Layerre vs Templated API + MCP

Layerre 42

Hosted lines, for the REST API and the hosted MCP server. No status page found on the site, in llms.txt or in the docs (0). No readable incident history (5). Rate limits published as 10 requests a second, a 20-request burst and 600 a minute per IP address (15). A 429 carries Retry-After and a retry_after field, and the docs give retry code samples. No idempotency key or safe-retry note for variant creation, which spends renders (12 of 15). No SLA found (0). Neither surface is labelled beta, though both are at version 0.1.0 (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.

Templated API + MCP 65

Better Stack status page with API, App and Website components over 30, 60 and 90 days (20). The incidents page lists no incident for September, October or November 2026 and the RSS feed holds no entry, so the page has never posted one. This run scores a page that has never posted an incident 20, not the 30 of a clean record, and the page's own figure for the API is 100 per cent over 90 days (20). Rate limits per plan in the Markdown price list, 60, 150 and 300 requests a minute (15). No 429 behaviour, Retry-After or retry advice in the API docs or llms-full.txt. MCP 1.9.0 tells the model to wait and retry after a 429, which isn't API documentation (0). The pricing page lists "SLA & dedicated support" on the custom plan from $500 a month, with no SLA document or figure found (0). The render API is GA. Video launched on 7 January 2026 as "now live" (10). 20 + 20 + 15 + 0 + 0 + 10 = 65.

Layerre 87

Public OpenAPI 3.1 at layerre.com/openapi.json with 16 operations, and zod schemas on all 13 MCP tools in the open-source server (25). llms.txt, auth.md and Markdown mirrors of the pricing, FAQ and integration pages (10). Every operation has a description, and tool descriptions note costs such as 'an expensive operation that may take 10-30 seconds', without saying when not to use a tool (15 of 20). Layer properties have minimums, maximums and enums such as text_align, and list calls cap limit at 1,000 (14 of 15). 88 examples in the spec, and 404, 422 and 429 responses documented on most operations (13 of 15). Versioned /v1 paths and dated What's New pages, read from the sitemap since the pages are drawn by script; the API itself is version 0.1.0 (10 of 15). 25 + 10 + 15 + 14 + 13 + 10 = 87.

Templated API + MCP 74

No OpenAPI. All 25 MCP tools carry typed JSON Schema inputs, and server.json is published to the MCP registry, so partial credit (18). llms.txt, llms-small.txt, llms-full.txt, pricing.md and a Markdown version of every page (10). Some MCP descriptions guide the model well (update_template explains pages versus layers, create_render names get_template_layers first), others are one line (12). Format and layer type enums and a required template field, and MCP 1.9.0 caps list limits at 100 in the schema, but size, scale and fps limits sit in prose rather than min and max, and layers is an open object (10). Request and response examples per endpoint. Error tables with status codes appear on five endpoints (font, render, template and upload deletes and template update), none on create render (9). Versioned /v1 path, a dated changelog now at templated.io/changelog/ and tagged MCP releases (15). 18 + 10 + 12 + 10 + 9 + 15 = 74.

Layerre 63

The MCP server is MIT. The service is closed under terms of 13 August 2026 that name a sole proprietorship in Ontario (20 of 30). The privacy policy and DPA of the same date agree. Data is kept while the account is active and deleted from production on account deletion, with limited backups. Design files aren't used to train public AI models. Google Analytics runs on accepted cookies (24 of 30). No deprecation policy or notice period (0). Ten subprocessors listed with purpose and location in both documents, including Supabase, Stripe, Cloudflare, Google, Resend, Canva and Slack (20). 20 + 24 + 0 + 20 = 64.

Templated API + MCP 76

MCP server MIT with a LICENSE file. The rendering service is closed under published terms (18). Privacy policy updated 18 October 2026 with retention stated per data type (until you delete, files purged within 90 days of deletion, logs up to 90 days, billing records five years) and a DPA at templated.io/dpa, though it doesn't say whether customer content trains models (25). No deprecation policy or dated deprecation notices found (0). Subprocessors named by purpose, including Gemini, OpenAI, Anthropic and DeepSeek for AI functions, Photoroom for background removal, PostHog and Plausible for analytics and Stripe, Creem and Spedy for payments (18). 18 + 25 + 0 + 18 = 61.

Layerre 25

No x402, MPP or L402 (0). Plan prices are public with render counts, and one import or one variant is one render, so the price a render follows from the plan (about $0.03 on Starter, $0.005 on Pro) without being published per unit (15 of 20). Free plan of 50 renders a month with API access; the pricing page doesn't say whether a card is needed (10 of 20, half as with an unstated card rule). A person signs up and creates the key, or approves OAuth in a browser (0). 0 + 15 + 10 + 0 = 25.

Templated API + MCP 35

No x402, MPP or L402 in the docs or llms-full.txt (0). Plan prices and per-unit credit rules are public in pricing.md, 1 credit an image or PDF page and a pixel-rate formula for video (15). Trial of 50 credits with no card (20). A person signs up in a browser for a key or an OAuth login, including through Claude's connectors directory since 27 October 2026 (0). 0 + 15 + 20 + 0 = 35.

Layerre 48

OAuth 2.1 with PKCE for MCP through a Supabase authorisation server, and revocable lyr_ API keys with rotation in the dashboard. No scopes documented for either, and auth.md says the REST API has no OAuth yet (22 of 30). The MCP server cannot delete templates, change billing or manage API keys, but there is no read-only key or endpoint (12 of 20). Tools return the user's own templates and renders; template import fetches a Canva link the user gives (10 of 15). The open-source server emits audit log lines for each tool call for whoever runs it, and nothing per call is documented for the hosted service (4 of 15). No security.txt (the path returns the site's HTML shell), disclosure policy, bug bounty or certification (0). 22 + 12 + 10 + 4 + 0 = 48.

Templated API + MCP 42

The REST key has full account access by the docs' own words, and the privacy policy says it can be regenerated. The hosted MCP is an OAuth 2.1 resource server since MCP 1.6.0 (18). The MCP setup guide still documents ?apiKey= in the server URL for automations, less 10 (8). Folder and external ID scoping is enforced server side, and destructive tools are annotated so clients can ask first. No read-only key (12). Tool results pass through allowlists, and the docs describe server-side scoping as a guard against prompt injection (12). No audit log or per-call log found for the customer beyond the render list (3). A valid security.txt since 28 October 2026 (Last-Modified), sending reports to support@templated.io and expiring 8 October 2027, and 2FA since September 2026. No certification or bug bounty found (7, as a valid security.txt to a support address with nothing else). 8 + 12 + 12 + 3 + 7 = 42.