Google Maps Platform + Grounding Lite MCP vs NextBillion.ai

Google Maps Platform + Grounding Lite MCP 90

Google Cloud's status dashboard has a Maps Platform section with per-product incident history and a JSON feed, re-read on 1 November (20). The 26 July traffic-data incident has left the 90-day window (cause time). Four incidents since 3 August. Directions, Distance Matrix and Routes had elevated errors and latency from 18:56 to 20:40 UTC on 19 October. Reverse-geocoding requests to the Geocoding API resolved to an address in Vietnam from 02:40 to 04:42 UTC on 23 October, which Google labels an outage, and some street results came back with incomplete or wrongly localised addresses from 25 October, resolved by 30 October with data restoration still running. A Maps SDK for Android crash on some Adreno GPUs on 28 September isn't on this listing's surfaces. Each touches one product, one group of products or some requests, so each is partial and read as minor, as this run reads Google's dashboard on google-speech-to-text and google-cloud-document-ai (20). Grounding Lite (now Maps Experience agent tools) quotas are 300 queries a minute per project for search, weather and routes and 600 for the resolvers, per the 1 October check, not re-read on 1 November (15). The Geocoding best-practice page gives exponential backoff with a worked example, 100 ms doubling to 5 s, and says which status codes to retry, per the 1 October check (15). A 99.9 per cent monthly SLA with 10, 25 and 50 per cent credits, re-read on 1 November (10). Places (New), Routes and the agent tools' Essentials SKU are GA; the Pro SKU is in Restricted GA (10). 20 + 20 + 15 + 15 + 10 + 10 = 90.

NextBillion.ai 45

Hosted lines, for the REST APIs at api.nextbillion.io and the hosted MCP server. A status page at status.nextbillion.io, 'NextBillion.AI API Status', renders only in a browser, and its Statuspage-style JSON paths return 404, so we couldn't see its components (10) or read any history. That's our limit, not a finding, and the rubric gives 5 (5). The API reference states 2,400 queries a minute, or 40 a second, for continuous requests (15). Each endpoint's error table lists 429 as 'QPM or API request count quota reached', with no Retry-After or backoff guidance (5). No SLA found; the terms say access isn't warranted to be uninterrupted (0). The REST APIs are GA. The MCP server is at version 0.5.3 (10). 10+5+15+5+0+10 = 45.

Google Maps Platform + Grounding Lite MCP 73

API keys with API restrictions and IP restrictions, documented rotation with an overlap window, and OAuth 2.0 with per-method scopes (such as maps-platform.places.textsearch in the Places discovery document) and the maps-platform.mapstools scope for the agent tools, which earns 30. Less 10 because a credential can travel in the URL. Classic Geocoding and Static Maps take the key as the key query parameter, and on 1 November Places API (New) answered a made-up ?key= with API_KEY_INVALID and a made-up ?access_token= with 401 invalid credentials (not missing), with both listed as query parameters in its discovery document. That's one deduction, the same test and reading as google-weather-api and gmail-api (20). A key can be restricted to the APIs it needs, and no agent-facing call writes anything (16). Places and the agent tools return reviews and AI-generated place summaries, which are third-party text, and we found no prompt-injection guidance (5). Cloud Monitoring's Metrics Explorer shows usage per key and per API (12). google.com's security.txt is valid to 1 April 2030 and names the vulnerability reward programme, and the Maps Platform trust centre lists ISO/IEC 27001:2022 and 27017, SOC 2 and SOC 3, both read on 1 November. Read as Google's hosted APIs whose product a certification names are read in this run (gmail-api, google-drive-api, google-cloud-document-ai, google-model-armor, google-speech-to-text) (20). 20 + 16 + 5 + 12 + 20 = 73.

NextBillion.ai 46

The REST APIs take a single key query parameter, so a plain key that travels in URLs, which earns 20 less 10. The MCP server adds OAuth 2.1 with PKCE, seals the key into tokens with AES-256-GCM, accepts a Bearer header and stores nothing server-side, so 5 back (15). Every tool is read-only, and keys can carry an IP allowlist (12). Places results are POI and address text with no prompt-injection guidance (7). Usage alerts at 50, 75 and 90 per cent of credits, per the pricing FAQ. No per-call log found (5). /.well-known/security.txt returns 404, and we found no disclosure policy or bug bounty. The about page says the company follows ISO 27001 standards, without naming a certificate (7). 15+12+7+5+7 = 46.

