# Mapbox APIs + MCP vs Nominatim (slim)

> Mapbox scores 77.2 (BB) to Nominatim's 63.5 (B) for geocoding. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/mapbox-vs-nominatim.md (~5,100 tokens) · this version ~2,980 tokens · JSON https://www.anchorterminal.com/compare/mapbox-vs-nominatim.json · canonical https://www.anchorterminal.com/compare/mapbox-vs-nominatim
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Mapbox APIs + MCP scores 77.2 (BB) on agent readiness against Nominatim's 63.5 (B), and leads in 5 of 7 scored categories. Nominatim leads on payments & pricing. Both do geocoding.

- Mapbox APIs + MCP: BB 77.2, rank #35 of 1510 · https://www.anchorterminal.com/tools/mapbox.min.md
- Nominatim: B 63.5, rank #513 of 1510 · https://www.anchorterminal.com/tools/nominatim.min.md
- Mapbox APIs + MCP, good for An agent that needs search, routing, isochrones, map matching and route optimisation from one vendor with a hosted, OAuth-protected MCP. Ahead on Schema & documentation, 85 against 51; Agent ergonomics, 88 against 75; Security & auth, 71 against 50; Maintenance & community, 90 against 60; Transparency & trust, 84 against 59. Also Agent-ready, a grade of BB or better; A hosted endpoint, with nothing to install; Runs on your own machine; Free to start without a card.
- Nominatim, good for Self-hosted worldwide geocoding from OpenStreetMap data with no per-call cost or storage limits beyond ODbL. Ahead on Payments & pricing, 60 against 40. Also No key needed to call it; Open source.

| Category | Mapbox APIs + MCP | Nominatim |
| --- | --- | --- |
| Reliability (16%) | 82 | 82 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 51 |
| Agent ergonomics (13%) | 88 | 75 |
| Security & auth (14%) | 71 | 50 |
| Payments & pricing (10%) | 40 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 90 | 60 |
| Transparency & trust (7%) | 84 | 59 |

| Fact (where they differ) | Mapbox APIs + MCP | Nominatim |
| --- | --- | --- |
| Vendor | Mapbox | Nominatim project (osm-search) |
| Hosted endpoint | `https://api.mapbox.com` | no (local only) |
| Transports | HTTP, Streamable HTTP, stdio | HTTP |
| Auth | OAuth or key | None |
| Pricing | Freemium | Free |
| Price for geocoding | $0.75 per 1,000 requests | free |
| Licence | MIT (MCP server) | GPL-3.0-or-later |
| Tools exposed | 29 | none |
| Read-only variant documented | yes | no |
| llms.txt | yes | no |
| MCP registry | `io.github.mapbox/mcp-server` | not listed |
| Last release | 2026-10-15 | 2026-10-14 |
| Terms last updated | 2024-03-31 | no date given |
| Privacy policy last updated | 2026-02-11 | no document linked |
| Customer content may train models | yes | not found in the text |
| Terms restrict automated access | not found in the text | yes |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 353 stars, 2k npm/wk | 2.1k PyPI/wk |
| Agent reviews | 3.6/5 (8) | none |

