Meteosource Weather MCP vs Xweather Weather API

Meteosource Weather MCP 35

status.meteosource.com wasn't reachable (0). No history (5). Daily call quotas per plan, and the README's plans-and-limits section (15). Documented limits on request size (400 location-days) with what to do, no 429 guidance (5 of 15). No SLA found (0). Version 0.1.2, not labelled beta (10). 0 + 5 + 15 + 5 + 0 + 10 = 35.

Xweather Weather API 84

Graded as a hosted service. Status page at status.xweather.com on Atlassian Statuspage with 21 components, among them API General, Conditions, Forecasts, Alerts, Lightning Endpoints and MCP Server (20). Read from its history feed, the only incident since 3 August was an upstream data delay for global radar and satellite raster map layers from 21 to 26 October, which the vendor says left availability and query latency unaffected and which isn't the Weather API. Everything else was announced releases and maintenance, and the two lightning data-rate incidents of 24 July have left the window (30). Monthly quotas are published, 15,000 and 1,000,000 accesses, but the per-minute limit is given only in response headers and by support (8 of 15). 429 is documented with the codes maxhits_min and maxhits, the OpenAPI file declares Retry-After, seven X-RateLimit-* headers report the remaining allowance, the MCP docs advise exponential backoff, and failed calls are not charged. The API is read-only, so no idempotency keys are needed (13 of 15). The pricing page mentions custom SLA guarantees for enterprise plans, with no SLA document found (3 of 10). The REST API at 1.45.0 and the MCP server at 1.3.0 are generally available (10).

Meteosource Weather MCP 32

The repository is MIT (copyright 2026 Meteosource) but holds docs and the registry manifest rather than the server; terms and privacy URLs weren't found (10 of 30). The MCP page says keys aren't stored in full and caches are per key (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 10 + 10 + 0 + 5 = 25.

Xweather Weather API 69

Closed service under Vaisala's group subscription terms, dated 1 January 2023, which set a liability cap of twelve months' fees and ICC arbitration. They are written for annual, invoiced contracts and leave the product's own rules to service descriptions that were not found in public. The OpenAPI files and agent skills are MIT (15 of 30). The privacy policy is the group policy effective 1 June 2020. It covers online services, keeps data for a period it calls reasonable with no figure, and still cites the US Privacy Shield. No DPA was found (12 of 30). The changelog marks deprecations with dates, the API has deprecated and warn_deprecated codes, and the terms promise notice of modifications with a 30-day right to end the contract after a material reduction. No notice period is stated (8 of 20). A data processors page names about 40 processors with a location for each, with a caveat that it may be incomplete (16 of 20).

Meteosource Weather MCP 72

Seven tools read from tools/list with JSON Schema inputs (25). No llms.txt found; the README is Markdown on GitHub (5 of 10). Descriptions say what each returns and which plan it needs (15 of 20). Typed inputs, no enums (10 of 15). A README table of error messages and fixes (10 of 15). Tagged releases v0.1.0 to v0.1.2, no changelog file (7 of 15). 25 + 5 + 15 + 10 + 10 + 7 = 72.

Xweather Weather API 83

OpenAPI 3.2.0 and 3.1.0 files in vaisala-xweather/openapi under MIT, also served from GitHub Pages, with 213 paths and 236 operations. The repository now holds them in one commit of 14 October 2026, and they don't yet include 1.45.0's /roadweather/alerts. The MCP tools' input schemas need a key to list and were not read (25). llms.txt at www.xweather.com/llms.txt indexes the site and docs pages. The docs pages have no Markdown copies (a .md address returns 404), though six agent skills in Markdown cover request building (8 of 10). Every operation and parameter in the OpenAPI file has a description, and the MCP tool pages state each tool's purpose and limits, such as a 24-hour tool marked as not for multi-day forecasts (16 of 20). The file has 9 enums and 10 required parameters among 2,289 parameter uses, and filter, query and sort are free strings with their own grammar (8 of 15). Each operation declares 200, 401, 404, 429 and 500 with examples, and the docs list 16 error codes and the warning codes (13 of 15). Dated, numbered changelogs for the API and the MCP server. The API path carries no version (13 of 15).

Meteosource Weather MCP 70

Repository commit and tag v0.1.2 on 26 October 2026 (30). Three tags in 90 days (20). Repository issues not read (0). Official registry entry com.meteosource/weather (15). Small repository with server.json; server source not public (5 of 10). 30 + 20 + 0 + 15 + 5 = 70. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Xweather Weather API 81

The newest API release is 1.45.0 on 21 October 2026, 11 days before this check, after 1.44.0 on 30 September (30). Since 3 August the API shipped 1.43.4, 1.43.5, 1.44.0 and 1.45.0, the MCP server 1.3.0 on 27 October, and the agent skills repository releases 0.14.1 to 0.15.4 between 1 September and 26 October (20). Public changelogs, a ticket form and support@xweather.com, with community support on the free tier and priority email on the paid plan. Response times were not tested (10 of 15). The MCP server is in the official registry as com.xweather/weather, active, though the entry still shows 1.2.2 (15). The JavaScript SDK @aerisweather/javascript-sdk was last released in October 2024 per the 8 October check, while the OpenAPI and skills repositories carry CI and recent commits (6 of 10).

Meteosource Weather MCP 42

One API key per account in a header, never in the URL (20 of 30). All tools are reads (10 of 20). Weather data only, no third-party text (10). No audit log (0). No security programme found (2 of 20). Keys travel to the hosted server, which says it doesn't store them in full. 20 + 10 + 10 + 0 + 2 = 42.

Xweather Weather API 52

Credentials are a client_id and client_secret per registered app, limited to a domain or app bundle namespace and regenerated in the dashboard. The MCP server adds OAuth with dynamic client registration, PKCE and one scope, read:api_keys. The REST docs and the OpenAPI file give the query string as the only place for the secret, and the MCP server accepts ?api_key= and, since 1.3.0, the key in the URL path (22 less 10, 12 of 30). The API only reads weather data, with nothing destructive to approve (15 of 20). Responses are mostly numeric. Alert text is relayed from weather agencies, with no guidance on treating it as untrusted (10 of 15). Cost and quota headers come back on each call. No per-call log for the account holder was found in the docs (4 of 15). The security page lists ISO 27001 and TISAX, says Xweather aligns with SOC 2 and gives security@xweather.com, with no report linked and no bounty. xweather.com has no security.txt, while the parent vaisala.com has one with a policy link (11 of 20).