Pictify vs PostNitro

Pictify 40

No x402, MPP or L402 (0). Overage prices per render published without login, $0.02 on Basic, $0.01 on Pro and $0.005 on Business, with plan prices (20). Free plan of 50 renders a month, marked no card and no watermark (20). A person signs up and creates the key in the dashboard (0). 0 + 20 + 20 + 0 = 40.

PostNitro 20

No x402, MPP or L402 (0). Credit prices are public without a login at $0.04 a credit, 1 per imported slide and 2 per AI-written slide, with plan prices of $15, $30 and $60 a month (20). The web app has a free plan with no card, but the subscription docs, the MCP docs and llms.txt now agree there is no free API tier, and calls without a paid plan return 402 (0). A person signs up in a browser and generates a key, or approves OAuth in the client. Dynamic client registration removes the key step but not the signup (0). 0 + 20 + 0 + 0 = 20.

Pictify 88

Public OpenAPI 3.1 at docs.pictify.io/openapi/v1.yaml with 20 paths (25). llms.txt on the site and docs, with a Markdown copy of every docs page and a machine-readable pricing.md (10). Endpoint pages say what each call is for, and pictify_create_image says to pass only one of html, url or template. The MCP docs page still lists 26 tools including some removed on 19 September 2026 (14 of 20). Width and height ranges (1 to 4,000), output enums and quality bounds (12 of 15). An error page with status codes, stable code slugs and what to do for each, plus examples on every endpoint page (14 of 15). Versioned v1 contract and a public changelog by month; the September 2026 entry has no day (13 of 15). 25 + 10 + 14 + 12 + 14 + 13 = 88.

PostNitro 77

OpenAPI 3.1 document for the Embed API at /.well-known/openapi/embed.json, with 13 operations per the 14 October check and not re-read. The MCP docs now point to a public tool catalogue on the MCP host with every tool's input and output schema, which we didn't request, so the earlier partial is held (20). llms.txt (updated 29 October 2026), llms-full.txt, a docs llms.txt and .md twins (10). The docs state what each tool is for, when not to use PostNitro and the embedPostId and designId split, and the tool count now reads 40 on every page read (15). 24 enums, typed slide objects and per-platform settings with conditional rules per the 14 October check, and unknown keys in settings objects are now refused by name (12). Examples on each page and a full table of validation messages for the Schedule API (13). info.version 1.0.0 with no version in the path and no API changelog. The CLI has a dated Keep a Changelog file with semver (7). 20 + 10 + 15 + 12 + 13 + 7 = 77.

Pictify 45

Prefixed API keys that can be rotated or revoked at once in the dashboard, with no scopes. The hosted MCP endpoint's metadata names api.pictify.io as authorisation server with one mcp:tools scope, not described in the docs (22 of 30). No read-only key or mode, and delete tools need no confirmation (5 of 20). The URL screenshot and render tools return images and URLs rather than page text, and an SSRF protection page documents how fetches are limited (10 of 15). A dashboard usage view and webhook events for renders, with no per-call audit log (5 of 15). No security.txt, disclosure policy, bug bounty or certification found; docs pages on key handling and SSRF only (3 of 20). 22 + 5 + 10 + 5 + 3 = 45.

PostNitro 56

The MCP server runs OAuth 2.1 with PKCE S256, dynamic client registration and a revocation endpoint, but with one broad postnitro scope, per the 14 October reading of its published metadata. Keys are pn- API keys sent in a header, generated in the web app, with no scopes or rotation documented (20). A read-only MCP server URL can't generate, edit, schedule or delete, and the destructive tools are annotated so a client can ask before running them. No read-only API key (14). The MCP docs, and the server when a client connects, say that slide text, names and captions derived from an article or X post are third-party content, never to follow instructions in it or let it choose tools (12). Per-job processing logs come back from the status endpoint. No account audit log was found (3). security.txt, expiring 1 November 2027, names support@postnitro.ai, with no disclosure policy, acknowledgement time, bug bounty or certification found (7). 20 + 14 + 12 + 3 + 7 = 56.

Pictify 74

25 MCP tools in the 2.0.0 source (15 for 11 to 30), with no toolsets or read-only subset (15). List endpoints page with page and limit (16 of 20). Error bodies carry code slugs such as quota_exceeded, template_limit_reached and invalid_variable, and the docs say which are retryable (18 of 20). Generation is safe to retry and failed calls bill nothing, but the MCP source sets no readOnlyHint or destructiveHint, and the delete tools for templates and video templates run without a confirmation step (10 of 20). Official SDKs for Node.js, Python, Go and Ruby, sensible defaults such as 1200 x 630 PNG (15). 15 + 16 + 18 + 10 + 15 = 74.

PostNitro 68

40 MCP tools load together on the main server URL (5). A read-only server URL serves only the 16 tools annotated readOnlyHint, the DESIGN output skips rendering and the _and_wait tools fold polling into one call (8 back, 13). Templates and brands page with page and limit up to 100, and scheduled posts filter by date range and social account (14). API errors reach the agent verbatim with their status and a plain message, the schedule error page lists every validation message, unknown keys are refused by name, and a missing ID returns the candidate IDs. A brand-limit error comes back as 401, per the 14 October check (14). Every create tool takes an idempotencyKey, and the MCP docs say every tool carries readOnlyHint and destructiveHint, naming the six destructive tools (20). Saved defaults and single-candidate auto-selection keep required arguments to one or two. Official code is a Node CLI and a browser editor SDK, one language (7). 13 + 14 + 14 + 20 + 7 = 68.

Pictify 52

The MCP server is MIT. The service is closed under terms of 18 July 2024 that name only Pictify.io (20 of 30). The privacy policy of the same date keeps data 'for as long as necessary' with no periods, names no processors and doesn't mention that the MCP server sends tool arguments, results and the account email to PostHog (6 of 30). The changelog records retirements, Workflows in September 2026 and MCP tools on 19 September, with no notice period or deprecation policy (5 of 20). MCP analytics are on by default and disclosed with an opt-out in the README only, and no subprocessors or data locations are listed (8 of 20). 20 + 6 + 5 + 8 = 39.

PostNitro 58

Closed service under Terms of Service last updated 20 May 2024, re-read on 5 November, that cover the APIs, allow changes or discontinuation without notice and take a perpetual licence to user content to run the service. The terms name no legal entity or governing law (12). The privacy policy, updated 2 November 2026, corrects its Use of Data section and now says PostNitro doesn't train AI models on user content, in line with the Claude page. Personal data is kept while the account is active and deleted within 24 hours of a request. No DPA (14). The fact sheet dates the withdrawal of the Creator and Team plans and existing subscribers keep them. The CLI changelog marks API-version dependencies. No deprecation policy for the API (8). The policy names UserMaven and CrispChat and an unnamed payment processor, the docs name Lemon Squeezy for billing, and no data locations were found (5). 12 + 14 + 8 + 5 = 39.