Geoapify Location Platform + MCP vs MapTiler Cloud

Geoapify Location Platform + MCP 29

Plain API keys per project, which earns 20. Less the checklist's fixed 10 because the specs call the apiKey query parameter 'Recommended authentication method for public APIs'. The x-api-key header works too and the spec warns that keys in URLs can be logged (10). The APIs only read (12). Results are OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). We didn't find per-call logs we could read (0). www.geoapify.com/.well-known/security.txt returned 404 on 4 November, and we found no disclosure policy, bug bounty or certification (0). 10+12+7+0+0 = 29.

MapTiler Cloud 64

Revocable keys that can be limited to origins and a User-Agent substring and managed by the API keys API, and service tokens that sign requests so the token itself never travels, which earns 27. Less 10 because the key is 'always passed as a query parameter' (17). The public APIs are read-only, and account changes need a separate service token (16). Geocoding returns OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). An Analytics API and account usage statistics (8). security.txt, a vulnerability disclosure policy and ISO/IEC 27001:2022 certification per the security page. No bug bounty found (16). 17+16+7+8+16 = 64.

Geoapify Location Platform + MCP 60

status.geoapify.com redirects to an UptimeRobot page. On 4 November its HTML again showed only an error fetching the data, which the page loads from stats.uptimerobot.com/api/, a path that host's robots.txt closes, so no component or incident was read. The page keeps its first award of 15 of 20 while the UptimeRobot split stays open, and 5 for a history we couldn't read (our limit, not a finding against Geoapify). Per-plan rates are published, 5 requests a second on Free up to 30 on API 250 (15). 429 is in the OpenAPI specs as 'Rate limit or quota exceeded' with a JSON body, but there's no Retry-After or backoff guidance, and the pricing page says limits are soft and Geoapify doesn't throttle in general (7, an earlier partial kept). The terms say all paid plans include a default SLA of 99.5 per cent monthly availability, with a 10 per cent discount below it and 50 per cent below 99 per cent (10). The APIs are GA. The MCP page gives no launch stage (8, an earlier partial kept). 15+5+15+7+10+8 = 60.

MapTiler Cloud 43

Hosted lines. status.maptiler.com is a StatusCake public uptime report rather than a component incident page (15). Its data loads from app.statuscake.com, whose robots.txt answered with a redirect, so we didn't fetch it and read no history. That's our limit, not a finding, and the rubric gives 5 (5). Monthly request and session quotas are published per plan, but no per-second limit (5). No 429, Retry-After or backoff guidance found in the API reference, the OpenAPI spec or llms-full.txt (0). The pricing page lists a 99.9% SLA on the Custom plan, while the Cloud terms call availability best effort and point to a custom SLA (8). The public APIs are GA (10). 15+5+5+0+8+10 = 43.

Geoapify Location Platform + MCP 67

Editorial half only. Closed service with readable terms, still version 5 of 2 February 2024 on 4 November, under Cypriot law (15). The privacy policy says data for successful requests is held no longer than 24 hours and that servers are hosted by Hetzner, with custom DPAs on request (possibly at a cost). The docs say Places and Batch results can be cached or stored with no limits, while the terms say nothing on storage (22). No deprecation policy or dated deprecation notice on the What's new page, and the terms reserve the right to suspend, terminate or change the Service at any time without notice (0). Six processors named, including Hetzner (Germany), Cloudflare and Google Firebase, without locations for most (15). 15+22+0+15 = 52.

MapTiler Cloud 80

Editorial half only. Closed service with general and Cloud-specific terms under Swiss law, and SDKs under BSD 3-Clause and the skill under MIT (20). The privacy policy covers account and payment data and says legal-claim data is kept up to 10 years, but says nothing about how long API request logs are kept (15). A dated deprecation page for v3 maps and migration guides, with no written notice period (12). Hosting with OVHcloud and Google Firebase, data mainly in Switzerland and the EEA, and an EU-only endpoint. Google Analytics, Firebase and FastSpring named in the privacy policy (17). 20+15+12+17 = 64.

Geoapify Location Platform + MCP 30

No x402, MPP or L402 (0). Public plan prices with credit costs per request (1 credit for a simple geocode, place search, route or timezone lookup), but no per-unit overage price, since limits are soft and Geoapify asks heavy users to upgrade (10). Free plan of 3,000 credits a day with 'No credit card required', and commercial use allowed with attribution (20). Signup is a browser flow (0). 0+10+20+0 = 30.

MapTiler Cloud 40

No x402, MPP or L402 (0). Per-1,000 prices for requests ($0.15) and sessions ($2.50) public without login (20). Free plan with no card, though only for testing and non-commercial use (20). Signup is a browser flow (0). 0+20+20+0 = 40.

Geoapify Location Platform + MCP 84

OpenAPI 3.1 specs for 22 APIs and a separate spec per MCP tool in geoapify/geoapify-openapi-specs, with documented 400, 401, 429 and 500 responses, and the repository added the Timezone API on 23 October 2026 (25). apidocs.geoapify.com/llms.txt still serves the HTML home page on 4 November, and we found no Markdown docs for agents (0). The MCP page's 12 tools each carry a 'when to use' line and name the sibling tool to use instead, for example calculate_route_matrix sends you to calculate_route for geometry (18). Typed parameters with limits such as limit at most 100, and enums for type and format (13). Error examples in the specs, such as '"limit" must be less than or equal to 100', and a playground per API (13). v1 and v2 paths, versioned specs, and a dated public changelog at www.geoapify.com/news-and-updates/ with entries back to September 2022 and an RSS feed, which the 1 October check missed (15, from 5). 25+0+18+13+13+15 = 84.

MapTiler Cloud 79

OpenAPI 3.1.0 document with 32 paths for the public APIs (25). llms.txt, llms-full.txt and a Markdown twin of every page (10). Each API page says what it's for and when to use the SDK instead (session billing), with little on when not to call it (13). Parameters are typed with defaults, such as limit (default 5 forward, 1 reverse) and a types enum, but bbox and proximity are strings (11). Examples on every endpoint, and the spec documents 400, 403, 404 and 414, without an error reference page (10). A dated platform updates page and a geocoding index changelog, but no version in the API path and the spec is version '1.0' (10). 25+10+13+11+10+10 = 79.