NextBillion.ai vs TomTom Maps APIs + MCP

NextBillion.ai 45

Hosted lines, for the REST APIs at api.nextbillion.io and the hosted MCP server. A status page at status.nextbillion.io, 'NextBillion.AI API Status', renders only in a browser, and its Statuspage-style JSON paths return 404, so we couldn't see its components (10) or read any history. That's our limit, not a finding, and the rubric gives 5 (5). The API reference states 2,400 queries a minute, or 40 a second, for continuous requests (15). Each endpoint's error table lists 429 as 'QPM or API request count quota reached', with no Retry-After or backoff guidance (5). No SLA found; the terms say access isn't warranted to be uninterrupted (0). The REST APIs are GA. The MCP server is at version 0.5.3 (10). 10+5+15+5+0+10 = 45.

TomTom Maps APIs + MCP 15

TomTom's API status page sits on tomtom.service-now.com, whose robots.txt disallows every path on 4 November, so the earlier status readings are struck (0). With no history we may read, the record scores 5. No published QPS limits or 429 guidance were found on the docs pages we read on 1 October; TomTom's acceptable use policy now bars robots from its websites, so they weren't re-read (0). The MCP maps a 429 to a typed rate-limit error with a message, and we found nothing on Retry-After (5, the earlier partial kept). No SLA found (0). Orbis APIs went GA on 8 July 2026, but the remote MCP server is in public preview and the README says some Orbis and EV services may not be enabled on every account (5, kept). 0+5+0+5+0+5 = 15.

NextBillion.ai 73

MCP server 0.5.3 on 30 October 2026 (30). Eleven tagged MCP releases between 7 October and 30 October, adding hosted mode, truck routing and geometry tools (20). Support by email, a public MCP repository with a changelog, but no public API changelog (8). The MCP server isn't in the official MCP registry, and we didn't check the mobile SDK versions (7). The MCP repository runs CI with unit and end-to-end tests (8). 30+20+8+7+8 = 73.

TomTom Maps APIs + MCP 86

MCP v1.6.15 on 2 November 2026 (30). Eight tags since 6 August, v1.6.8 (15 September) to v1.6.15 (2 November) (20). Pull requests from several maintainers merged up to 3 November 2026. We couldn't see issue reply times from git (18, kept). The package is at 1.6.15 in its repository; the 30 September note that it wasn't in the official MCP registry came from the registry's JSON API and is struck (8, kept). CI runs type checks, lint, build, end-to-end tests and a Veracode scan, with dependabot (10). 30+20+18+8+10 = 86.

NextBillion.ai 46

The REST APIs take a single key query parameter, so a plain key that travels in URLs, which earns 20 less 10. The MCP server adds OAuth 2.1 with PKCE, seals the key into tokens with AES-256-GCM, accepts a Bearer header and stores nothing server-side, so 5 back (15). Every tool is read-only, and keys can carry an IP allowlist (12). Places results are POI and address text with no prompt-injection guidance (7). Usage alerts at 50, 75 and 90 per cent of credits, per the pricing FAQ. No per-call log found (5). /.well-known/security.txt returns 404, and we found no disclosure policy or bug bounty. The about page says the company follows ISO 27001 standards, without naming a certificate (7). 15+12+7+5+7 = 46.

TomTom Maps APIs + MCP 51

API keys from the developer portal, limited to the products selected for them, which earns 25. Less 10 because REST calls take the key as the key query parameter. The hosted MCP takes a tomtom-api-key header, and the source carries OAuth with an audience check that 1.6.13 made mandatory for OAuth deployments (15). Keys can be limited by product and every tool reads (16). Results include POI names and traffic incident text with no prompt-injection guidance. An app-only tool, tomtom-get-api-key, returns the raw key to the map app; since 1.6.12 clients that render no apps don't receive it (6, kept). We didn't find per-call logs or usage reporting we could read (0). HackerOne disclosure programme with a 3 business day first response in the organisation's SECURITY.md, Veracode scanning in CI, and no security.txt per the 30 September check (14, kept). 15+16+6+0+14 = 51.

NextBillion.ai 20

No x402, MPP or L402 (0). Pricing is by quote, with annual licences per order, asset or API call and no published unit price (0). A 7-day free trial with an API key and 'No credit card required' (20). A person signs up through the console or emails support for a key (0). 0+0+20+0 = 20.

TomTom Maps APIs + MCP 25

No x402, MPP or L402 (0). Free allowances are public, but the pricing page re-read on 2 October showed no paid rate as a number, only a euro estimator and a contact-sales link (5 of 20, kept). A no-card free allowance of 20,000 geocodes, 20,000 reverse geocodes and 20,000 routes a month, with Search and Matrix at 2,500 (20). Signup is a browser flow (0). The pricing page is on a host whose acceptable use policy now bars robots, so it wasn't re-read on 4 November. 0+5+20+0 = 25.