Nominatim vs OpenCage Geocoding API

Nominatim 51

No OpenAPI or machine-readable contract (0). nominatim.org/llms.txt returns 404, and the manual is HTML, though its Markdown sources sit in the repository's docs folder (0). The API reference explains each endpoint and parameter and when not to use one, such as the details endpoint being for debugging (14). Types, enums and limits are documented, such as format, layer and limit (at most 40), but there's no schema to validate against (12). Example queries and outputs per endpoint, with errors described in prose (10). A versioned manual per release, a ChangeLog and a migration guide (15). 0+0+14+12+10+15 = 51.

OpenCage Geocoding API 77

No OpenAPI. The MCP's three tools have JSON Schema inputs, and the REST API is one endpoint described parameter by parameter (15). llms.txt with 70 or more Markdown pages, including the API reference, pricing, terms and the MCP tutorial (10). The API reference explains each parameter and when to use it, but the MCP descriptions are one line each with no when-not-to-use (12). min and max on latitude, longitude and limit, but countrycode and bounds are free strings (10). A status code table and 23 tutorials across languages (15). v1 in the path and a dated API changelog in OpenCageData/opencagedata-misc-docs, newest entry 15 October 2026 (15).

Nominatim 60

Release 5.3.3 on 14 October 2026, 23 days before this check (30). Only one release in the 90 days from 8 August, against 106 commits on the default branch; commits aren't counted as releases (0). Commits from the lead maintainer and seven or more contributors since August, but we couldn't read issue reply times (12). The nominatim-api Python library is current with the server (10). CI on every push, current PostgreSQL and Python versions (8). 30+0+12+10+8 = 60.

OpenCage Geocoding API 86

The newest API changelog entry is 15 October 2026 (SMDG port terminal codes), and the Python SDK released 3.5.0 on 28 October 2026, both within 30 days (30). Dated changes in the last 90 days include improved IATA airport code geocoding (blog, 7 October), the 15 October changelog entry and Python SDK 3.5.0, with spreadsheet upload improvements on 14 August (20). Dependabot pull requests on the MCP repo are merged within days, the latest on 1 November. We couldn't see issue reply times from git (15). In the official MCP registry as io.github.OpenCageData/opencage-geocoding-mcp, and the Python SDK is current at 3.5.0 (15). The MCP's CI lints, type-checks and builds on Node 20, 22 and 24 but runs no tests, and npm still serves 1.0.3 from 11 September 2025 while the repo is at 1.0.5 (6).

Nominatim 59

Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.

OpenCage Geocoding API 85

Closed service with clear terms, an MIT MCP server and open-source SDKs (20). Results may be stored permanently, even after cancelling. Query logs are deleted after six months and never used to train AI, no_record turns query logging off, and the DPA is public on GitHub. The GDPR page was updated 22 July 2026 with its change history (30). A dated API changelog that announces deprecations, such as the jsonp parameter on 11 May 2026, which keeps working for existing customers. No written deprecation policy (14). Seven subprocessors with locations, and hosting at Hetzner in Germany and Finland with backups in Switzerland (20).

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

OpenCage Geocoding API 35

No x402, MPP or L402 (0). Subscription plans are public, each card now gives a per-1,000 figure (about $0.17 on X-Small to $0.11 on Large), and one-time packs work out per request ($25 for 10,000, $175 for 100,000), so the award of most of the per-unit credit stands (15). A 2,500-a-day free trial with no card, for testing only (20). Signup is a browser flow (0).

Nominatim 75

API reading. limit, addressdetails, extratags, namedetails and the polygon options size responses, and geocodejson, geojson and jsonv2 formats are available (22). countrycodes, viewbox, bounded, layer, featureType and exclude_place_ids filter results, the last one standing in for pagination (18). Bad parameters return an error rather than a silent default in current versions, but there's no error code reference (12). Every endpoint reads and is safe to retry (15). Few required parameters, and the Python library exposes the same search API in-process, but there are no other official clients (8). 22+18+12+15+8 = 75.

OpenCage Geocoding API 86

Three compact MCP tools, and the API sizes its output with limit, no_annotations, abbrv and address_only (25). countrycode, bounds, proximity and min_confidence narrow results. No pagination, which a geocoder rarely needs (18). Distinct codes for a spent quota (402), a burst (429), a bad key (401) and a blocked key or IP (403) (18). Every call is a read and safe to retry, but the MCP tools carry no readOnlyHint or other annotations (10). One required parameter, sensible defaults, and official Python (3.5.0) and JavaScript (2.2.0) clients (15).

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.

OpenCage Geocoding API 44

Plain revocable keys that can be disabled or tied to IP addresses, which earns 20 with 2 back for the IP rules. Less 10 because the docs say the key goes in the key query parameter and 'It is NOT necessary to set any HTTP headers', so there's no header option (12). The API only reads, so there's nothing to approve (15). Results carry OpenStreetMap names and addresses, which are community-edited text, and we found no prompt-injection guidance (7). The MCP's get-opencage-info tool reports usage and rate state. We didn't check the dashboard's per-call visibility (3). A security policy page, a security@opencagedata.com contact and a SECURITY.md on GitHub. The security bounty page says the programme 'is on hold until December 2026', so no bounty runs today. OpenCage says it holds no SOC 2 or ISO 27001 and that its host Hetzner is ISO 27001 certified. security.txt couldn't be checked because robots.txt blocks it. That is below contactsplus (8, discretionary bounties running) (7).