Layerre vs Pixelixe

Layerre 78

@layerre/mcp-server 0.1.0 published to npm on 29 October 2026, 8 days before this check (30). MCP server commits from 19 to 24 October, the registry entry of 29 October, and What's New entries dated 21 August and 18 October in the sitemap (20). The repository is a week old with no issues to judge; support by email and in-app chat (5 of 25). com.layerre/layerre is in the official MCP registry under a domain-verified namespace (15). CI runs the vitest suite on push and pull requests to main on Node 22 (8 of 10). 30 + 20 + 5 + 15 + 8 = 78.

Pixelixe 19

No dated release or API change was found. The newest dated items are the MCP registry entry of 26 March 2026 and the privacy policy of 7 April 2026, more than 180 days before this check (0). No three dated changes since 8 August (0). No changelog. Support by email at inquiries@pixelixe.com, not tested (4 of 15). com.pixelixe/pixelixe-mcp is in the official MCP registry under a domain-verified namespace; there are no official SDKs (15). No public package or repository (0). 0 + 0 + 4 + 15 + 0 = 19.

Layerre 42

Hosted lines, for the REST API and the hosted MCP server. No status page found on the site, in llms.txt or in the docs (0). No readable incident history (5). Rate limits published as 10 requests a second, a 20-request burst and 600 a minute per IP address (15). A 429 carries Retry-After and a retry_after field, and the docs give retry code samples. No idempotency key or safe-retry note for variant creation, which spends renders (12 of 15). No SLA found (0). Neither surface is labelled beta, though both are at version 0.1.0 (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.

Pixelixe 15

Hosted lines. No status page found on the site or in the docs (0). No readable incident history (5). No rate limit is published; the terms only forbid circumventing them (0). No 429, Retry-After or backoff guidance. Every error, a wrong key and exhausted credits included, is a 400 with a message (0). No SLA found; the terms supply the service as is (0). API v2 is current and not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Layerre 63

The MCP server is MIT. The service is closed under terms of 13 August 2026 that name a sole proprietorship in Ontario (20 of 30). The privacy policy and DPA of the same date agree. Data is kept while the account is active and deleted from production on account deletion, with limited backups. Design files aren't used to train public AI models. Google Analytics runs on accepted cookies (24 of 30). No deprecation policy or notice period (0). Ten subprocessors listed with purpose and location in both documents, including Supabase, Stripe, Cloudflare, Google, Resend, Canva and Slack (20). 20 + 24 + 0 + 20 = 64.

Pixelixe 41

Closed service under terms of 19 March 2026 that choose French law but name no company (12 of 30). The privacy policy of 7 April 2026 keeps account data while the account is active and 'as long as reasonably necessary' after, with no periods, and says nothing about AI processing or training (10 of 30). V1 is marked deprecated in the docs with no dates or notice period (5 of 20). Processors are described only by category, with Google Analytics named, and data processed in France, the EEA and other vendor countries (5 of 20). 12 + 10 + 5 + 5 = 32.

Layerre 87

Public OpenAPI 3.1 at layerre.com/openapi.json with 16 operations, and zod schemas on all 13 MCP tools in the open-source server (25). llms.txt, auth.md and Markdown mirrors of the pricing, FAQ and integration pages (10). Every operation has a description, and tool descriptions note costs such as 'an expensive operation that may take 10-30 seconds', without saying when not to use a tool (15 of 20). Layer properties have minimums, maximums and enums such as text_align, and list calls cap limit at 1,000 (14 of 15). 88 examples in the spec, and 404, 422 and 429 responses documented on most operations (13 of 15). Versioned /v1 paths and dated What's New pages, read from the sitemap since the pages are drawn by script; the API itself is version 0.1.0 (10 of 15). 25 + 10 + 15 + 14 + 13 + 10 = 87.

Pixelixe 66

OpenAPI 3.1 (version 2.0.0) at pixelixe.com/pixelixe-openapi.json, but it covers four endpoints, authentication, document search, graphic automation and photo effects, and leaves out the JSON-to-graphic and image processing APIs (18 of 25). llms.txt exists but routes readers to marketing pages; the MCP reference is written for LLMs (7 of 10). The MCP reference says what each of the seven tools maps to, that pixelixe_generate_graphic_variant 'is not a free-form layout API', lists common mistakes and how to present outputs (17 of 20). The MCP layer documents canonical field names and refuses legacy aliases; the REST modifications are open structures keyed by element name (10 of 15). Request examples throughout, but errors are one table of message strings all returning 400 (8 of 15). /v2 paths and a deprecated V1, with no changelog (6 of 15). 18 + 7 + 17 + 10 + 8 + 6 = 66.

Layerre 69

13 MCP tools (15 for 11 to 30), with no toolsets or read-only subset (15). Template and variant lists take skip and limit, and templates filter by tag and q and can leave out layers (16 of 20). 422 validation bodies and a JSON 429 with retry_after (17 of 20). Every tool is annotated, read tools with readOnlyHint and idempotentHint, updates idempotent, no tool destructive, and the server has no delete tool. The REST API has no idempotency keys for variant creation (16 of 20). Few required fields, but no official SDK; a Postman collection and the MCP package only (5 of 15). 15 + 16 + 17 + 16 + 5 = 69.

Pixelixe 49

Seven compact MCP tools (25). Document and design-set search filters, with no pagination documented (10 of 20). All errors are 400 with free-text messages, so an agent can't branch on a code (6 of 20). No idempotency keys, and annotations couldn't be read on the closed server. The MCP tools only read and create, with nothing that deletes (5 of 20). Few required fields, but no official SDK (3 of 15). 25 + 10 + 6 + 5 + 3 = 49.

Layerre 48

OAuth 2.1 with PKCE for MCP through a Supabase authorisation server, and revocable lyr_ API keys with rotation in the dashboard. No scopes documented for either, and auth.md says the REST API has no OAuth yet (22 of 30). The MCP server cannot delete templates, change billing or manage API keys, but there is no read-only key or endpoint (12 of 20). Tools return the user's own templates and renders; template import fetches a Canva link the user gives (10 of 15). The open-source server emits audit log lines for each tool call for whoever runs it, and nothing per call is documented for the hosted service (4 of 15). No security.txt (the path returns the site's HTML shell), disclosure policy, bug bounty or certification (0). 22 + 12 + 10 + 4 + 0 = 48.

Pixelixe 38

A bearer API key per account, plus a public key for the embedded editor. The MCP server accepts the key or an OAuth token from studio.pixelixe.com/oauth/mcp with one pixelixe.mcp scope. No key scopes, rotation or revocation documented (18 of 30). No read-only mode, though the MCP tools can't delete or change account settings (10 of 20). Tools return the account's own templates and renders (10 of 15). No audit log or per-call record documented (0). No security.txt, disclosure policy, bug bounty or certification found (0). 18 + 10 + 10 + 0 + 0 = 38.