MapTiler Cloud vs OpenCage Geocoding API

MapTiler Cloud 43

Hosted lines. status.maptiler.com is a StatusCake public uptime report rather than a component incident page (15). Its data loads from app.statuscake.com, whose robots.txt answered with a redirect, so we didn't fetch it and read no history. That's our limit, not a finding, and the rubric gives 5 (5). Monthly request and session quotas are published per plan, but no per-second limit (5). No 429, Retry-After or backoff guidance found in the API reference, the OpenAPI spec or llms-full.txt (0). The pricing page lists a 99.9% SLA on the Custom plan, while the Cloud terms call availability best effort and point to a custom SLA (8). The public APIs are GA (10). 15+5+5+0+8+10 = 43.

OpenCage Geocoding API 85

Instatus page at status.opencagedata.com, measured by StatusCake, with forward geocoding, reverse geocoding, geosearch, the website and email sending as components (20). The incident history feed, read on 1 November 2026, lists nothing since the 26 June 2026 email outage, so the last 90 days are clean (30). Free trial limits of 2,500 a day and 1 a second, and per-second rates for each paid plan (15). 402 for a spent quota and 429 for going too fast are separate codes, and free and one-time plans get X-RateLimit-Limit, -Remaining and -Reset. There's no backoff guidance beyond '408 means try again' (10). No SLA found (0). GA (10).

MapTiler Cloud 64

Revocable keys that can be limited to origins and a User-Agent substring and managed by the API keys API, and service tokens that sign requests so the token itself never travels, which earns 27. Less 10 because the key is 'always passed as a query parameter' (17). The public APIs are read-only, and account changes need a separate service token (16). Geocoding returns OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). An Analytics API and account usage statistics (8). security.txt, a vulnerability disclosure policy and ISO/IEC 27001:2022 certification per the security page. No bug bounty found (16). 17+16+7+8+16 = 64.

OpenCage Geocoding API 44

Plain revocable keys that can be disabled or tied to IP addresses, which earns 20 with 2 back for the IP rules. Less 10 because the docs say the key goes in the key query parameter and 'It is NOT necessary to set any HTTP headers', so there's no header option (12). The API only reads, so there's nothing to approve (15). Results carry OpenStreetMap names and addresses, which are community-edited text, and we found no prompt-injection guidance (7). The MCP's get-opencage-info tool reports usage and rate state. We didn't check the dashboard's per-call visibility (3). A security policy page, a security@opencagedata.com contact and a SECURITY.md on GitHub. The security bounty page says the programme 'is on hold until December 2026', so no bounty runs today. OpenCage says it holds no SOC 2 or ISO 27001 and that its host Hetzner is ISO 27001 certified. security.txt couldn't be checked because robots.txt blocks it. That is below contactsplus (8, discretionary bounties running) (7).

MapTiler Cloud 70

API reading. limit, types, bbox, proximity, country, language and fuzzyMatch size geocoding results, and the batch endpoint takes up to 50 queries (20). Country, bbox and type filters, no pagination (geocoding rarely needs it) (16). Errors are documented as 400 and 403 with no recovery guidance (10). Every public API reads and is safe to retry (12). Few required parameters, but official clients are JavaScript and TypeScript only, plus native mobile SDKs (12). 20+16+10+12+12 = 70.

OpenCage Geocoding API 86

Three compact MCP tools, and the API sizes its output with limit, no_annotations, abbrv and address_only (25). countrycode, bounds, proximity and min_confidence narrow results. No pagination, which a geocoder rarely needs (18). Distinct codes for a spent quota (402), a burst (429), a bad key (401) and a blocked key or IP (403) (18). Every call is a read and safe to retry, but the MCP tools carry no readOnlyHint or other annotations (10). One required parameter, sensible defaults, and official Python (3.5.0) and JavaScript (2.2.0) clients (15).

MapTiler Cloud 70

@maptiler/client 3.1.0 and @maptiler/sdk 4.2.0 on 2 October 2026, 35 days before this check, with the agent skill updated on 21 October (20). Platform updates entries for August (EU endpoint, key security) and September 2026 (terrain blending) plus the two October releases (20). A Discord community and support answered on a best-effort basis within two business days, per the Cloud terms. We didn't read GitHub issues (10). Official JavaScript client and SDK current, no Python client (12). The SDK repository runs unit and end-to-end tests in CI; we didn't check results (8). 20+20+10+12+8 = 70.

OpenCage Geocoding API 86

The newest API changelog entry is 15 October 2026 (SMDG port terminal codes), and the Python SDK released 3.5.0 on 28 October 2026, both within 30 days (30). Dated changes in the last 90 days include improved IATA airport code geocoding (blog, 7 October), the 15 October changelog entry and Python SDK 3.5.0, with spreadsheet upload improvements on 14 August (20). Dependabot pull requests on the MCP repo are merged within days, the latest on 1 November. We couldn't see issue reply times from git (15). In the official MCP registry as io.github.OpenCageData/opencage-geocoding-mcp, and the Python SDK is current at 3.5.0 (15). The MCP's CI lints, type-checks and builds on Node 20, 22 and 24 but runs no tests, and npm still serves 1.0.3 from 11 September 2025 while the repo is at 1.0.5 (6).

MapTiler Cloud 40

No x402, MPP or L402 (0). Per-1,000 prices for requests ($0.15) and sessions ($2.50) public without login (20). Free plan with no card, though only for testing and non-commercial use (20). Signup is a browser flow (0). 0+20+20+0 = 40.

OpenCage Geocoding API 35

No x402, MPP or L402 (0). Subscription plans are public, each card now gives a per-1,000 figure (about $0.17 on X-Small to $0.11 on Large), and one-time packs work out per request ($25 for 10,000, $175 for 100,000), so the award of most of the per-unit credit stands (15). A 2,500-a-day free trial with no card, for testing only (20). Signup is a browser flow (0).

MapTiler Cloud 80

Editorial half only. Closed service with general and Cloud-specific terms under Swiss law, and SDKs under BSD 3-Clause and the skill under MIT (20). The privacy policy covers account and payment data and says legal-claim data is kept up to 10 years, but says nothing about how long API request logs are kept (15). A dated deprecation page for v3 maps and migration guides, with no written notice period (12). Hosting with OVHcloud and Google Firebase, data mainly in Switzerland and the EEA, and an EU-only endpoint. Google Analytics, Firebase and FastSpring named in the privacy policy (17). 20+15+12+17 = 64.

OpenCage Geocoding API 85

Closed service with clear terms, an MIT MCP server and open-source SDKs (20). Results may be stored permanently, even after cancelling. Query logs are deleted after six months and never used to train AI, no_record turns query logging off, and the DPA is public on GitHub. The GDPR page was updated 22 July 2026 with its change history (30). A dated API changelog that announces deprecations, such as the jsonp parameter on 11 May 2026, which keeps working for existing customers. No written deprecation policy (14). Seven subprocessors with locations, and hosting at Hetzner in Germany and Finland with backups in Switzerland (20).