SimScale vs Zoo

SimScale 33

Read for a closed service with open SDK sources. The Python SDK's newest release is 19.1.0 of 3 March 2026, 245 days before the check, and the v1 document carries no date (5 of 30, for a change in the window being likely from the v1 beta but unproven). Ten SDK releases from February 2025 to March 2026 and none since (0 of 20). api@simscale.com, support@simscale.com and a community forum; response times were not tested and the SDK repository has no issue activity we could read (10 of 15). Official Python and C# SDKs, with v1 editions, generated from the document (15). The SDK repository has no CI workflow and pins the document version at 0.0.0 (3 of 10). 5 + 0 + 10 + 15 + 3 = 33.

Zoo 90

Read for a hosted service with open-source clients. zoo-mcp v0.33.0 on 30 October 2026, the CLI v0.2.209 on 28 October and kittycad 1.8.0 on 15 October (30). Nine zoo-mcp tags from 24 to 30 October alone, with CLI and SDK releases through October (20). Commits land daily across the KittyCAD organisation, with a Discord and a community forum; issue response times were not read because GitHub's issue pages refused us (15 of 25). io.github.KittyCAD/zoo-mcp is in the official MCP registry under a GitHub-verified namespace, though at version 0.10.0 of 27 January 2026 (15). pytest across Python 3.11 to 3.14, ruff, ty, a security workflow and Dependabot, with the scheduled run on main passing on 3 November (10). 30 + 20 + 15 + 15 + 10 = 90.

SimScale 15

Read with the hosted lines on api.simscale.com. No status page, since status.simscale.com has no DNS record and none is linked from the site, the docs hub or the API document (0). No readable incident history (5). No rate limit with a number; the terms reserve the right to impose rate or traffic limits and the v0 document mentions a 429 response once (0). No Retry-After, backoff guidance or idempotency keys; runs can be cancelled (0). No SLA, and the terms say SimScale cannot warrant uninterrupted availability with Free plans carrying no availability obligation (0). /v0 is the generally available version; /v1 is in beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Zoo 55

Read with the hosted lines on api.zoo.dev. A Better Stack status page at status.zoo.dev lists public and internal components with uptime figures (20). Its incident pages show no incidents for September, October and November 2026; the June to August archive didn't render for our reader, so about three weeks of the 90-day window are unread (25 of 30). No rate limit with a number was found in the OpenAPI document, the API docs, the FAQ or the MCP source (0). No Retry-After or backoff guidance and no idempotency keys; the document says only that cancellation is idempotent (3 of 15). No SLA on any plan, and the terms disclaim uninterrupted service (0). The REST API and Zookeeper are not labelled beta, while POST /ml/kcl/completions carries the beta tag and zoo-mcp declares the Beta classifier (7 of 10). 20 + 25 + 0 + 3 + 0 + 7 = 55.

SimScale 10

No x402, MPP or L402 (0). No price is published; Mechanical, Professional and Enterprise are on request and the Community plan carries no API (0). The sandbox with its fixed public key lets an agent exercise every endpoint without an account or card, though it runs nothing, and the free Community plan has no API; read as a partial free route (10 of 20). An API key comes with an Enterprise contract arranged by people (0). 0 + 0 + 10 + 0 = 10.

Zoo 35

No x402, MPP or L402 (0). The per-second rate ($0.0083) and plan allowances are public in the pricing JSON the site loads and on the blog, with the FAQ stating rounding and free GETs (20). The Free plan carries $10 of usage a month with no plan fee; whether sign-up asks for a card was not established, and pay-as-you-go needs a payment method (15 of 20). A person signs in with SSO in a browser and mints the token; service accounts come only after an organisation exists (0). 0 + 20 + 15 + 0 = 35.

SimScale 44

One API key per user in the X-API-KEY header, with no scopes, documented expiry, rotation or revocation; the SDK reads it from an environment variable (10 of 30). Project and space permission endpoints exist and the sandbox cannot change data, but no read-only key or confirmation step for deletes was found (8 of 20). The API returns the owner's own geometry and results and no third-party content, so there is little untrusted content to inject (10 of 15). No audit log or per-call visibility found on the pages read (0 of 15). SOC 2 Type II by Prescient Assurance, a public Intigriti bug bounty with the API in scope, security.txt and AES encryption (16 of 20). 10 + 8 + 10 + 0 + 16 = 44.

