Lingo.dev vs TranslatePlus

Lingo.dev 87

The weekly changelog's latest entry, W43 on 30 October 2026, shipped engine context provisioning from a website (30). Twelve weekly changelog entries since 4 August (W32 on 9 August to W43 on 30 October), and the lingo.dev CLI shipped 0.138.5 to 0.138.9 between 19 August and 5 October, with 0.138.10 and 0.138.11 (7 and 26 October) dependency-only (20). Per the 8 October check, the GitHub repository had 5,402 stars and 17 open issues, each with at least one comment and most of them requests for new functions, with two compiler bug reports from March 2026 open; not re-read on 2 November. The weekly changelog is public and the site links a Discord community (17 of 25). The official MCP registry lists dev.lingo/main 1.0.0 at https://mcp.lingo.dev/main, a different path from the /account endpoint in the docs. The JavaScript SDK last shipped on 26 October 2026 (0.17.4, a dependency bump) and the Python SDK on 7 March 2026 (1.5.0, from its repository tags) (12 of 15). The repository runs pull-request checks and a release workflow and overrode dependencies for advisories on 26 October. Per the 8 October check, @lingo.dev/cli states no licence, repository or engines field on npm (8 of 10).

TranslatePlus 10

The newest dated change found is translateplus-python 2.0.7 and translateplus-js 2.0.1 on 11 January 2026, about ten months before this check, and the API changelog stops at 9 December 2024 (0). No release or dated change in the last 90 days (0). Support by email and a support portal; the status page hasn't updated since January (3). SDKs exist for four languages but haven't changed since January (5). Weekly downloads of 4 (PyPI) and 6 (npm) (2). 0+0+3+5+2 = 10.

Lingo.dev 81

Hosted reading of the checklist, for the REST API and the hosted MCP server. status.lingo.dev runs on OpenStatus with WEB and API monitors and an events history (20). Between 4 August and 2 November the history lists one incident, a partial outage of the localization endpoint on 22 September 2026 from 22:09 to 23:59 UTC, in which 'a portion of localization requests' failed and other services were unaffected. Partial, so minor (20). The 18 July partial outage has left the window. Daily token quotas are published per plan, 100,000 on Sandbox and 5 million on Production, with no per-second request limit found (12 of 15). The errors page says to retry 500 with exponential backoff and not to retry 402 or 429, and async job creation takes an idempotencyKey. No Retry-After header is documented (12 of 15). The pricing page lists a 99.99% uptime SLA for Enterprise without publishing the document, and the terms say the company strives for 99.9% without a guarantee (7 of 10). Version 1.0 shipped on 15 March 2026 and nothing on the API pages is marked beta (10).

TranslatePlus 45

Hosted lines. status.translateplus.io is the vendor's own page; on 6 November 2026 it showed 'All systems unknown' and a last update of 22 January 2026, with data loading by script (5). No incident history to read (5). The rate-limits guide gives 100,000 requests a minute and 100,000,000 an hour per key, while llms.txt gives 50 requests a second on the Free plan, so limits are published but inconsistent (10). 429 returns a JSON detail message, responses carry X-RateLimit-Limit, -Remaining and -Reset, and the guide shows waiting for the reset with capped retries (15). No SLA. The terms say TranslatePlus strives for 99.9% uptime 'but do not guarantee uninterrupted service' (0). API v2 is the current, non-beta version (10). 5+5+10+15+0+10 = 45.

Lingo.dev 62

The MCP server uses OAuth with PKCE and dynamic client registration and publishes no scopes. API keys are stored hashed, shown once and revoked by deletion. Personal keys carry their creator's full access, and keys with their own role and engine scope need Enterprise. No documented option puts a key in a URL (22 of 30). RBAC with 20 permissions exists on Enterprise only. On other plans every member is an Owner. The MCP server can create and revoke API keys and invite members with admin access by default, and no confirmation step is documented (8 of 20). Responses are translations of the caller's own content, while engine provisioning reads links the caller supplies. No injection guidance was found (7 of 15). Request logs with model, tokens and full input and output are on every plan. The append-only audit log, which records the acting user or key and the IP address, is Enterprise only (12 of 15). security.txt gives a contact and a disclosure policy with a safe-harbour promise and a maximum reward of a $50 gift card. The site states SOC 2 Type II, with the report available on Enterprise. No bug bounty or public advisories were found (13 of 20).

