NextBillion.ai vs Stadia Maps

NextBillion.ai 20

No x402, MPP or L402 (0). Pricing is by quote, with annual licences per order, asset or API call and no published unit price (0). A 7-day free trial with an API key and 'No credit card required' (20). A person signs up through the console or emails support for a key (0). 0+0+20+0 = 20.

Stadia Maps 40

No x402, MPP or L402 (0). Credit costs per call and per-1,000-credit overage ($0.03, $0.02 and $0.015) published without login, re-read on 2 November (20). Free tier of 200,000 credits a month and a 14-day Professional trial without a credit card, though the free tier doesn't allow commercial use (20). Signup is a browser flow (0). 0+20+20+0 = 40.

NextBillion.ai 45

Hosted lines, for the REST APIs at api.nextbillion.io and the hosted MCP server. A status page at status.nextbillion.io, 'NextBillion.AI API Status', renders only in a browser, and its Statuspage-style JSON paths return 404, so we couldn't see its components (10) or read any history. That's our limit, not a finding, and the rubric gives 5 (5). The API reference states 2,400 queries a minute, or 40 a second, for continuous requests (15). Each endpoint's error table lists 429 as 'QPM or API request count quota reached', with no Retry-After or backoff guidance (5). No SLA found; the terms say access isn't warranted to be uninterrupted (0). The REST APIs are GA. The MCP server is at version 0.5.3 (10). 10+5+15+5+0+10 = 45.

Stadia Maps 63

Instatus page with 27 components across maps, routing, geocoding and data APIs, plus RSS and Atom history back to April 2025 (20). One incident in the 90 days to 2 November (history feed re-read on 2 November), on 25 September 2026, when a software update on edge nodes caused elevated request errors "in the initial deployment regions" across 24 listed components from 10:20 to 10:22 UTC before it was rolled back. Limited to some regions and two minutes, so minor (20). The FAQ says there's no fixed requests-a-second limit and the cap is the monthly credit pool, with credits per call published (12). A 429 is what you get when credits run out until the next cycle, with no Retry-After and no backoff guidance, so an agent can't tell a spent month from a burst (3). No SLA. The terms say the service is provided as is (0). The APIs are GA, but the MCP server has no release (8). 20+20+12+3+0+8 = 63.

NextBillion.ai 58

Editorial half only. Closed service under terms that name NextBillion.ai Pte. Ltd. and Singapore law, and an Apache-2.0 MCP server (18). The privacy policy keeps personal data while a legitimate business need exists, with no periods given. The MCP README says only tool arguments are sent to the API and nothing is retained between requests (14). No deprecation policy or dated notices found. The terms promise 10 days' notice of material changes to the terms (3). Data is mainly processed in Singapore, with transfers abroad under standard clauses. No sub-processor list found (8). 18+14+3+8 = 43.

Stadia Maps 76

Closed service with clear terms, last updated 18 March 2026, a BSD-3-Clause MCP server and open-source SDKs (20). Server logs kept about 7 to 14 days, account data deleted within 30 days of closure, a DPA, and per-plan storage rules spelt out. The privacy policy was updated 1 October 2026 (28). No deprecation policy. The terms promise 30 days' notice for fee increases and reasonable efforts for other material changes (6). Third-party processors listed with locations in the privacy policy, and hosting described as primarily US (18). 20+28+6+18 = 72.

NextBillion.ai 73

No OpenAPI document for the REST APIs was found in llms.txt or the docs. The hosted MCP server's 27 tools are defined with Zod schemas, so they carry typed JSON Schema inputs (15 of 25). llms.txt, llms-full.txt and a Markdown file for each docs page (10). Endpoint pages explain each parameter, and MCP tool descriptions say when not to use a tool, such as the geometry tools being straight-line rather than road distance (16). Parameter tables give types, allowed values and defaults, such as types and limit (default 10), though in packs several filters into one string (12). curl examples and a per-endpoint error table with causes (13). The MCP server has a dated changelog. No API changelog or versioned path was found (7). 15+10+16+12+13+7 = 73.

Stadia Maps 86

Public OpenAPI 3.1.0 document at api.stadiamaps.com/openapi.yaml, version 11.1.0 (re-read on 2 November), from which the TypeScript and Python SDKs are generated (25). llms.txt at docs.stadiamaps.com, re-read on 2 November (10). The MCP's six tool descriptions say when not to use a tool, for example bulk-geocode warns against POI names (14). Zod inputs with minimums such as at least two route locations, but some fields are loose strings (12). Docs examples per endpoint. We didn't read an error reference (10). A dated public changelog with 14 entries between 12 August and 26 October 2026 and a Keep a Changelog file in each SDK (15). 25+10+14+12+10+15 = 86.

NextBillion.ai 73

MCP server 0.5.3 on 30 October 2026 (30). Eleven tagged MCP releases between 7 October and 30 October, adding hosted mode, truck routing and geometry tools (20). Support by email, a public MCP repository with a changelog, but no public API changelog (8). The MCP server isn't in the official MCP registry, and we didn't check the mobile SDK versions (7). The MCP repository runs CI with unit and end-to-end tests (8). 30+20+8+7+8 = 73.

Stadia Maps 80

Changelog entry on 26 October 2026, a forward geocoding fix for Unicode edge cases (30). 14 dated changelog entries between 12 August and 26 October 2026, among them the 20 October Static Maps rebuild and the 17 October geocoding data release (20). A public changelog and support desk, but the MCP repo's last commit is still 29 July 2025 on 2 November (10). Official TypeScript SDK v9.1.0 and Python SDK v8.1.0, both tagged 27 April 2026 and still the newest tags (15). SDK CI runs integration tests against the live API, but the MCP server has no CI, no tagged release, no npm package and no registry entry (5). 30+20+10+15+5 = 80.

NextBillion.ai 46

The REST APIs take a single key query parameter, so a plain key that travels in URLs, which earns 20 less 10. The MCP server adds OAuth 2.1 with PKCE, seals the key into tokens with AES-256-GCM, accepts a Bearer header and stores nothing server-side, so 5 back (15). Every tool is read-only, and keys can carry an IP allowlist (12). Places results are POI and address text with no prompt-injection guidance (7). Usage alerts at 50, 75 and 90 per cent of credits, per the pricing FAQ. No per-call log found (5). /.well-known/security.txt returns 404, and we found no disclosure policy or bug bounty. The about page says the company follows ISO 27001 standards, without naming a certificate (7). 15+12+7+5+7 = 46.

Stadia Maps 40

Revocable keys per property with rotation through the Account Management API and a header option (Authorization: Stadia-Auth), which earns 25. Less 10 because api_key in the query string is a documented option (the authentication page re-read on 2 November calls it the simplest) and the OpenAPI document defines only that scheme (15). The APIs only read, but keys aren't scoped to particular APIs (12). Results carry OpenStreetMap names, websites and opening hours, which are community-edited text, and we found no prompt-injection guidance (7). Dashboard usage and billing threshold alerts added on 20 August 2026 (6). stadiamaps.com/.well-known/security.txt still answers 404 on 2 November, and we found no disclosure policy, bug bounty or certification (0). 15+12+7+6+0 = 40.