Geocodio vs Stadia Maps

Geocodio 58

Revocable keys, five on pay-as-you-go, each with permissions (Lists and Distance off by default), which earns 25. Less 10 because the docs say 'All requests require &api_key=YOUR_API_KEY' and the OpenAPI spec defines only the query scheme, though an Authorization header has worked since March 2025 (15). Per-key permissions limit what a key can reach. DELETE on lists and distance jobs needs no confirmation (13). Results are addresses and government district, census and legislator data rather than user-written text. No prompt-injection guidance found (9). Usage per API key in the dashboard, downloadable as CSV, and billable-lookup headers on every response (8). Valid security.txt to 30 January 2030 with a PGP key and a responsible disclosure policy. SOC 2 Type II and annual penetration tests apply to the Enterprise platform only. No bug bounty found (13). 15+13+9+8+13 = 58.

Stadia Maps 40

Revocable keys per property with rotation through the Account Management API and a header option (Authorization: Stadia-Auth), which earns 25. Less 10 because api_key in the query string is a documented option (the authentication page re-read on 2 November calls it the simplest) and the OpenAPI document defines only that scheme (15). The APIs only read, but keys aren't scoped to particular APIs (12). Results carry OpenStreetMap names, websites and opening hours, which are community-edited text, and we found no prompt-injection guidance (7). Dashboard usage and billing threshold alerts added on 20 August 2026 (6). stadiamaps.com/.well-known/security.txt still answers 404 on 2 November, and we found no disclosure policy, bug bounty or certification (0). 15+12+7+6+0 = 40.

Geocodio 87

Editorial half only. Closed service with clear, dated terms under Virginia law, and libraries and CLI under MIT (20). The privacy policy says API and spreadsheet input and results are deleted within 45 days, error logs kept 90 days, and customer data isn't used to train AI models. A separate data retention policy and llms.txt put Lists API data at 72 hours. Results may be stored permanently by the customer (27). Replaced API versions are guaranteed for at least 12 months, breaking changes come only with a new version, and the changelog marks each one 'Breaking' (18). The privacy policy names its processors, such as Sentry and Laravel Nightwatch, and the security page says self-serve is hosted in Europe (15). 20+27+18+15 = 80.

Stadia Maps 76

Closed service with clear terms, last updated 18 March 2026, a BSD-3-Clause MCP server and open-source SDKs (20). Server logs kept about 7 to 14 days, account data deleted within 30 days of closure, a DPA, and per-plan storage rules spelt out. The privacy policy was updated 1 October 2026 (28). No deprecation policy. The terms promise 30 days' notice for fee increases and reasonable efforts for other material changes (6). Third-party processors listed with locations in the privacy policy, and hosting described as primarily US (18). 20+28+6+18 = 72.

Geocodio 70

Hosted lines. incident.io status page at status.geocod.io with five components (Geocodio API, Dashboard, Enterprise API, Enterprise Dashboard, Website) and an incidents feed at /api/v2/incidents.json (20). In the 90 days to 6 November 2026 the feed lists one incident marked major, 'Spreadsheet geocoding jobs are failing' on 27 October from 12:35 to 15:15 UTC, and a PHP security patch on 21 October marked no impact, so one major outage of a core feature (10). 1,000 requests a minute on single geocoding for pay-as-you-go and Flex, 100 on Enterprise Flex (15). 429 carries X-RateLimit-Remaining, -Limit and -Period, and llms.txt and AGENTS.md give a retry rule per status code with capped backoff, plus client-side idempotency guidance for the non-idempotent list and batch writes (15). The pricing page lists custom SLAs as an add-on on Unlimited and Enterprise plans, with no published terms, so no SLA (0). GA (10). 20+10+15+15+0+10 = 70.

Stadia Maps 63

Instatus page with 27 components across maps, routing, geocoding and data APIs, plus RSS and Atom history back to April 2025 (20). One incident in the 90 days to 2 November (history feed re-read on 2 November), on 25 September 2026, when a software update on edge nodes caused elevated request errors "in the initial deployment regions" across 24 listed components from 10:20 to 10:22 UTC before it was rolled back. Limited to some regions and two minutes, so minor (20). The FAQ says there's no fixed requests-a-second limit and the cap is the monthly credit pool, with credits per call published (12). A 429 is what you get when credits run out until the next cycle, with no Retry-After and no backoff guidance, so an agent can't tell a spent month from a burst (3). No SLA. The terms say the service is provided as is (0). The APIs are GA, but the MCP server has no release (8). 20+20+12+3+0+8 = 63.

Geocodio 92

OpenAPI 3.0.1 spec, version 2.1.0, with 11 paths (25). llms.txt and an AGENTS.md written for agents (10). llms.txt and AGENTS.md say when to use each endpoint and when not to, such as the Lists API over looping single calls, the upload tool for a one-off spreadsheet and straightline over driving distance unless road distance is needed (19). Typed parameters with country values, component fields and documented limits, though fields is a comma-separated string (12). Error table with retry guidance, examples throughout, but the spec documents 200, 400, 403, 404, 422 and 424 and not 429 or 500 (11). Versioned paths from v1 to v2.1 and a dated public changelog with entries back to 2024 (15). 25+10+19+12+11+15 = 92.

Stadia Maps 86

Public OpenAPI 3.1.0 document at api.stadiamaps.com/openapi.yaml, version 11.1.0 (re-read on 2 November), from which the TypeScript and Python SDKs are generated (25). llms.txt at docs.stadiamaps.com, re-read on 2 November (10). The MCP's six tool descriptions say when not to use a tool, for example bulk-geocode warns against POI names (14). Zod inputs with minimums such as at least two route locations, but some fields are loose strings (12). Docs examples per endpoint. We didn't read an error reference (10). A dated public changelog with 14 entries between 12 August and 26 October 2026 and a Keep a Changelog file in each SDK (15). 25+10+14+12+10+15 = 86.

Geocodio 86

API v2.1 released 3 November 2026 (Australia and New Zealand), and PHP library 3.4.1 on 4 November (30). Dated changelog entries on 8 September, 1, 8, 9, 19, 22 and 31 October and 3 November 2026, plus library releases in October (20). Public changelog, support by email and a team-staffed help desk named on the pricing page. We didn't read GitHub issue reply times (12). Official Python 1.6.0 and Node 2.3.0 from 12 October and PHP 3.4.1 from 4 November are current (15). Each library and the CLI run CI on GitHub Actions; we didn't check whether the runs pass (9). 30+20+12+15+9 = 86.

Stadia Maps 80

Changelog entry on 26 October 2026, a forward geocoding fix for Unicode edge cases (30). 14 dated changelog entries between 12 August and 26 October 2026, among them the 20 October Static Maps rebuild and the 17 October geocoding data release (20). A public changelog and support desk, but the MCP repo's last commit is still 29 July 2025 on 2 November (10). Official TypeScript SDK v9.1.0 and Python SDK v8.1.0, both tagged 27 April 2026 and still the newest tags (15). SDK CI runs integration tests against the live API, but the MCP server has no CI, no tagged release, no npm package and no registry entry (5). 30+20+10+15+5 = 80.