TranslatePlus 35

One API key per account in the X-API-KEY header, which the docs say 'carries full access to your account's resources', and can be revoked in the dashboard (15). No scopes or read-only keys (5). Translations return the caller's own text, so little untrusted content (10). llms.txt claims request logging and an analytics dashboard, which we couldn't see without an account (5). translateplus.io/.well-known/security.txt returns 404 and no disclosure policy was found; llms.txt says 'SOC 2 compliant' and 'SOC 2 Type II certified infrastructure' with no report or auditor named (0). 15+5+10+5+0 = 35.

Lingo.dev 72

The platform is closed under published terms. The legacy CLI, the JavaScript SDK, the compiler and the Python SDK are Apache-2.0, and the current @lingo.dev/cli package states no licence (18 of 30). The terms and the privacy policy agree that user content is not used to train AI models and that AI providers keep content for up to 30 days by default. The privacy policy gives translation data 30 days by default while the pricing page gives 7 days on Sandbox. The Data Processing Agreement the policy refers to is not published (17 of 30). The terms promise advance notice and migration instructions for breaking API changes without stating a period, and the older CLI's docs are kept under a legacy section (8 of 20). The terms name Supabase in Frankfurt and Cloudflare. The sub-processor page the privacy policy points to, lingo.dev/security, redirects to a 404 page (2 November), and the LLM providers are not listed as sub-processors on any page we read (8 of 20).

TranslatePlus 52

Editorial half only. Closed service under terms last updated 18 December 2024 that name PetaBytes, Inc. as a US corporation but give no address, governing law or courts (10). The terms say translation requests aren't permanently stored 'unless required by law', the privacy policy says 'unless required for caching or service improvement purposes', and the terms allow using anonymised usage data to improve the service (8). API v1 is kept as legacy, with no dated deprecation notice (5). No subprocessor list or data location found (0). 10+8+5+0 = 23.

Lingo.dev 75

API reading of the checklist. Sync responses return only the translated data, the model and a usage block, and job lists return summaries without output. The MCP server covers team, role, key and audit administration alongside translation, with no documented toolsets or read-only subset, and its tool count is unpublished (15 of 25). Job lists page by cursor with limit from 20 to 100 and filters for engine and status (20). Errors are keyed on seven status codes with retry advice for each group, but the body has no machine-readable code (15 of 20). Async job creation is idempotent with idempotencyKey. The sync call has no such key, and MCP annotations could not be read (12 of 20). A sync call needs three fields and falls back to the organisation's default engine. JavaScript and Python SDKs exist, though the Python one last shipped on 7 March 2026 and the docs site has no SDK section (13 of 15).

TranslatePlus 61

API reading. Batch translation of up to 100 texts a call and separate HTML, email, subtitle and i18n job endpoints (16). Few output controls or filters (10). Errors are a detail string with HTTP status codes (12). No idempotency key for i18n jobs, though text translation is stateless (8). Official SDKs listed for Python, JavaScript and TypeScript, Java and PHP, with few required fields (15). 16+10+12+8+15 = 61.

Lingo.dev 64

No OpenAPI file was found. https://api.lingo.dev/openapi.json returns 404 and the docs link none. The open-source JavaScript SDK carries typed request schemas, and the MCP tool definitions can't be read without signing in (5 of 25). llms.txt now indexes the docs, pricing and guides, and llms-full.txt lists every docs page with a description, including 28 API reference pages, which render as server-side HTML. Docs pages have no Markdown version (10). The reference says what each endpoint is for and when to pick the sync call or async jobs (16 of 20). Parameters have types and limits, such as 1 to 100 target locales, 100 locked-key patterns and five job statuses, while data is a free-form object by design (11 of 15). Request and response examples are given in up to five languages, and one page lists seven status codes. Error bodies hold only a message string (12 of 15). A weekly changelog runs from 15 March to 30 October 2026. No API version in the path or a header was found (10 of 15).

TranslatePlus 52

No OpenAPI or other machine-readable contract found in the docs or either llms.txt (0). llms.txt on the site and on docs.translateplus.io (10). Endpoint pages say what each call does, with little on when to choose HTML, email or i18n jobs over plain text (10). Required fields and per-plan character limits per request are documented, without enums for language codes beyond a supported-languages call (10). Code examples in several languages and an error-handling guide with status codes (12). Versioned /v1 and /v2 paths and a changelog, whose newest entry is 2.0.0 on 9 December 2024 (10). 0+10+10+10+12+10 = 52.