Robolly vs Templated API + MCP

Robolly 5

No changelog, release notes or dated API change was found. The sitemap marks every docs page as modified on 4 November 2026, which reads as a site rebuild rather than a change, so it isn't counted (0). No dated changes since 8 August (0). Support by email, with chat on higher plans; not tested (5 of 15). Not in the official MCP registry and no SDKs (0). No public package or repository (0). 0 + 0 + 5 + 0 + 0 = 5.

Templated API + MCP 80

mcp-server-templated v1.9.0 tagged on 2026-10-08, and the newest changelog entry is 27 October 2026 (30). Six MCP tags in the 90 days from 4 August (v1.4.0 and v1.4.1 on 5 August, v1.7.0 and v1.7.1 on 8 September, v1.8.0 on 6 October, v1.9.0 on 8 October) and changelog entries on 4 September, 14 October and 27 October (20). Dated public changelog and support by email. GitHub issue response wasn't checked (github.com refuses our requests) (10). Listed in the official MCP registry as io.github.templated-io/mcp-server-templated, with 1.9.0 published on 8 October by GitHub OIDC from CI (15). @modelcontextprotocol/sdk 1.32.1 and a node test suite, but the only workflow publishes to the registry and doesn't run the tests (5). 30 + 20 + 10 + 15 + 5 = 80.

Robolly 49

Closed service under terms effective 8 April 2026 from Avantis Innovations LLC in Wyoming. The terms can change without notice (15). The privacy policy of the same date covers Google sign-in and Sheets data, says spreadsheet rows aren't kept beyond a render and account data is deleted with the account, and otherwise names no periods (10 of 30). No deprecation policy or notices (0). Hosting is described only as third-party vendors, with no processors or locations named, while the footer says Made in EU (2 of 20). 15 + 10 + 0 + 2 = 27.

Templated API + MCP 76

MCP server MIT with a LICENSE file. The rendering service is closed under published terms (18). Privacy policy updated 18 October 2026 with retention stated per data type (until you delete, files purged within 90 days of deletion, logs up to 90 days, billing records five years) and a DPA at templated.io/dpa, though it doesn't say whether customer content trains models (25). No deprecation policy or dated deprecation notices found (0). Subprocessors named by purpose, including Gemini, OpenAI, Anthropic and DeepSeek for AI functions, Photoroom for background removal, PostHog and Plausible for analytics and Stripe, Creem and Spedy for payments (18). 18 + 25 + 0 + 18 = 61.

Robolly 48

Hosted lines. The footer links an UptimeRobot status page, but it loads its figures from /api/, which stats.uptimerobot.com's robots.txt disallows, so the page showed no monitors or history (10 of 20 for a page that exists) and no history was read (5). A hard limit of 3 renders a second is published (15). The rate-limit error code and advice to send renders one at a time, and identical renders are cached for 45 days at no cost, which makes a retry safe; there's no Retry-After or backoff interval (8 of 15). No SLA found (0). The API isn't labelled beta (10). 10 + 5 + 15 + 8 + 0 + 10 = 48.

Templated API + MCP 65

Better Stack status page with API, App and Website components over 30, 60 and 90 days (20). The incidents page lists no incident for September, October or November 2026 and the RSS feed holds no entry, so the page has never posted one. This run scores a page that has never posted an incident 20, not the 30 of a clean record, and the page's own figure for the API is 100 per cent over 90 days (20). Rate limits per plan in the Markdown price list, 60, 150 and 300 requests a minute (15). No 429 behaviour, Retry-After or retry advice in the API docs or llms-full.txt. MCP 1.9.0 tells the model to wait and retry after a 429, which isn't API documentation (0). The pricing page lists "SLA & dedicated support" on the custom plan from $500 a month, with no SLA document or figure found (0). The render API is GA. Video launched on 7 January 2026 as "now live" (10). 20 + 20 + 15 + 0 + 0 + 10 = 65.

