Layerre vs PostNitro

Layerre 78

@layerre/mcp-server 0.1.0 published to npm on 29 October 2026, 8 days before this check (30). MCP server commits from 19 to 24 October, the registry entry of 29 October, and What's New entries dated 21 August and 18 October in the sitemap (20). The repository is a week old with no issues to judge; support by email and in-app chat (5 of 25). com.layerre/layerre is in the official MCP registry under a domain-verified namespace (15). CI runs the vitest suite on push and pull requests to main on Node 22 (8 of 10). 30 + 20 + 5 + 15 + 8 = 78.

PostNitro 65

CLI 1.6.0 tagged on 1 November 2026, with motion styles, post read and edit and an AI voiceover, against an Embed API release it names (30). CLI 1.3.0 (tagged 19 August), 1.4.1 (29 September), 1.5.0 (7 October) and 1.6.0 (1 November) fall in the 90 days, read from the repository's tags and changelog (20). Closed service with a dated CLI changelog, support by email and in-app chat, and public repositories with few outside contributions to judge replies by (8). No official MCP registry entry could be read, and the server card's ai.postnitro/mcp is a claim (0). The CLI publishes from a GitHub Actions workflow. The Embed SDK was last published on 15 July 2025, per the 14 October check (7). 30 + 20 + 8 + 0 + 7 = 65.

Layerre 87

Public OpenAPI 3.1 at layerre.com/openapi.json with 16 operations, and zod schemas on all 13 MCP tools in the open-source server (25). llms.txt, auth.md and Markdown mirrors of the pricing, FAQ and integration pages (10). Every operation has a description, and tool descriptions note costs such as 'an expensive operation that may take 10-30 seconds', without saying when not to use a tool (15 of 20). Layer properties have minimums, maximums and enums such as text_align, and list calls cap limit at 1,000 (14 of 15). 88 examples in the spec, and 404, 422 and 429 responses documented on most operations (13 of 15). Versioned /v1 paths and dated What's New pages, read from the sitemap since the pages are drawn by script; the API itself is version 0.1.0 (10 of 15). 25 + 10 + 15 + 14 + 13 + 10 = 87.

PostNitro 77

OpenAPI 3.1 document for the Embed API at /.well-known/openapi/embed.json, with 13 operations per the 14 October check and not re-read. The MCP docs now point to a public tool catalogue on the MCP host with every tool's input and output schema, which we didn't request, so the earlier partial is held (20). llms.txt (updated 29 October 2026), llms-full.txt, a docs llms.txt and .md twins (10). The docs state what each tool is for, when not to use PostNitro and the embedPostId and designId split, and the tool count now reads 40 on every page read (15). 24 enums, typed slide objects and per-platform settings with conditional rules per the 14 October check, and unknown keys in settings objects are now refused by name (12). Examples on each page and a full table of validation messages for the Schedule API (13). info.version 1.0.0 with no version in the path and no API changelog. The CLI has a dated Keep a Changelog file with semver (7). 20 + 10 + 15 + 12 + 13 + 7 = 77.

Layerre 48

OAuth 2.1 with PKCE for MCP through a Supabase authorisation server, and revocable lyr_ API keys with rotation in the dashboard. No scopes documented for either, and auth.md says the REST API has no OAuth yet (22 of 30). The MCP server cannot delete templates, change billing or manage API keys, but there is no read-only key or endpoint (12 of 20). Tools return the user's own templates and renders; template import fetches a Canva link the user gives (10 of 15). The open-source server emits audit log lines for each tool call for whoever runs it, and nothing per call is documented for the hosted service (4 of 15). No security.txt (the path returns the site's HTML shell), disclosure policy, bug bounty or certification (0). 22 + 12 + 10 + 4 + 0 = 48.

PostNitro 56

The MCP server runs OAuth 2.1 with PKCE S256, dynamic client registration and a revocation endpoint, but with one broad postnitro scope, per the 14 October reading of its published metadata. Keys are pn- API keys sent in a header, generated in the web app, with no scopes or rotation documented (20). A read-only MCP server URL can't generate, edit, schedule or delete, and the destructive tools are annotated so a client can ask before running them. No read-only API key (14). The MCP docs, and the server when a client connects, say that slide text, names and captions derived from an article or X post are third-party content, never to follow instructions in it or let it choose tools (12). Per-job processing logs come back from the status endpoint. No account audit log was found (3). security.txt, expiring 1 November 2027, names support@postnitro.ai, with no disclosure policy, acknowledgement time, bug bounty or certification found (7). 20 + 14 + 12 + 3 + 7 = 56.

Layerre 25

No x402, MPP or L402 (0). Plan prices are public with render counts, and one import or one variant is one render, so the price a render follows from the plan (about $0.03 on Starter, $0.005 on Pro) without being published per unit (15 of 20). Free plan of 50 renders a month with API access; the pricing page doesn't say whether a card is needed (10 of 20, half as with an unstated card rule). A person signs up and creates the key, or approves OAuth in a browser (0). 0 + 15 + 10 + 0 = 25.

PostNitro 20

No x402, MPP or L402 (0). Credit prices are public without a login at $0.04 a credit, 1 per imported slide and 2 per AI-written slide, with plan prices of $15, $30 and $60 a month (20). The web app has a free plan with no card, but the subscription docs, the MCP docs and llms.txt now agree there is no free API tier, and calls without a paid plan return 402 (0). A person signs up in a browser and generates a key, or approves OAuth in the client. Dynamic client registration removes the key step but not the signup (0). 0 + 20 + 0 + 0 = 20.

Layerre 63

The MCP server is MIT. The service is closed under terms of 13 August 2026 that name a sole proprietorship in Ontario (20 of 30). The privacy policy and DPA of the same date agree. Data is kept while the account is active and deleted from production on account deletion, with limited backups. Design files aren't used to train public AI models. Google Analytics runs on accepted cookies (24 of 30). No deprecation policy or notice period (0). Ten subprocessors listed with purpose and location in both documents, including Supabase, Stripe, Cloudflare, Google, Resend, Canva and Slack (20). 20 + 24 + 0 + 20 = 64.

PostNitro 58

Closed service under Terms of Service last updated 20 May 2024, re-read on 5 November, that cover the APIs, allow changes or discontinuation without notice and take a perpetual licence to user content to run the service. The terms name no legal entity or governing law (12). The privacy policy, updated 2 November 2026, corrects its Use of Data section and now says PostNitro doesn't train AI models on user content, in line with the Claude page. Personal data is kept while the account is active and deleted within 24 hours of a request. No DPA (14). The fact sheet dates the withdrawal of the Creator and Team plans and existing subscribers keep them. The CLI changelog marks API-version dependencies. No deprecation policy for the API (8). The policy names UserMaven and CrispChat and an unnamed payment processor, the docs name Lemon Squeezy for billing, and no data locations were found (5). 12 + 14 + 8 + 5 = 39.