Geocodio vs Mapbox APIs + MCP

Geocodio 58

Revocable keys, five on pay-as-you-go, each with permissions (Lists and Distance off by default), which earns 25. Less 10 because the docs say 'All requests require &api_key=YOUR_API_KEY' and the OpenAPI spec defines only the query scheme, though an Authorization header has worked since March 2025 (15). Per-key permissions limit what a key can reach. DELETE on lists and distance jobs needs no confirmation (13). Results are addresses and government district, census and legislator data rather than user-written text. No prompt-injection guidance found (9). Usage per API key in the dashboard, downloadable as CSV, and billable-lookup headers on every response (8). Valid security.txt to 30 January 2030 with a PGP key and a responsible disclosure policy. SOC 2 Type II and annual penetration tests apply to the Enterprise platform only. No bug bounty found (13). 15+13+9+8+13 = 58.

Mapbox APIs + MCP 71

Public and secret tokens with scopes, URL restrictions, one-hour temporary tokens and documented rotation, which earns 30. Less 10 because the REST APIs take the token as the access_token query parameter, and that's the documented way in. The hosted MCP signs in with OAuth instead. Accounts on the card-free trial get a single token they can't rotate or delete until a payment method is added (20). Public-scope tokens can't change the account, and every MCP tool is read-only (18). Responses are structured place data, partly third-party POI names and attributes, and we found no prompt-injection guidance (7). The local MCP emits OpenTelemetry traces per tool call tagged with the client name. We didn't check per-token usage reporting in the account (8). SOC 2 Type II and SOC 3, a HackerOne bug bounty and a disclosure programme, re-read on 1 November. MCP 0.13.0 on 30 July 2026 fixed a query-parameter injection through directions_tool's exclude field, and 0.15.0 on 8 October shipped the fix for reads of cached tool results by anyone who knew a resource URI and could forge the owner's username claim, with a narrowed map CSP. 0.16.0 on 15 October replaced those cached refs for directions and isochrones with refs that re-run the request under the reader's token, and fetches place photos server-side only from public https hosts. All were stated in the public changelog. On 21 October the URL check for custom marker images and place photos was fixed to strip every trailing dot (localhost.. had passed), released in the v0.17.0-dev pre-releases of 30 October and not yet in a stable release. The photo fetch also resolves the host and refuses private addresses, and marker URLs are fetched by Mapbox's Static Images API, so we read it as hardening and don't deduct. No security.txt, still 404 on 1 November (18).

Geocodio 70

Hosted lines. incident.io status page at status.geocod.io with five components (Geocodio API, Dashboard, Enterprise API, Enterprise Dashboard, Website) and an incidents feed at /api/v2/incidents.json (20). In the 90 days to 6 November 2026 the feed lists one incident marked major, 'Spreadsheet geocoding jobs are failing' on 27 October from 12:35 to 15:15 UTC, and a PHP security patch on 21 October marked no impact, so one major outage of a core feature (10). 1,000 requests a minute on single geocoding for pay-as-you-go and Flex, 100 on Enterprise Flex (15). 429 carries X-RateLimit-Remaining, -Limit and -Period, and llms.txt and AGENTS.md give a retry rule per status code with capped backoff, plus client-side idempotency guidance for the non-idempotent list and batch writes (15). The pricing page lists custom SLAs as an add-on on Unlimited and Enterprise plans, with no published terms, so no SLA (0). GA (10). 20+10+15+15+0+10 = 70.

