MapTiler Cloud vs TomTom Maps APIs + MCP

MapTiler Cloud 43

Hosted lines. status.maptiler.com is a StatusCake public uptime report rather than a component incident page (15). Its data loads from app.statuscake.com, whose robots.txt answered with a redirect, so we didn't fetch it and read no history. That's our limit, not a finding, and the rubric gives 5 (5). Monthly request and session quotas are published per plan, but no per-second limit (5). No 429, Retry-After or backoff guidance found in the API reference, the OpenAPI spec or llms-full.txt (0). The pricing page lists a 99.9% SLA on the Custom plan, while the Cloud terms call availability best effort and point to a custom SLA (8). The public APIs are GA (10). 15+5+5+0+8+10 = 43.

TomTom Maps APIs + MCP 15

TomTom's API status page sits on tomtom.service-now.com, whose robots.txt disallows every path on 4 November, so the earlier status readings are struck (0). With no history we may read, the record scores 5. No published QPS limits or 429 guidance were found on the docs pages we read on 1 October; TomTom's acceptable use policy now bars robots from its websites, so they weren't re-read (0). The MCP maps a 429 to a typed rate-limit error with a message, and we found nothing on Retry-After (5, the earlier partial kept). No SLA found (0). Orbis APIs went GA on 8 July 2026, but the remote MCP server is in public preview and the README says some Orbis and EV services may not be enabled on every account (5, kept). 0+5+0+5+0+5 = 15.

MapTiler Cloud 80

Editorial half only. Closed service with general and Cloud-specific terms under Swiss law, and SDKs under BSD 3-Clause and the skill under MIT (20). The privacy policy covers account and payment data and says legal-claim data is kept up to 10 years, but says nothing about how long API request logs are kept (15). A dated deprecation page for v3 maps and migration guides, with no written notice period (12). Hosting with OVHcloud and Google Firebase, data mainly in Switzerland and the EEA, and an EU-only endpoint. Google Analytics, Firebase and FastSpring named in the privacy policy (17). 20+15+12+17 = 64.

TomTom Maps APIs + MCP 58

Closed APIs with an Apache-2.0 MCP server. The developer terms page still renders client-side on 4 November, and TomTom's acceptable use policy (linked from its Terms of Use of 1 September 2025) bars data mining, robots and scraping on all TomTom websites, so the privacy and deprecation pages weren't re-read. Licence clarity 10, data handling 11 of 30, deprecation 8 and subprocessors 12 of 20 stand per the 2 October check, not re-read on 4 November. 10+11+8+12 = 41.

MapTiler Cloud 70

@maptiler/client 3.1.0 and @maptiler/sdk 4.2.0 on 2 October 2026, 35 days before this check, with the agent skill updated on 21 October (20). Platform updates entries for August (EU endpoint, key security) and September 2026 (terrain blending) plus the two October releases (20). A Discord community and support answered on a best-effort basis within two business days, per the Cloud terms. We didn't read GitHub issues (10). Official JavaScript client and SDK current, no Python client (12). The SDK repository runs unit and end-to-end tests in CI; we didn't check results (8). 20+20+10+12+8 = 70.

TomTom Maps APIs + MCP 86

MCP v1.6.15 on 2 November 2026 (30). Eight tags since 6 August, v1.6.8 (15 September) to v1.6.15 (2 November) (20). Pull requests from several maintainers merged up to 3 November 2026. We couldn't see issue reply times from git (18, kept). The package is at 1.6.15 in its repository; the 30 September note that it wasn't in the official MCP registry came from the registry's JSON API and is struck (8, kept). CI runs type checks, lint, build, end-to-end tests and a Veracode scan, with dependabot (10). 30+20+18+8+10 = 86.

MapTiler Cloud 40

No x402, MPP or L402 (0). Per-1,000 prices for requests ($0.15) and sessions ($2.50) public without login (20). Free plan with no card, though only for testing and non-commercial use (20). Signup is a browser flow (0). 0+20+20+0 = 40.

TomTom Maps APIs + MCP 25

No x402, MPP or L402 (0). Free allowances are public, but the pricing page re-read on 2 October showed no paid rate as a number, only a euro estimator and a contact-sales link (5 of 20, kept). A no-card free allowance of 20,000 geocodes, 20,000 reverse geocodes and 20,000 routes a month, with Search and Matrix at 2,500 (20). Signup is a browser flow (0). The pricing page is on a host whose acceptable use policy now bars robots, so it wasn't re-read on 4 November. 0+5+20+0 = 25.

MapTiler Cloud 64

Revocable keys that can be limited to origins and a User-Agent substring and managed by the API keys API, and service tokens that sign requests so the token itself never travels, which earns 27. Less 10 because the key is 'always passed as a query parameter' (17). The public APIs are read-only, and account changes need a separate service token (16). Geocoding returns OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). An Analytics API and account usage statistics (8). security.txt, a vulnerability disclosure policy and ISO/IEC 27001:2022 certification per the security page. No bug bounty found (16). 17+16+7+8+16 = 64.

TomTom Maps APIs + MCP 51

API keys from the developer portal, limited to the products selected for them, which earns 25. Less 10 because REST calls take the key as the key query parameter. The hosted MCP takes a tomtom-api-key header, and the source carries OAuth with an audience check that 1.6.13 made mandatory for OAuth deployments (15). Keys can be limited by product and every tool reads (16). Results include POI names and traffic incident text with no prompt-injection guidance. An app-only tool, tomtom-get-api-key, returns the raw key to the map app; since 1.6.12 clients that render no apps don't receive it (6, kept). We didn't find per-call logs or usage reporting we could read (0). HackerOne disclosure programme with a 3 business day first response in the organisation's SECURITY.md, Veracode scanning in CI, and no security.txt per the 30 September check (14, kept). 15+16+6+0+14 = 51.

MapTiler Cloud 79

OpenAPI 3.1.0 document with 32 paths for the public APIs (25). llms.txt, llms-full.txt and a Markdown twin of every page (10). Each API page says what it's for and when to use the SDK instead (session billing), with little on when not to call it (13). Parameters are typed with defaults, such as limit (default 5 forward, 1 reverse) and a types enum, but bbox and proximity are strings (11). Examples on every endpoint, and the spec documents 400, 403, 404 and 414, without an error reference page (10). A dated platform updates page and a geocoding index changelog, but no version in the API path and the spec is version '1.0' (10). 25+10+13+11+10+10 = 79.

TomTom Maps APIs + MCP 71

No public OpenAPI that we found. The MCP's tools have Zod schemas with described fields (22). docs.tomtom.com/llms.txt indexes about 180 pages, many as .md, per the 2 October check, not re-read on 4 November (10). Tool descriptions are mostly one line, with little on when not to use a tool (12). Typed fields with constraints, and since 1.6.12 the search, routing and EV tools list their valid values from the maps-sdk (11, kept). We couldn't read the REST error reference. The MCP returns typed errors per status code, and since 1.6.13 tells a 401 from a 403 (8). Versioned REST paths; the MCP CHANGELOG.md has dated entries from 1.6.11 (5 October 2026) to 1.6.14 and says 1.1.1 to 1.6.10 have none (8, kept). 22+10+12+11+8+8 = 71.