Zoo 67

Bearer API tokens minted in the account, several per user, listed and deleted at /user/api-tokens, organisation service accounts on Team and Enterprise, and OAuth 2.0 apps with PKCE and a device grant; no scopes were found on tokens and no rotation guidance (22 of 30). No read-only token or MCP subset; the Team plan's admin console and auditing give oversight after the fact, and the MCP client's own file permissions govern writes to main.kcl (8 of 20). Zookeeper carries a web_search tool and the MCP server returns KCL samples and docs, with no prompt-injection guidance found (5 of 15). Organisation admins get an API activity log and /user/api-calls lists each call with its cost (12 of 15). security.txt with a GitHub advisory contact and a policy committing to a 72-hour reply and severity-based rewards, SOC 2 Type II on the trust centre, and two Trail of Bits reviews published in 2024 and 2026 (20 of 20). 22 + 8 + 5 + 12 + 20 = 67.

SimScale 55

List endpoints page with limit and page parameters and results are fetched per run and per export rather than whole (15 of 25). Pagination on lists and filters on some, such as valid geometries only (15 of 20). Typed error responses by status code; message shapes were not read in detail and the v1 error format page rendered empty (10 of 20). No idempotency keys; runs are asynchronous with event logs and cancel, so a retry can start a second run (5 of 20). Official Python and C# SDKs cover the surface, but a simulation setup needs a full Simulation Spec object with many required fields and a matching schema version (10 of 15). 15 + 15 + 10 + 5 + 10 = 55.

Zoo 44

zoo-mcp lists 42 tools in one process with no toolset switch, read-only subset or dynamic loading, and their docstrings total about 30,000 characters (5 of 25). List endpoints take limit, page_token and sort_by (31 paginated operations), with no field selection or filtering (15 of 20). Errors are a generic object with a message and request_id, no error codes, and MCP tools return a string on failure (8 of 20). No idempotency keys, no readOnlyHint or destructiveHint in the tool source, and the websocket needs a ping every 5 seconds to stay open (4 of 20). Few required parameters, official SDKs in Python, TypeScript, Rust and Go, but one modeling session per MCP process and a websocket protocol an agent has to drive by hand (12 of 15). 5 + 15 + 8 + 4 + 12 = 44.

SimScale 71

Public OpenAPI 3.0.3 documents for /v0 (98 operations) and /v1 (163 operations), with the simulation and meshing schema versions selectable by query parameter (25). No llms.txt and no Markdown docs; the API docs are Swagger UI and script-rendered pages (0). The introduction explains the sandbox, versioning and Workbench compatibility, and operations carry one-line summaries, but 10 of the 98 v0 operations have no description and the guides for v1 rendered empty (12 of 20). 2,112 schemas with 355 enum lists, required fields and a typed security scheme (13 of 15). The sandbox answers every endpoint with example data, which stands in for examples, and responses are typed for 400, 403, 404, 409, 422 and 429 (11 of 15). Path versions v0 and v1 with a migration guide and changelog for v1, and dated SDK releases, though the changelog page itself rendered empty (10 of 15). 25 + 0 + 12 + 13 + 11 + 10 = 71.

Zoo 65

OpenAPI 3.0.3 served at the root of api.zoo.dev, 174 paths and 226 operations each with a summary, and MCP tools whose inputs are typed Python signatures that the SDK turns into JSON Schema (25). No llms.txt (404) and no Markdown twin of the docs (0). The MCP docstrings average about 725 characters and say what each tool is for and when to use another, with snapshot at 3,500 characters; the OpenAPI summaries are one line and the websocket page lists one client message type (14 of 20). 583 schemas with 976 enum lists and required fields, and the file conversion path takes typed format parameters (12 of 15). Each docs endpoint page carries a request example, but errors are one generic object with request_id and message, and the websocket's server messages are not enumerated in the docs (9 of 15). The document reports version 0.1.0, there is no API changelog page, and changes are announced per repository release or on the blog, as the per-second billing change of 30 September 2025 was (5 of 15). 25 + 0 + 14 + 12 + 9 + 5 = 65.