Meteosource Weather MCP vs Tomorrow.io Weather API

Meteosource Weather MCP 70

Repository commit and tag v0.1.2 on 26 October 2026 (30). Three tags in 90 days (20). Repository issues not read (0). Official registry entry com.meteosource/weather (15). Small repository with server.json; server source not public (5 of 10). 30 + 20 + 0 + 15 + 5 = 70. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Tomorrow.io Weather API 27

The newest release-note entry is October 2026, dated by month only, with the Bulk Timelines API, Density Altitude and new probability layers, a Dew Point Depression core layer and new aviation altitudes. A month-only entry is dated to its month, and October runs 4 to 34 days back, so it can't show a change within 30 days (20). The page was last updated on 13 October 2026, and the 8 October check saw July as the newest entry. That is one dated entry since 6 August, not three (0). Release notes with five entries in thirteen months, a status page updated several times a week, and a help centre that answered 403 on 8 October, not re-read. The community repository on GitHub was last pushed in April 2021, per the 8 October check (7 of 15). No official SDK, and no registry presence read in this run (0). No packages to assess (0). 20 + 0 + 7 + 0 + 0 = 27.

Meteosource Weather MCP 35

status.meteosource.com wasn't reachable (0). No history (5). Daily call quotas per plan, and the README's plans-and-limits section (15). Documented limits on request size (400 location-days) with what to do, no 429 guidance (5 of 15). No SLA found (0). Version 0.1.2, not labelled beta (10). 0 + 5 + 15 + 5 + 0 + 10 = 35.

Tomorrow.io Weather API 60

Graded as a hosted service. Status page at status.tomorrow.io on Atlassian Statuspage, with 22 components on its history page, among them Timeline API, Historical API, Alerts API and Gale AI (20). The history pages list 37 incidents between 7 August and 3 November 2026, most of them stale or degraded data for a region or product. Two are labelled major. Recently created insights and monitors produced stale data on 12 August (12:46 to 16:30 UTC, Insights API and Alerts API), and Next Gen FOCUS regional forecast data was missing for some regions on 14 August (15:15 to 01:00 UTC, CONUS unaffected). Each hit one product or a set of regions, so both read as partial and the record is minor incidents only (20). The rate-limit page says limits are per hour and day by plan and gives no numbers (0 of 15). 429 is documented for a passed limit, and the errors page gives Retry-After and 'wait and retry' for 503, with no idempotency keys or safe-retry guidance on the location, insight and alert writes, so Retry-After alone (10). The pricing page lists Custom SLAs on Enterprise and its title claims 99.9% uptime, but no SLA document was found, and a listed SLA nobody could read gives 0 (0). Version 4 of the REST API is generally available (10). 20 + 20 + 0 + 10 + 0 + 10 = 60.

Meteosource Weather MCP 32

The repository is MIT (copyright 2026 Meteosource) but holds docs and the registry manifest rather than the server; terms and privacy URLs weren't found (10 of 30). The MCP page says keys aren't stored in full and caches are per key (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 10 + 10 + 0 + 5 = 25.

Tomorrow.io Weather API 53

Closed service under subscription terms at www.tomorrow.io/legal/terms-of-service/. robots.txt on www.tomorrow.io closes /legal/ to every reader, as our policy reader recorded on 8 October, so the 8 October readings of the terms, the product privacy policy and the data sources page are struck. The terms are published but unread on a host that refuses us, which keeps the licence line at 15, as for linkedin-marketing-api and figma-mcp. The plans page footer names The Tomorrow Companies Inc. in Boston (15 of 30). Data handling rested only on the struck privacy reading, and no docs page states retention or deletion, so the line is 0, as struck evidence is for x-mcp and hexis (0 of 30). The versioning policy promises notice far in advance of a breaking change with no period, and the docs mark the best timestep as deprecated without a date (6 of 20). Subprocessors and data locations rested only on the struck privacy and data sources readings (0 of 20). 15 + 0 + 6 + 0 = 21.

Meteosource Weather MCP 30

No machine payment protocol (0). Plan prices with daily call quotas, public (10). Free plan with 400 calls a day, no card (20). A person signs up in a browser for the key (0). 0 + 10 + 20 + 0 = 30.

Tomorrow.io Weather API 20

No x402, MPP or L402 in the docs or the OpenAPI file. A 402 response exists for spent tokens, with no payment protocol behind it (0). The plan table is public and lists what Free includes, but Enterprise is by quote and token prices for the Historical API aren't published (5 of 20). A free plan with a 5-day forecast, 24 hours of history, one monitored location and one alert. The pages read name no card or payment step, but the signup form is a script-rendered app we couldn't read (15 of 20). A person signs up in a browser. The MCP OAuth flow registers clients by API but still needs a human login (0). 0 + 5 + 15 + 0 = 20.

Meteosource Weather MCP 42

One API key per account in a header, never in the URL (20 of 30). All tools are reads (10 of 20). Weather data only, no third-party text (10). No audit log (0). No security programme found (2 of 20). Keys travel to the hosted server, which says it doesn't store them in full. 20 + 10 + 10 + 0 + 2 = 42.

Tomorrow.io Weather API 34

The docs state that API keys carry full privileges, with one default key on the dashboard and more keys created by an account manager. The key may travel as an apikey query parameter, which the OpenAPI file declares as the scheme, or as a header. The MCP endpoint also advertises OAuth with dynamic client registration, PKCE (S256) and one scope, mcp:read, in its live metadata, which the MCP docs page doesn't mention (12 of 30, after the 10-point deduction for a secret in the URL). Weather calls only read, the OAuth scope is read-only, and the key can also create, change and delete locations, insights and alerts with no confirmation step (10 of 20). Responses are mostly numeric fields. Gale AI returns generated text and the feeds carry third-party event text, with no guidance on treating it as untrusted (8 of 15). An X-Correlation-ID on every response and an Activity section in the dashboard for webhooks. No per-call log was found in the docs (4 of 15). No security.txt (404 on www on 4 November 2026, and on the apex and api hosts per the 8 October check), and no disclosure policy, bounty or certification found on the pages read or by a site search (0 of 20). 12 + 10 + 8 + 4 + 0 = 34.