Geoapify Location Platform + MCP vs Woosmap

Geoapify Location Platform + MCP 69

The What's new page dates two API entries on 2 November 2026 (Marker Icon API and Static Maps API marker options), two days before this check (30). In the 90 days from 6 August it lists API or MCP changes on 6 August (MCP Places and Routing tools), 28 August (MCP geometry operations), 23 October (Timezone API and get_timezone tool) and 2 November (two), and the OpenAPI repository has commits on 1, 2 and 25 September and 16, 23 and 30 October (20, from 15). A public changelog with an RSS feed and email support on paid plans. We didn't test support response (8 of 15, from 5). The JavaScript libraries are current, with geocoder-autocomplete at v3.1.0 on 27 July 2026, and the official MCP isn't in the MCP registry (6). The autocomplete SDK carries Jest tests (5). 30+20+8+6+5 = 69.

Woosmap 26

No dated API release, changelog or release note found. The newest dated activity we saw is the public woosmap-samples repository on 16 September 2026, which isn't an API release (10). No dated changes to count in the last 90 days (0). Support by email and a support centre, with no public changelog (5). Official JavaScript, iOS and Android SDKs exist, but we couldn't check their versions because the GitHub API was rate-limited and two SDK repository names didn't resolve; the MCP server isn't in the official MCP registry (8). The samples carry tests, per the rate-limits page (3). 10+0+5+8+3 = 26.

Geoapify Location Platform + MCP 60

status.geoapify.com redirects to an UptimeRobot page. On 4 November its HTML again showed only an error fetching the data, which the page loads from stats.uptimerobot.com/api/, a path that host's robots.txt closes, so no component or incident was read. The page keeps its first award of 15 of 20 while the UptimeRobot split stays open, and 5 for a history we couldn't read (our limit, not a finding against Geoapify). Per-plan rates are published, 5 requests a second on Free up to 30 on API 250 (15). 429 is in the OpenAPI specs as 'Rate limit or quota exceeded' with a JSON body, but there's no Retry-After or backoff guidance, and the pricing page says limits are soft and Geoapify doesn't throttle in general (7, an earlier partial kept). The terms say all paid plans include a default SLA of 99.5 per cent monthly availability, with a 10 per cent discount below it and 50 per cent below 99 per cent (10). The APIs are GA. The MCP page gives no launch stage (8, an earlier partial kept). 15+5+15+7+10+8 = 60.

Woosmap 78

Hosted lines. Atlassian Statuspage at status.woosmap.com with seven components (Localities, Store Search, Geolocation, Distance, Address, Map and Indoor APIs) (20). The status home page lists no incidents from 23 October to 6 November 2026. The full history page loads by script and the site's robots.txt disallows /api/, so the rest of the 90 days wasn't read and the line is held between the unreadable and minor tiers (10). Each endpoint's reference states its own rate limit, such as 50 a second, shared by a project's keys (15). Every response carries RateLimit-Policy and RateLimit headers, and the rate-limits page says to wait t seconds after a 429, retry at most three times and back off 1, 2 and 4 seconds when the header is missing, with sample code (15). A 99.9% SLA on the Enterprise plan per the pricing page; we didn't read its terms (8). GA (10). 20+10+15+15+8+10 = 78.

Geoapify Location Platform + MCP 29

Plain API keys per project, which earns 20. Less the checklist's fixed 10 because the specs call the apiKey query parameter 'Recommended authentication method for public APIs'. The x-api-key header works too and the spec warns that keys in URLs can be logged (10). The APIs only read (12). Results are OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). We didn't find per-call logs we could read (0). www.geoapify.com/.well-known/security.txt returned 404 on 4 November, and we found no disclosure policy, bug bounty or certification (0). 10+12+7+0+0 = 29.

Woosmap 43

Public keys are read-only and must carry a domain or IP restriction. Private keys are read-only or read and write (fixed at creation), restricted by IP, iOS or Android, and can go in an X-Api-Key header. Less 10 because private_key in the query string is a documented option and the default in the spec (17). Read-only keys and the read/write split give least privilege; no confirmation step on dataset deletes was found (16). find_nearby and get_place_details return public POI data, ratings and opening hours, with no prompt-injection guidance (7). Console usage per project wasn't checked (3). www.woosmap.com/.well-known/security.txt returns 404, and we found no disclosure policy, bug bounty or certification (0). 17+16+7+3+0 = 43.

Geoapify Location Platform + MCP 67

Editorial half only. Closed service with readable terms, still version 5 of 2 February 2024 on 4 November, under Cypriot law (15). The privacy policy says data for successful requests is held no longer than 24 hours and that servers are hosted by Hetzner, with custom DPAs on request (possibly at a cost). The docs say Places and Batch results can be cached or stored with no limits, while the terms say nothing on storage (22). No deprecation policy or dated deprecation notice on the What's new page, and the terms reserve the right to suspend, terminate or change the Service at any time without notice (0). Six processors named, including Hetzner (Germany), Cloudflare and Google Firebase, without locations for most (15). 15+22+0+15 = 52.

Woosmap 54

Editorial half only. Closed service under online terms that name WOOSMAP SAS of Montpellier and the Commercial Court of Paris (15). The privacy policy covers website visitors only, and we found no statement on how long API request data is kept (5). The pricing page says the Address API is 'being deprecated for Pro Plan subscriptions', with no date (5). The legal notice says the site is hosted by Amazon Web Services; no sub-processor list or data location for the APIs was found (6). 15+5+5+6 = 31.