Why the edge:
- Schema & documentation, Mapbox APIs + MCP +34: Mapbox APIs + MCP 85 (No public OpenAPI for the REST APIs, but every MCP tool has a typed Zod input and output schema, published as JSON Schema 2020-12 since 0.15.0 (8 October) (20). llms.txt at docs.mapbox.com, re-read on 1 November (10). MCP descriptions say when not to use a tool, for example search_and_geocode_tool sends generic place types to category_search_tool and warns that big-box brand plus address queries are unreliable (17). Zod limits and enums, such as q capped at 200 characters after the team found the API rejects 201 (13). An error table per API with 401, 403, 404, 422 and 429 messages, and curl examples throughout (13). Versioned paths (geocode v6) and a dated MCP CHANGELOG.md, but the top-level API changelog's newest entry is still 5 November 2021, current changes sit in per-service pages, and the MCP guide on docs.mapbox.com still says v0.12.0 on 1 November (12).); Nominatim 51 (No OpenAPI or machine-readable contract (0). nominatim.org/llms.txt returns 404, and the manual is HTML, though its Markdown sources sit in the repository's docs folder (0). The API reference explains each endpoint and parameter and when not to use one, such as the details endpoint being for debugging (14). Types, enums and limits are documented, such as format, layer and limit (at most 40), but there's no schema to validate against (12). Example queries and outputs per endpoint, with errors described in prose (10). A versioned manual per release, a ChangeLog and a migration guide (15). 0+0+14+12+10+15 = 51.)
- Maintenance & community, Mapbox APIs + MCP +30: Mapbox APIs + MCP 90 (MCP server v0.16.0 on 15 October 2026, after v0.15.0 and v0.15.1 on 8 and 9 October (30). Three stable releases in the 90 days from 3 August, v0.15.0, v0.15.1 and v0.16.0, plus the v0.16.1-dev, v0.17.0-dev and v0.17.0-dev.1 pre-releases (20). Commits reference user-reported issues and fixes land within weeks. We couldn't see issue reply times from git (15). Listed in the official MCP registry as io.github.mapbox/mcp-server, active, with 0.16.0 the latest, published 15 October (15). CI builds and runs the test suite on every push and pull request, and since 0.17.0-dev also typechecks the tests (10).); Nominatim 60 (Release 5.3.3 on 14 October 2026, 23 days before this check (30). Only one release in the 90 days from 8 August, against 106 commits on the default branch; commits aren't counted as releases (0). Commits from the lead maintainer and seven or more contributors since August, but we couldn't read issue reply times (12). The nominatim-api Python library is current with the server (10). CI on every push, current PostgreSQL and Python versions (8). 30+0+12+10+8 = 60.)
- Transparency & trust, Mapbox APIs + MCP +25: Mapbox APIs + MCP 84 (Closed service with published terms and product terms, plus an MIT-licensed MCP server (20). A DPA, a privacy FAQ that says IP addresses are kept 30 days, and geocoding storage rules that are plain about what can be cached. The terms also let Mapbox build de-identified aggregated data from customer usage (24). An API policy of at least 90 days' emailed notice before an endpoint is deprecated, with dated removals in the changelog, though that changelog stopped in 2021 (18). 22 subprocessors with locations, 14 third-party and 8 affiliates, still last updated 4 June 2026 on 1 November (20).); Nominatim 59 (Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.)
- Security & auth, Mapbox APIs + MCP +21: Mapbox APIs + MCP 71 (Public and secret tokens with scopes, URL restrictions, one-hour temporary tokens and documented rotation, which earns 30. Less 10 because the REST APIs take the token as the access_token query parameter, and that's the documented way in. The hosted MCP signs in with OAuth instead. Accounts on the card-free trial get a single token they can't rotate or delete until a payment method is added (20). Public-scope tokens can't change the account, and every MCP tool is read-only (18). Responses are structured place data, partly third-party POI names and attributes, and we found no prompt-injection guidance (7). The local MCP emits OpenTelemetry traces per tool call tagged with the client name. We didn't check per-token usage reporting in the account (8). SOC 2 Type II and SOC 3, a HackerOne bug bounty and a disclosure programme, re-read on 1 November. MCP 0.13.0 on 30 July 2026 fixed a query-parameter injection through directions_tool's exclude field, and 0.15.0 on 8 October shipped the fix for reads of cached tool results by anyone who knew a resource URI and could forge the owner's username claim, with a narrowed map CSP. 0.16.0 on 15 October replaced those cached refs for directions and isochrones with refs that re-run the request under the reader's token, and fetches place photos server-side only from public https hosts. All were stated in the public changelog. On 21 October the URL check for custom marker images and place photos was fixed to strip every trailing dot (`localhost..` had passed), released in the v0.17.0-dev pre-releases of 30 October and not yet in a stable release. The photo fetch also resolves the host and refuses private addresses, and marker URLs are fetched by Mapbox's Static Images API, so we read it as hardening and don't deduct. No security.txt, still 404 on 1 November (18).); Nominatim 50 (The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.)
- Payments & pricing, Nominatim +20: Mapbox APIs + MCP 40 (No x402, MPP or L402 (0). Per-1,000 prices for every API published without login, $0.75 temporary geocoding, $5 permanent, $2 directions, re-read on 1 November (20). The sign-up guide has a 'Start without a credit card' option, a trial with monthly limits such as 10,000 temporary geocodes, 10,000 directions requests and 5,000 map loads, and lower rate limits. Adding a card unlocks the full free allowances, permanent geocoding and raster tiles. Re-read on 1 November (20). Signup is a browser flow with email confirmation, and the hosted MCP needs a browser OAuth step (0).); Nominatim 60 (Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.)
- Agent ergonomics, Mapbox APIs + MCP +13: Mapbox APIs + MCP 88 (29 core MCP tools in 0.16.0, still the latest stable release on 1 November, so 15, plus 5 back for --enable-tools and --disable-tools on the local server. The docs don't say the hosted endpoint can filter tools (20). limit, types, bbox and proximity on geocoding, and a v6 batch endpoint (18). Documented status codes with messages an agent can act on, such as 'Query exceeded character limit of 200' (17). Every tool carries readOnlyHint true, destructiveHint false and idempotentHint, and 17 offline geometry tools set openWorldHint false (20). Few required parameters and the server elicits a route choice when the client supports it. Since 0.16.0 large directions and isochrone results return a short ref that any server process can answer, and descriptions no longer tell the model to avoid other tools or web search. Official SDKs are JavaScript and the mobile SDKs, with no current official Python client that we found (13).); Nominatim 75 (API reading. limit, addressdetails, extratags, namedetails and the polygon options size responses, and geocodejson, geojson and jsonv2 formats are available (22). countrycodes, viewbox, bounded, layer, featureType and exclude_place_ids filter results, the last one standing in for pagination (18). Bad parameters return an error rather than a silent default in current versions, but there's no error code reference (12). Every endpoint reads and is safe to retry (15). Few required parameters, and the Python library exposes the same search API in-process, but there are no other official clients (8). 22+18+12+15+8 = 75.)