Lingo.dev vs Localazy

Lingo.dev 62

The MCP server uses OAuth with PKCE and dynamic client registration and publishes no scopes. API keys are stored hashed, shown once and revoked by deletion. Personal keys carry their creator's full access, and keys with their own role and engine scope need Enterprise. No documented option puts a key in a URL (22 of 30). RBAC with 20 permissions exists on Enterprise only. On other plans every member is an Owner. The MCP server can create and revoke API keys and invite members with admin access by default, and no confirmation step is documented (8 of 20). Responses are translations of the caller's own content, while engine provisioning reads links the caller supplies. No injection guidance was found (7 of 15). Request logs with model, tokens and full input and output are on every plan. The append-only audit log, which records the acting user or key and the IP address, is Enterprise only (12 of 15). security.txt gives a contact and a disclosure policy with a safe-harbour promise and a maximum reward of a $50 gift card. The site states SOC 2 Type II, with the report available on Enterprise. No bug bounty or public advisories were found (13 of 20).

Localazy 37

Bearer tokens in the Authorization header. A project token reaches every endpoint of one project with read and write access; a translation token reaches only the AI Translation endpoint; organisation tokens are in beta on request (20). The translation token is the only least-privilege option, and project tokens can delete keys and glossary items without a confirmation step (10). The API returns strings written by translators and contributors, with no guidance on untrusted content (5). No per-call log or audit trail for tokens found (2). localazy.com/.well-known/security.txt and /security return 404, and we found no disclosure policy or certification (0). 20+10+5+2+0 = 37.

Lingo.dev 20

No x402, MPP or L402. The API's 402 status reports a credit limit and carries no payment instructions (0). Unit prices are public without a login, $2 per million output tokens plus the model's cost with no markup, $0.50 per engine a month and $0.01 per AI review run (20). Sandbox has a $0 base price, but every translation is charged against prepaid credits and no free allowance or trial was found on the pricing page or in the docs (0). A person signs up in a browser. The CLI signs in with an emailed code and the MCP server with browser OAuth (0).

Localazy 35

No x402, MPP or L402 (0). Plan prices are public ($34, $78 and $175 a month billed annually) and credits are $1 each, with Localazy AI at about $0.005 a word on average, so partial per-unit credit (15). A free plan for small projects and a 14-day Business trial with no credit card (20). A person signs up in a browser and mints tokens in the developer settings (0). 0+15+20+0 = 35.

Lingo.dev 72

The platform is closed under published terms. The legacy CLI, the JavaScript SDK, the compiler and the Python SDK are Apache-2.0, and the current @lingo.dev/cli package states no licence (18 of 30). The terms and the privacy policy agree that user content is not used to train AI models and that AI providers keep content for up to 30 days by default. The privacy policy gives translation data 30 days by default while the pricing page gives 7 days on Sandbox. The Data Processing Agreement the policy refers to is not published (17 of 30). The terms promise advance notice and migration instructions for breaking API changes without stating a period, and the older CLI's docs are kept under a legacy section (8 of 20). The terms name Supabase in Frankfurt and Cloudflare. The sub-processor page the privacy policy points to, lingo.dev/security, redirects to a 404 page (2 November), and the LLM providers are not listed as sub-processors on any page we read (8 of 20).

Localazy 57

Editorial half only. Closed service under terms that name Localazy s.r.o. of Brno and Czech law; the CLI is BSD-3-Clause and the API client MIT (15). The privacy policy keeps data while the service is used and 24 months after, and includes a DPA, but says nothing on whether content sent to Localazy AI is used for training (15). No deprecation policy or dated notices found (0). The DPA links a list of suppliers and subprocessors on an external knowledge base we didn't read (10). 15+15+0+10 = 40.

