Attendee vs Circleback

Attendee 26

Graded on the hosted API with the hosted lines. No status page was found on the site, the docs or the README, and the footer's Status entry has no link (0). With no readable incident history the record takes the default (5). No rate limit is in the docs. The source sets defaults of 3,000 POST requests a minute per project and 2,500 concurrent bots, and the hosted values are not stated (5). No 429 response or Retry-After guidance is documented. deduplication_key makes bot and calendar creation safe to retry, and webhooks are retried 3 times (6). The terms supply the service as is with no uptime figure (0). The /api/v1 API has no beta label, though calendar integration is labelled Beta (10). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The rate-limit 5 and 429 6 are partials kept and flagged. 0 + 5 + 5 + 6 + 0 + 10 = 26.

Circleback 77

Graded on the hosted REST API and MCP server with the hosted lines. incident.io status page at status.circleback.ai with four components, none of them the API (20). Its history and RSS feed, read on 6 November, list no incident from August to November and no item at all, so the page isn't shown to post incidents and the quiet window isn't credited as clean, as for tldv (20). Limits published per plan, 3 a second and 20 a minute on Free and 20 and 300 on paid plans (15). 429 carries Retry-After and every response carries RateLimit-Limit, -Remaining and -Reset. No idempotency key or safe-retry guidance for writes (12 of 15). No SLA found in the Terms or on the pricing page (0). The API has no beta label (10). 20+20+15+12+0+10 = 77.

Attendee 48

Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The OpenAPI 3.1.1 file at docs.attendee.dev/api-reference/openapi.json was read on 9 October in place of the rendered reference, but no docs page read then was recorded as linking it as a visible download, and the docs host is now paused, so it isn't counted as a published contract (0). The repository carries the spec as docs/openapi.yml (OpenAPI 3.0.3, 30 operations, last changed 28 October 2026), which no read page links for download either. llms.txt and a Markdown twin of each docs page (10). Most operations have a short description, and a few state when a call is allowed, such as delete_data only after a bot has ended (9). Enums, required fields and typed settings objects, with a free-form metadata object and no security scheme, since the key is declared as a header parameter (11). The only error responses are 400 and 404 with no schema, and 401 and 429 are absent, as the repository's docs/openapi.yml also shows on 4 November (8). The path is versioned as v1, info.version stays 1.0.0, and the site changelog has dated entries up to 24 March 2026 while repository tags continue to 30 October 2026 (10). 0 + 10 + 9 + 11 + 8 + 10 = 48.

Circleback 81

Each reference page embeds the OpenAPI 3.2 operation for its endpoint, but no single spec file is linked, and MCP input schemas need a sign-in (20 of 25). llms.txt and a Markdown copy of each docs page (10). Operation descriptions state what is returned and who may act, such as only the owner deleting a meeting, and the update call explains replace semantics (16 of 20). Typed parameters with enums and defaults, such as ownership All, Mine or Shared (13 of 15). curl examples, a JSON error envelope with error and code, and 400 and 429 responses per operation (12 of 15). Paths carry no version, and a public releases page dates each entry (10 of 15). 20+10+16+13+12+10 = 81.

Attendee 33

Project API keys sent in a header, stored as SHA-256 hashes, several per project and each can be disabled. No scopes, expiry or rotation tooling was found (20). No read-only key and no confirmation before delete_data, which the docs call irreversible. Dashboard users are admins or regular users limited to assigned projects (5). Transcripts and chat are participant-written, and no injection guidance was found (0). Bot events and a bot_logs.update webhook give per-bot visibility. No audit log of API calls is documented (5). No security.txt, SECURITY.md, disclosure address, bug bounty or certification was found. The source is public and dependency updates are automated (3). Per the 9 October check, re-read from the repository on 4 November. Commits of 11 and 15 September add dashboard permissions such as who may manage API keys; API keys still carry no scopes. OSV lists nothing for this project (its one hit, MAL-2022-6154, is an unrelated npm package named attendee). 20 + 5 + 0 + 5 + 3 = 33.

Circleback 61

OAuth with dynamic client registration and two scopes on MCP, and API keys that are read-only or read and write, shown once (28 of 30). Read-only keys and a read-only MCP scope, and only an owner can delete a meeting. No confirmation step on the API for shares or deletes (14 of 20). Transcripts, notes and emails are participant-written text, and no prompt-injection guidance was found (0). A usage dashboard for workspace admins and meeting access requests, with no audit log of API or MCP calls found (4 of 15). SOC 2 Type II, EU-U.S. Data Privacy Framework certification, HIPAA, an external penetration test report on the security portal and a valid security.txt. No bug bounty found (15 of 20). 28+14+0+4+15 = 61.

Attendee 61

The recording is returned as a short-lived URL and transcripts and chat take updated_after, with no field selection or page size parameter (15). Cursor pagination on every list, with filters by state, meeting URL, join time and deduplication key (16). 400 responses are described only as Invalid input, while bot failures carry typed events and sub-types (8). deduplication_key on bots and calendars and an idempotency_key on webhook deliveries, with no idempotency header on the other POST calls (14). Two required fields to create a bot. No official SDK was found (8). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 15 + 16 + 8 + 14 + 8 = 61.

Circleback 72

28 MCP tools (15 for 11 to 30), plus 5 for the read-only scope that leaves write tools failing. The API lists return pages with filters (20 of 25). Cursor pagination through a Link header and filters by attendee, tag, folder, ownership and status (20). Errors carry a message and a code such as RATE_LIMITED (16 of 20). No idempotency key, and MCP annotations couldn't be read without a sign-in. Read-only keys and scope keep writes off (8 of 20). Few required parameters. The only official client is the Node CLI, with --json output (8 of 15). 20+20+16+8+8 = 72.

Attendee 40

No x402, MPP or L402 (0). The hosted price is public without a login at $0.50 a bot hour, down to $0.35 by volume (20). Five free hours at signup. The signup page asks for an email address and password or a Google sign-in and no card, and we created no account to confirm (20). A person signs up in a browser to get a key (0). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 0 + 20 + 20 + 0 = 40.

Circleback 30

No x402, MPP or L402 (0). Seat prices are public, $15 and $25 a user a month, with nothing priced per call (10). The Free plan includes API, MCP and CLI access with 30 days of history and costs nothing. A card isn't mentioned for it (20). A person signs up in a browser and creates a key or approves OAuth (0). 0+10+20+0 = 30.

Attendee 61

The source is public under the Elastic License 2.0, which is clear but not an OSI licence and bars offering the software as a hosted service. The site and README call it open source (20). The privacy policy of 1 June 2025 states 5 days for audio and video, indefinite retention for transcripts and participant data, and deletion on request. No DPA was found, and the terms describe themselves as covering the web pages (18). No deprecation policy or dated removal notice was found (0). A sub-processor page lists seven vendors with roles and no locations, and the privacy policy says data is stored in the United States (12). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 20 + 18 + 0 + 12 = 50.

Circleback 70

Closed service with clear terms, effective 7 April 2026, naming Circleback AI, Inc. under Delaware law (15 of 30). The security page says customer data isn't used to train models, retention settings are documented per data type with permanent deletion, the Terms delete data when an account is deleted, and a DPA and BAA are published. The Privacy Policy dates from 15 July 2024 and gives no periods (22 of 30). No deprecation policy or dated deprecation notice found (0 of 20). US processing under the Data Privacy Framework is stated. Sub-processors weren't found outside the DPA, which wasn't read in full (10 of 20). 15+22+0+10 = 47.