MapQuest vs Nominatim

MapQuest 23

Graded as a hosted service. No status page is linked from the developer site, the docs or the plans page (0). With no page there is no readable incident history (5). The reference marks endpoints 'Rate Limited Yes' and gives functional maximums (100 locations a batch, 50 a route, 25 a matrix) but no request-rate numbers (5). No 429, Retry-After or backoff guidance found (0). The Enterprise plan lists a service-level agreement, with no text published (3). The REST API is generally available and the MCP page calls the server production-ready (10).

Nominatim 82

Read with the local-software lines, since the listing is the Nominatim server an operator runs. The public instance at nominatim.openstreetmap.org belongs to the OpenStreetMap Foundation and its usage policy caps it at one request a second, so it isn't graded as a hosted service. Official packages nominatim-db and nominatim-api on PyPI (5.3.3 on 14 October 2026, Python 3.9 or later) and installation guides for Ubuntu 22 and 24 (20). A public CI workflow runs unit and BDD tests on every push across Ubuntu 24 and 26 with PostgreSQL 13 to 18, and Windows unit tests. We couldn't see run results (20). Issue counts and reply times couldn't be read because the GitHub API was rate-limited for us; Sarah Hoffmann made 76 of the 106 commits since 8 August (12). A ChangeLog per release and semantic version numbers (15). Version 5.3.3 (15). 20+20+12+15+15 = 82.

MapQuest 23

The newest dated product changes are two blog announcements on 16 July 2026 (the Geolocation API and a 10,000 by 10,000 async route matrix), 84 days before the check (20). Two dated entries in 90 days. The MCP guide's version 1.2 is dated 7 July 2026, 93 days before (0). No changelog. Support is by email, untested (3). The MCP registry returns no server for 'mapquest', and the only current SDKs are browser libraries with no dated releases found (0). No package to judge (0).

Nominatim 60

Release 5.3.3 on 14 October 2026, 23 days before this check (30). Only one release in the 90 days from 8 August, against 106 commits on the default branch; commits aren't counted as releases (0). Commits from the lead maintainer and seven or more contributors since August, but we couldn't read issue reply times (12). The nominatim-api Python library is current with the server (10). CI on every push, current PostgreSQL and Python versions (8). 30+0+12+10+8 = 60.

MapQuest 30

No x402, MPP or L402 (0). $0.0045 a transaction and four monthly plans are published without a login (20). 50,000 one-time free transactions, expiring 1 January 2027. The sign-up page is drawn by script, so we could not confirm that no card is needed, and half credit is given (10). A person registers in a browser. The Account API creates further keys but needs a key first (0).

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

MapQuest 31

Closed service. The only terms linked are System1's website terms of 26 February 2021, which allow personal, non-commercial use and do not mention the APIs. The plans page states the storage rule (5). The System1 group privacy policy of 5 July 2023 gives no retention periods and describes sale and sharing of personal information, while the plans page says 'we don't collect or sell user data' (8). No deprecation policy. Dated notices exist from 2018 only (5). The policy names categories of service providers, with no list or locations. The geocoding docs name TomTom for international queries (3).

Nominatim 59

Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.

MapQuest 28

REST uses API keys, several per account, created in the dashboard or by API. The MCP server uses OAuth with one scope, mcp:tools. That earns 20, less 10 because the key query parameter is the documented way to send the secret (10). No key scopes, referrer or IP restrictions, or read-only mode found in the docs (3). Place and address text is returned with no prompt-injection guidance (7). The usage endpoint reports transactions by key, service and hour (8). No security.txt, disclosure policy, bug bounty or certification found (0).

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.

MapQuest 60

The MCP page names 13 tools. Their definitions were not read, so context cost is scored from the count and from REST controls such as maxResults, thumbMaps=false and outFormat (15). Place search pages with pageSize 1 to 50 and filters by category, circle, bounding box or corridor (16). Status codes are documented, with geocoding and directions errors carried in the response body and problem+json on the Account API (12). Most calls read and are safe to retry. Data Manager writes have no idempotency key, and MCP annotations were not read (10). Geocoding needs only key and location. The only current SDKs are browser libraries (7).

Nominatim 75

API reading. limit, addressdetails, extratags, namedetails and the polygon options size responses, and geocodejson, geojson and jsonv2 formats are available (22). countrycodes, viewbox, bounded, layer, featureType and exclude_place_ids filter results, the last one standing in for pagination (18). Bad parameters return an error rather than a silent default in current versions, but there's no error code reference (12). Every endpoint reads and is safe to retry (15). Few required parameters, and the Python library exposes the same search API in-process, but there are no other official clients (8). 22+18+12+15+8 = 75.