Lingo.dev 81

Hosted reading of the checklist, for the REST API and the hosted MCP server. status.lingo.dev runs on OpenStatus with WEB and API monitors and an events history (20). Between 4 August and 2 November the history lists one incident, a partial outage of the localization endpoint on 22 September 2026 from 22:09 to 23:59 UTC, in which 'a portion of localization requests' failed and other services were unaffected. Partial, so minor (20). The 18 July partial outage has left the window. Daily token quotas are published per plan, 100,000 on Sandbox and 5 million on Production, with no per-second request limit found (12 of 15). The errors page says to retry 500 with exponential backoff and not to retry 402 or 429, and async job creation takes an idempotencyKey. No Retry-After header is documented (12 of 15). The pricing page lists a 99.99% uptime SLA for Enterprise without publishing the document, and the terms say the company strives for 99.9% without a guarantee (7 of 10). Version 1.0 shipped on 15 March 2026 and nothing on the API pages is marked beta (10).

Localazy 68

Hosted lines, for the REST API at api.localazy.com. Better Stack status page with Web, API, Public API, Payments and Connect API components and 30, 60 and 90-day uptime (20). The incidents page reports none for September, October or November 2026, but the Public API shows 99.805% uptime in one 30-day bucket, roughly an hour and a half of downtime with no incident posted, so the line is held below clean (25). Limits per plan of 100 requests a minute and 10 a second, plus daily import and fetch caps per project (15). No 429 or retry guidance found in the API docs (0). No SLA found on the pricing page or in the terms (0). The core API is GA; the AI Translation endpoint is marked beta (8). 20+25+15+0+0+8 = 68.

Lingo.dev 64

No OpenAPI file was found. https://api.lingo.dev/openapi.json returns 404 and the docs link none. The open-source JavaScript SDK carries typed request schemas, and the MCP tool definitions can't be read without signing in (5 of 25). llms.txt now indexes the docs, pricing and guides, and llms-full.txt lists every docs page with a description, including 28 API reference pages, which render as server-side HTML. Docs pages have no Markdown version (10). The reference says what each endpoint is for and when to pick the sync call or async jobs (16 of 20). Parameters have types and limits, such as 1 to 100 target locales, 100 locked-key patterns and five job statuses, while data is a free-form object by design (11 of 15). Request and response examples are given in up to five languages, and one page lists seven status codes. Error bodies hold only a message string (12 of 15). A weekly changelog runs from 15 March to 30 October 2026. No API version in the path or a header was found (10 of 15).

Localazy 51

No OpenAPI or other machine-readable contract was found (0). localazy.com/llms.txt is a six-link index of top-level pages, with no Markdown docs for agents (5). Each endpoint page states which token types can call it, whether write permission is needed and the minimum role, and the limits page says to use the CDN, not the API, for production fetches (14). Request bodies list required and optional fields with limits, such as 512 characters for a key and 1,000 for a comment (12). Sample requests, responses and error responses per endpoint (13). Docs pages carry 'last updated' dates and the blog posts dated release updates, but there's no API version or changelog (7). 0+5+14+12+13+7 = 51.

Lingo.dev 75

API reading of the checklist. Sync responses return only the translated data, the model and a usage block, and job lists return summaries without output. The MCP server covers team, role, key and audit administration alongside translation, with no documented toolsets or read-only subset, and its tool count is unpublished (15 of 25). Job lists page by cursor with limit from 20 to 100 and filters for engine and status (20). Errors are keyed on seven status codes with retry advice for each group, but the body has no machine-readable code (15 of 20). Async job creation is idempotent with idempotencyKey. The sync call has no such key, and MCP annotations could not be read (12 of 20). A sync call needs three fields and falls back to the organisation's default engine. JavaScript and Python SDKs exist, though the Python one last shipped on 7 March 2026 and the docs site has no SDK section (13 of 15).

Localazy 62

API reading. List endpoints return whole projects, files and keys with few output controls (13). Filtering by file, language and tags, and batch imports of up to 1,000 keys and 50 files a request (14). Error responses are documented per endpoint, with HTTP codes and messages (12). No idempotency keys, and the docs warn against parallel imports into the same new file (8). Official TypeScript API client, a CLI and Android and iOS libraries, with few required fields (15). 13+14+12+8+15 = 62.