NextBillion.ai vs Radar

NextBillion.ai 45

Hosted lines, for the REST APIs at api.nextbillion.io and the hosted MCP server. A status page at status.nextbillion.io, 'NextBillion.AI API Status', renders only in a browser, and its Statuspage-style JSON paths return 404, so we couldn't see its components (10) or read any history. That's our limit, not a finding, and the rubric gives 5 (5). The API reference states 2,400 queries a minute, or 40 a second, for continuous requests (15). Each endpoint's error table lists 429 as 'QPM or API request count quota reached', with no Retry-After or backoff guidance (5). No SLA found; the terms say access isn't warranted to be uninterrupted (0). The REST APIs are GA. The MCP server is at version 0.5.3 (10). 10+5+15+5+0+10 = 45.

Radar 70

Read with the hosted lines. status.radar.com is a Statuspage site with components for the Geocoding, Search, Routing, Maps, Track and Trips APIs among others (20). Its history feed lists two incidents in the 90 days to 4 November 2026. Elevated API errors on 27 August from 19:31 to 20:34 EDT, and elevated API latencies on 23 October from 11:52 to 14:57 EDT, traced to a Cloudflare incident. Neither states the share of failed requests, and this run reads "elevated" errors or latencies as partial, so both are minor (20). Each operation states a default rate limit, 100 requests a second for geocoding down to 10 for matrix and the data operations (15). 429 is documented with three meanings, with no Retry-After header or backoff guidance found, and PUT upserts keyed on tag and externalId make geofence writes repeatable (5, partial kept). No SLA is published (0). The APIs carry no beta label (10). 20 + 20 + 15 + 5 + 0 + 10 = 70.

NextBillion.ai 73

No OpenAPI document for the REST APIs was found in llms.txt or the docs. The hosted MCP server's 27 tools are defined with Zod schemas, so they carry typed JSON Schema inputs (15 of 25). llms.txt, llms-full.txt and a Markdown file for each docs page (10). Endpoint pages explain each parameter, and MCP tool descriptions say when not to use a tool, such as the geometry tools being straight-line rather than road distance (16). Parameter tables give types, allowed values and defaults, such as types and limit (default 10), though in packs several filters into one string (12). curl examples and a per-endpoint error table with causes (13). The MCP server has a dated changelog. No API changelog or versioned path was found (7). 15+10+16+12+13+7 = 73.

Radar 50

No OpenAPI description or other machine-readable contract was found in the docs index (0). docs.radar.com publishes llms.txt and a Markdown twin of each page, with the whole API reference in one Markdown file of about 154 KB (10). Descriptions say what an operation is for and sometimes when to use another, for example forward geocoding for complete addresses and autocomplete for partial ones (14). Parameters are listed with type, required or optional, ranges and allowed values, though coordinate lists travel as pipe-delimited strings and there is no schema to validate against (11). Every operation has a sample request and response, and there is one list of 12 response codes with one sample error (11). Paths carry /v1, and no API changelog was found (4). 0 + 10 + 14 + 11 + 11 + 4 = 50.

NextBillion.ai 77

MCP reading, since the hosted server is the agent surface. 27 tools, four of them for documentation and seven local geometry tools, with shapes simplified to a 500-vertex budget to save context (18). limit, types, country, bbox and circle filters, and batch geocoding of up to 100 queries (16). The error table explains each code, and the MCP masks the key in error text (15). Every API tool is marked readOnlyHint, idempotentHint and not destructive in the source (18). Few required parameters and explicit latitude and longitude objects, but no official server-side SDK, only mobile and web map SDKs (10). 18+16+15+18+10 = 77.

Radar 65

Read as an API. limit on search operations (1 to 100), layers and country filters on geocoding, and optional geometry on route optimisation size a response, with no field selection (14). List operations page with limit up to 1,000 and date cursors such as updatedBefore (16). Errors are JSON with code, param and message, and every response carries X-Radar-Request-ID (15). The maps operations only read. Geofence and beacon writes are PUT upserts by external ID, and no idempotency key was found for trip or user creation (10). Most maps calls need one parameter. Official SDKs cover web, iOS, Android and five cross-platform frameworks, all client-side, with no server library found (10). 14 + 16 + 15 + 10 + 10 = 65.

NextBillion.ai 46

The REST APIs take a single key query parameter, so a plain key that travels in URLs, which earns 20 less 10. The MCP server adds OAuth 2.1 with PKCE, seals the key into tokens with AES-256-GCM, accepts a Bearer header and stores nothing server-side, so 5 back (15). Every tool is read-only, and keys can carry an IP allowlist (12). Places results are POI and address text with no prompt-injection guidance (7). Usage alerts at 50, 75 and 90 per cent of credits, per the pricing FAQ. No per-call log found (5). /.well-known/security.txt returns 404, and we found no disclosure policy or bug bounty. The about page says the company follows ISO 27001 standards, without naming a certificate (7). 15+12+7+5+7 = 46.

Radar 56

Four keys a project, test and live, publishable and secret, sent in the Authorization header only. A secret key can read or write any data and no scopes were found. Key rotation was not read (20). Publishable keys reach only 16 of the 38 documented operations and can be restricted by website domain or mobile app identifier, and dashboard accounts have read, write, admin and owner roles. No confirmation step for deletes (10). Results are addresses and place names from open and commercial datasets, with no prompt-injection guidance (6). Audit logs cover dashboard requests on enterprise plans, and each API response has a request ID (7). security.txt answers 404 (4 November 2026). The FAQ gives a disclosure address, and the DPA states SOC 2 Type II, a yearly third-party penetration test and a bug bounty, with the report on request. The trust centre is script-drawn and was not read (13). 20 + 10 + 6 + 7 + 13 = 56.

NextBillion.ai 20

No x402, MPP or L402 (0). Pricing is by quote, with annual licences per order, asset or API call and no published unit price (0). A 7-day free trial with an API key and 'No credit card required' (20). A person signs up through the console or emails support for a key (0). 0+0+20+0 = 20.

Radar 10

No x402, MPP or L402 (0). The pricing page publishes starting prices without a login, $0.50 per 1,000 calls for Core Maps and $2.00 for Premium Maps, but every plan is an annual commitment at a rate set by quote (10). The pricing page says "Radar does not currently offer a free tier", and the technical validation period goes through sales (0). Keys come from a dashboard account, and the sign-up page was closed to us by robots.txt on 9 October, so no programmatic route was found (0). 0 + 10 + 0 + 0 = 10.