15). SOC 2 with an unqualified opinion is stated in the privacy notice (5), which links Alibaba Cloud's compliance repository (5), read the same way as the alibaba-wan listing. No security.txt on alibabacloud.com and no Model Studio bug bounty was found (0). 30+20+5+0+15+5+5+0 = 80.

FLORA 83

Closed service with a dated changelog. The newest MCP changelog entry is 23 October 2026, and flora.ai/updates has product entries to 28 October (30). 31 dated MCP changelog entries between 4 August and 23 October 2026 (20). Support at support@florafauna.ai, bug and feature forms, a Discord linked from the home page, weekly training sessions, and GitHub issues on the skills repository as its support URL (2 open); no response times stated (10 of 15). ai.flora/flora 0.11.5 is in the official MCP registry under a DNS-verified namespace since 16 October 2026 (15). The TypeScript SDK @flora-ai/flora 0.21.1 (14 October 2026, 157 downloads in the week to 1 November) has CI, release-please and an npm publish workflow; the skills repository was last pushed on 18 October 2026 (8 of 10). 30+20+10+15+8 = 83.

Qwen-Image 2.1 (Model Studio) 77

Model reading. qwen-image-2.1-turbo joined the release page for the International scope on 9 October 2026, after qwen-image-2.1-pro on 2 October, and the dashscope SDK shipped 2.0.3 on 30 October per the alibaba-wan listing's PyPI reading of 2 November (30). The decommissioning policy now gives stable models (series names, dated versions and -latest aliases) at least 3 months' notice before end of service and preview models 14 days, by announcement, email and internal message. No qwen-image model is in its retirement batches. The preview window is short, so 15 of 20, as for alibaba-wan. A dated model release page with qwen-image entries on 20 July, 4 August, 2 October and 9 October, and Alibaba Cloud ticket support (12 of 15). Current official SDK on PyPI (15). PyPI links no source repository or CI (5). 30+15+12+15+5 = 77. The 10 October note's SDK dates came from PyPI's JSON path, which pypi.org's robots.txt disallows, so that reading is struck.

FLORA 68

MCP reading for context cost. 59 tools (56 callable by the model) with no toolsets or read-only subset; since 23 September 2026 the list is filtered to the account's access and flora_list_tools returns what the connection has (7 of 25). Cursor pagination with limit 1 to 100 on 10 REST list endpoints, history filters by workspace, project and status, include_inputs off by default, per-node and per-slide document reads, and up to 20 runs read in one call (17 of 20). One REST error envelope with code, message and field errors, retryability per code, a Flora-Request-Id, MCP failures grouped into retry now, retry later, change input and report, and retired tool names answering with their replacement (18 of 20). Idempotency-Key on every mutating REST request and a body key on Technique runs; every MCP tool carries readOnlyHint and destructiveHint annotations and spending tools are marked destructive; quote: true prices before running; the MCP create call has no idempotency key (16 of 20). Few required parameters (project_id, type, prompt, with the workspace resolved from the project) and an official TypeScript SDK and a Go CLI, but no SDK in a second language (10 of 15). 7+17+18+16+10 = 68.

Qwen-Image 2.1 (Model Studio) 73

API reading of the checklist. A sync call returns one or more PNG URLs with a small usage object. Base64 output is not available on the OpenAI-compatible mode (20 of 25). n (1 to 6) and size control output, and the async mode returns a task id to poll. No task list was found (15 of 20). Errors carry a code, a message and the parameter at fault, and the error-code page gives a fix for each code (18 of 20). No idempotency key, and nothing found on whether failed calls are billed for this model (5 of 20). Only model and prompt are required, everything else has a default, and the DashScope SDK for Python and Java and the OpenAI SDKs all work (15). 20+15+18+5+15 = 73.