Google Maps Platform + Grounding Lite MCP vs MapTiler Cloud

Google Maps Platform + Grounding Lite MCP 90

Google Cloud's status dashboard has a Maps Platform section with per-product incident history and a JSON feed, re-read on 1 November (20). The 26 July traffic-data incident has left the 90-day window (cause time). Four incidents since 3 August. Directions, Distance Matrix and Routes had elevated errors and latency from 18:56 to 20:40 UTC on 19 October. Reverse-geocoding requests to the Geocoding API resolved to an address in Vietnam from 02:40 to 04:42 UTC on 23 October, which Google labels an outage, and some street results came back with incomplete or wrongly localised addresses from 25 October, resolved by 30 October with data restoration still running. A Maps SDK for Android crash on some Adreno GPUs on 28 September isn't on this listing's surfaces. Each touches one product, one group of products or some requests, so each is partial and read as minor, as this run reads Google's dashboard on google-speech-to-text and google-cloud-document-ai (20). Grounding Lite (now Maps Experience agent tools) quotas are 300 queries a minute per project for search, weather and routes and 600 for the resolvers, per the 1 October check, not re-read on 1 November (15). The Geocoding best-practice page gives exponential backoff with a worked example, 100 ms doubling to 5 s, and says which status codes to retry, per the 1 October check (15). A 99.9 per cent monthly SLA with 10, 25 and 50 per cent credits, re-read on 1 November (10). Places (New), Routes and the agent tools' Essentials SKU are GA; the Pro SKU is in Restricted GA (10). 20 + 20 + 15 + 15 + 10 + 10 = 90.

MapTiler Cloud 43

Hosted lines. status.maptiler.com is a StatusCake public uptime report rather than a component incident page (15). Its data loads from app.statuscake.com, whose robots.txt answered with a redirect, so we didn't fetch it and read no history. That's our limit, not a finding, and the rubric gives 5 (5). Monthly request and session quotas are published per plan, but no per-second limit (5). No 429, Retry-After or backoff guidance found in the API reference, the OpenAPI spec or llms-full.txt (0). The pricing page lists a 99.9% SLA on the Custom plan, while the Cloud terms call availability best effort and point to a custom SLA (8). The public APIs are GA (10). 15+5+5+0+8+10 = 43.

Google Maps Platform + Grounding Lite MCP 85

Grounding Lite has three tools plus two experimental resolvers, and the REST APIs size their responses with X-Goog-FieldMask, which also sets the price (25). pageSize and pageToken on Text Search, includedTypes, locationBias and locationRestriction (20). google.rpc status codes with messages, and Geocoding's OK, UNKNOWN_ERROR, OVER_QUERY_LIMIT and INVALID_REQUEST split into retryable and not (16). Every agent-facing call is a read and the backoff guidance is explicit. We couldn't check MCP annotations on the closed server (14). Official generated clients in many languages, such as @googlemaps/places 3.0.1 on npm, but a missing field mask on Places (New) or Routes is an error rather than a default, which costs a turn (10).

MapTiler Cloud 70

API reading. limit, types, bbox, proximity, country, language and fuzzyMatch size geocoding results, and the batch endpoint takes up to 50 queries (20). Country, bbox and type filters, no pagination (geocoding rarely needs it) (16). Errors are documented as 400 and 403 with no recovery guidance (10). Every public API reads and is safe to retry (12). Few required parameters, but official clients are JavaScript and TypeScript only, plus native mobile SDKs (12). 20+16+10+12+12 = 70.

Google Maps Platform + Grounding Lite MCP 80

Newest dated API change is the Routes API note of 23 October 2026 on route tokens passed to the Navigation SDK, 9 days before this check (30). Three dated release-note entries in the 90 days from 3 August, Places API (New) on 6 August (entrances and navigation points), Geocoding API on 13 October (entrance display names and Experimental parking facilities) and Routes API on 23 October. The listed googlemaps Python client and Node services library tagged nothing in the window (20). Dated release notes, emailed change notices and a paid support route (12). Current generated clients such as @googlemaps/places, but the listed Python library googlemaps last tagged v4.10.0 on 26 January 2023 and its README now sends new APIs to the Cloud client libraries, and the Node services library last tagged v3.4.2 on 6 July 2025 (12). The generated clients are built in googleapis' CI. The older libraries say they sit outside the SLA and deprecation policy (6). 30 + 20 + 12 + 12 + 6 = 80.

