Nutrient DWS Processor API vs PDFMonkey

Nutrient DWS Processor API 68

OAuth at api.nutrient.io with PKCE (S256), dynamic client registration, a revocation endpoint and per-product scopes; the hosted MCP server asks for mcp:invoke and accepts product:processor, product:data_extraction and others. Live keys can be scoped, and POST /tokens issues JWTs limited to named operations and origins, expiring within 24 hours and revocable. The base key can only be regenerated. No query-string credential is documented (28). Scoped keys, operation-limited JWTs and product scopes on OAuth, but no confirmation step. The supported MCP route is now hosted and reads no local paths, so the local server's unrestricted file access without SANDBOX_PATH no longer applies (15, up from 13). Document text comes back as untrusted content, and no prompt-injection guidance was found (4). Each response reports credit cost and remaining credits with a request id, a usage endpoint exists, and extraction runs from the MCP server land in a run history the person can review. No audit log was found (6). SOC 2 Type 2 and SOC 3 per the trust centre, annual penetration testing by Prescient Security, and a vulnerability disclosure policy with a report page, per the 8 October check. security.txt is still a 404 and no bounty was established (15). 28+15+4+6+15 = 68.

PDFMonkey 36

One secret key per account with the whole account's privileges, sent as a Bearer header; it can be rotated with a 2-day overlap and the old key revoked at once, but there are no scopes, no second key and no read-only key (12). No least-privilege mode; the MCP server exposes delete_document, the CLI asks before deletions unless -y, and the MCP docs say most clients ask before running a delete (6). The tools return the account's own templates, documents and quota, not third-party content (10). Each document carries generation logs and the dashboard shows usage, but no audit log or per-key activity view was found (3). No security.txt (404), no disclosure policy and no bug bounty; the compliance page says there is no SOC 2 or ISO 27001, and sets against that EU hosting, encrypted payloads and a DPA dated 15 October 2026 (5). 12 + 6 + 10 + 3 + 5 = 36.

Nutrient DWS Processor API 82

A public OpenAPI 3.1.0 document, now version 1.20.0 per the API reference page, with 17 operations and 203 schemas per the 8 October check of 1.19.0, not re-read on 1 November (25). llms.txt at site and product level with topic indexes, and a Markdown twin of each guide (10). Tag descriptions explain the Build API, async jobs and authorisation at length. The tool descriptions of the hosted MCP server couldn't be read first-hand, since tools/list needs an OAuth token (15, kept from 8 October). 102 of 203 schemas use enums and build actions are discriminated by type, per the 8 October check (13). Guides carry samples in six languages, and the errors guide and async tables document the response bodies (14). The spec is versioned, but the only changelog was the local MCP server's, which stopped with that server on 14 October, and the hosted server 2.0.0 has none. No public API changelog was found, and the move from 1.19.0 to 1.20.0 is undated (5). 25+10+15+13+14+5 = 82.

PDFMonkey 61

No OpenAPI document was found on pdfmonkey.io, in llms-full.txt or in the repositories; the 11 MCP tools carry JSON Schema inputs from src/tools.ts (12). llms.txt and llms-full.txt, and every docs page has a Markdown twin (10). MCP tool descriptions are one line each and say what the tool does, and the MCP docs say what the server can't do (create or edit templates) and send that job to the CLI; the API docs explain async against sync and when to use each (12). Parameter tables give types and required fields, list_documents has a status enum, and payload is by nature a free JSON object matched to the template (10). Request examples in curl, Ruby, Node.js, Python and PHP on every endpoint, a 401 body, a 422 body with field names and a troubleshooting section for blank documents, empty and 403 download URLs (12). The API lives under /api/v1 and docs pages carry a last-updated date, but there is no changelog page, changes are announced in blog posts such as What We Shipped Since the Summer of 26 October 2026 (5). 12 + 10 + 12 + 10 + 12 + 5 = 61.

Nutrient DWS Processor API 78

Graded with the hosted lines. Status page at www.nutrientstatus.com on Better Stack with a Processor API component and 90 days of daily history (20). The JSON feed read on 1 November 2026 covers 3 August to 1 November. The Processor API was down on five days, the longest 451 seconds on 6 August and the latest 205 seconds on 30 October. DWS Platform was down 45 seconds on 23 August and 154 seconds on 7 September, and the Data Extraction API 1,763 seconds (about 29 minutes) on 1 September. Nothing reaches an hour, so minor only (20). The feed has no component for the hosted MCP server. The pricing guide and the product page FAQ give 100 requests a minute per key on all plans, and 10 a minute for test keys (15). It recommends exponential backoff, async admission returns Retry-After, and Idempotency-Key covers async builds only, so 13 of 15. The product page mentions guaranteed SLAs on custom plans, but no SLA document is published and the terms disclaim availability (0). GA, at spec version 1.20.0 (10). 20+20+15+13+0+10 = 78.

PDFMonkey 60

Read with the hosted lines. status.pdfmonkey.io is an updown.io page with six checks (API, dashboard, preview, website, generation latency, queue size) and one month of rolling uptime per check, but no incident write-ups (15). The readable record is the uptime figures (API 99.98 per cent and queue 99.97 per cent since 3 October 2026) and the one incident the vendor wrote up, a slowdown of a little under an hour on 29 September 2026 with a post-mortem on 1 October; the 90-day list itself isn't published, so minor incidents only (20). The docs say there is no hard rate limit, only the monthly quota, so no request-rate numbers (5 for the quota numbers). The Node.js SDK retries 408, 429 and 5xx with backoff and honours Retry-After, and the webhook docs say delivery is at least once and to make handlers idempotent, but document creation has no idempotency key (10). No SLA found in the terms or pricing (0). GA (10). 15 + 20 + 5 + 10 + 0 + 10 = 60.