# Attendee vs Circleback (slim)

> Circleback scores 67.6 (B) to Attendee's 45.2 (E) for meeting bots. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/attendee-vs-circleback.md (~4,800 tokens) · this version ~3,080 tokens · JSON https://www.anchorterminal.com/compare/attendee-vs-circleback.json · canonical https://www.anchorterminal.com/compare/attendee-vs-circleback
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Circleback scores 67.6 (B) on agent readiness against Attendee's 45.2 (E), and leads in 6 of 7 scored categories. Attendee leads on payments & pricing. Both do meeting bots.

- Attendee: E 45.2, rank #1184 of 1486 · https://www.anchorterminal.com/tools/attendee.min.md
- Circleback: B 67.6, rank #315 of 1486 · https://www.anchorterminal.com/tools/circleback.min.md
- Attendee, good for Developers building a notetaker or voice agent who want one API across Zoom, Google Meet and Teams with the option to run the code themselves. Ahead on Payments & pricing, 40 against 30.
- Circleback, good for Agents that need a person's meeting notes, transcripts and action items from a notetaker they already use, including on Free. Ahead on Reliability, 77 against 26; Schema & documentation, 81 against 48; Agent ergonomics, 72 against 61; Security & auth, 61 against 33; Maintenance & community, 78 against 70; Transparency & trust, 70 against 61.

| Category | Attendee | Circleback |
| --- | --- | --- |
| Reliability (16%) | 26 | 77 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 48 | 81 |
| Agent ergonomics (13%) | 61 | 72 |
| Security & auth (14%) | 33 | 61 |
| Payments & pricing (10%) | 40 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 78 |
| Transparency & trust (7%) | 61 | 70 |

| Fact (where they differ) | Attendee | Circleback |
| --- | --- | --- |
| Vendor | Attendee Labs, Inc. | Circleback AI, Inc. |
| Hosted endpoint | `https://app.attendee.dev` | `https://circleback.ai/api/mcp` |
| Transports | HTTP | HTTP, Streamable HTTP |
| Auth | API key | OAuth or key |
| Pricing | Pay per use | Freemium |
| Price for meeting bots | $0.0058 per minute of call | not published |
| Licence | Elastic License 2.0 for the source in attendee-labs/attendee, which is source-available and not an OSI licence. The hosted service is under Attendee Labs' terms of service | Proprietary service under Circleback's Terms of Service. The `@circleback/cli` npm package is MIT |
| Tools exposed | none | 28 |
| Read-only variant documented | no | yes |
| MCP registry | not listed | `ai.circleback/circleback` |
| Last release | 2026-10-30 | 2026-11-03 |
| Terms last updated | 2025-06-01 | 2026-04-07 |
| Privacy policy last updated | 2025-06-01 | 2024-07-15 |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 752 stars | none |

