FLORA vs SurgePix API

FLORA 79

Platform with an MCP server and an API, read with the API and MCP lines. The API reference is generated from version 5.10.2 of FLORA's OpenAPI document and reproduces each operation's fields with types, enums, patterns and limits in Markdown, but the document itself is not published and the SDK's README says the generated code comes from it; MCP tool inputs are documented with types and constraints and were not seen live (15 of 25). llms.txt and a Markdown twin of every docs page (10). The tools reference says what each tool does and labels it read-only, writes, destructive, spends money or async, and the cost, runs and security pages say when not to call (flora_run_canvas_nodes spends with no confirmation, never re-fire a partial batch, stop on billing errors); per-tool descriptions are one line (16 of 20). Typed inputs with enums for type and status, prefixed id formats (ws_, prj_, run_, tech_), item and length limits and unknown keys rejected, but params is a free-form object whose names come from flora_list_models (11 of 15). An example call per tool, a REST error table with 13 codes and their retryability, the MCP failure shapes and run error codes, and the skills repository's failure-codes reference (14 of 15). Versioned path /v1 with the API version in the SDK changelog, a dated MCP changelog with entries from 28 May to 23 October 2026 and a retired-tools page; no version numbers on the MCP changelog and no written versioning policy (13 of 15). 15+10+16+11+14+13 = 79.

SurgePix API 40

No OpenAPI or other machine-readable contract was found (0). surgepix.ai/llms.txt returns 404. The docs are HTML pages, but the 15 SKILL.md files in the MIT repository are Markdown written for agents, so half (5). The API reference states the purpose of each of its five operations and the async and session model. The SKILL.md files add trigger phrases and explicit do-not-use routing between skills, but 11 of the task endpoints the skills call appear only in their scripts, with no reference (10). Parameter tables give type and required for the documented operations, with no enums or limits, and the undocumented endpoints have no schema at all (7). JSON examples for every documented operation and an error table with 401, 404 and error.file.sensitive_content (10). A dated public changelog from 11 March 2026, but no version in the API path and no API-specific change notes (8). 0+5+10+7+10+8 = 40.

FLORA 68

Closed service under terms of service (17 November 2025) that name FLORA AND FAUNA FLOWERSHOP, INC., give the user all rights in output and limit FLORA's licence in user data to running the service; the SDK is Apache-2.0 and the skills MIT (15 of 30). The terms, the data, security and IP page and the MCP security page agree that FLORA does not train on user data or let model providers train on it. The privacy notice (1 June 2026) is silent on training, names only Google Analytics and an unnamed session replay tool, and gives no retention period beyond the life of the account; a DPA is for Enterprise and paid workspaces with client data (18 of 30). The MCP changelog dates deprecations with replacements (a beta endpoint deprecated 28 May and removed 30 June 2026, execute deprecated 11 September and retired 8 October 2026) and a retired-tools page lists five, but there is no written notice period, and flora_comments forwards with no end date (12 of 20). The sub-processors page (2 June 2026) names 23 services with their locations, including India, the UK, China and Singapore, with no commitment to notice of changes (16 of 20). 15+18+12+16 = 61.

SurgePix API 29

The editorial half. A closed service whose terms name no company or address. They restrict any commercial use of what the service produces without SurgePix's permission, and contain clauses from an unrelated product (a "big data" query platform and "non-resume content"). The skills are MIT. Unclear terms, with a little credit for the open skills (5). The privacy policy is dated both 10 June 2026 and 1 July 2022, describes WeChat and phone registration and "domestic servers", and gives no retention periods. The API reference says uploads go to Tencent Cloud storage in Seoul as public URLs. No DPA. The statements don't agree (5). No deprecation policy or notices, and the terms let changes take effect on publication without notice (0). Tencent Cloud Object Storage in ap-seoul is named in the API reference, and Alipay and WeChat Pay in the privacy policy. No subprocessor list or stated data location (4). 5+5+0+4 = 14.

FLORA 46

Hosted reading, for the MCP server and the REST API. A status page at status.flora.ai is linked from the home page and the MCP page, but its robots.txt answered a client error twice on 2 November 2026, so under our rules nothing on that host was fetched and its components are unread (10 of 20, for a linked page whose content we could not check). No readable incident history, so the floor, and this is our fetch rule rather than a finding about FLORA (5). No requests-per-minute figure is published, as the cost and limits page says in so many words; batch sizes (1 to 20 generations, 20 run ids, 50 canvas nodes, 25 files), the polling cooldown (15 seconds, or 2 seconds a run) and one-at-a-time generation for new unpaid accounts are given with numbers (8 of 15). 429 rate_limited is documented with Retry-After on the API and retry_after_seconds on MCP, a 60-second fallback, exponential backoff and a retryability table, and the SDK retries 408, 429 and 5xx twice. Idempotency-Key covers every mutating REST request for two hours, but flora_create_generations over MCP has none and the docs say to read history before retrying (13 of 15). No SLA; the terms provide the service as is (0). No beta or preview label on either surface; the old beta endpoint was removed on 30 June 2026, though the registry version is 0.11.5 (10). 10+5+8+13+0+10 = 46.

