Geoapify Location Platform + MCP vs NextBillion.ai

Geoapify Location Platform + MCP 29

Plain API keys per project, which earns 20. Less the checklist's fixed 10 because the specs call the apiKey query parameter 'Recommended authentication method for public APIs'. The x-api-key header works too and the spec warns that keys in URLs can be logged (10). The APIs only read (12). Results are OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). We didn't find per-call logs we could read (0). www.geoapify.com/.well-known/security.txt returned 404 on 4 November, and we found no disclosure policy, bug bounty or certification (0). 10+12+7+0+0 = 29.

NextBillion.ai 46

The REST APIs take a single key query parameter, so a plain key that travels in URLs, which earns 20 less 10. The MCP server adds OAuth 2.1 with PKCE, seals the key into tokens with AES-256-GCM, accepts a Bearer header and stores nothing server-side, so 5 back (15). Every tool is read-only, and keys can carry an IP allowlist (12). Places results are POI and address text with no prompt-injection guidance (7). Usage alerts at 50, 75 and 90 per cent of credits, per the pricing FAQ. No per-call log found (5). /.well-known/security.txt returns 404, and we found no disclosure policy or bug bounty. The about page says the company follows ISO 27001 standards, without naming a certificate (7). 15+12+7+5+7 = 46.

Geoapify Location Platform + MCP 60

status.geoapify.com redirects to an UptimeRobot page. On 4 November its HTML again showed only an error fetching the data, which the page loads from stats.uptimerobot.com/api/, a path that host's robots.txt closes, so no component or incident was read. The page keeps its first award of 15 of 20 while the UptimeRobot split stays open, and 5 for a history we couldn't read (our limit, not a finding against Geoapify). Per-plan rates are published, 5 requests a second on Free up to 30 on API 250 (15). 429 is in the OpenAPI specs as 'Rate limit or quota exceeded' with a JSON body, but there's no Retry-After or backoff guidance, and the pricing page says limits are soft and Geoapify doesn't throttle in general (7, an earlier partial kept). The terms say all paid plans include a default SLA of 99.5 per cent monthly availability, with a 10 per cent discount below it and 50 per cent below 99 per cent (10). The APIs are GA. The MCP page gives no launch stage (8, an earlier partial kept). 15+5+15+7+10+8 = 60.

NextBillion.ai 45

Hosted lines, for the REST APIs at api.nextbillion.io and the hosted MCP server. A status page at status.nextbillion.io, 'NextBillion.AI API Status', renders only in a browser, and its Statuspage-style JSON paths return 404, so we couldn't see its components (10) or read any history. That's our limit, not a finding, and the rubric gives 5 (5). The API reference states 2,400 queries a minute, or 40 a second, for continuous requests (15). Each endpoint's error table lists 429 as 'QPM or API request count quota reached', with no Retry-After or backoff guidance (5). No SLA found; the terms say access isn't warranted to be uninterrupted (0). The REST APIs are GA. The MCP server is at version 0.5.3 (10). 10+5+15+5+0+10 = 45.

Geoapify Location Platform + MCP 84

OpenAPI 3.1 specs for 22 APIs and a separate spec per MCP tool in geoapify/geoapify-openapi-specs, with documented 400, 401, 429 and 500 responses, and the repository added the Timezone API on 23 October 2026 (25). apidocs.geoapify.com/llms.txt still serves the HTML home page on 4 November, and we found no Markdown docs for agents (0). The MCP page's 12 tools each carry a 'when to use' line and name the sibling tool to use instead, for example calculate_route_matrix sends you to calculate_route for geometry (18). Typed parameters with limits such as limit at most 100, and enums for type and format (13). Error examples in the specs, such as '"limit" must be less than or equal to 100', and a playground per API (13). v1 and v2 paths, versioned specs, and a dated public changelog at www.geoapify.com/news-and-updates/ with entries back to September 2022 and an RSS feed, which the 1 October check missed (15, from 5). 25+0+18+13+13+15 = 84.

