Localazy vs Phrase

Localazy 51

No OpenAPI or other machine-readable contract was found (0). localazy.com/llms.txt is a six-link index of top-level pages, with no Markdown docs for agents (5). Each endpoint page states which token types can call it, whether write permission is needed and the minimum role, and the limits page says to use the CDN, not the API, for production fetches (14). Request bodies list required and optional fields with limits, such as 512 characters for a key and 1,000 for a comment (12). Sample requests, responses and error responses per endpoint (13). Docs pages carry 'last updated' dates and the blog posts dated release updates, but there's no API version or changelog (7). 0+5+14+12+13+7 = 51.

Phrase 87

OpenAPI 3 specs for all nine APIs at developers.phrase.com/openapi, among them Strings with 301 operations and TMS with 547 (25). llms.txt and a Markdown copy of every docs page (10). Every Strings and Language AI operation has a description, 390 of 547 TMS operations do, and a page titled Choose the right API says which API fits which job. Few operations say when not to use them (14 of 20). Language AI inputs carry length limits, item counts and enums. The Strings spec has 49 enums across 301 operations (11 of 15). Strings documents 400, 401, 403, 404 and 429 on nearly every operation with 896 examples, while the Language AI error responses have no body schema (12 of 15). Versioned paths, four TMS versions to pin, and a dated changelog (15).

Localazy 37

Bearer tokens in the Authorization header. A project token reaches every endpoint of one project with read and write access; a translation token reaches only the AI Translation endpoint; organisation tokens are in beta on request (20). The translation token is the only least-privilege option, and project tokens can delete keys and glossary items without a confirmation step (10). The API returns strings written by translators and contributors, with no guidance on untrusted content (5). No per-call log or audit trail for tokens found (2). localazy.com/.well-known/security.txt and /security return 404, and we found no disclosure policy or certification (0). 20+10+5+2+0 = 37.

Phrase 58

The hosted MCP server uses OAuth with PKCE, dynamic client registration and three scopes. Service accounts use the client credentials grant limited by product and scope, and platform tokens are exchanged for JWTs that last about four hours (30). Less 10 because the Strings docs give an access_token query parameter as an option, and still document Basic authentication with email and password (20 of 30). View, create and delete consents on MCP, revocable under the Consents tab, with role permissions still applied. No confirmation step for destructive calls was found (15 of 20). Tools return customer strings, comments and translations, and no prompt-injection guidance was found (3 of 15). Each user sees their login history, while audit logs are held by Phrase engineers and supplied on request (6 of 15). ISO 27001 certificate, SOC 2 Type I with Type II expected in 2026, annual third-party penetration tests and a disclosure address at security@phrase.com. No security.txt and no bug bounty found (14 of 20).

Localazy 57

Editorial half only. Closed service under terms that name Localazy s.r.o. of Brno and Czech law; the CLI is BSD-3-Clause and the API client MIT (15). The privacy policy keeps data while the service is used and 24 months after, and includes a DPA, but says nothing on whether content sent to Localazy AI is used for training (15). No deprecation policy or dated notices found (0). The DPA links a list of suppliers and subprocessors on an external knowledge base we didn't read (10). 15+15+0+10 = 40.

Phrase 74

Closed service with published terms, and the CLI, clients and local MCP server under MIT (15). The privacy notice of 6 October 2026, the Data Processing Addendum and the AI statement agree on processor status, a 60-day deletion period and which products train on customer content. The terms still permit training non-text models, and any model for internal research, on customer content without approval (22 of 30). Deprecations are announced in the changelog with dates, such as the Quality Evaluator v1 and v2 endpoints on 2 July 2026, but without removal dates, and no written notice period was found (10 of 20). A sub-processor list with locations and transfer mechanisms, a choice of EU or US data centre, and hosting on AWS and Google Cloud disclosed (18 of 20).

Localazy 62

API reading. List endpoints return whole projects, files and keys with few output controls (13). Filtering by file, language and tags, and batch imports of up to 1,000 keys and 50 files a request (14). Error responses are documented per endpoint, with HTTP codes and messages (12). No idempotency keys, and the docs warn against parallel imports into the same new file (8). Official TypeScript API client, a CLI and Android and iOS libraries, with few required fields (15). 13+14+12+8+15 = 62.

Phrase 70

API reading of the checklist, with the hosted MCP server noted where its behaviour is documented. Strings lists return 25 items by default with per_page up to 100, and locale downloads support ETag. The hosted MCP server's tool list isn't published, and the deprecated local server listed 145 tools (17 of 25). page and per_page with Link headers, and filters on list endpoints (18 of 20). Strings returns a message on 400 and field-level errors on 422, and names the limit hit on 429. Language AI error bodies are undocumented (14 of 20). No idempotency keys. Conditional GETs are safe to repeat, and the MCP consent separates view, create, and modify and delete (8 of 20). Language AI needs three fields, six official Strings clients and a CLI exist, but a missing User-Agent header earns a 400 and the clients cover Strings alone (13 of 15).

Localazy 75

@localazy/api-client 2.3.2 on 26 October 2026 (30). Releases 2.3.0 (12 August), 2.3.1 (29 September) and 2.3.2 (26 October) in the last 90 days (20). Support by email, blog release updates, and public GitHub repositories, but we didn't read issue reply times (7). The TypeScript client and the CLI (2.0.12 on 31 July 2026) are current (13). The client repository shows coverage badges; we didn't confirm CI runs (5). 30+20+7+13+5 = 75.

Phrase 83

The changelog's latest entry is 22 October 2026, CLI 2.71.0 is of 23 October and phrase-js 3.31.0 was tagged on 28 October (30). 39 dated changelog entries since 4 August 2026, and CLI and phrase-js releases in October (20). A public changelog, a help centre and written support around the clock on paid plans. We didn't read the GitHub issues (11 of 15). The hosted MCP server is in the official MCP registry as io.github.phrase/mcp, and phrase-js 3.31.0 is current (15). The CLI has release and vulnerability workflows. The local MCP server was deprecated on 7 August 2026, under six months after its first tag (7 of 10). Total 83.

Localazy 35

No x402, MPP or L402 (0). Plan prices are public ($34, $78 and $175 a month billed annually) and credits are $1 each, with Localazy AI at about $0.005 a word on average, so partial per-unit credit (15). A free plan for small projects and a 14-day Business trial with no credit card (20). A person signs up in a browser and mints tokens in the developer settings (0). 0+15+20+0 = 35.

Phrase 30

No x402, MPP or L402 (0). Plan prices are public, $27, $525 and $1,245 a month billed annually, with included capacities and the MTU conversion published. Top-up prices and the Business and Enterprise plans are quoted by sales, so plan-only credit (10). A 14-day trial whose signup form asks for an email address and a password, with no automatic charge afterwards (20). A person signs up in a browser, and the MCP server needs a Phrase account login (0).