SurgePix API 15

Read with the hosted lines. No status page was found on surgepix.ai or in the docs, and status.surgepix.ai doesn't resolve (0). With no history to read, the incident line takes the floor (5). No rate limits with numbers are documented. The terms say "non-human continuous or frequent query operations" lead to automatic account suspension, with no threshold given (0). No 429 or backoff guidance. The skill scripts poll every 2 seconds for up to 5 to 15 minutes, but that is client code, not a documented policy (0). No SLA, and the terms disclaim uninterrupted service (0). The API isn't labelled beta or preview, and API keys have been self-serve since 2 June 2026 per the changelog (10). 0+5+0+0+0+10 = 15.

FLORA 68

OAuth with the authorisation code grant, PKCE (the metadata lists plain and S256, the docs S256), dynamic client registration, refresh tokens and revocation at the token endpoint, with no named scopes, no documented token lifetimes and no list of OAuth connections in FLORA's settings; API keys ak_ scoped to chosen workspaces with Read, Write and Billing permissions, shown once, five at a time and revoked at once, with no expiry or rotation feature. Only the header form is documented (24 of 30). Read-only keys and per-workspace scoping, roles that cap what an agent can do, guests who cannot generate, spending caps per member, workspace, organisation and overage, and a quote-first rule; flora_run_canvas_nodes spends with no confirmation step (16 of 20). Agents read canvas prompts, comments, Techniques and files written by others; the security page says to treat them as data, to review the quote after reading shared content and to use least-privilege keys for unattended accounts, with no technical filtering described (11 of 15). Operators see spend by member in the app and through flora_get_usage, organisation usage exports through the API, charged_cost per run and failed webhook deliveries; FLORA's own MCP logs are not exposed to the operator (9 of 15). The trust centre lists SOC 2 Type 2, GDPR and CCPA (published 26 October 2026) with no report shown; no security.txt was found on flora.ai, and no disclosure policy or bug bounty for the service. The SDK's SECURITY.md points SDK reports at Stainless while its README says the SDK is generated by Fern (8 of 20). 24+16+11+9+8 = 68.

SurgePix API 41

Plain API keys created in the account settings, which the docs say can be revoked and reset. The key goes in the authorization header, never in a URL. No scopes found (20). No read-only key or spend cap. The plan's credit allowance bounds spend. Every uploaded file becomes a publicly accessible URL on Tencent Cloud storage, which counts against least privilege (3). The API returns image and file URLs, not untrusted text (10). The billing page's credit statement lists each request with its model and token counts, and sessions group calls in the web app, per the docs (8). No security.txt, disclosure policy, bug bounty or certification was found (0). 20+3+10+8+0 = 41.

FLORA 53

No x402, MPP or L402 (0). Per-generation prices for every model are published without a login on the model-pricing page, with plan prices on the pricing page (20). Free gives each new workspace $2.50 of usage, which the docs and the MCP changelog (1 September 2026) say an agent can spend through MCP; the REST API answers paid_plan_required on Free, the pricing page marks MCP 'Not included' there, and no page says whether Free needs a card, so this is a one-off trial on one surface (15 of 20). A person signs up in a browser and approves OAuth, or makes a key in Settings (0). 0+20+15+0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

SurgePix API 30

No x402, MPP or L402 (0). Plan prices and monthly credits are public, but credits are spent per token with no per-call price for any API task, so plan-only pricing (10). A free plan with 25 credits a day. The pages don't say whether a card is needed or whether a free account can create API keys, so half, a judgement call (10). A person signs up in a browser and creates the key in settings (0). 0+10+10+0 = 20. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.

FLORA 83

Closed service with a dated changelog. The newest MCP changelog entry is 23 October 2026, and flora.ai/updates has product entries to 28 October (30). 31 dated MCP changelog entries between 4 August and 23 October 2026 (20). Support at support@florafauna.ai, bug and feature forms, a Discord linked from the home page, weekly training sessions, and GitHub issues on the skills repository as its support URL (2 open); no response times stated (10 of 15). ai.flora/flora 0.11.5 is in the official MCP registry under a DNS-verified namespace since 16 October 2026 (15). The TypeScript SDK @flora-ai/flora 0.21.1 (14 October 2026, 157 downloads in the week to 1 November) has CI, release-please and an npm publish workflow; the skills repository was last pushed on 18 October 2026 (8 of 10). 30+20+10+15+8 = 83.

SurgePix API 66

The last dated change is GPT-Image-2.5 on 23 October 2026, 10 days before the check (30). Changelog entries on 15, 22 and 23 October, 16, 9 and 2 September 2026, more than three in 90 days (20). For a closed service, a dated changelog, a Discord server and a contact email. We didn't open Discord or the GitHub issues, so answering isn't confirmed (8). No official SDK. The skills are maintained client scripts with tags from v1.0.0 (4 June 2026) to v1.5.0 (2 September 2026), a judgement call (5). The repository's CI checks SKILL.md front matter only, with no tests, and the skills aren't published as a package (3). 30+20+8+5+3 = 66.