HERE Location Services vs NextBillion.ai

HERE Location Services 45

HERE's changelogs sit on docs.here.com, paused under the acceptable use policy, so entries after 9 October are unread. On the 9 October reading the newest dated entries are Matrix Routing 8.49.0 on 9 September 2026 (a documentation change) and Routing 8.162.0 on 7 September 2026, 58 days before this check (20). From 6 August only Routing 8.161.0 (11 August) and 8.162.0 (7 September) fall in the window, with the Matrix documentation change at half, 2.5 in all and short of three (0, cause time; 8.160.0 of 16 July has left the window). Changelogs are public for each API, and paid support plans state response times from 72 hours down to 4 (10 of 15). HERE's GitHub repositories, read as a third-party host, show the HERE SDK for Android, iOS and Flutter current, with example apps tagged for releases 4.27.2.0 (17 August), 4.27.3.0 (3 September), 4.28.0.0 (1 October) and 4.28.1.0 (2 November 2026), and their search and routing engines are the SDKs the ergonomics note credits. The Python client for the REST APIs has carried a deprecation notice since 5 September 2023. These SDK releases aren't counted on the release lines, because their release notes sit on HERE's paused pages and nothing read shows them changing the location services (15; the 5 carried isn't a checklist value). Package health isn't visible for a closed service, and the SDK examples repository has no CI workflow (0; the 5 carried isn't a checklist value). 20+0+10+15+0 = 45.

NextBillion.ai 73

MCP server 0.5.3 on 30 October 2026 (30). Eleven tagged MCP releases between 7 October and 30 October, adding hosted mode, truck routing and geometry tools (20). Support by email, a public MCP repository with a changelog, but no public API changelog (8). The MCP server isn't in the official MCP registry, and we didn't check the mobile SDK versions (7). The MCP repository runs CI with unit and end-to-end tests (8). 30+20+8+7+8 = 73.

HERE Location Services 0

Readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). No x402, MPP or L402 was found in the docs index or the terms (0). The Base Plan price page is public, but its table is drawn by script and showed no prices to our reader, so per-request prices score as absent, a limit of our reading and not a finding that prices are hidden (0). HERE's docs say a new organisation can get started for free, but whether a card is asked for was not established, so the free-tier line can't be credited (0; the 10 carried isn't a checklist value). Sign-up is a browser flow with email verification (0). Support plans are priced in public, from $50 a month for the Developer plan. 0+0+0+0 = 0.

NextBillion.ai 20

No x402, MPP or L402 (0). Pricing is by quote, with annual licences per order, asset or API call and no published unit price (0). A 7-day free trial with an API key and 'No credit card required' (20). A person signs up through the console or emails support for a key (0). 0+0+20+0 = 20.

HERE Location Services 65

All readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). Credentials are API keys, OAuth 2.0 client credentials and OAuth 2.1 private_key_jwt with a registered JWK, where the private key stays with the customer. Tokens are short-lived and can be scoped to a project, and an app holds two API keys or two JWKs for rotation (30). Less 10 because the documented API key method is the apiKey query parameter (20). The location services only read. Trusted domains limit where a key works, and app credentials do not inherit the user's permissions (15 of 20). Results carry place names from third-party sources. The Location Reasoning examples load a guardrails://location-reasoning-usage-policy resource and a hlr___secure_location_reasoning prompt, whose text was not read (7 of 15). A Usage API reports billable usage by app and project. Per-call logs were not found (6 of 15). ISO/IEC 27001:2022, 27701, 27017, 27018 and 42001 certificates, SOC 2 Type 2 scoped to Platform Foundation and Workspace, TISAX AL3 and CSA STAR Level 2 are listed. A disclosure policy of 13 July 2023 names security@here.com with a 90-day window. No bug bounty and no security.txt were found (17 of 20). Total 65.

NextBillion.ai 46

The REST APIs take a single key query parameter, so a plain key that travels in URLs, which earns 20 less 10. The MCP server adds OAuth 2.1 with PKCE, seals the key into tokens with AES-256-GCM, accepts a Bearer header and stores nothing server-side, so 5 back (15). Every tool is read-only, and keys can carry an IP allowlist (12). Places results are POI and address text with no prompt-injection guidance (7). Usage alerts at 50, 75 and 90 per cent of credits, per the pricing FAQ. No per-call log found (5). /.well-known/security.txt returns 404, and we found no disclosure policy or bug bounty. The about page says the company follows ISO 27001 standards, without naming a certificate (7). 15+12+7+5+7 = 46.

