Nominatim vs Stadia Maps

Nominatim 51

No OpenAPI or machine-readable contract (0). nominatim.org/llms.txt returns 404, and the manual is HTML, though its Markdown sources sit in the repository's docs folder (0). The API reference explains each endpoint and parameter and when not to use one, such as the details endpoint being for debugging (14). Types, enums and limits are documented, such as format, layer and limit (at most 40), but there's no schema to validate against (12). Example queries and outputs per endpoint, with errors described in prose (10). A versioned manual per release, a ChangeLog and a migration guide (15). 0+0+14+12+10+15 = 51.

Stadia Maps 86

Public OpenAPI 3.1.0 document at api.stadiamaps.com/openapi.yaml, version 11.1.0 (re-read on 2 November), from which the TypeScript and Python SDKs are generated (25). llms.txt at docs.stadiamaps.com, re-read on 2 November (10). The MCP's six tool descriptions say when not to use a tool, for example bulk-geocode warns against POI names (14). Zod inputs with minimums such as at least two route locations, but some fields are loose strings (12). Docs examples per endpoint. We didn't read an error reference (10). A dated public changelog with 14 entries between 12 August and 26 October 2026 and a Keep a Changelog file in each SDK (15). 25+10+14+12+10+15 = 86.

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

Stadia Maps 40

No x402, MPP or L402 (0). Credit costs per call and per-1,000-credit overage ($0.03, $0.02 and $0.015) published without login, re-read on 2 November (20). Free tier of 200,000 credits a month and a 14-day Professional trial without a credit card, though the free tier doesn't allow commercial use (20). Signup is a browser flow (0). 0+20+20+0 = 40.

Nominatim 60

Release 5.3.3 on 14 October 2026, 23 days before this check (30). Only one release in the 90 days from 8 August, against 106 commits on the default branch; commits aren't counted as releases (0). Commits from the lead maintainer and seven or more contributors since August, but we couldn't read issue reply times (12). The nominatim-api Python library is current with the server (10). CI on every push, current PostgreSQL and Python versions (8). 30+0+12+10+8 = 60.

Stadia Maps 80

Changelog entry on 26 October 2026, a forward geocoding fix for Unicode edge cases (30). 14 dated changelog entries between 12 August and 26 October 2026, among them the 20 October Static Maps rebuild and the 17 October geocoding data release (20). A public changelog and support desk, but the MCP repo's last commit is still 29 July 2025 on 2 November (10). Official TypeScript SDK v9.1.0 and Python SDK v8.1.0, both tagged 27 April 2026 and still the newest tags (15). SDK CI runs integration tests against the live API, but the MCP server has no CI, no tagged release, no npm package and no registry entry (5). 30+20+10+15+5 = 80.

Nominatim 82

Read with the local-software lines, since the listing is the Nominatim server an operator runs. The public instance at nominatim.openstreetmap.org belongs to the OpenStreetMap Foundation and its usage policy caps it at one request a second, so it isn't graded as a hosted service. Official packages nominatim-db and nominatim-api on PyPI (5.3.3 on 14 October 2026, Python 3.9 or later) and installation guides for Ubuntu 22 and 24 (20). A public CI workflow runs unit and BDD tests on every push across Ubuntu 24 and 26 with PostgreSQL 13 to 18, and Windows unit tests. We couldn't see run results (20). Issue counts and reply times couldn't be read because the GitHub API was rate-limited for us; Sarah Hoffmann made 76 of the 106 commits since 8 August (12). A ChangeLog per release and semantic version numbers (15). Version 5.3.3 (15). 20+20+12+15+15 = 82.

Stadia Maps 63

Instatus page with 27 components across maps, routing, geocoding and data APIs, plus RSS and Atom history back to April 2025 (20). One incident in the 90 days to 2 November (history feed re-read on 2 November), on 25 September 2026, when a software update on edge nodes caused elevated request errors "in the initial deployment regions" across 24 listed components from 10:20 to 10:22 UTC before it was rolled back. Limited to some regions and two minutes, so minor (20). The FAQ says there's no fixed requests-a-second limit and the cap is the monthly credit pool, with credits per call published (12). A 429 is what you get when credits run out until the next cycle, with no Retry-After and no backoff guidance, so an agent can't tell a spent month from a burst (3). No SLA. The terms say the service is provided as is (0). The APIs are GA, but the MCP server has no release (8). 20+20+12+3+0+8 = 63.

Nominatim 59

Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.

Stadia Maps 76

Closed service with clear terms, last updated 18 March 2026, a BSD-3-Clause MCP server and open-source SDKs (20). Server logs kept about 7 to 14 days, account data deleted within 30 days of closure, a DPA, and per-plan storage rules spelt out. The privacy policy was updated 1 October 2026 (28). No deprecation policy. The terms promise 30 days' notice for fee increases and reasonable efforts for other material changes (6). Third-party processors listed with locations in the privacy policy, and hosting described as primarily US (18). 20+28+6+18 = 72.

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.

Stadia Maps 40

Revocable keys per property with rotation through the Account Management API and a header option (Authorization: Stadia-Auth), which earns 25. Less 10 because api_key in the query string is a documented option (the authentication page re-read on 2 November calls it the simplest) and the OpenAPI document defines only that scheme (15). The APIs only read, but keys aren't scoped to particular APIs (12). Results carry OpenStreetMap names, websites and opening hours, which are community-edited text, and we found no prompt-injection guidance (7). Dashboard usage and billing threshold alerts added on 20 August 2026 (6). stadiamaps.com/.well-known/security.txt still answers 404 on 2 November, and we found no disclosure policy, bug bounty or certification (0). 15+12+7+6+0 = 40.