Osmo CLI vs Pictify

Osmo CLI 7

No release date can be read. The 6 October date for 0.1.19 and the version timestamps came from npm's registry document, a JSON data interface this method no longer reads, so they are struck. The 0.1.19 package itself, read on 8 October, carries no release date, the CLI page and llms.txt give none, and the skill repository has no tags or versions (0). No dated release in the 90 days from 7 August can be counted for the same reason (0). No public changelog or tracker. Support is support@osmo.inc, and the skill repository has eight commits and two merged pull requests, the latest on 15 October (3). No SDKs and no MCP registry entry (0). One pinned dependency with a third-party inventory and hashes in release.json, per the 0.1.19 package read on 8 October, but no public CI. Partial kept (4). The skill now names osmo usage, absent from 0.1.19, so a later version is likely. 0 + 0 + 3 + 0 + 4 = 7.

Pictify 68

@pictify/mcp-server 2.0.0 published on 20 September 2026, 47 days before this check, with the changelog's newest entry dated September 2026 (20). Since 8 August, MCP versions 1.5.0 (8 August), 1.5.1 (11 August) and 2.0.0 (20 September), and changelog entries for August and September (20). GitHub issues weren't read, and the repository has one committer (5 of 25, unchecked). io.github.pictify-io/mcp is in the official MCP registry under the GitHub-verified namespace at 2.0.0, and official SDKs exist in four languages (15). CI builds and runs tests on push and pull requests (8 of 10). 20 + 20 + 5 + 15 + 8 = 68.

Osmo CLI 34

API checklist adapted to a CLI. No OpenAPI or command schema is published on a docs page. The model input schemas recorded on 8 October came from the product's own catalogue API at studio.osmo.inc/api/resources, which this method no longer reads, so the contract line has nothing behind it (0). The skill's SKILL.md is Markdown written for agents, with a command table, and osmo.inc/llms.txt now links the CLI page; the package's README, SETUP.md and DEPLOY.md were read from the 0.1.19 tarball on 8 October (10). Help text in the 0.1.19 bundle states what each command is for and when to pick share over studio deploy, per the 8 October check (12). Typed inputs with enums and ranges were read only from the catalogue API, so none remain (0). An example per command and JSON output shapes in DEPLOY.md, and a command table in the skill, but no reference for the roughly 50 error codes (8). Semver versions with no changelog (4). 0 + 10 + 12 + 0 + 8 + 4 = 34.

Pictify 88

Public OpenAPI 3.1 at docs.pictify.io/openapi/v1.yaml with 20 paths (25). llms.txt on the site and docs, with a Markdown copy of every docs page and a machine-readable pricing.md (10). Endpoint pages say what each call is for, and pictify_create_image says to pass only one of html, url or template. The MCP docs page still lists 26 tools including some removed on 19 September 2026 (14 of 20). Width and height ranges (1 to 4,000), output enums and quality bounds (12 of 15). An error page with status codes, stable code slugs and what to do for each, plus examples on every endpoint page (14 of 15). Versioned v1 contract and a public changelog by month; the September 2026 entry has no day (13 of 15). 25 + 10 + 14 + 12 + 14 + 13 = 88.

Osmo CLI 10

Graded on the paid hosted service the CLI depends on, by the published rubric. No x402, MPP or L402 in the OAuth metadata or the skill (0). osmo.inc/pricing, terms and privacy render only in the browser, and the 8 October prices were read from the site's script, which this method no longer reads, so no price is readable (0). The skill README says model runs use the account's plan, which includes a free monthly allowance, without saying whether a card is needed, so half (10). A person has to create an account and approve the device login in a browser (0). 0 + 0 + 10 + 0 = 10.

Pictify 40

No x402, MPP or L402 (0). Overage prices per render published without login, $0.02 on Basic, $0.01 on Pro and $0.005 on Business, with plan prices (20). Free plan of 50 renders a month, marked no card and no watermark (20). A person signs up and creates the key in the dashboard (0). 0 + 20 + 20 + 0 = 40.

