Geoapify Location Platform + MCP vs Geocodio

Geoapify Location Platform + MCP 29

Plain API keys per project, which earns 20. Less the checklist's fixed 10 because the specs call the apiKey query parameter 'Recommended authentication method for public APIs'. The x-api-key header works too and the spec warns that keys in URLs can be logged (10). The APIs only read (12). Results are OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). We didn't find per-call logs we could read (0). www.geoapify.com/.well-known/security.txt returned 404 on 4 November, and we found no disclosure policy, bug bounty or certification (0). 10+12+7+0+0 = 29.

Geocodio 58

Revocable keys, five on pay-as-you-go, each with permissions (Lists and Distance off by default), which earns 25. Less 10 because the docs say 'All requests require &api_key=YOUR_API_KEY' and the OpenAPI spec defines only the query scheme, though an Authorization header has worked since March 2025 (15). Per-key permissions limit what a key can reach. DELETE on lists and distance jobs needs no confirmation (13). Results are addresses and government district, census and legislator data rather than user-written text. No prompt-injection guidance found (9). Usage per API key in the dashboard, downloadable as CSV, and billable-lookup headers on every response (8). Valid security.txt to 30 January 2030 with a PGP key and a responsible disclosure policy. SOC 2 Type II and annual penetration tests apply to the Enterprise platform only. No bug bounty found (13). 15+13+9+8+13 = 58.

Geoapify Location Platform + MCP 67

Editorial half only. Closed service with readable terms, still version 5 of 2 February 2024 on 4 November, under Cypriot law (15). The privacy policy says data for successful requests is held no longer than 24 hours and that servers are hosted by Hetzner, with custom DPAs on request (possibly at a cost). The docs say Places and Batch results can be cached or stored with no limits, while the terms say nothing on storage (22). No deprecation policy or dated deprecation notice on the What's new page, and the terms reserve the right to suspend, terminate or change the Service at any time without notice (0). Six processors named, including Hetzner (Germany), Cloudflare and Google Firebase, without locations for most (15). 15+22+0+15 = 52.

Geocodio 87

Editorial half only. Closed service with clear, dated terms under Virginia law, and libraries and CLI under MIT (20). The privacy policy says API and spreadsheet input and results are deleted within 45 days, error logs kept 90 days, and customer data isn't used to train AI models. A separate data retention policy and llms.txt put Lists API data at 72 hours. Results may be stored permanently by the customer (27). Replaced API versions are guaranteed for at least 12 months, breaking changes come only with a new version, and the changelog marks each one 'Breaking' (18). The privacy policy names its processors, such as Sentry and Laravel Nightwatch, and the security page says self-serve is hosted in Europe (15). 20+27+18+15 = 80.

Geoapify Location Platform + MCP 69

The What's new page dates two API entries on 2 November 2026 (Marker Icon API and Static Maps API marker options), two days before this check (30). In the 90 days from 6 August it lists API or MCP changes on 6 August (MCP Places and Routing tools), 28 August (MCP geometry operations), 23 October (Timezone API and get_timezone tool) and 2 November (two), and the OpenAPI repository has commits on 1, 2 and 25 September and 16, 23 and 30 October (20, from 15). A public changelog with an RSS feed and email support on paid plans. We didn't test support response (8 of 15, from 5). The JavaScript libraries are current, with geocoder-autocomplete at v3.1.0 on 27 July 2026, and the official MCP isn't in the MCP registry (6). The autocomplete SDK carries Jest tests (5). 30+20+8+6+5 = 69.

Geocodio 86

API v2.1 released 3 November 2026 (Australia and New Zealand), and PHP library 3.4.1 on 4 November (30). Dated changelog entries on 8 September, 1, 8, 9, 19, 22 and 31 October and 3 November 2026, plus library releases in October (20). Public changelog, support by email and a team-staffed help desk named on the pricing page. We didn't read GitHub issue reply times (12). Official Python 1.6.0 and Node 2.3.0 from 12 October and PHP 3.4.1 from 4 November are current (15). Each library and the CLI run CI on GitHub Actions; we didn't check whether the runs pass (9). 30+20+12+15+9 = 86.

