TomTom Maps APIs + MCP vs Woosmap

TomTom Maps APIs + MCP 15

TomTom's API status page sits on tomtom.service-now.com, whose robots.txt disallows every path on 4 November, so the earlier status readings are struck (0). With no history we may read, the record scores 5. No published QPS limits or 429 guidance were found on the docs pages we read on 1 October; TomTom's acceptable use policy now bars robots from its websites, so they weren't re-read (0). The MCP maps a 429 to a typed rate-limit error with a message, and we found nothing on Retry-After (5, the earlier partial kept). No SLA found (0). Orbis APIs went GA on 8 July 2026, but the remote MCP server is in public preview and the README says some Orbis and EV services may not be enabled on every account (5, kept). 0+5+0+5+0+5 = 15.

Woosmap 78

Hosted lines. Atlassian Statuspage at status.woosmap.com with seven components (Localities, Store Search, Geolocation, Distance, Address, Map and Indoor APIs) (20). The status home page lists no incidents from 23 October to 6 November 2026. The full history page loads by script and the site's robots.txt disallows /api/, so the rest of the 90 days wasn't read and the line is held between the unreadable and minor tiers (10). Each endpoint's reference states its own rate limit, such as 50 a second, shared by a project's keys (15). Every response carries RateLimit-Policy and RateLimit headers, and the rate-limits page says to wait t seconds after a 429, retry at most three times and back off 1, 2 and 4 seconds when the header is missing, with sample code (15). A 99.9% SLA on the Enterprise plan per the pricing page; we didn't read its terms (8). GA (10). 20+10+15+15+8+10 = 78.

TomTom Maps APIs + MCP 86

MCP v1.6.15 on 2 November 2026 (30). Eight tags since 6 August, v1.6.8 (15 September) to v1.6.15 (2 November) (20). Pull requests from several maintainers merged up to 3 November 2026. We couldn't see issue reply times from git (18, kept). The package is at 1.6.15 in its repository; the 30 September note that it wasn't in the official MCP registry came from the registry's JSON API and is struck (8, kept). CI runs type checks, lint, build, end-to-end tests and a Veracode scan, with dependabot (10). 30+20+18+8+10 = 86.

Woosmap 26

No dated API release, changelog or release note found. The newest dated activity we saw is the public woosmap-samples repository on 16 September 2026, which isn't an API release (10). No dated changes to count in the last 90 days (0). Support by email and a support centre, with no public changelog (5). Official JavaScript, iOS and Android SDKs exist, but we couldn't check their versions because the GitHub API was rate-limited and two SDK repository names didn't resolve; the MCP server isn't in the official MCP registry (8). The samples carry tests, per the rate-limits page (3). 10+0+5+8+3 = 26.

TomTom Maps APIs + MCP 71

No public OpenAPI that we found. The MCP's tools have Zod schemas with described fields (22). docs.tomtom.com/llms.txt indexes about 180 pages, many as .md, per the 2 October check, not re-read on 4 November (10). Tool descriptions are mostly one line, with little on when not to use a tool (12). Typed fields with constraints, and since 1.6.12 the search, routing and EV tools list their valid values from the maps-sdk (11, kept). We couldn't read the REST error reference. The MCP returns typed errors per status code, and since 1.6.13 tells a 401 from a 403 (8). Versioned REST paths; the MCP CHANGELOG.md has dated entries from 1.6.11 (5 October 2026) to 1.6.14 and says 1.1.1 to 1.6.10 have none (8, kept). 22+10+12+11+8+8 = 71.

Woosmap 81

OpenAPI 3.1 spec, version 1.46.3, with 47 paths across Localities, Stores, Distance, Datasets, Indoor, Map and what3words endpoints (25). llms.txt as a routing index, llms-full.txt and a Markdown twin of every page (10). llms.txt says which pages are authoritative for parameters and which explain products, and endpoint pages describe purpose, with little on when not to call one (15). Typed parameters from the spec with enums and required fields (13). The spec documents 400, 401, 402, 403, 404, 409, 422 and 429 responses, and pages carry examples (13). The spec is versioned, but no public changelog or release notes were found (developers.woosmap.com/changelog/ and /release-notes/ return 404) (5). 25+10+15+13+13+5 = 81.

TomTom Maps APIs + MCP 51

API keys from the developer portal, limited to the products selected for them, which earns 25. Less 10 because REST calls take the key as the key query parameter. The hosted MCP takes a tomtom-api-key header, and the source carries OAuth with an audience check that 1.6.13 made mandatory for OAuth deployments (15). Keys can be limited by product and every tool reads (16). Results include POI names and traffic incident text with no prompt-injection guidance. An app-only tool, tomtom-get-api-key, returns the raw key to the map app; since 1.6.12 clients that render no apps don't receive it (6, kept). We didn't find per-call logs or usage reporting we could read (0). HackerOne disclosure programme with a 3 business day first response in the organisation's SECURITY.md, Veracode scanning in CI, and no security.txt per the 30 September check (14, kept). 15+16+6+0+14 = 51.

Woosmap 43

Public keys are read-only and must carry a domain or IP restriction. Private keys are read-only or read and write (fixed at creation), restricted by IP, iOS or Android, and can go in an X-Api-Key header. Less 10 because private_key in the query string is a documented option and the default in the spec (17). Read-only keys and the read/write split give least privilege; no confirmation step on dataset deletes was found (16). find_nearby and get_place_details return public POI data, ratings and opening hours, with no prompt-injection guidance (7). Console usage per project wasn't checked (3). www.woosmap.com/.well-known/security.txt returns 404, and we found no disclosure policy, bug bounty or certification (0). 17+16+7+3+0 = 43.

TomTom Maps APIs + MCP 25

No x402, MPP or L402 (0). Free allowances are public, but the pricing page re-read on 2 October showed no paid rate as a number, only a euro estimator and a contact-sales link (5 of 20, kept). A no-card free allowance of 20,000 geocodes, 20,000 reverse geocodes and 20,000 routes a month, with Search and Matrix at 2,500 (20). Signup is a browser flow (0). The pricing page is on a host whose acceptable use policy now bars robots, so it wasn't re-read on 4 November. 0+5+20+0 = 25.

Woosmap 30

No x402, MPP or L402 (0). Plans and per-API tier breakpoints are public, but per-request prices sit in a script-driven calculator we couldn't read, so plan-only credit (10). Free plan up to 10,000 requests a month with 'No Credit Card Required' (20). A person signs up and creates a key in the console (0). 0+10+20+0 = 30.