Mapbox APIs + MCP 82

Atlassian Statuspage at status.mapbox.com with an uptime view (20). The history page renders client-side and robots.txt disallows the incidents API, so on 1 November we read the history RSS feed and the incident pages. Two incidents on Navigation (API) fall in the 90 days from 3 August. On 19 October, 19:18 to 19:41 UTC, the Directions and Map Matching APIs in US-East had "elevated latency and missing route data for a significant portion of regional traffic" (23 minutes). On 20 October, 14:45 to 15:47 UTC, "brief, recurring periods of elevated latency and missing route results" in US-East (62 minutes of intermittent disruption). Neither was a core API down, or wide errors, for an hour or more, so minor only (20, was 30 with nothing after 29 June). Rate limits with numbers, 1,000 geocoding requests a minute by default, and X-Rate-Limit-Interval, -Limit and -Reset headers on responses, re-read on 1 November (15). A 429 on overrun with a reset timestamp to wait for, but no Retry-After and no backoff guidance (10). A published Service Level Agreement (last updated 15 April 2024) at mapbox.com/legal/sla gives customers with an executed order 99.9 per cent monthly availability per API, with service credits of 10 and 25 per cent. The 1 October to 17 October checks looked only at the pricing page and the API docs (10, was 0). The REST APIs are GA, but the MCP server is at 0.16 and its place_details_tool calls the Places API Details endpoint, which Mapbox still labels Public Preview with a contract subject to change (7). 20+20+15+10+10+7 = 82.

Geocodio 80

API reading. limit, opt-in fields appends and stable_address_key re-lookups size responses and cost, and results are ordered best first (20). Batches of 10,000 lookups, Lists for 10 million, distance filters (max_distance, max_results, order_by) and paginated list listings (17). Codes 403, 422, 429 and 500 each carry a documented meaning and retry rule, error bodies link a help page, and _warnings reports ignored parameters (18). Geocoding reads are safe to retry, but there's no idempotency key on batch or list creation and AGENTS.md says a retried request is billed again (10). One required parameter on a single geocode, and official libraries for Python, Node, PHP and Ruby plus a CLI with --agent output (15). 20+17+18+10+15 = 80.

Mapbox APIs + MCP 88

29 core MCP tools in 0.16.0, still the latest stable release on 1 November, so 15, plus 5 back for --enable-tools and --disable-tools on the local server. The docs don't say the hosted endpoint can filter tools (20). limit, types, bbox and proximity on geocoding, and a v6 batch endpoint (18). Documented status codes with messages an agent can act on, such as 'Query exceeded character limit of 200' (17). Every tool carries readOnlyHint true, destructiveHint false and idempotentHint, and 17 offline geometry tools set openWorldHint false (20). Few required parameters and the server elicits a route choice when the client supports it. Since 0.16.0 large directions and isochrone results return a short ref that any server process can answer, and descriptions no longer tell the model to avoid other tools or web search. Official SDKs are JavaScript and the mobile SDKs, with no current official Python client that we found (13).

Geocodio 92

OpenAPI 3.0.1 spec, version 2.1.0, with 11 paths (25). llms.txt and an AGENTS.md written for agents (10). llms.txt and AGENTS.md say when to use each endpoint and when not to, such as the Lists API over looping single calls, the upload tool for a one-off spreadsheet and straightline over driving distance unless road distance is needed (19). Typed parameters with country values, component fields and documented limits, though fields is a comma-separated string (12). Error table with retry guidance, examples throughout, but the spec documents 200, 400, 403, 404, 422 and 424 and not 429 or 500 (11). Versioned paths from v1 to v2.1 and a dated public changelog with entries back to 2024 (15). 25+10+19+12+11+15 = 92.

Mapbox APIs + MCP 85

No public OpenAPI for the REST APIs, but every MCP tool has a typed Zod input and output schema, published as JSON Schema 2020-12 since 0.15.0 (8 October) (20). llms.txt at docs.mapbox.com, re-read on 1 November (10). MCP descriptions say when not to use a tool, for example search_and_geocode_tool sends generic place types to category_search_tool and warns that big-box brand plus address queries are unreliable (17). Zod limits and enums, such as q capped at 200 characters after the team found the API rejects 201 (13). An error table per API with 401, 403, 404, 422 and 429 messages, and curl examples throughout (13). Versioned paths (geocode v6) and a dated MCP CHANGELOG.md, but the top-level API changelog's newest entry is still 5 November 2021, current changes sit in per-service pages, and the MCP guide on docs.mapbox.com still says v0.12.0 on 1 November (12).