Geoapify Location Platform + MCP 60

status.geoapify.com redirects to an UptimeRobot page. On 4 November its HTML again showed only an error fetching the data, which the page loads from stats.uptimerobot.com/api/, a path that host's robots.txt closes, so no component or incident was read. The page keeps its first award of 15 of 20 while the UptimeRobot split stays open, and 5 for a history we couldn't read (our limit, not a finding against Geoapify). Per-plan rates are published, 5 requests a second on Free up to 30 on API 250 (15). 429 is in the OpenAPI specs as 'Rate limit or quota exceeded' with a JSON body, but there's no Retry-After or backoff guidance, and the pricing page says limits are soft and Geoapify doesn't throttle in general (7, an earlier partial kept). The terms say all paid plans include a default SLA of 99.5 per cent monthly availability, with a 10 per cent discount below it and 50 per cent below 99 per cent (10). The APIs are GA. The MCP page gives no launch stage (8, an earlier partial kept). 15+5+15+7+10+8 = 60.

Geocodio 70

Hosted lines. incident.io status page at status.geocod.io with five components (Geocodio API, Dashboard, Enterprise API, Enterprise Dashboard, Website) and an incidents feed at /api/v2/incidents.json (20). In the 90 days to 6 November 2026 the feed lists one incident marked major, 'Spreadsheet geocoding jobs are failing' on 27 October from 12:35 to 15:15 UTC, and a PHP security patch on 21 October marked no impact, so one major outage of a core feature (10). 1,000 requests a minute on single geocoding for pay-as-you-go and Flex, 100 on Enterprise Flex (15). 429 carries X-RateLimit-Remaining, -Limit and -Period, and llms.txt and AGENTS.md give a retry rule per status code with capped backoff, plus client-side idempotency guidance for the non-idempotent list and batch writes (15). The pricing page lists custom SLAs as an add-on on Unlimited and Enterprise plans, with no published terms, so no SLA (0). GA (10). 20+10+15+15+0+10 = 70.

Geoapify Location Platform + MCP 30

No x402, MPP or L402 (0). Public plan prices with credit costs per request (1 credit for a simple geocode, place search, route or timezone lookup), but no per-unit overage price, since limits are soft and Geoapify asks heavy users to upgrade (10). Free plan of 3,000 credits a day with 'No credit card required', and commercial use allowed with attribution (20). Signup is a browser flow (0). 0+10+20+0 = 30.

Geocodio 40

No x402, MPP or L402 (0). $1 per 1,000 lookups after the free tier, and per-credit rates for every Flex tier, public without login (20). 2,500 lookups a day free with no card until usage passes the free tier (20). Signup and key creation are a browser flow at dash.geocod.io (0). 0+20+20+0 = 40.

Geoapify Location Platform + MCP 84

OpenAPI 3.1 specs for 22 APIs and a separate spec per MCP tool in geoapify/geoapify-openapi-specs, with documented 400, 401, 429 and 500 responses, and the repository added the Timezone API on 23 October 2026 (25). apidocs.geoapify.com/llms.txt still serves the HTML home page on 4 November, and we found no Markdown docs for agents (0). The MCP page's 12 tools each carry a 'when to use' line and name the sibling tool to use instead, for example calculate_route_matrix sends you to calculate_route for geometry (18). Typed parameters with limits such as limit at most 100, and enums for type and format (13). Error examples in the specs, such as '"limit" must be less than or equal to 100', and a playground per API (13). v1 and v2 paths, versioned specs, and a dated public changelog at www.geoapify.com/news-and-updates/ with entries back to September 2022 and an RSS feed, which the 1 October check missed (15, from 5). 25+0+18+13+13+15 = 84.

Geocodio 92

OpenAPI 3.0.1 spec, version 2.1.0, with 11 paths (25). llms.txt and an AGENTS.md written for agents (10). llms.txt and AGENTS.md say when to use each endpoint and when not to, such as the Lists API over looping single calls, the upload tool for a one-off spreadsheet and straightline over driving distance unless road distance is needed (19). Typed parameters with country values, component fields and documented limits, though fields is a comma-separated string (12). Error table with retry guidance, examples throughout, but the spec documents 200, 400, 403, 404, 422 and 424 and not 429 or 500 (11). Versioned paths from v1 to v2.1 and a dated public changelog with entries back to 2024 (15). 25+10+19+12+11+15 = 92.