HERE Location Services 89

All readings per the 9 October check, not re-read on 4 November, because HERE's hosts are paused under its acceptable use policy. Each endpoint page has a Markdown twin holding an OpenAPI 3.0.0 definition, read for /geocode at version 7.157 (25). docs.here.com has a site llms.txt and one for each product and section (10). Endpoint descriptions state the purpose, and parameter descriptions are long, with ALPHA, BETA and RESTRICTED maturity tags. Little says when not to use an endpoint (14 of 20). Parameters are typed with 34 enums in the geocode definition, ranges such as limit 1 to 100 and defaults (13 of 15). 400, 405, 429 and 503 share an ErrorResponse schema, and the developer guide has code examples for each endpoint (12 of 15). The Routing v8 changelog is dated by entry up to 8.162.0 on 7 September 2026, with versioned APIs; the Geocoding and Search release notes are numbered without dates. The line lists 15, the nearest value to the 13 carried. The Location Reasoning tool schemas come only from tools/list and were not read. 25+10+14+13+12+15 = 89.

NextBillion.ai 73

No OpenAPI document for the REST APIs was found in llms.txt or the docs. The hosted MCP server's 27 tools are defined with Zod schemas, so they carry typed JSON Schema inputs (15 of 25). llms.txt, llms-full.txt and a Markdown file for each docs page (10). Endpoint pages explain each parameter, and MCP tool descriptions say when not to use a tool, such as the geometry tools being straight-line rather than road distance (16). Parameter tables give types, allowed values and defaults, such as types and limit (default 10), though in packs several filters into one string (12). curl examples and a per-endpoint error table with causes (13). The MCP server has a dated changelog. No API changelog or versioned path was found (7). 15+10+16+12+13+7 = 73.

HERE Location Services 93

All readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). limit sizes geocoding responses (1 to 100, default 20), and show and return parameters add optional blocks only when asked for. The MCP server lists 13 tools, two of them experimental, and passes cached route and isoline IDs between tools so geometry is not returned twice (18 of 25). Filters by country, result type, position and bounding area and a result limit are documented, with no offset or cursor paging for geocoding (20; the 15 carried isn't a checklist value, and filters with a size limit meet the line). Errors carry status, title, code, cause, action and correlationId, and the routing changelog names error codes such as E605502 (20; the 17 carried isn't a checklist value). The location calls are reads and safe to repeat (20; the 14 carried isn't a checklist value; MCP annotations were not read). A geocode needs only q and a credential, and HERE publishes SDKs in JavaScript, Android, iOS and Flutter, for maps rather than as REST clients (15; the 10 carried isn't a checklist value). 18+20+20+20+15 = 93.

NextBillion.ai 77

MCP reading, since the hosted server is the agent surface. 27 tools, four of them for documentation and seven local geometry tools, with shapes simplified to a 500-vertex budget to save context (18). limit, types, country, bbox and circle filters, and batch geocoding of up to 100 queries (16). The error table explains each code, and the MCP masks the key in error text (15). Every API tool is marked readOnlyHint, idempotentHint and not destructive in the source (18). Few required parameters and explicit latitude and longitude objects, but no official server-side SDK, only mobile and web map SDKs (10). 18+16+15+18+10 = 77.

HERE Location Services 55

Graded on the REST APIs (Geocoding and Search v7, Routing v8) with the hosted lines. HERE's acceptable use policy bars data mining and scraping of HERE Materials, websites included, so HERE's hosts were not requested on 4 November and the 9 October readings stand. HERE's docs describe a public status page at status.here.com/status with current status, a status history tab and scheduled maintenance (per the 9 October check, not re-read on 4 November) (20). The page was drawn by script on 9 October and is now paused, so the record from 6 August is unread (5). No rate limit with a number was found in the docs; the Base Plan limits sit on a price page drawn by script (0; the 5 carried isn't a checklist value). The Limits and Quotas page says an exceeded quota returns 429 or 503 and that a surge can be throttled for about 10 minutes, and the OpenAPI definition lists 429, with no Retry-After header or backoff guidance and only reads involved (per the 9 October check, not re-read on 4 November). Documented 429 handling without backoff guidance reads at the line's 10 (the 7 carried isn't a checklist value). Monthly availability targets of 99.9 per cent are published for Geocoding and Search v7 and Routing v8, with service credits for the Essential support plan and above (per the 9 October check, not re-read on 4 November) (10). Both APIs are in the Active lifecycle stage (10). 20+5+0+10+10+10 = 55.

NextBillion.ai 45

Hosted lines, for the REST APIs at api.nextbillion.io and the hosted MCP server. A status page at status.nextbillion.io, 'NextBillion.AI API Status', renders only in a browser, and its Statuspage-style JSON paths return 404, so we couldn't see its components (10) or read any history. That's our limit, not a finding, and the rubric gives 5 (5). The API reference states 2,400 queries a minute, or 40 a second, for continuous requests (15). Each endpoint's error table lists 429 as 'QPM or API request count quota reached', with no Retry-After or backoff guidance (5). No SLA found; the terms say access isn't warranted to be uninterrupted (0). The REST APIs are GA. The MCP server is at version 0.5.3 (10). 10+5+15+5+0+10 = 45.