Robolly 57

No OpenAPI or other machine-readable contract found for the REST API, and the MCP server is closed. The MCP page lists all nine tools and get_template_modifications returns each template's keys, constraints and examples at run time (8 of 25, on that partial evidence). llms.txt indexes the docs (10). The MCP page says what each tool does, which tools change templates or spend credits, and that there is no delete tool (14 of 20). Modification keys follow {element-name}.{modification-key} with constraints from the template rather than a fixed schema (7 of 15). Request examples throughout and an error code table with eight codes (13 of 15). /v1 paths with no changelog (5 of 15). 8 + 10 + 14 + 7 + 13 + 5 = 57.

Templated API + MCP 74

No OpenAPI. All 25 MCP tools carry typed JSON Schema inputs, and server.json is published to the MCP registry, so partial credit (18). llms.txt, llms-small.txt, llms-full.txt, pricing.md and a Markdown version of every page (10). Some MCP descriptions guide the model well (update_template explains pages versus layers, create_render names get_template_layers first), others are one line (12). Format and layer type enums and a required template field, and MCP 1.9.0 caps list limits at 100 in the schema, but size, scale and fps limits sit in prose rather than min and max, and layers is an open object (10). Request and response examples per endpoint. Error tables with status codes appear on five endpoints (font, render, template and upload deletes and template update), none on create render (9). Versioned /v1 path, a dated changelog now at templated.io/changelog/ and tagged MCP releases (15). 18 + 10 + 12 + 10 + 9 + 15 = 74.

Robolly 75

Nine MCP tools (25). The renders list pages with a cursor, and templates are found by name (14 of 20). Errors carry errorCode and developerMessage with eight documented codes (17 of 20). Identical renders are cached for 45 days, so repeats are free and safe, the MCP server has no delete tool, and annotations couldn't be read on the closed server (12 of 20). Renders return the file synchronously by default, but there's no SDK (7 of 15). 25 + 14 + 17 + 12 + 7 = 75.

Templated API + MCP 70

25 MCP tools (15), plus results passed through field allowlists, and MCP 1.9.0 prunes JSON results (get_template_layers about 78 per cent smaller by the release note) (3). Lists take page and limit, default 25 and at most 100 in the MCP, and the MCP can filter to one folder or external ID (17). The API docs give status tables on five endpoints. MCP 1.9.0 (8 October 2026) turns each status into an instruction, such as calling the list tool for a missing ID, reconnecting on 401 or waiting for Retry-After on 429, and rejects unknown layer names before rendering (12). Every tool carries readOnlyHint and destructiveHint, with deletes and template updates marked destructive. No idempotency key (15). Only template is required and renders are synchronous by default, but there are no official SDKs, only code samples in JavaScript, Python and PHP (8). 18 + 17 + 12 + 15 + 8 = 70.

Robolly 47

Bearer API key, signed render links, and MCP OAuth with one robolly:mcp scope limited to the organisation the user approves. Connections are listed and revoked under Connected AI Tools, and the API key is never shared with an OAuth client. No key scopes or rotation documented (22 of 30). The MCP server can create and update templates but not delete them; there's no read-only mode (10 of 20). Tools return the user's templates and public gallery designs (10 of 15). A renders list and the connected-tools view give some visibility, with no audit log documented (5 of 15). No security.txt (the path returns the site's HTML shell), disclosure policy, bug bounty or certification (0). 22 + 10 + 10 + 5 + 0 = 47.

Templated API + MCP 42

The REST key has full account access by the docs' own words, and the privacy policy says it can be regenerated. The hosted MCP is an OAuth 2.1 resource server since MCP 1.6.0 (18). The MCP setup guide still documents ?apiKey= in the server URL for automations, less 10 (8). Folder and external ID scoping is enforced server side, and destructive tools are annotated so clients can ask first. No read-only key (12). Tool results pass through allowlists, and the docs describe server-side scoping as a guard against prompt injection (12). No audit log or per-call log found for the customer beyond the render list (3). A valid security.txt since 28 October 2026 (Last-Modified), sending reports to support@templated.io and expiring 8 October 2027, and 2FA since September 2026. No certification or bug bounty found (7, as a valid security.txt to a support address with nothing else). 8 + 12 + 12 + 3 + 7 = 42.