Phrase vs TranslatePlus

Phrase 83

The changelog's latest entry is 22 October 2026, CLI 2.71.0 is of 23 October and phrase-js 3.31.0 was tagged on 28 October (30). 39 dated changelog entries since 4 August 2026, and CLI and phrase-js releases in October (20). A public changelog, a help centre and written support around the clock on paid plans. We didn't read the GitHub issues (11 of 15). The hosted MCP server is in the official MCP registry as io.github.phrase/mcp, and phrase-js 3.31.0 is current (15). The CLI has release and vulnerability workflows. The local MCP server was deprecated on 7 August 2026, under six months after its first tag (7 of 10). Total 83.

TranslatePlus 10

The newest dated change found is translateplus-python 2.0.7 and translateplus-js 2.0.1 on 11 January 2026, about ten months before this check, and the API changelog stops at 9 December 2024 (0). No release or dated change in the last 90 days (0). Support by email and a support portal; the status page hasn't updated since January (3). SDKs exist for four languages but haven't changed since January (5). Weekly downloads of 4 (PyPI) and 6 (npm) (2). 0+0+3+5+2 = 10.

Phrase 87

OpenAPI 3 specs for all nine APIs at developers.phrase.com/openapi, among them Strings with 301 operations and TMS with 547 (25). llms.txt and a Markdown copy of every docs page (10). Every Strings and Language AI operation has a description, 390 of 547 TMS operations do, and a page titled Choose the right API says which API fits which job. Few operations say when not to use them (14 of 20). Language AI inputs carry length limits, item counts and enums. The Strings spec has 49 enums across 301 operations (11 of 15). Strings documents 400, 401, 403, 404 and 429 on nearly every operation with 896 examples, while the Language AI error responses have no body schema (12 of 15). Versioned paths, four TMS versions to pin, and a dated changelog (15).

TranslatePlus 52

No OpenAPI or other machine-readable contract found in the docs or either llms.txt (0). llms.txt on the site and on docs.translateplus.io (10). Endpoint pages say what each call does, with little on when to choose HTML, email or i18n jobs over plain text (10). Required fields and per-plan character limits per request are documented, without enums for language codes beyond a supported-languages call (10). Code examples in several languages and an error-handling guide with status codes (12). Versioned /v1 and /v2 paths and a changelog, whose newest entry is 2.0.0 on 9 December 2024 (10). 0+10+10+10+12+10 = 52.

Phrase 70

Hosted reading, for the public APIs and the hosted MCP server. status.phrase.com on Statuspage, with components for Strings, TMS and the Language AI API in the EU and the US (20). Its history feed, re-read on 2 November 2026, lists nine incidents between 4 August and 2 November, besides scheduled maintenance. Each touched one component, one region or some users, such as TMS project management in the EU and the US for about three and a half hours on 31 August, Strings branching in the EU for about 19 hours on 6 and 7 August, TMS access for some users on 23 September and TMS in the EU for 11 minutes on 15 October. Read as partial, whatever the label, so minor incidents only (20 of 30). Strings publishes 1,000 requests in 5 minutes and, since 22 October, 8 concurrent, TMS 6,000 a minute and 100 concurrent, and the Language AI API says only that per-account limits apply (12 of 15). 429 responses carry X-Rate-Limit-Reset and X-Rate-Limit-Reason on Strings and Ratelimit-Remaining on TMS. No Retry-After, backoff guidance or idempotency keys were found in the reviewed documentation (8 of 15). No SLA in the public terms, which disclaim uninterrupted availability (0). The APIs and the MCP server are generally available (10). Total 70.

TranslatePlus 45

Hosted lines. status.translateplus.io is the vendor's own page; on 6 November 2026 it showed 'All systems unknown' and a last update of 22 January 2026, with data loading by script (5). No incident history to read (5). The rate-limits guide gives 100,000 requests a minute and 100,000,000 an hour per key, while llms.txt gives 50 requests a second on the Free plan, so limits are published but inconsistent (10). 429 returns a JSON detail message, responses carry X-RateLimit-Limit, -Remaining and -Reset, and the guide shows waiting for the reset with capped retries (15). No SLA. The terms say TranslatePlus strives for 99.9% uptime 'but do not guarantee uninterrupted service' (0). API v2 is the current, non-beta version (10). 5+5+10+15+0+10 = 45.