Google Maps Platform + Grounding Lite MCP 40

No x402, MPP or L402 (0). Per-1,000 prices for every SKU published without login, re-read on 1 November (20). Monthly free caps per SKU (10,000 Essentials, 5,000 Pro, 1,000 Enterprise) need a Cloud billing account, but the Maps Demo Key lets a personal Google account prototype with Places API (New), Geocoding API v4, Compute Routes, Weather and the agent tools without billing information, within daily limits, so a trial with no card exists (20). A person still signs in to a Google account and accepts terms in a browser before the first key exists (0). 0 + 20 + 20 + 0 = 40.

NextBillion.ai 20

No x402, MPP or L402 (0). Pricing is by quote, with annual licences per order, asset or API call and no published unit price (0). A 7-day free trial with an API key and 'No credit card required' (20). A person signs up through the console or emails support for a key (0). 0+0+20+0 = 20.

Google Maps Platform + Grounding Lite MCP 72

Closed service with long, specific terms that were last modified 26 August 2026, and Apache-2.0 client libraries (18). The service terms spell out caching (coordinates 30 days, place IDs exempt, a per-user geocode cache allowed) and Grounding Lite says Maps content isn't cached, stored or used to improve the model. The privacy policy is Google's general one (22). A 12-month deprecation policy and a deprecations page with dates, such as the Heatmap Layer deprecated May 2025 and gone May 2026 (20). Separate EEA terms and regional contracting entities are disclosed. A Maps Platform subprocessor list wasn't at the URL we tried (5).

NextBillion.ai 58

Editorial half only. Closed service under terms that name NextBillion.ai Pte. Ltd. and Singapore law, and an Apache-2.0 MCP server (18). The privacy policy keeps personal data while a legitimate business need exists, with no periods given. The MCP README says only tool arguments are sent to the API and nothing is retained between requests (14). No deprecation policy or dated notices found. The terms promise 10 days' notice of material changes to the terms (3). Data is mainly processed in Singapore, with transfers abroad under standard clauses. No sub-processor list found (8). 18+14+3+8 = 43.

Google Maps Platform + Grounding Lite MCP 85

Grounding Lite has three tools plus two experimental resolvers, and the REST APIs size their responses with X-Goog-FieldMask, which also sets the price (25). pageSize and pageToken on Text Search, includedTypes, locationBias and locationRestriction (20). google.rpc status codes with messages, and Geocoding's OK, UNKNOWN_ERROR, OVER_QUERY_LIMIT and INVALID_REQUEST split into retryable and not (16). Every agent-facing call is a read and the backoff guidance is explicit. We couldn't check MCP annotations on the closed server (14). Official generated clients in many languages, such as @googlemaps/places 3.0.1 on npm, but a missing field mask on Places (New) or Routes is an error rather than a default, which costs a turn (10).

NextBillion.ai 77

MCP reading, since the hosted server is the agent surface. 27 tools, four of them for documentation and seven local geometry tools, with shapes simplified to a 500-vertex budget to save context (18). limit, types, country, bbox and circle filters, and batch geocoding of up to 100 queries (16). The error table explains each code, and the MCP masks the key in error text (15). Every API tool is marked readOnlyHint, idempotentHint and not destructive in the source (18). Few required parameters and explicit latitude and longitude objects, but no official server-side SDK, only mobile and web map SDKs (10). 18+16+15+18+10 = 77.

Google Maps Platform + Grounding Lite MCP 80

Newest dated API change is the Routes API note of 23 October 2026 on route tokens passed to the Navigation SDK, 9 days before this check (30). Three dated release-note entries in the 90 days from 3 August, Places API (New) on 6 August (entrances and navigation points), Geocoding API on 13 October (entrance display names and Experimental parking facilities) and Routes API on 23 October. The listed googlemaps Python client and Node services library tagged nothing in the window (20). Dated release notes, emailed change notices and a paid support route (12). Current generated clients such as @googlemaps/places, but the listed Python library googlemaps last tagged v4.10.0 on 26 January 2023 and its README now sends new APIs to the Cloud client libraries, and the Node services library last tagged v3.4.2 on 6 July 2025 (12). The generated clients are built in googleapis' CI. The older libraries say they sit outside the SLA and deprecation policy (6). 30 + 20 + 12 + 12 + 6 = 80.

NextBillion.ai 73

MCP server 0.5.3 on 30 October 2026 (30). Eleven tagged MCP releases between 7 October and 30 October, adding hosted mode, truck routing and geometry tools (20). Support by email, a public MCP repository with a changelog, but no public API changelog (8). The MCP server isn't in the official MCP registry, and we didn't check the mobile SDK versions (7). The MCP repository runs CI with unit and end-to-end tests (8). 30+20+8+7+8 = 73.