Gemini 4 Carbon vs xAI API (Grok)

Gemini 4 Carbon 55

Model reading for gemini-4-carbon on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. Keys bound to a service account and restricted to the Gemini API, with no scopes and a token accepted in the URL (15 of 30, the platform's deduction). Carbon is on the paid tier only, and Google's terms say paid-tier content isn't used to improve products; AI Studio use under a Google AI Ultra subscription falls under terms we didn't read, so 15 of 20 (a judgement call; the platform's 10 is for its free tier). Abuse retention with no number, and new paid projects store requests by default since 26 October (5 of 15). Request logs for billed projects (15). security.txt and a reward programme, no certification naming the API (5 of 20). 15 + 15 + 5 + 15 + 5 = 55.

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Gemini 4 Carbon 40

Model reading for gemini-4-carbon on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. Status page at aistudio.google.com/status with no readable components or history (10 of 20) and no readable incident record (5 of 30). Rate-limit tiers and spend limits published, per-model limits in AI Studio (5 of 15). Backoff guidance for 429 and 503 and SDK retries (15). No SLA (0). Carbon's launch stage isn't stated in Google's developer post, the Antigravity post or the Cloud developer guide read on 10 November, and the model ID carries no preview label, so half (5 of 10, a judgement call; Argon's GA earned the platform 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Gemini 4 Carbon 72

Model reading for gemini-4-carbon on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. Closed service with clear terms, SDKs Apache-2.0 (15). Paid-tier data isn't used, abuse retention has no number, and request storage is on by default for new paid projects (20 of 30). Deprecations table (15 of 20). Data may be cached anywhere Google has facilities; no subprocessor list checked (5 of 20). Every benchmark figure is Google's own. 15 + 20 + 15 + 5 = 55.

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

Gemini 4 Carbon 83

Model reading for gemini-4-carbon on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. Released to developers on 10 November 2026, with the platform's changelog (30). Deprecations with earliest dates and no stated minimum notice (4 of 12). Shutdowns in the last 90 days kept to their table (4 of 8). Dated changelog (15). SDK replies not sampled (5 of 10). Current SDKs (15). Runtimes stated (10). 30 + 4 + 4 + 15 + 5 + 15 + 10 = 83.

xAI API (Grok) 77

Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, grok-voice-transcribe-1.0 on 2 October and grok-imagine-image-quality on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, xai-sdk 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).