Phrase 58

The hosted MCP server uses OAuth with PKCE, dynamic client registration and three scopes. Service accounts use the client credentials grant limited by product and scope, and platform tokens are exchanged for JWTs that last about four hours (30). Less 10 because the Strings docs give an access_token query parameter as an option, and still document Basic authentication with email and password (20 of 30). View, create and delete consents on MCP, revocable under the Consents tab, with role permissions still applied. No confirmation step for destructive calls was found (15 of 20). Tools return customer strings, comments and translations, and no prompt-injection guidance was found (3 of 15). Each user sees their login history, while audit logs are held by Phrase engineers and supplied on request (6 of 15). ISO 27001 certificate, SOC 2 Type I with Type II expected in 2026, annual third-party penetration tests and a disclosure address at security@phrase.com. No security.txt and no bug bounty found (14 of 20).

TranslatePlus 35

One API key per account in the X-API-KEY header, which the docs say 'carries full access to your account's resources', and can be revoked in the dashboard (15). No scopes or read-only keys (5). Translations return the caller's own text, so little untrusted content (10). llms.txt claims request logging and an analytics dashboard, which we couldn't see without an account (5). translateplus.io/.well-known/security.txt returns 404 and no disclosure policy was found; llms.txt says 'SOC 2 compliant' and 'SOC 2 Type II certified infrastructure' with no report or auditor named (0). 15+5+10+5+0 = 35.

Phrase 74

Closed service with published terms, and the CLI, clients and local MCP server under MIT (15). The privacy notice of 6 October 2026, the Data Processing Addendum and the AI statement agree on processor status, a 60-day deletion period and which products train on customer content. The terms still permit training non-text models, and any model for internal research, on customer content without approval (22 of 30). Deprecations are announced in the changelog with dates, such as the Quality Evaluator v1 and v2 endpoints on 2 July 2026, but without removal dates, and no written notice period was found (10 of 20). A sub-processor list with locations and transfer mechanisms, a choice of EU or US data centre, and hosting on AWS and Google Cloud disclosed (18 of 20).

TranslatePlus 52

Editorial half only. Closed service under terms last updated 18 December 2024 that name PetaBytes, Inc. as a US corporation but give no address, governing law or courts (10). The terms say translation requests aren't permanently stored 'unless required by law', the privacy policy says 'unless required for caching or service improvement purposes', and the terms allow using anonymised usage data to improve the service (8). API v1 is kept as legacy, with no dated deprecation notice (5). No subprocessor list or data location found (0). 10+8+5+0 = 23.

Phrase 70

API reading of the checklist, with the hosted MCP server noted where its behaviour is documented. Strings lists return 25 items by default with per_page up to 100, and locale downloads support ETag. The hosted MCP server's tool list isn't published, and the deprecated local server listed 145 tools (17 of 25). page and per_page with Link headers, and filters on list endpoints (18 of 20). Strings returns a message on 400 and field-level errors on 422, and names the limit hit on 429. Language AI error bodies are undocumented (14 of 20). No idempotency keys. Conditional GETs are safe to repeat, and the MCP consent separates view, create, and modify and delete (8 of 20). Language AI needs three fields, six official Strings clients and a CLI exist, but a missing User-Agent header earns a 400 and the clients cover Strings alone (13 of 15).

TranslatePlus 61

API reading. Batch translation of up to 100 texts a call and separate HTML, email, subtitle and i18n job endpoints (16). Few output controls or filters (10). Errors are a detail string with HTTP status codes (12). No idempotency key for i18n jobs, though text translation is stateless (8). Official SDKs listed for Python, JavaScript and TypeScript, Java and PHP, with few required fields (15). 16+10+12+8+15 = 61.