MapQuest vs MapTiler Cloud

MapQuest 31

Closed service. The only terms linked are System1's website terms of 26 February 2021, which allow personal, non-commercial use and do not mention the APIs. The plans page states the storage rule (5). The System1 group privacy policy of 5 July 2023 gives no retention periods and describes sale and sharing of personal information, while the plans page says 'we don't collect or sell user data' (8). No deprecation policy. Dated notices exist from 2018 only (5). The policy names categories of service providers, with no list or locations. The geocoding docs name TomTom for international queries (3).

MapTiler Cloud 80

Editorial half only. Closed service with general and Cloud-specific terms under Swiss law, and SDKs under BSD 3-Clause and the skill under MIT (20). The privacy policy covers account and payment data and says legal-claim data is kept up to 10 years, but says nothing about how long API request logs are kept (15). A dated deprecation page for v3 maps and migration guides, with no written notice period (12). Hosting with OVHcloud and Google Firebase, data mainly in Switzerland and the EEA, and an EU-only endpoint. Google Analytics, Firebase and FastSpring named in the privacy policy (17). 20+15+12+17 = 64.

MapQuest 23

The newest dated product changes are two blog announcements on 16 July 2026 (the Geolocation API and a 10,000 by 10,000 async route matrix), 84 days before the check (20). Two dated entries in 90 days. The MCP guide's version 1.2 is dated 7 July 2026, 93 days before (0). No changelog. Support is by email, untested (3). The MCP registry returns no server for 'mapquest', and the only current SDKs are browser libraries with no dated releases found (0). No package to judge (0).

MapTiler Cloud 70

@maptiler/client 3.1.0 and @maptiler/sdk 4.2.0 on 2 October 2026, 35 days before this check, with the agent skill updated on 21 October (20). Platform updates entries for August (EU endpoint, key security) and September 2026 (terrain blending) plus the two October releases (20). A Discord community and support answered on a best-effort basis within two business days, per the Cloud terms. We didn't read GitHub issues (10). Official JavaScript client and SDK current, no Python client (12). The SDK repository runs unit and end-to-end tests in CI; we didn't check results (8). 20+20+10+12+8 = 70.

MapQuest 28

REST uses API keys, several per account, created in the dashboard or by API. The MCP server uses OAuth with one scope, mcp:tools. That earns 20, less 10 because the key query parameter is the documented way to send the secret (10). No key scopes, referrer or IP restrictions, or read-only mode found in the docs (3). Place and address text is returned with no prompt-injection guidance (7). The usage endpoint reports transactions by key, service and hour (8). No security.txt, disclosure policy, bug bounty or certification found (0).

MapTiler Cloud 64

Revocable keys that can be limited to origins and a User-Agent substring and managed by the API keys API, and service tokens that sign requests so the token itself never travels, which earns 27. Less 10 because the key is 'always passed as a query parameter' (17). The public APIs are read-only, and account changes need a separate service token (16). Geocoding returns OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). An Analytics API and account usage statistics (8). security.txt, a vulnerability disclosure policy and ISO/IEC 27001:2022 certification per the security page. No bug bounty found (16). 17+16+7+8+16 = 64.

MapQuest 47

https://developer.mapquest.com/openapi.json describes the marketing site and has an empty paths object, so the product APIs have no machine-readable contract. The MCP tool definitions sit behind OAuth and were not read (0). llms.txt indexes every API with a one-line purpose (10). The reference states each endpoint's purpose and each parameter's effect, without when-not-to-use guidance (12). Parameter tables give ranges and allowed values in prose (8). Example requests and responses on each page, and status-code pages per API (12). Versions in the path (v1, v2, v4, v5) but no changelog (5).

MapTiler Cloud 79

OpenAPI 3.1.0 document with 32 paths for the public APIs (25). llms.txt, llms-full.txt and a Markdown twin of every page (10). Each API page says what it's for and when to use the SDK instead (session billing), with little on when not to call it (13). Parameters are typed with defaults, such as limit (default 5 forward, 1 reverse) and a types enum, but bbox and proximity are strings (11). Examples on every endpoint, and the spec documents 400, 403, 404 and 414, without an error reference page (10). A dated platform updates page and a geocoding index changelog, but no version in the API path and the spec is version '1.0' (10). 25+10+13+11+10+10 = 79.

MapQuest 23

Graded as a hosted service. No status page is linked from the developer site, the docs or the plans page (0). With no page there is no readable incident history (5). The reference marks endpoints 'Rate Limited Yes' and gives functional maximums (100 locations a batch, 50 a route, 25 a matrix) but no request-rate numbers (5). No 429, Retry-After or backoff guidance found (0). The Enterprise plan lists a service-level agreement, with no text published (3). The REST API is generally available and the MCP page calls the server production-ready (10).

MapTiler Cloud 43

Hosted lines. status.maptiler.com is a StatusCake public uptime report rather than a component incident page (15). Its data loads from app.statuscake.com, whose robots.txt answered with a redirect, so we didn't fetch it and read no history. That's our limit, not a finding, and the rubric gives 5 (5). Monthly request and session quotas are published per plan, but no per-second limit (5). No 429, Retry-After or backoff guidance found in the API reference, the OpenAPI spec or llms-full.txt (0). The pricing page lists a 99.9% SLA on the Custom plan, while the Cloud terms call availability best effort and point to a custom SLA (8). The public APIs are GA (10). 15+5+5+0+8+10 = 43.

MapQuest 60

The MCP page names 13 tools. Their definitions were not read, so context cost is scored from the count and from REST controls such as maxResults, thumbMaps=false and outFormat (15). Place search pages with pageSize 1 to 50 and filters by category, circle, bounding box or corridor (16). Status codes are documented, with geocoding and directions errors carried in the response body and problem+json on the Account API (12). Most calls read and are safe to retry. Data Manager writes have no idempotency key, and MCP annotations were not read (10). Geocoding needs only key and location. The only current SDKs are browser libraries (7).

MapTiler Cloud 70

API reading. limit, types, bbox, proximity, country, language and fuzzyMatch size geocoding results, and the batch endpoint takes up to 50 queries (20). Country, bbox and type filters, no pagination (geocoding rarely needs it) (16). Errors are documented as 400 and 403 with no recovery guidance (10). Every public API reads and is safe to retry (12). Few required parameters, but official clients are JavaScript and TypeScript only, plus native mobile SDKs (12). 20+16+10+12+12 = 70.