NextBillion.ai 73

No OpenAPI document for the REST APIs was found in llms.txt or the docs. The hosted MCP server's 27 tools are defined with Zod schemas, so they carry typed JSON Schema inputs (15 of 25). llms.txt, llms-full.txt and a Markdown file for each docs page (10). Endpoint pages explain each parameter, and MCP tool descriptions say when not to use a tool, such as the geometry tools being straight-line rather than road distance (16). Parameter tables give types, allowed values and defaults, such as types and limit (default 10), though in packs several filters into one string (12). curl examples and a per-endpoint error table with causes (13). The MCP server has a dated changelog. No API changelog or versioned path was found (7). 15+10+16+12+13+7 = 73.

Geoapify Location Platform + MCP 30

No x402, MPP or L402 (0). Public plan prices with credit costs per request (1 credit for a simple geocode, place search, route or timezone lookup), but no per-unit overage price, since limits are soft and Geoapify asks heavy users to upgrade (10). Free plan of 3,000 credits a day with 'No credit card required', and commercial use allowed with attribution (20). Signup is a browser flow (0). 0+10+20+0 = 30.

NextBillion.ai 20

No x402, MPP or L402 (0). Pricing is by quote, with annual licences per order, asset or API call and no published unit price (0). A 7-day free trial with an API key and 'No credit card required' (20). A person signs up through the console or emails support for a key (0). 0+0+20+0 = 20.

Geoapify Location Platform + MCP 67

Editorial half only. Closed service with readable terms, still version 5 of 2 February 2024 on 4 November, under Cypriot law (15). The privacy policy says data for successful requests is held no longer than 24 hours and that servers are hosted by Hetzner, with custom DPAs on request (possibly at a cost). The docs say Places and Batch results can be cached or stored with no limits, while the terms say nothing on storage (22). No deprecation policy or dated deprecation notice on the What's new page, and the terms reserve the right to suspend, terminate or change the Service at any time without notice (0). Six processors named, including Hetzner (Germany), Cloudflare and Google Firebase, without locations for most (15). 15+22+0+15 = 52.

NextBillion.ai 58

Editorial half only. Closed service under terms that name NextBillion.ai Pte. Ltd. and Singapore law, and an Apache-2.0 MCP server (18). The privacy policy keeps personal data while a legitimate business need exists, with no periods given. The MCP README says only tool arguments are sent to the API and nothing is retained between requests (14). No deprecation policy or dated notices found. The terms promise 10 days' notice of material changes to the terms (3). Data is mainly processed in Singapore, with transfers abroad under standard clauses. No sub-processor list found (8). 18+14+3+8 = 43.

Geoapify Location Platform + MCP 72

Read on response sizing for kind: http-api. limit, type, filter, bias, lang and format let a caller size geocoding and places responses, and the hosted MCP lists 12 tools with a per-tool OpenAPI spec so an integration can import one tool (18 of 25, unchanged). limit, type, filter, bias, lang and format on geocoding (18). Errors come as JSON with statusCode, error and a readable message (16). Every call reads and the four geometry tools run without an API call, but the docs don't mention MCP annotations (10). One required parameter on most calls. Official JavaScript autocomplete, route planner, batch geocoding and route waypoint selector libraries, no Python client found (10). 18+18+16+10+10 = 72.

NextBillion.ai 77

MCP reading, since the hosted server is the agent surface. 27 tools, four of them for documentation and seven local geometry tools, with shapes simplified to a 500-vertex budget to save context (18). limit, types, country, bbox and circle filters, and batch geocoding of up to 100 queries (16). The error table explains each code, and the MCP masks the key in error text (15). Every API tool is marked readOnlyHint, idempotentHint and not destructive in the source (18). Few required parameters and explicit latitude and longitude objects, but no official server-side SDK, only mobile and web map SDKs (10). 18+16+15+18+10 = 77.