MapTiler Cloud vs Woosmap

MapTiler Cloud 70

@maptiler/client 3.1.0 and @maptiler/sdk 4.2.0 on 2 October 2026, 35 days before this check, with the agent skill updated on 21 October (20). Platform updates entries for August (EU endpoint, key security) and September 2026 (terrain blending) plus the two October releases (20). A Discord community and support answered on a best-effort basis within two business days, per the Cloud terms. We didn't read GitHub issues (10). Official JavaScript client and SDK current, no Python client (12). The SDK repository runs unit and end-to-end tests in CI; we didn't check results (8). 20+20+10+12+8 = 70.

Woosmap 26

No dated API release, changelog or release note found. The newest dated activity we saw is the public woosmap-samples repository on 16 September 2026, which isn't an API release (10). No dated changes to count in the last 90 days (0). Support by email and a support centre, with no public changelog (5). Official JavaScript, iOS and Android SDKs exist, but we couldn't check their versions because the GitHub API was rate-limited and two SDK repository names didn't resolve; the MCP server isn't in the official MCP registry (8). The samples carry tests, per the rate-limits page (3). 10+0+5+8+3 = 26.

MapTiler Cloud 43

Hosted lines. status.maptiler.com is a StatusCake public uptime report rather than a component incident page (15). Its data loads from app.statuscake.com, whose robots.txt answered with a redirect, so we didn't fetch it and read no history. That's our limit, not a finding, and the rubric gives 5 (5). Monthly request and session quotas are published per plan, but no per-second limit (5). No 429, Retry-After or backoff guidance found in the API reference, the OpenAPI spec or llms-full.txt (0). The pricing page lists a 99.9% SLA on the Custom plan, while the Cloud terms call availability best effort and point to a custom SLA (8). The public APIs are GA (10). 15+5+5+0+8+10 = 43.

Woosmap 78

Hosted lines. Atlassian Statuspage at status.woosmap.com with seven components (Localities, Store Search, Geolocation, Distance, Address, Map and Indoor APIs) (20). The status home page lists no incidents from 23 October to 6 November 2026. The full history page loads by script and the site's robots.txt disallows /api/, so the rest of the 90 days wasn't read and the line is held between the unreadable and minor tiers (10). Each endpoint's reference states its own rate limit, such as 50 a second, shared by a project's keys (15). Every response carries RateLimit-Policy and RateLimit headers, and the rate-limits page says to wait t seconds after a 429, retry at most three times and back off 1, 2 and 4 seconds when the header is missing, with sample code (15). A 99.9% SLA on the Enterprise plan per the pricing page; we didn't read its terms (8). GA (10). 20+10+15+15+8+10 = 78.

MapTiler Cloud 80

Editorial half only. Closed service with general and Cloud-specific terms under Swiss law, and SDKs under BSD 3-Clause and the skill under MIT (20). The privacy policy covers account and payment data and says legal-claim data is kept up to 10 years, but says nothing about how long API request logs are kept (15). A dated deprecation page for v3 maps and migration guides, with no written notice period (12). Hosting with OVHcloud and Google Firebase, data mainly in Switzerland and the EEA, and an EU-only endpoint. Google Analytics, Firebase and FastSpring named in the privacy policy (17). 20+15+12+17 = 64.

Woosmap 54

Editorial half only. Closed service under online terms that name WOOSMAP SAS of Montpellier and the Commercial Court of Paris (15). The privacy policy covers website visitors only, and we found no statement on how long API request data is kept (5). The pricing page says the Address API is 'being deprecated for Pro Plan subscriptions', with no date (5). The legal notice says the site is hosted by Amazon Web Services; no sub-processor list or data location for the APIs was found (6). 15+5+5+6 = 31.

MapTiler Cloud 64

Revocable keys that can be limited to origins and a User-Agent substring and managed by the API keys API, and service tokens that sign requests so the token itself never travels, which earns 27. Less 10 because the key is 'always passed as a query parameter' (17). The public APIs are read-only, and account changes need a separate service token (16). Geocoding returns OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). An Analytics API and account usage statistics (8). security.txt, a vulnerability disclosure policy and ISO/IEC 27001:2022 certification per the security page. No bug bounty found (16). 17+16+7+8+16 = 64.

Woosmap 43

Public keys are read-only and must carry a domain or IP restriction. Private keys are read-only or read and write (fixed at creation), restricted by IP, iOS or Android, and can go in an X-Api-Key header. Less 10 because private_key in the query string is a documented option and the default in the spec (17). Read-only keys and the read/write split give least privilege; no confirmation step on dataset deletes was found (16). find_nearby and get_place_details return public POI data, ratings and opening hours, with no prompt-injection guidance (7). Console usage per project wasn't checked (3). www.woosmap.com/.well-known/security.txt returns 404, and we found no disclosure policy, bug bounty or certification (0). 17+16+7+3+0 = 43.

MapTiler Cloud 40

No x402, MPP or L402 (0). Per-1,000 prices for requests ($0.15) and sessions ($2.50) public without login (20). Free plan with no card, though only for testing and non-commercial use (20). Signup is a browser flow (0). 0+20+20+0 = 40.

Woosmap 30

No x402, MPP or L402 (0). Plans and per-API tier breakpoints are public, but per-request prices sit in a script-driven calculator we couldn't read, so plan-only credit (10). Free plan up to 10,000 requests a month with 'No Credit Card Required' (20). A person signs up and creates a key in the console (0). 0+10+20+0 = 30.

MapTiler Cloud 70

API reading. limit, types, bbox, proximity, country, language and fuzzyMatch size geocoding results, and the batch endpoint takes up to 50 queries (20). Country, bbox and type filters, no pagination (geocoding rarely needs it) (16). Errors are documented as 400 and 403 with no recovery guidance (10). Every public API reads and is safe to retry (12). Few required parameters, but official clients are JavaScript and TypeScript only, plus native mobile SDKs (12). 20+16+10+12+12 = 70.

Woosmap 76

API reading, with the hosted MCP server's nine tools as a second surface. Localities and Stores responses can be narrowed by type, components and fields, and the MCP set is small (20). Store search takes query filters, radius and paging, and the Distance Matrix has an async mode for large jobs (17). Documented error codes including 402 for billing and 429 with reset timing (17). Reads are safe to retry, but no idempotency key was found for the Datasets and Stores write endpoints, and the MCP docs don't mention tool annotations (10). Official JavaScript, iOS and Android SDKs and samples in Python and JavaScript, with few required parameters (12). 20+17+17+10+12 = 76.