nTop vs Zoo

nTop 45

Read for closed software with a docs site. The newest release notes are for nTop 6.3, undated; the docs sitemap last modified the 6.1 page on 21 September 2026 and the Core package page on 19 October 2026, so a change within 90 days is likely but no release date was read (20 of 30). Four versions (6.0 to 6.3) are documented and the 6.0 and 6.1 pages changed in September, but without dates we can't count three releases in 90 days (12 of 20). support@ntop.com, a community site that renders only a loading screen, and a feedback tool on the docs server; no public issues or reply times (8 of 25). No entry in the official MCP registry for the docs server, and the only SDK is a beta Python package behind a login (5 of 15). No CI, package index or dependency data to read (0 of 10). 20 + 12 + 8 + 5 + 0 = 45.

Zoo 90

Read for a hosted service with open-source clients. zoo-mcp v0.33.0 on 30 October 2026, the CLI v0.2.209 on 28 October and kittycad 1.8.0 on 15 October (30). Nine zoo-mcp tags from 24 to 30 October alone, with CLI and SDK releases through October (20). Commits land daily across the KittyCAD organisation, with a Discord and a community forum; issue response times were not read because GitHub's issue pages refused us (15 of 25). io.github.KittyCAD/zoo-mcp is in the official MCP registry under a GitHub-verified namespace, though at version 0.10.0 of 27 January 2026 (15). pytest across Python 3.11 to 3.14, ruff, ty, a security workflow and Dependabot, with the scheduled run on main passing on 3 November (10). 30 + 20 + 15 + 15 + 10 = 90.

nTop 26

Licence credentials rather than tokens, since ntopcl signs in with a username and password on the command line or a FlexNet server address, with no scoped, revocable or expiring key (8 of 30). The Run Command block has Prompt per File, Prompt per Block and Disallow All settings, which is the only approval control found; the docs MCP server is read-only (10 of 20). The docs server returns nTop's own documentation and ntopcl returns geometry, so little untrusted content reaches the model; no guidance was found (8 of 15). No audit log or per-call record found (0 of 15). No security.txt (404), disclosure policy, bug bounty, certification or advisories found on ntop.com or docs.ntop.com (0 of 20). 8 + 10 + 8 + 0 + 0 = 26.

Zoo 67

Bearer API tokens minted in the account, several per user, listed and deleted at /user/api-tokens, organisation service accounts on Team and Enterprise, and OAuth 2.0 apps with PKCE and a device grant; no scopes were found on tokens and no rotation guidance (22 of 30). No read-only token or MCP subset; the Team plan's admin console and auditing give oversight after the fact, and the MCP client's own file permissions govern writes to main.kcl (8 of 20). Zookeeper carries a web_search tool and the MCP server returns KCL samples and docs, with no prompt-injection guidance found (5 of 15). Organisation admins get an API activity log and /user/api-calls lists each call with its cost (12 of 15). security.txt with a GitHub advisory contact and a policy committing to a 72-hour reply and severity-based rewards, SOC 2 Type II on the trust centre, and two Trail of Bits reviews published in 2024 and 2026 (20 of 20). 22 + 8 + 5 + 12 + 20 = 67.

nTop 0

Read with the paid-software rule, since nothing an agent would run is free. No x402, MPP or L402 (0). No price is published anywhere we read; licences are quoted by sales (0). No free tier or trial terms found; educational licences exist for students (0). A person buys a per-user licence, signs in at app.ntop.com and installs nTop; nothing is obtainable by an agent alone (0). 0 + 0 + 0 + 0 = 0.

Zoo 35

No x402, MPP or L402 (0). The per-second rate ($0.0083) and plan allowances are public in the pricing JSON the site loads and on the blog, with the FAQ stating rounding and free GETs (20). The Free plan carries $10 of usage a month with no plan fee; whether sign-up asks for a card was not established, and pay-as-you-go needs a payment method (15 of 20). A person signs in with SSO in a browser and mints the token; service accounts come only after an organisation exists (0). 0 + 20 + 15 + 0 = 35.

nTop 51

Closed software under an EULA last updated February 2026 that names nTopology Inc. and New York law (15). The privacy policy of February 2026 names the controller and US hosting, keeps data as long as needed with no periods, names no subprocessors, and the EULA says usage data is collected to run and improve the products; the statements agree but say little (12 of 30). No deprecation policy; the Core package says only that breaking changes may occur (4 of 20). The EULA discloses usage data collection and the licensing page says the desktop connects to the cloud for analytics, with no opt-out found (6 of 20). 15 + 12 + 4 + 6 = 37.