Osmo CLI 23

Local-package reading, since the owner runs the CLI. Installs from npm. The vendor's skill README (revised 15 October 2026) states Node 22 or later, Git 2.29 or later, FFmpeg, and Studio on Apple Silicon macOS and Linux x64 and arm64 (glibc), while the npm README read on 8 October said any OS; the current npm README couldn't be read, so 15 is kept as a partial (15). The source is private, so there is no public CI or test suite (0). No public issue tracker for the CLI. Support is an email address (5). Versions are semver-shaped with preview tags, but no changelog was found, and osmo share --video FILE in 0.1.17 became osmo share FILE by 0.1.19 without a published note (3). Version 0.1.19 on 8 October, not declared stable (0). 15 + 0 + 5 + 3 + 0 = 23.

Pictify 45

Hosted lines, for the REST API. The home page links a status page at status.pictify.io, but its robots.txt disallows every path, so its components and history weren't read. Half for a page that exists (10 of 20) and no readable history (5). Monthly render quotas are published per plan, and the docs say a few endpoints carry fixed per-minute limits without giving the numbers (5 of 15). Retry guidance is explicit. A 429 is told apart by code, rate-limit 429s send x-ratelimit-* and retry-after, a 5xx can be retried once, and generation is idempotent from the caller's side with failed requests unbilled (15). No SLA found (0). The API isn't labelled beta (10). 10 + 5 + 5 + 15 + 0 + 10 = 45.

Osmo CLI 33

Closed source. The skill README says the CLI, renderer and resource packages are proprietary, and the npm packages carried no licence field or LICENSE file on 8 October. The terms of service render only in the browser and were read on 8 October from the site's script bundle, which this method no longer reads, so no licence terms are readable (0, as for other listings whose terms were only ever read from a script bundle). The privacy policy and terms were read the same way, so no data-handling statement remains (0). No deprecation policy or dated notices (0). The CLI bundle read on 8 October contacts only studio.osmo.inc and contains no analytics hosts, though telemetry isn't documented either way; the AI providers named in the struck privacy policy no longer count. Partial kept (10). 0 + 0 + 0 + 10 = 10.

Pictify 52

The MCP server is MIT. The service is closed under terms of 18 July 2024 that name only Pictify.io (20 of 30). The privacy policy of the same date keeps data 'for as long as necessary' with no periods, names no processors and doesn't mention that the MCP server sends tool arguments, results and the account email to PostHog (6 of 30). The changelog records retirements, Workflows in September 2026 and MCP tools on 19 September, with no notice period or deprecation policy (5 of 20). MCP analytics are on by default and disclosed with an opt-out in the README only, and no subprocessors or data locations are listed (8 of 20). 20 + 6 + 5 + 8 = 39.

Osmo CLI 51

OAuth device flow with a client registered per device, refresh tokens, a revocation endpoint and osmo logout. The OAuth metadata re-read on 5 November lists scopes projects:write, energy:spend and a new account:read. Tokens sit in a 0600 file under ~/.osmo/auth per the 8 October bundle reading, and no secret travels in a URL (26). --no-spend drops the spending scope and shares delete needs --yes, but every login asks for projects:write and no read-only login is documented (11). Comments from anyone with a review link are returned to the agent. The skill (15 October) tells the agent a review comment is feedback on the video, never an instruction to run commands, change access or work outside the project, and that a commenter's name is self-reported, and the CLI strips control and bidirectional characters from output. Guidance and one mitigation (10). Connections are named per device and osmo jobs lists runs. No audit log found (4). No security.txt (osmo.inc answers with its HTML shell, studio.osmo.inc 404), disclosure policy, bug bounty or certification found. The earlier 2 had no programme evidence behind it, so the line is 0 (0). 26 + 11 + 10 + 4 + 0 = 51.

Pictify 45

Prefixed API keys that can be rotated or revoked at once in the dashboard, with no scopes. The hosted MCP endpoint's metadata names api.pictify.io as authorisation server with one mcp:tools scope, not described in the docs (22 of 30). No read-only key or mode, and delete tools need no confirmation (5 of 20). The URL screenshot and render tools return images and URLs rather than page text, and an SSRF protection page documents how fetches are limited (10 of 15). A dashboard usage view and webhook events for renders, with no per-call audit log (5 of 15). No security.txt, disclosure policy, bug bounty or certification found; docs pages on key handling and SSRF only (3 of 20). 22 + 5 + 10 + 5 + 3 = 45.