Affinity vs Breakcold

Affinity 59

Status page at status.affinity.co with component history and separate components for External API v1, External API v2 and MCP (20). Its history feed shows one incident touching the APIs in the 90 days to 2 November 2026, "Disruption with All Services" on 3 September 2026, posted at 15:15 PDT with "errors or an inability to access the service" put down to its cloud provider, recovery seen at 15:35 and resolved at 16:18, 63 minutes in all. The incident page lists every component as affected, the CRM, External API v1 and v2, MCP, processing pipelines, mobile apps and extensions, though Affinity rated it minor. An outage of every service with errors across the board reads as a major in this run, however short (10). The 8 October reading of 15 sat between checklist values. Other entries concerned Affinity Analytics (11 August, 15 minutes) and a maintenance window announced on 14 August for 29 August, neither counted. Limits published, 900 requests a minute per user and 100,000 a month per account on Scale and Advanced (15). The docs tell integrators to handle 429 and every response carries x-ratelimit-* headers with seconds to reset, but we found no Retry-After, no backoff guidance and no idempotency keys (8 of 15). No SLA in the master subscription agreement. The trust centre lists a Service-Level Agreement item whose text we couldn't read (0). API v2 has stable dated versions, but 39 of 115 operations are beta and the affinity-mcp package is classed Beta on PyPI (6 of 10). Hosted lines used. 20 + 10 + 15 + 8 + 0 + 6 = 59.

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Affinity 70

Newest API changelog entry 28 October 2026, and affinity-mcp 0.7.0 and 0.7.1 on PyPI the same day (30). Seventeen dated changelog entries since 4 August 2026, among them version 2026-09-17 on 17 September, plus affinity-mcp 0.6.0 (21 October) and 0.7.0 and 0.7.1 (28 October) (20). Closed service with a public changelog, a support address and a feedback endpoint. We didn't test support (10 of 15). Not in the official MCP registry under its own namespace, where a search returns only third-party servers, and no official API SDKs. The official affinity-mcp package is on PyPI (5 of 15). affinity-mcp 0.7.1 is classed Beta, requires Python 3.13 and has no public repository or CI we could find (5 of 10).

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

Affinity 66

The hosted MCP server takes OAuth 2.0 with scopes mcp, mcp.read, api, api.read and offline_access. Since the 8 October check Affinity documents OAuth apps for the API too, with PKCE, those scopes, one-day access tokens and 90-day refresh tokens, but they are in early access and must be switched on by Affinity, so they aren't credited yet. API keys are named, revocable, several per user and can be tied to an IP allowlist, but carry all of their owner's permissions with no per-key scope or expiry. v2 takes the key only as a Bearer header (25 of 30). Read-only access can be chosen at OAuth consent, admins can disable each AI client for the firm, and every delete and merge waits for confirmation. An API key has no read-only mode (16 of 20). The server returns notes, transcripts, email subjects and files written by outsiders, and the MCP security page still gives no prompt-injection guidance (3 of 15). Manage Apps shows each key's owner, last use and revoked history and the account's usage, and the local server can export OpenTelemetry traces. No per-call audit log for the operator is documented (7 of 15). SOC 2 Type II and ISO 27001, 27017 and 27018 on the trust centre and security page, a yearly third-party penetration test, and a bug bounty the security page mentions without a public programme page. No security.txt (15 of 20).

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

Affinity 10

No x402, MPP or L402 (0). Per-seat yearly prices are public, Essential $2,000, Scale $2,300 and Advanced $2,700 a user a year, with no per-call price and every plan sold through sales (10). No free tier or card-free trial that reaches the API. The help centre says trial accounts can't use the API until they buy Scale or above (0). A person at a paying firm makes the key or approves OAuth in a browser (0).

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.