Why the edge:
- Reliability, Circleback +51: Attendee 26 (Graded on the hosted API with the hosted lines. No status page was found on the site, the docs or the README, and the footer's Status entry has no link (0). With no readable incident history the record takes the default (5). No rate limit is in the docs. The source sets defaults of 3,000 POST requests a minute per project and 2,500 concurrent bots, and the hosted values are not stated (5). No 429 response or Retry-After guidance is documented. `deduplication_key` makes bot and calendar creation safe to retry, and webhooks are retried 3 times (6). The terms supply the service as is with no uptime figure (0). The `/api/v1` API has no beta label, though calendar integration is labelled Beta (10). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The rate-limit 5 and 429 6 are partials kept and flagged. 0 + 5 + 5 + 6 + 0 + 10 = 26.); Circleback 77 (Graded on the hosted REST API and MCP server with the hosted lines. incident.io status page at status.circleback.ai with four components, none of them the API (20). Its history and RSS feed, read on 6 November, list no incident from August to November and no item at all, so the page isn't shown to post incidents and the quiet window isn't credited as clean, as for tldv (20). Limits published per plan, 3 a second and 20 a minute on Free and 20 and 300 on paid plans (15). 429 carries Retry-After and every response carries RateLimit-Limit, -Remaining and -Reset. No idempotency key or safe-retry guidance for writes (12 of 15). No SLA found in the Terms or on the pricing page (0). The API has no beta label (10). 20+20+15+12+0+10 = 77.)
- Schema & documentation, Circleback +33: Attendee 48 (Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The OpenAPI 3.1.1 file at docs.attendee.dev/api-reference/openapi.json was read on 9 October in place of the rendered reference, but no docs page read then was recorded as linking it as a visible download, and the docs host is now paused, so it isn't counted as a published contract (0). The repository carries the spec as docs/openapi.yml (OpenAPI 3.0.3, 30 operations, last changed 28 October 2026), which no read page links for download either. llms.txt and a Markdown twin of each docs page (10). Most operations have a short description, and a few state when a call is allowed, such as `delete_data` only after a bot has ended (9). Enums, required fields and typed settings objects, with a free-form `metadata` object and no security scheme, since the key is declared as a header parameter (11). The only error responses are 400 and 404 with no schema, and 401 and 429 are absent, as the repository's docs/openapi.yml also shows on 4 November (8). The path is versioned as v1, `info.version` stays 1.0.0, and the site changelog has dated entries up to 24 March 2026 while repository tags continue to 30 October 2026 (10). 0 + 10 + 9 + 11 + 8 + 10 = 48.); Circleback 81 (Each reference page embeds the OpenAPI 3.2 operation for its endpoint, but no single spec file is linked, and MCP input schemas need a sign-in (20 of 25). llms.txt and a Markdown copy of each docs page (10). Operation descriptions state what is returned and who may act, such as only the owner deleting a meeting, and the update call explains replace semantics (16 of 20). Typed parameters with enums and defaults, such as `ownership` All, Mine or Shared (13 of 15). curl examples, a JSON error envelope with `error` and `code`, and 400 and 429 responses per operation (12 of 15). Paths carry no version, and a public releases page dates each entry (10 of 15). 20+10+16+13+12+10 = 81.)
- Security & auth, Circleback +28: Attendee 33 (Project API keys sent in a header, stored as SHA-256 hashes, several per project and each can be disabled. No scopes, expiry or rotation tooling was found (20). No read-only key and no confirmation before `delete_data`, which the docs call irreversible. Dashboard users are admins or regular users limited to assigned projects (5). Transcripts and chat are participant-written, and no injection guidance was found (0). Bot events and a `bot_logs.update` webhook give per-bot visibility. No audit log of API calls is documented (5). No security.txt, SECURITY.md, disclosure address, bug bounty or certification was found. The source is public and dependency updates are automated (3). Per the 9 October check, re-read from the repository on 4 November. Commits of 11 and 15 September add dashboard permissions such as who may manage API keys; API keys still carry no scopes. OSV lists nothing for this project (its one hit, MAL-2022-6154, is an unrelated npm package named attendee). 20 + 5 + 0 + 5 + 3 = 33.); Circleback 61 (OAuth with dynamic client registration and two scopes on MCP, and API keys that are read-only or read and write, shown once (28 of 30). Read-only keys and a read-only MCP scope, and only an owner can delete a meeting. No confirmation step on the API for shares or deletes (14 of 20). Transcripts, notes and emails are participant-written text, and no prompt-injection guidance was found (0). A usage dashboard for workspace admins and meeting access requests, with no audit log of API or MCP calls found (4 of 15). SOC 2 Type II, EU-U.S. Data Privacy Framework certification, HIPAA, an external penetration test report on the security portal and a valid security.txt. No bug bounty found (15 of 20). 28+14+0+4+15 = 61.)
- Agent ergonomics, Circleback +11: Attendee 61 (The recording is returned as a short-lived URL and transcripts and chat take `updated_after`, with no field selection or page size parameter (15). Cursor pagination on every list, with filters by state, meeting URL, join time and deduplication key (16). 400 responses are described only as Invalid input, while bot failures carry typed events and sub-types (8). `deduplication_key` on bots and calendars and an `idempotency_key` on webhook deliveries, with no idempotency header on the other POST calls (14). Two required fields to create a bot. No official SDK was found (8). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 15 + 16 + 8 + 14 + 8 = 61.); Circleback 72 (28 MCP tools (15 for 11 to 30), plus 5 for the read-only scope that leaves write tools failing. The API lists return pages with filters (20 of 25). Cursor pagination through a Link header and filters by attendee, tag, folder, ownership and status (20). Errors carry a message and a code such as `RATE_LIMITED` (16 of 20). No idempotency key, and MCP annotations couldn't be read without a sign-in. Read-only keys and scope keep writes off (8 of 20). Few required parameters. The only official client is the Node CLI, with `--json` output (8 of 15). 20+20+16+8+8 = 72.)
- Payments & pricing, Attendee +10: Attendee 40 (No x402, MPP or L402 (0). The hosted price is public without a login at $0.50 a bot hour, down to $0.35 by volume (20). Five free hours at signup. The signup page asks for an email address and password or a Google sign-in and no card, and we created no account to confirm (20). A person signs up in a browser to get a key (0). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 0 + 20 + 20 + 0 = 40.); Circleback 30 (No x402, MPP or L402 (0). Seat prices are public, $15 and $25 a user a month, with nothing priced per call (10). The Free plan includes API, MCP and CLI access with 30 days of history and costs nothing. A card isn't mentioned for it (20). A person signs up in a browser and creates a key or approves OAuth (0). 0+10+20+0 = 30.)
- Transparency & trust, Circleback +9: Attendee 61 (The source is public under the Elastic License 2.0, which is clear but not an OSI licence and bars offering the software as a hosted service. The site and README call it open source (20). The privacy policy of 1 June 2025 states 5 days for audio and video, indefinite retention for transcripts and participant data, and deletion on request. No DPA was found, and the terms describe themselves as covering the web pages (18). No deprecation policy or dated removal notice was found (0). A sub-processor page lists seven vendors with roles and no locations, and the privacy policy says data is stored in the United States (12). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 20 + 18 + 0 + 12 = 50.); Circleback 70 (Closed service with clear terms, effective 7 April 2026, naming Circleback AI, Inc. under Delaware law (15 of 30). The security page says customer data isn't used to train models, retention settings are documented per data type with permanent deletion, the Terms delete data when an account is deleted, and a DPA and BAA are published. The Privacy Policy dates from 15 July 2024 and gives no periods (22 of 30). No deprecation policy or dated deprecation notice found (0 of 20). US processing under the Data Privacy Framework is stated. Sub-processors weren't found outside the DPA, which wasn't read in full (10 of 20). 15+22+0+10 = 47.)