Affinity vs Relaticle

Affinity 10

No x402, MPP or L402 (0). Per-seat yearly prices are public, Essential $2,000, Scale $2,300 and Advanced $2,700 a user a year, with no per-call price and every plan sold through sales (10). No free tier or card-free trial that reaches the API. The help centre says trial accounts can't use the API until they buy Scale or above (0). A person at a paying firm makes the key or approves OAuth in a browser (0).

Relaticle 30

No x402, MPP or L402 (0). Cloud prices are public per workspace with nothing per call (10). A 14-day Cloud Pro trial with no card, and self-hosting is free (20). A person signs up in a browser behind a Cloudflare check, or deploys a server (0). 0 + 10 + 20 + 0 = 30.

Affinity 70

Newest API changelog entry 28 October 2026, and affinity-mcp 0.7.0 and 0.7.1 on PyPI the same day (30). Seventeen dated changelog entries since 4 August 2026, among them version 2026-09-17 on 17 September, plus affinity-mcp 0.6.0 (21 October) and 0.7.0 and 0.7.1 (28 October) (20). Closed service with a public changelog, a support address and a feedback endpoint. We didn't test support (10 of 15). Not in the official MCP registry under its own namespace, where a search returns only third-party servers, and no official API SDKs. The official affinity-mcp package is on PyPI (5 of 15). affinity-mcp 0.7.1 is classed Beta, requires Python 3.13 and has no public repository or CI we could find (5 of 10).

Relaticle 90

v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.

Affinity 59

Status page at status.affinity.co with component history and separate components for External API v1, External API v2 and MCP (20). Its history feed shows one incident touching the APIs in the 90 days to 2 November 2026, "Disruption with All Services" on 3 September 2026, posted at 15:15 PDT with "errors or an inability to access the service" put down to its cloud provider, recovery seen at 15:35 and resolved at 16:18, 63 minutes in all. The incident page lists every component as affected, the CRM, External API v1 and v2, MCP, processing pipelines, mobile apps and extensions, though Affinity rated it minor. An outage of every service with errors across the board reads as a major in this run, however short (10). The 8 October reading of 15 sat between checklist values. Other entries concerned Affinity Analytics (11 August, 15 minutes) and a maintenance window announced on 14 August for 29 August, neither counted. Limits published, 900 requests a minute per user and 100,000 a month per account on Scale and Advanced (15). The docs tell integrators to handle 429 and every response carries x-ratelimit-* headers with seconds to reset, but we found no Retry-After, no backoff guidance and no idempotency keys (8 of 15). No SLA in the master subscription agreement. The trust centre lists a Service-Level Agreement item whose text we couldn't read (0). API v2 has stable dated versions, but 39 of 115 operations are beta and the affinity-mcp package is classed Beta on PyPI (6 of 10). Hosted lines used. 20 + 10 + 15 + 8 + 0 + 6 = 59.

Relaticle 40

Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Affinity 66

The hosted MCP server takes OAuth 2.0 with scopes mcp, mcp.read, api, api.read and offline_access. Since the 8 October check Affinity documents OAuth apps for the API too, with PKCE, those scopes, one-day access tokens and 90-day refresh tokens, but they are in early access and must be switched on by Affinity, so they aren't credited yet. API keys are named, revocable, several per user and can be tied to an IP allowlist, but carry all of their owner's permissions with no per-key scope or expiry. v2 takes the key only as a Bearer header (25 of 30). Read-only access can be chosen at OAuth consent, admins can disable each AI client for the firm, and every delete and merge waits for confirmation. An API key has no read-only mode (16 of 20). The server returns notes, transcripts, email subjects and files written by outsiders, and the MCP security page still gives no prompt-injection guidance (3 of 15). Manage Apps shows each key's owner, last use and revoked history and the account's usage, and the local server can export OpenTelemetry traces. No per-call audit log for the operator is documented (7 of 15). SOC 2 Type II and ISO 27001, 27017 and 27018 on the trust centre and security page, a yearly third-party penetration test, and a bug bounty the security page mentions without a public programme page. No security.txt (15 of 20).

Relaticle 57

Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single mcp:use scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.

Affinity 66

API responses can be sized with limit, fieldIds and fieldTypes, but the MCP server lists 75 tools and skills with no toolsets or dynamic loading documented (12 of 25). Cursor pagination with nextUrl, a filter grammar, and search endpoints with nested filters and up to five sorts (20). Errors come as an array of typed codes with messages, and validation errors name the property (15 of 20). No idempotency keys. The affinity-mcp 0.5.1 package registers every tool with readOnlyHint, destructiveHint and idempotentHint, which we read in the wheel. We couldn't list the hosted server's tools without an account. Deletes and merges wait for confirmation per the docs (13 of 20). Defaults are sensible and few parameters are required, but we found no official API client in any language, only the Python MCP package (6 of 15).

Relaticle 59

50 MCP tools, six schema resources and a prompt, with no toolsets or read-only subset (5). Filters combine native fields, custom fields and linked records with $and, $or and $not, plus sort, include, per_page (MCP maximum 25) and cursors (20). Errors come back as HTTP codes and inline MCP error responses such as Invalid ability provided.; no error catalogue was read (12 of 20). Base tool classes set readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and upserts by unique field make creates safe to retry (17 of 20). One URL with OAuth or a token; no official SDK (5 of 15). 5 + 20 + 12 + 17 + 5 = 59.

Affinity 67

Closed service with a published master subscription agreement naming Project Affinity, Inc., and a separate developer agreement. The MCP package is MIT (15). DPA, a privacy policy updated July 2026, deletion of the customer's instance within 45 days of termination, and a statement that customer data is never used to train AI models. Breach notice is 'without undue delay' with no hours given, and the terms let Affinity use aggregated anonymous data freely (22 of 30). Old API versions are locked when a new one ships, with migration steps, but no sunset period for API versions is stated and beta endpoints can change without notice. Data Share has a written 60-day deprecation policy (10 of 20). 17 sub-processors named with locations, all in the USA, AWS hosting, and three AI sub-processors named (17 of 20).

Relaticle 73

AGPL-3.0 source with an integration exception, and terms for the Cloud service (30). The privacy policy (4 November 2026) gives retention for server logs (90 days), contact forms (12 months) and paused trial workspaces (deleted after 60 days with notice), and names provider categories; no DPA was found (20 of 30). No deprecation policy or dated notices found (5 of 20). The security page lists each Cloud provider and what it receives, with hosting at Hetzner in Germany, and website analytics through Fathom without CRM content (17 of 20). 30 + 20 + 5 + 17 = 72.