MapTiler Cloud 70

@maptiler/client 3.1.0 and @maptiler/sdk 4.2.0 on 2 October 2026, 35 days before this check, with the agent skill updated on 21 October (20). Platform updates entries for August (EU endpoint, key security) and September 2026 (terrain blending) plus the two October releases (20). A Discord community and support answered on a best-effort basis within two business days, per the Cloud terms. We didn't read GitHub issues (10). Official JavaScript client and SDK current, no Python client (12). The SDK repository runs unit and end-to-end tests in CI; we didn't check results (8). 20+20+10+12+8 = 70.

Google Maps Platform + Grounding Lite MCP 73

API keys with API restrictions and IP restrictions, documented rotation with an overlap window, and OAuth 2.0 with per-method scopes (such as maps-platform.places.textsearch in the Places discovery document) and the maps-platform.mapstools scope for the agent tools, which earns 30. Less 10 because a credential can travel in the URL. Classic Geocoding and Static Maps take the key as the key query parameter, and on 1 November Places API (New) answered a made-up ?key= with API_KEY_INVALID and a made-up ?access_token= with 401 invalid credentials (not missing), with both listed as query parameters in its discovery document. That's one deduction, the same test and reading as google-weather-api and gmail-api (20). A key can be restricted to the APIs it needs, and no agent-facing call writes anything (16). Places and the agent tools return reviews and AI-generated place summaries, which are third-party text, and we found no prompt-injection guidance (5). Cloud Monitoring's Metrics Explorer shows usage per key and per API (12). google.com's security.txt is valid to 1 April 2030 and names the vulnerability reward programme, and the Maps Platform trust centre lists ISO/IEC 27001:2022 and 27017, SOC 2 and SOC 3, both read on 1 November. Read as Google's hosted APIs whose product a certification names are read in this run (gmail-api, google-drive-api, google-cloud-document-ai, google-model-armor, google-speech-to-text) (20). 20 + 16 + 5 + 12 + 20 = 73.

MapTiler Cloud 64

Revocable keys that can be limited to origins and a User-Agent substring and managed by the API keys API, and service tokens that sign requests so the token itself never travels, which earns 27. Less 10 because the key is 'always passed as a query parameter' (17). The public APIs are read-only, and account changes need a separate service token (16). Geocoding returns OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). An Analytics API and account usage statistics (8). security.txt, a vulnerability disclosure policy and ISO/IEC 27001:2022 certification per the security page. No bug bounty found (16). 17+16+7+8+16 = 64.

Google Maps Platform + Grounding Lite MCP 72

Closed service with long, specific terms that were last modified 26 August 2026, and Apache-2.0 client libraries (18). The service terms spell out caching (coordinates 30 days, place IDs exempt, a per-user geocode cache allowed) and Grounding Lite says Maps content isn't cached, stored or used to improve the model. The privacy policy is Google's general one (22). A 12-month deprecation policy and a deprecations page with dates, such as the Heatmap Layer deprecated May 2025 and gone May 2026 (20). Separate EEA terms and regional contracting entities are disclosed. A Maps Platform subprocessor list wasn't at the URL we tried (5).

MapTiler Cloud 80

Editorial half only. Closed service with general and Cloud-specific terms under Swiss law, and SDKs under BSD 3-Clause and the skill under MIT (20). The privacy policy covers account and payment data and says legal-claim data is kept up to 10 years, but says nothing about how long API request logs are kept (15). A dated deprecation page for v3 maps and migration guides, with no written notice period (12). Hosting with OVHcloud and Google Firebase, data mainly in Switzerland and the EEA, and an EU-only endpoint. Google Analytics, Firebase and FastSpring named in the privacy policy (17). 20+15+12+17 = 64.