Zoo 69

The API is closed, with terms last updated 15 April 2026 under California law; the MCP server, CLI, SDKs and Design Studio are MIT (22 of 30). The terms licence inputs and outputs for model training with an opt-out only where the tier allows it, the pricing JSON states the behaviour per plan, and the security page says team and enterprise data is excluded by default; the privacy policy of 9 September 2026 is silent on training and gives no retention periods, and the enterprise page says Zoo trains on customer CAD data without naming the opt-out (15 of 30). No deprecation policy; billing changes were announced on the blog with dates (6 of 20). The trust centre names OpenAI, Cockroach Labs, Google Cloud and AWS as subprocessors, the security page names a US Regulated region, and the privacy policy says data may be processed anywhere in the world (14 of 20). 22 + 15 + 6 + 14 = 57.

nTop 38

Read with the local-software lines, since ntopcl and the Core package run on the owner's machine. ntopcl ships inside the nTop Windows installer and the Core package states Python 3.10 or later on Windows and Linux, but both come from app.ntop.com behind a login, not a public package index (12 of 20). No public CI or test suite (0). No public issue tracker; the knowledge base has articles on debugging Automate errors and the 6.3 notes record ntopcl rejecting duplicate input names, which is all the crash record we could read (8 of 25). Release notes per version call out behaviour changes such as unique block names in 6.3, and the Core package warns that breaking changes may land between any two versions, with no semver statement (8 of 15). nTop 6.x is a released product; nTop Core is beta (10 of 15). 12 + 0 + 8 + 8 + 10 = 38.

Zoo 55

Read with the hosted lines on api.zoo.dev. A Better Stack status page at status.zoo.dev lists public and internal components with uptime figures (20). Its incident pages show no incidents for September, October and November 2026; the June to August archive didn't render for our reader, so about three weeks of the 90-day window are unread (25 of 30). No rate limit with a number was found in the OpenAPI document, the API docs, the FAQ or the MCP source (0). No Retry-After or backoff guidance and no idempotency keys; the document says only that cancellation is idempotent (3 of 15). No SLA on any plan, and the terms disclaim uninterrupted service (0). The REST API and Zookeeper are not labelled beta, while POST /ml/kcl/completions carries the beta tag and zoo-mcp declares the Beta classifier (7 of 10). 20 + 25 + 0 + 3 + 0 + 7 = 55.

nTop 60

A command line with one notebook and two JSON files, a Python package with one class, and a docs MCP server with two tools, so almost nothing to load before work starts (20 of 25). Outputs are files whose size follows the notebook, mesh and voxel outputs are sized by feature_size and spacing, and the docs server caps each answer at 30 KB with rg and head for narrowing (12 of 20). Core raises builtin exceptions with messages; ntopcl's errors are described in knowledge-base articles rather than a reference (10 of 20). Running a notebook again with the same inputs produces the same outputs, and the SAVE flag controls whether inputs are written back; no annotations on the docs tools were published (10 of 20). The three-function ntopcl.py helper keeps defaults few, but every run needs a licence argument or signed-in session and only Python is covered (8 of 15). 20 + 12 + 10 + 10 + 8 = 60.

Zoo 44

zoo-mcp lists 42 tools in one process with no toolset switch, read-only subset or dynamic loading, and their docstrings total about 30,000 characters (5 of 25). List endpoints take limit, page_token and sort_by (31 paginated operations), with no field selection or filtering (15 of 20). Errors are a generic object with a message and request_id, no error codes, and MCP tools return a string on failure (8 of 20). No idempotency keys, no readOnlyHint or destructiveHint in the tool source, and the websocket needs a ping every 5 seconds to stay open (4 of 20). Few required parameters, official SDKs in Python, TypeScript, Rust and Go, but one modeling session per MCP process and a websocket protocol an agent has to drive by hand (12 of 15). 5 + 15 + 8 + 4 + 12 = 44.