MapTiler Cloud vs Stadia Maps

MapTiler Cloud 64

Revocable keys that can be limited to origins and a User-Agent substring and managed by the API keys API, and service tokens that sign requests so the token itself never travels, which earns 27. Less 10 because the key is 'always passed as a query parameter' (17). The public APIs are read-only, and account changes need a separate service token (16). Geocoding returns OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). An Analytics API and account usage statistics (8). security.txt, a vulnerability disclosure policy and ISO/IEC 27001:2022 certification per the security page. No bug bounty found (16). 17+16+7+8+16 = 64.

Stadia Maps 40

Revocable keys per property with rotation through the Account Management API and a header option (Authorization: Stadia-Auth), which earns 25. Less 10 because api_key in the query string is a documented option (the authentication page re-read on 2 November calls it the simplest) and the OpenAPI document defines only that scheme (15). The APIs only read, but keys aren't scoped to particular APIs (12). Results carry OpenStreetMap names, websites and opening hours, which are community-edited text, and we found no prompt-injection guidance (7). Dashboard usage and billing threshold alerts added on 20 August 2026 (6). stadiamaps.com/.well-known/security.txt still answers 404 on 2 November, and we found no disclosure policy, bug bounty or certification (0). 15+12+7+6+0 = 40.

MapTiler Cloud 43

Hosted lines. status.maptiler.com is a StatusCake public uptime report rather than a component incident page (15). Its data loads from app.statuscake.com, whose robots.txt answered with a redirect, so we didn't fetch it and read no history. That's our limit, not a finding, and the rubric gives 5 (5). Monthly request and session quotas are published per plan, but no per-second limit (5). No 429, Retry-After or backoff guidance found in the API reference, the OpenAPI spec or llms-full.txt (0). The pricing page lists a 99.9% SLA on the Custom plan, while the Cloud terms call availability best effort and point to a custom SLA (8). The public APIs are GA (10). 15+5+5+0+8+10 = 43.

Stadia Maps 63

Instatus page with 27 components across maps, routing, geocoding and data APIs, plus RSS and Atom history back to April 2025 (20). One incident in the 90 days to 2 November (history feed re-read on 2 November), on 25 September 2026, when a software update on edge nodes caused elevated request errors "in the initial deployment regions" across 24 listed components from 10:20 to 10:22 UTC before it was rolled back. Limited to some regions and two minutes, so minor (20). The FAQ says there's no fixed requests-a-second limit and the cap is the monthly credit pool, with credits per call published (12). A 429 is what you get when credits run out until the next cycle, with no Retry-After and no backoff guidance, so an agent can't tell a spent month from a burst (3). No SLA. The terms say the service is provided as is (0). The APIs are GA, but the MCP server has no release (8). 20+20+12+3+0+8 = 63.

MapTiler Cloud 70

API reading. limit, types, bbox, proximity, country, language and fuzzyMatch size geocoding results, and the batch endpoint takes up to 50 queries (20). Country, bbox and type filters, no pagination (geocoding rarely needs it) (16). Errors are documented as 400 and 403 with no recovery guidance (10). Every public API reads and is safe to retry (12). Few required parameters, but official clients are JavaScript and TypeScript only, plus native mobile SDKs (12). 20+16+10+12+12 = 70.

Stadia Maps 80

Six MCP tools, pared down on 20 June 2025 'to save on context tokens' (25). size, layers, boundary filters and focus points on geocoding, and a bulk geocoding endpoint (18). The same 429 means a burst or a spent month, which costs a turn to work out (12). Every call reads, but the MCP tools carry no readOnlyHint or other annotations (10). Official generated SDKs in TypeScript and Python, with sensible defaults (15). 25+18+12+10+15 = 80.

MapTiler Cloud 70

@maptiler/client 3.1.0 and @maptiler/sdk 4.2.0 on 2 October 2026, 35 days before this check, with the agent skill updated on 21 October (20). Platform updates entries for August (EU endpoint, key security) and September 2026 (terrain blending) plus the two October releases (20). A Discord community and support answered on a best-effort basis within two business days, per the Cloud terms. We didn't read GitHub issues (10). Official JavaScript client and SDK current, no Python client (12). The SDK repository runs unit and end-to-end tests in CI; we didn't check results (8). 20+20+10+12+8 = 70.

Stadia Maps 80

Changelog entry on 26 October 2026, a forward geocoding fix for Unicode edge cases (30). 14 dated changelog entries between 12 August and 26 October 2026, among them the 20 October Static Maps rebuild and the 17 October geocoding data release (20). A public changelog and support desk, but the MCP repo's last commit is still 29 July 2025 on 2 November (10). Official TypeScript SDK v9.1.0 and Python SDK v8.1.0, both tagged 27 April 2026 and still the newest tags (15). SDK CI runs integration tests against the live API, but the MCP server has no CI, no tagged release, no npm package and no registry entry (5). 30+20+10+15+5 = 80.

MapTiler Cloud 79

OpenAPI 3.1.0 document with 32 paths for the public APIs (25). llms.txt, llms-full.txt and a Markdown twin of every page (10). Each API page says what it's for and when to use the SDK instead (session billing), with little on when not to call it (13). Parameters are typed with defaults, such as limit (default 5 forward, 1 reverse) and a types enum, but bbox and proximity are strings (11). Examples on every endpoint, and the spec documents 400, 403, 404 and 414, without an error reference page (10). A dated platform updates page and a geocoding index changelog, but no version in the API path and the spec is version '1.0' (10). 25+10+13+11+10+10 = 79.

Stadia Maps 86

Public OpenAPI 3.1.0 document at api.stadiamaps.com/openapi.yaml, version 11.1.0 (re-read on 2 November), from which the TypeScript and Python SDKs are generated (25). llms.txt at docs.stadiamaps.com, re-read on 2 November (10). The MCP's six tool descriptions say when not to use a tool, for example bulk-geocode warns against POI names (14). Zod inputs with minimums such as at least two route locations, but some fields are loose strings (12). Docs examples per endpoint. We didn't read an error reference (10). A dated public changelog with 14 entries between 12 August and 26 October 2026 and a Keep a Changelog file in each SDK (15). 25+10+14+12+10+15 = 86.