Geocodio vs TomTom Maps APIs + MCP

Geocodio 70

Hosted lines. incident.io status page at status.geocod.io with five components (Geocodio API, Dashboard, Enterprise API, Enterprise Dashboard, Website) and an incidents feed at /api/v2/incidents.json (20). In the 90 days to 6 November 2026 the feed lists one incident marked major, 'Spreadsheet geocoding jobs are failing' on 27 October from 12:35 to 15:15 UTC, and a PHP security patch on 21 October marked no impact, so one major outage of a core feature (10). 1,000 requests a minute on single geocoding for pay-as-you-go and Flex, 100 on Enterprise Flex (15). 429 carries X-RateLimit-Remaining, -Limit and -Period, and llms.txt and AGENTS.md give a retry rule per status code with capped backoff, plus client-side idempotency guidance for the non-idempotent list and batch writes (15). The pricing page lists custom SLAs as an add-on on Unlimited and Enterprise plans, with no published terms, so no SLA (0). GA (10). 20+10+15+15+0+10 = 70.

TomTom Maps APIs + MCP 15

TomTom's API status page sits on tomtom.service-now.com, whose robots.txt disallows every path on 4 November, so the earlier status readings are struck (0). With no history we may read, the record scores 5. No published QPS limits or 429 guidance were found on the docs pages we read on 1 October; TomTom's acceptable use policy now bars robots from its websites, so they weren't re-read (0). The MCP maps a 429 to a typed rate-limit error with a message, and we found nothing on Retry-After (5, the earlier partial kept). No SLA found (0). Orbis APIs went GA on 8 July 2026, but the remote MCP server is in public preview and the README says some Orbis and EV services may not be enabled on every account (5, kept). 0+5+0+5+0+5 = 15.

Geocodio 87

Editorial half only. Closed service with clear, dated terms under Virginia law, and libraries and CLI under MIT (20). The privacy policy says API and spreadsheet input and results are deleted within 45 days, error logs kept 90 days, and customer data isn't used to train AI models. A separate data retention policy and llms.txt put Lists API data at 72 hours. Results may be stored permanently by the customer (27). Replaced API versions are guaranteed for at least 12 months, breaking changes come only with a new version, and the changelog marks each one 'Breaking' (18). The privacy policy names its processors, such as Sentry and Laravel Nightwatch, and the security page says self-serve is hosted in Europe (15). 20+27+18+15 = 80.

TomTom Maps APIs + MCP 58

Closed APIs with an Apache-2.0 MCP server. The developer terms page still renders client-side on 4 November, and TomTom's acceptable use policy (linked from its Terms of Use of 1 September 2025) bars data mining, robots and scraping on all TomTom websites, so the privacy and deprecation pages weren't re-read. Licence clarity 10, data handling 11 of 30, deprecation 8 and subprocessors 12 of 20 stand per the 2 October check, not re-read on 4 November. 10+11+8+12 = 41.

Geocodio 92

OpenAPI 3.0.1 spec, version 2.1.0, with 11 paths (25). llms.txt and an AGENTS.md written for agents (10). llms.txt and AGENTS.md say when to use each endpoint and when not to, such as the Lists API over looping single calls, the upload tool for a one-off spreadsheet and straightline over driving distance unless road distance is needed (19). Typed parameters with country values, component fields and documented limits, though fields is a comma-separated string (12). Error table with retry guidance, examples throughout, but the spec documents 200, 400, 403, 404, 422 and 424 and not 429 or 500 (11). Versioned paths from v1 to v2.1 and a dated public changelog with entries back to 2024 (15). 25+10+19+12+11+15 = 92.

TomTom Maps APIs + MCP 71

No public OpenAPI that we found. The MCP's tools have Zod schemas with described fields (22). docs.tomtom.com/llms.txt indexes about 180 pages, many as .md, per the 2 October check, not re-read on 4 November (10). Tool descriptions are mostly one line, with little on when not to use a tool (12). Typed fields with constraints, and since 1.6.12 the search, routing and EV tools list their valid values from the maps-sdk (11, kept). We couldn't read the REST error reference. The MCP returns typed errors per status code, and since 1.6.13 tells a 401 from a 403 (8). Versioned REST paths; the MCP CHANGELOG.md has dated entries from 1.6.11 (5 October 2026) to 1.6.14 and says 1.1.1 to 1.6.10 have none (8, kept). 22+10+12+11+8+8 = 71.

Geocodio 40

No x402, MPP or L402 (0). $1 per 1,000 lookups after the free tier, and per-credit rates for every Flex tier, public without login (20). 2,500 lookups a day free with no card until usage passes the free tier (20). Signup and key creation are a browser flow at dash.geocod.io (0). 0+20+20+0 = 40.

TomTom Maps APIs + MCP 25

No x402, MPP or L402 (0). Free allowances are public, but the pricing page re-read on 2 October showed no paid rate as a number, only a euro estimator and a contact-sales link (5 of 20, kept). A no-card free allowance of 20,000 geocodes, 20,000 reverse geocodes and 20,000 routes a month, with Search and Matrix at 2,500 (20). Signup is a browser flow (0). The pricing page is on a host whose acceptable use policy now bars robots, so it wasn't re-read on 4 November. 0+5+20+0 = 25.

Geocodio 58

Revocable keys, five on pay-as-you-go, each with permissions (Lists and Distance off by default), which earns 25. Less 10 because the docs say 'All requests require &api_key=YOUR_API_KEY' and the OpenAPI spec defines only the query scheme, though an Authorization header has worked since March 2025 (15). Per-key permissions limit what a key can reach. DELETE on lists and distance jobs needs no confirmation (13). Results are addresses and government district, census and legislator data rather than user-written text. No prompt-injection guidance found (9). Usage per API key in the dashboard, downloadable as CSV, and billable-lookup headers on every response (8). Valid security.txt to 30 January 2030 with a PGP key and a responsible disclosure policy. SOC 2 Type II and annual penetration tests apply to the Enterprise platform only. No bug bounty found (13). 15+13+9+8+13 = 58.

TomTom Maps APIs + MCP 51

API keys from the developer portal, limited to the products selected for them, which earns 25. Less 10 because REST calls take the key as the key query parameter. The hosted MCP takes a tomtom-api-key header, and the source carries OAuth with an audience check that 1.6.13 made mandatory for OAuth deployments (15). Keys can be limited by product and every tool reads (16). Results include POI names and traffic incident text with no prompt-injection guidance. An app-only tool, tomtom-get-api-key, returns the raw key to the map app; since 1.6.12 clients that render no apps don't receive it (6, kept). We didn't find per-call logs or usage reporting we could read (0). HackerOne disclosure programme with a 3 business day first response in the organisation's SECURITY.md, Veracode scanning in CI, and no security.txt per the 30 September check (14, kept). 15+16+6+0+14 = 51.