Replicate image models vs SurgePix API

Replicate image models 83

OpenAPI spec at api.replicate.com/openapi.json, and every model publishes its own input and output schema (25). llms.txt for the docs (10). Official model pages state what the model does. Community model descriptions vary and rarely say when not to use them (12). Typed per-model inputs with enums and defaults generated from each model's schema (13). Examples on every model page, no error catalogue found in this run (8). Models pinned by version hash and a dated changelog (15).

SurgePix API 40

No OpenAPI or other machine-readable contract was found (0). surgepix.ai/llms.txt returns 404. The docs are HTML pages, but the 15 SKILL.md files in the MIT repository are Markdown written for agents, so half (5). The API reference states the purpose of each of its five operations and the async and session model. The SKILL.md files add trigger phrases and explicit do-not-use routing between skills, but 11 of the task endpoints the skills call appear only in their scripts, with no reference (10). Parameter tables give type and required for the documented operations, with no enums or limits, and the undocumented endpoints have no schema at all (7). JSON examples for every documented operation and an error table with 401, 404 and error.file.sensitive_content (10). A dated public changelog from 11 March 2026, but no version in the API path and no API-specific change notes (8). 0+5+10+7+10+8 = 40.

Replicate image models 30

The changelog's newest entry is agent skills on 21 April 2026, 163 days ago (10). No dated changelog entries in the last 90 days (0). Public changelog. We didn't check GitHub issue response times in this run (5). The npm client was last published as 1.4.0 on 17 November 2025, and the changelog says the MCP server is discoverable through the official registry (12). replicate-mcp has had no release since June 2025 per the listing (3).

SurgePix API 66

The last dated change is GPT-Image-2.5 on 23 October 2026, 10 days before the check (30). Changelog entries on 15, 22 and 23 October, 16, 9 and 2 September 2026, more than three in 90 days (20). For a closed service, a dated changelog, a Discord server and a contact email. We didn't open Discord or the GitHub issues, so answering isn't confirmed (8). No official SDK. The skills are maintained client scripts with tags from v1.0.0 (4 June 2026) to v1.5.0 (2 September 2026), a judgement call (5). The repository's CI checks SKILL.md front matter only, with no tests, and the skills aren't published as a package (3). 30+20+8+5+3 = 66.

Replicate image models 48

replicatestatus.com exists, but when we fetched it the page said all services were online as of 15 April and listed only incidents from April 2024. The listing says it now redirects to Cloudflare's status page filtered to Replicate (10). No readable 90-day history (5). Published limits of 600 create-prediction requests a minute and 3,000 for other endpoints, 6 a minute for accounts with granted credit and no card, and tighter limits as a balance nears zero (15). Over the limit the API returns 429 with a message giving the reset time, about 30 seconds, but no Retry-After header or backoff advice (8). No SLA found (0). GA (10).

SurgePix API 15

Read with the hosted lines. No status page was found on surgepix.ai or in the docs, and status.surgepix.ai doesn't resolve (0). With no history to read, the incident line takes the floor (5). No rate limits with numbers are documented. The terms say "non-human continuous or frequent query operations" lead to automatic account suspension, with no threshold given (0). No 429 or backoff guidance. The skill scripts poll every 2 seconds for up to 5 to 15 minutes, but that is client code, not a documented policy (0). No SLA, and the terms disclaim uninterrupted service (0). The API isn't labelled beta or preview, and API keys have been self-serve since 2 June 2026 per the changelog (10). 0+5+0+0+0+10 = 15.

Replicate image models 60

Closed platform under terms updated 1 April 2026 naming Replicate, LLC. The clients are Apache-2.0 and each model keeps its own licence (15). The privacy policy (also 1 April 2026) says nothing on how long prediction inputs and outputs are kept or whether customer content trains models (5). Dated deprecations in the changelog, such as the stream parameter in July 2024 and spend limits in July 2025, but no policy on notice for hosted models (10). No subprocessor list or data locations in the privacy policy (0).

SurgePix API 28

The editorial half. A closed service whose terms name no company or address. They restrict any commercial use of what the service produces without SurgePix's permission, and contain clauses from an unrelated product (a "big data" query platform and "non-resume content"). The skills are MIT. Unclear terms, with a little credit for the open skills (5). The privacy policy is dated both 10 June 2026 and 1 July 2022, describes WeChat and phone registration and "domestic servers", and gives no retention periods. The API reference says uploads go to Tencent Cloud storage in Seoul as public URLs. No DPA. The statements don't agree (5). No deprecation policy or notices, and the terms let changes take effect on publication without notice (0). Tencent Cloud Object Storage in ap-seoul is named in the API reference, and Alipay and WeChat Pay in the privacy policy. No subprocessor list or stated data location (4). 5+5+0+4 = 14.

Replicate image models 66

replicate-mcp exposes every HTTP API operation as a tool, more than 30 (5), with a code mode the changelog lists as the way to keep context down (10). Outputs come back as URLs, list endpoints paginate, and Prefer: wait returns short jobs in one call (18). Error responses not checked in this run (10). No idempotency key. Webhooks for slow models (8). Official Python and JavaScript clients, few required inputs on official models (15).

SurgePix API 53

Every task returns one download URL, or one ZIP for an image set, and status responses are a few fields, so little enters context (18). Nothing to paginate. noWait chooses sync or async, and the skills pass size, aspect ratio, count and language, but none of these are in the public reference (10). Errors come back as a JSON code and msg, with 401 and 404 documented and an NSFW error on upload, but a failure can arrive as HTTP 200 with a non-zero code and failed task states carry no documented reason (12). Upload deduplicates by MD5 and returns the existing URL. Tasks have no idempotency key, and a retried task is a new task that spends credits again (5). Few required parameters (fileUrl for background removal). No official SDK, only the Node scripts inside the skills (8). 18+10+12+5+8 = 53.

Replicate image models 35

Plain bearer API tokens, no scopes found (20). No read-only or least-privilege mode found, and the changelog shows monthly spend limits were removed in July 2025 (0). The MCP server returns model descriptions and READMEs written by community authors, with no injection guidance found (5). Each prediction is listed with its inputs, outputs and logs on the dashboard and API (10). No security.txt, and no bug bounty or certification found in this run (0).

SurgePix API 41

Plain API keys created in the account settings, which the docs say can be revoked and reset. The key goes in the authorization header, never in a URL. No scopes found (20). No read-only key or spend cap. The plan's credit allowance bounds spend. Every uploaded file becomes a publicly accessible URL on Tencent Cloud storage, which counts against least privilege (3). The API returns image and file URLs, not untrusted text (10). The billing page's credit statement lists each request with its model and token counts, and sessions group calls in the web app, per the docs (8). No security.txt, disclosure policy, bug bounty or certification was found (0). 20+3+10+8+0 = 41.