ActiveCampaign vs Dreamlit

ActiveCampaign 5

There is no changelog. On 8 October the updatedAt stamps on 46 of the 185 reference pages fell on 12, 13, 17 and 31 August and 2 September 2026 (per the 8 October check, not re-read on 4 November). The 8 October check recorded them as page revisions, not changelog entries, and no API change was recorded on those pages. Page dates that record no change don't set recency (as wrike, coinbase-mcp and agentweb), and the clients are years old, so no dated API change is readable (0). Page stamps aren't releases, so the 90-day line is 0. No public changelog. A community site and a developer relations email address are published, and we did not see reply times (5). The official PHP and Node.js clients are v1 wrappers last changed in December 2017 and March 2018 (0). No current package to assess (0). 0 + 0 + 5 + 0 + 0 = 5.

Dreamlit 80

The latest changelog entry is 12 October 2026, custom repeating schedules (30). Eight dated entries between 10 August and 12 October (20). Priority support on Pro, dedicated support on Scale and a public changelog (10 of 15). ai.dreamlit/mcp is in the official MCP registry under its domain namespace (15). The metadata repository has validate and publish workflows; there's no package to check (5 of 10). Total 80.

ActiveCampaign 33

One API key per user in an Api-Token header, with no scopes. The MCP server is authorised by signing in and approving, with no scopes documented. Key rotation was not found in the reviewed documentation (15 of 30). No read-only key or mode. The listed MCP tools include no delete tool and none that schedules a campaign, though add_contact_to_automation can start messages, and the definitions name a permission resource for each operation (8 of 20). The API returns contact data, notes and message content written by outsiders, and no prompt-injection guidance was found (0 of 15). No audit log or per-call visibility was found in the developer docs. The help centre refused our reader, so this is unchecked (0 of 15). The security page states SOC 2, HIPAA and GDPR compliance, a red team and a trust centre with the SOC 2 report. No security.txt, bug bounty or disclosure policy was found (10 of 20). All per the 8 October check, not re-read on 4 November. robots.txt disallows /security/bounty, so whether a bounty page exists wasn't read.

Dreamlit 74

OAuth to one workspace with four scopes, and project-scoped personal access tokens with chosen scopes, shown once (30). A read-only grant is possible, publishing needs its own scope, confirm_publish runs only after the user approves the prepared payload, and a dedicated least-privilege database user reads the customer's data (20). The docs warn that AI clients can be tricked by untrusted prompts and tell users to review edit, publish and unpublish calls (8 of 15). The security page lists access logs for database operations and for the platform, and analytics expose run rows; no customer-facing log of MCP calls was described (8 of 15). The security page claims penetration testing and a bug bounty programme without a link, SOC 2 is coming soon, no security.txt (404), and the MCP repository's SECURITY.md routes reports to support (8 of 20). Total 74.

ActiveCampaign 52

List endpoints take limit up to 100 and contacts take meta=only for a count, but there is no field selection. The MCP server lists 50 tools with no documented toolsets (12 of 25). limit, offset, orders, filters and id_greater on contacts, less 4 because unsupported filter and order keys are silently ignored (16 of 20). Five documented status codes and a 422 errors array of titles without codes. Campaign state changes report failures as 200 with succeeded 0 and a localised message (10 of 20). No idempotency keys. Upsert by email and bulk import with per-row status give safe retries for contacts, and no MCP tool annotations are documented (8 of 20). Few required parameters. The official PHP and Node.js clients wrap the v1 API and last changed in 2017 and 2018, so no current official SDK was found (6 of 15). Docs per the 8 October check, not re-read on 4 November; the PHP client's last commit (7 December 2017) was confirmed from a clone.

Dreamlit 67

16 tools, the 11 to 30 band; tools follow the granted scopes, so a read-only grant sees fewer (20 of 25). Analytics take filters, sorting and pagination, and brand styles paginate (18 of 20). The docs describe the errors an agent will meet, such as authorization required, choose a project and browser hand-off, without codes (12 of 20). Publishing is prepare then confirm, and tests don't publish; no idempotency or annotations documented (10 of 20). Empty scope requests default to the v1 scopes and get_status gives a first call; no SDK or REST route (7 of 15). Total 67.

ActiveCampaign 20

No x402, MPP or L402 (0). The 8 October plan prices were read from a data file the pricing page loads, which this run doesn't use, and the pricing page wasn't re-read on 4 November because the terms bar automated access, so no published price is counted (0). A 14-day trial with no card, and a free developer sandbox on request (per the 8 October check, not re-read on 4 November) (20). A person signs up in a browser and copies the key from account settings (0). 0 + 0 + 20 + 0 = 20.

Dreamlit 10

No x402, MPP or L402 (0). Plan prices with included emails are public in pricing.md, no per-email overage price (10 of 20). No free plan for new accounts (0). Signup, database connection and payment happen in the web app (0). Total 10.

ActiveCampaign 68

Each reference page is public Markdown with an OpenAPI 3.1 definition for its operation. No single downloadable specification was found (20 of 25). llms.txt and Markdown pages (10). Pages revised in August 2026, such as contact upsert and contact search, say when to use each endpoint and when not to. Older pages are short, and the MCP page gives one line a tool with no input schemas (14 of 20). Query parameters are typed with enums on status and sort order, but the segment body is described as flexible JSON to be checked against the segment builder (10 of 15). Request examples on most pages. The errors page lists five status codes and one 422 body, and 400 responses in the definitions are empty objects (9 of 15). The version is in the path (v3, Segments 2.0.0). No changelog was found, and developers.activecampaign.com/changelog returns 404 (5 of 15). All per the 8 October check, not re-read on 4 November, since the terms bar automated access to the developer site.

Dreamlit 59

The registry entry and the dreamlit-ai/dreamlit-mcp repository carry metadata only, so tool JSON Schemas are readable only inside a session; the docs give each tool's purpose and required scope (5 of 25). llms.txt, pricing.md and Markdown copies of docs pages (10). Tool descriptions say when to use each, such as edit_workflow_steps for exact edits without AI, and the publish pair's order (16 of 20). Parameter types aren't published beyond names such as includeEmailHtml and startNewChat (5 of 15). Example prompts and a troubleshooting section for each documented error state (10 of 15). A dated changelog; server version 0.1.0 in the registry (13 of 15). Total 59.