Mapbox APIs + MCP vs Nominatim

Mapbox APIs + MCP 85

No public OpenAPI for the REST APIs, but every MCP tool has a typed Zod input and output schema, published as JSON Schema 2020-12 since 0.15.0 (8 October) (20). llms.txt at docs.mapbox.com, re-read on 1 November (10). MCP descriptions say when not to use a tool, for example search_and_geocode_tool sends generic place types to category_search_tool and warns that big-box brand plus address queries are unreliable (17). Zod limits and enums, such as q capped at 200 characters after the team found the API rejects 201 (13). An error table per API with 401, 403, 404, 422 and 429 messages, and curl examples throughout (13). Versioned paths (geocode v6) and a dated MCP CHANGELOG.md, but the top-level API changelog's newest entry is still 5 November 2021, current changes sit in per-service pages, and the MCP guide on docs.mapbox.com still says v0.12.0 on 1 November (12).

Nominatim 51

No OpenAPI or machine-readable contract (0). nominatim.org/llms.txt returns 404, and the manual is HTML, though its Markdown sources sit in the repository's docs folder (0). The API reference explains each endpoint and parameter and when not to use one, such as the details endpoint being for debugging (14). Types, enums and limits are documented, such as format, layer and limit (at most 40), but there's no schema to validate against (12). Example queries and outputs per endpoint, with errors described in prose (10). A versioned manual per release, a ChangeLog and a migration guide (15). 0+0+14+12+10+15 = 51.

Mapbox APIs + MCP 90

MCP server v0.16.0 on 15 October 2026, after v0.15.0 and v0.15.1 on 8 and 9 October (30). Three stable releases in the 90 days from 3 August, v0.15.0, v0.15.1 and v0.16.0, plus the v0.16.1-dev, v0.17.0-dev and v0.17.0-dev.1 pre-releases (20). Commits reference user-reported issues and fixes land within weeks. We couldn't see issue reply times from git (15). Listed in the official MCP registry as io.github.mapbox/mcp-server, active, with 0.16.0 the latest, published 15 October (15). CI builds and runs the test suite on every push and pull request, and since 0.17.0-dev also typechecks the tests (10).

Nominatim 60

Release 5.3.3 on 14 October 2026, 23 days before this check (30). Only one release in the 90 days from 8 August, against 106 commits on the default branch; commits aren't counted as releases (0). Commits from the lead maintainer and seven or more contributors since August, but we couldn't read issue reply times (12). The nominatim-api Python library is current with the server (10). CI on every push, current PostgreSQL and Python versions (8). 30+0+12+10+8 = 60.

Mapbox APIs + MCP 84

Closed service with published terms and product terms, plus an MIT-licensed MCP server (20). A DPA, a privacy FAQ that says IP addresses are kept 30 days, and geocoding storage rules that are plain about what can be cached. The terms also let Mapbox build de-identified aggregated data from customer usage (24). An API policy of at least 90 days' emailed notice before an endpoint is deprecated, with dated removals in the changelog, though that changelog stopped in 2021 (18). 22 subprocessors with locations, 14 third-party and 8 affiliates, still last updated 4 June 2026 on 1 November (20).

Nominatim 59

Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.

Mapbox APIs + MCP 71

Public and secret tokens with scopes, URL restrictions, one-hour temporary tokens and documented rotation, which earns 30. Less 10 because the REST APIs take the token as the access_token query parameter, and that's the documented way in. The hosted MCP signs in with OAuth instead. Accounts on the card-free trial get a single token they can't rotate or delete until a payment method is added (20). Public-scope tokens can't change the account, and every MCP tool is read-only (18). Responses are structured place data, partly third-party POI names and attributes, and we found no prompt-injection guidance (7). The local MCP emits OpenTelemetry traces per tool call tagged with the client name. We didn't check per-token usage reporting in the account (8). SOC 2 Type II and SOC 3, a HackerOne bug bounty and a disclosure programme, re-read on 1 November. MCP 0.13.0 on 30 July 2026 fixed a query-parameter injection through directions_tool's exclude field, and 0.15.0 on 8 October shipped the fix for reads of cached tool results by anyone who knew a resource URI and could forge the owner's username claim, with a narrowed map CSP. 0.16.0 on 15 October replaced those cached refs for directions and isochrones with refs that re-run the request under the reader's token, and fetches place photos server-side only from public https hosts. All were stated in the public changelog. On 21 October the URL check for custom marker images and place photos was fixed to strip every trailing dot (localhost.. had passed), released in the v0.17.0-dev pre-releases of 30 October and not yet in a stable release. The photo fetch also resolves the host and refuses private addresses, and marker URLs are fetched by Mapbox's Static Images API, so we read it as hardening and don't deduct. No security.txt, still 404 on 1 November (18).

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.

Mapbox APIs + MCP 40

No x402, MPP or L402 (0). Per-1,000 prices for every API published without login, $0.75 temporary geocoding, $5 permanent, $2 directions, re-read on 1 November (20). The sign-up guide has a 'Start without a credit card' option, a trial with monthly limits such as 10,000 temporary geocodes, 10,000 directions requests and 5,000 map loads, and lower rate limits. Adding a card unlocks the full free allowances, permanent geocoding and raster tiles. Re-read on 1 November (20). Signup is a browser flow with email confirmation, and the hosted MCP needs a browser OAuth step (0).

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

Mapbox APIs + MCP 88

29 core MCP tools in 0.16.0, still the latest stable release on 1 November, so 15, plus 5 back for --enable-tools and --disable-tools on the local server. The docs don't say the hosted endpoint can filter tools (20). limit, types, bbox and proximity on geocoding, and a v6 batch endpoint (18). Documented status codes with messages an agent can act on, such as 'Query exceeded character limit of 200' (17). Every tool carries readOnlyHint true, destructiveHint false and idempotentHint, and 17 offline geometry tools set openWorldHint false (20). Few required parameters and the server elicits a route choice when the client supports it. Since 0.16.0 large directions and isochrone results return a short ref that any server process can answer, and descriptions no longer tell the model to avoid other tools or web search. Official SDKs are JavaScript and the mobile SDKs, with no current official Python client that we found (13).

Nominatim 75

API reading. limit, addressdetails, extratags, namedetails and the polygon options size responses, and geocodejson, geojson and jsonv2 formats are available (22). countrycodes, viewbox, bounded, layer, featureType and exclude_place_ids filter results, the last one standing in for pagination (18). Bad parameters return an error rather than a silent default in current versions, but there's no error code reference (12). Every endpoint reads and is safe to retry (15). Few required parameters, and the Python library exposes the same search API in-process, but there are no other official clients (8). 22+18+12+15+8 = 75.