PDF.co API + MCP vs pdfRest API Toolkit

PDF.co API + MCP 20

status.pdf.co answers 302 to betterstack.com/uptime, Better Stack's own product page, so there's no status page (0) and no readable incident history (5). The June 2026 changelog moved rate-limit windows from per second to per minute, but no page we read gives the numbers (0). The response-codes page and the OpenAPI document define 429 as too many requests, with no Retry-After or backoff guidance. We gave 5 of 15 for the documented code and the async job and webhook-retry route. No SLA in the terms of 24 March 2026, which reserve the right to change or stop the service without notice (0). GA (10).

pdfRest API Toolkit 58

Read with the hosted lines. status.pdfrest.com is an Upptime page with a single check on the /up endpoint, backed by a public repository with daily history; one component and no incident write-ups (15). The repository shows 100 per cent uptime over 7 and 30 days, 99.95 per cent over a year and no down entries in the last 200 daily history commits (30). No request rate limit is documented and the OpenAPI document defines no 429 (0). A 408 timeout is documented and /request-status polls async jobs, but there is no 429 handling, backoff guidance or idempotency key (3). No SLA; the terms give the service as is (0). GA (10). 15 + 30 + 0 + 3 + 0 + 10 = 58.

PDF.co API + MCP 34

MCP server 0.0.9 on 2026-07-28, 65 days before this check (20). Two releases in the last 90 days, 0.0.8 on 2026-07-08 and 0.0.9, and both only repoint documentation links. The API changelog's last entry is June 2026, outside the window (0). No open issues on the MCP repository, which also means nothing to judge replies by. Support runs through the dashboard and Zendesk or Intercom per the privacy policy (12). Not in the official MCP registry. The only pdfco entry there is a third-party wrapper from mcparmory (0). The only CI workflow publishes releases. No tests, and the lock file dates from June 2025 (2).

pdfRest API Toolkit 70

Read as a closed service. 2.56.7 released 14 October 2026 (30). Nine dated releases between 7 August and 14 October 2026 (20). Support through a Jira service desk and email on paid plans; Datalogics links a Discord; no public issue tracker for the API (10 of 15). Code samples in six languages are kept on GitHub, but no official SDK package was confirmed (5). The status repository's CI runs daily; nothing else to assess (5). 30 + 20 + 10 + 5 + 5 = 70.

PDF.co API + MCP 20

No x402, MPP or L402 (0). Plan prices are public and the credit cost of each endpoint is published per page or per call, so per-unit cost is readable without a login (20). A sign-up trial exists per the 30 September check, but neither the pricing page nor the terms state its size or whether a card is needed, so we scored it absent (0). A person signs up in a browser to get a key (0).

pdfRest API Toolkit 40

No x402, MPP or L402 (0). Plan prices, per-call overage, EU and Pro Tools per-call fees and file-size overage are on the public pricing page and in llms.txt (20). Starter is free with 100 calls a month and no card (20). A person signs up in a browser and the key is shown in the account (0). 0 + 20 + 20 + 0 = 40.

PDF.co API + MCP 74

OpenAPI 3.0.1 at developer.pdf.co/openapi.json, header-only x-api-key scheme, and the 38 MCP tools carry typed JSON Schema from Pydantic (25). llms.txt and Markdown twins of every docs page (10). Tool docstrings state purpose and link the endpoint reference, and the URL field tells the model to use upload_file for local files, but none says when not to use a tool (10). No enums anywhere, since the server dropped Literal types for Gemini compatibility in May 2025. Page ranges, paper sizes and line_grouping are free strings, and the annotation and field arrays are List[Any] (6). The OpenAPI document describes errors 400, 401, 402, 403, 429 and 441 to 454 with a structured body, and every endpoint has samples (13). A monthly API changelog, but its last entry is June 2026, and the MCP server has tags and no changelog (10).

pdfRest API Toolkit 90

Public OpenAPI 3.1.1 at api.pdfrest.com/pdfrest-openapi.json, version 2.58.0, 60 operations on 59 paths (25). llms.txt on pdfrest.com with the endpoint list and pricing; docs.pdfrest.com has no Markdown twins (10). Every operation has a description that says what it does, links its tool page and notes Pro-tier gating, and the merge description explains ordering with pages[] and type[]; nothing says when not to use a tool (14). 88 enums, required lists on 248 schemas, an ErrorResponse schema and a oneOf for sync against async replies (13). 120 examples in the document, API Lab generates code in six languages, and 400, 401, 404, 408, 422, 500 and 503 are documented (13). Release notes dated per version, the document carries its version, and the OpenAPI endpoints were added on 17 September 2026 (15). 25 + 10 + 14 + 13 + 13 + 15 = 90.

PDF.co API + MCP 23

One API key per account in the x-api-key header, header only per the OpenAPI document. We found no scopes, no multiple keys and no rotation guide (10). Every MCP tool also takes api_key as an argument, which invites the key into the model's context. No read-only mode, no annotations, and upload_file reads any absolute local path and uploads it to PDF.co. The SSE and HTTP transports bind 0.0.0.0 with no authentication (0). PDF text, tables and invoice fields come back as untrusted content with no injection guidance (0). Each response reports credits used and remaining, which is a per-call cost trail. We found no audit log (5). The security page claims SOC 2 Type II and cites AWS's ISO 27001, PCI and FISMA, which are the data centre's. security.txt is a 404 and we found no disclosure policy or bounty (8).

pdfRest API Toolkit 37

One Api-Key header per account, revocable per the terms, with no scopes, expiry or rotation guide, and the polling guide shows a Bearer header instead (14). No read-only key; /delete removes uploaded files and there is no confirmation step, though demo output is watermarked (4). Extracted text, Markdown, summaries and translations return document content as text with no injection guidance (2). The container edition logs audit events; nothing documents per-call visibility for cloud accounts beyond usage counts (5). SOC 2 Type 2 through Datalogics' trust centre, HIPAA BAAs and a DPA, but no security.txt, disclosure policy or bug bounty found (12). 14 + 4 + 2 + 5 + 12 = 37.

PDF.co API + MCP 53

The MCP server is MIT. The API is closed with dated terms, so between the two bands (20). The privacy policy (25 August 2026) names Artifex Software, Inc. and says processing happens in the US, but states no document retention. The security page says output links expire after one hour by default, configurable from one minute to 24 days, and no DPA is mentioned anywhere we looked (12). No deprecation policy, and the terms allow changes without notice (0). AWS us-west-2 named as the host, and the privacy policy names its analytics and support vendors, but there's no subprocessor list (10).

pdfRest API Toolkit 62

Closed service with terms and a privacy policy that name Datalogics, Inc. (15). Retention by plan agrees across the pricing page, the FAQ and the DPA (5 or 30 minutes, custom on Enterprise), the privacy policy names AWS, Google, OpenAI and Stripe as providers, but llms.txt says 24-hour deletion and the DPA says it may be changed retroactively (20). Release notes record changes, and 2.56.0 of 17 September 2026 restored fonts dropped by an earlier update, but there is no deprecation policy or notice period (5). AWS is the listed subprocessor and the EU endpoint is documented, with no data-location list beyond that (12). 15 + 20 + 5 + 12 = 52.