Attendee vs MeetGeek

Attendee 70

v1.89.2 was tagged on 30 October 2026, 5 days before the check (30). 88 version tags in the 90 days from 6 August to 4 November 2026, from v1.58.13 (7 August) to v1.89.2 (20). The repository merges outside contributors' pull requests and links a Slack community; reply times couldn't be read (12, per 9 October). No official SDK was found, and there is no MCP server to register (0). A CI workflow runs the test suites on each push and dependency updates are merged; the CI result couldn't be read (8). 30 + 20 + 12 + 0 + 8 = 70.

MeetGeek 10

No API changelog or dated API release was found. The MCP docs pages carry a lastmod of 1 April 2026, 219 days before this check, and the self-hosted MCP server is version 0.1.0 (0). No dated releases in the 90 days from 8 August (0). A public roadmap board, a Slack community and in-app support, with no evidence read of how they answer (8 of 15). No official SDK and no entry in the official MCP registry (0). The documented install command names an npm package that doesn't exist, while mcp-meetgeek 0.1.0 was published from a personal account on 5 September 2025 (2 of 10). 0+0+8+0+2 = 10.

Attendee 26

Graded on the hosted API with the hosted lines. No status page was found on the site, the docs or the README, and the footer's Status entry has no link (0). With no readable incident history the record takes the default (5). No rate limit is in the docs. The source sets defaults of 3,000 POST requests a minute per project and 2,500 concurrent bots, and the hosted values are not stated (5). No 429 response or Retry-After guidance is documented. deduplication_key makes bot and calendar creation safe to retry, and webhooks are retried 3 times (6). The terms supply the service as is with no uptime figure (0). The /api/v1 API has no beta label, though calendar integration is labelled Beta (10). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The rate-limit 5 and 429 6 are partials kept and flagged. 0 + 5 + 5 + 6 + 0 + 10 = 26.

MeetGeek 70

Graded on the hosted REST API and cloud MCP server with the hosted lines. Instatus page at meetgeek.instatus.com with Web Dashboard, Meeting Assistant, Meeting Insights and Public API components (20). Its history feed, read on 6 November, has no Public API incident in the 90 days from 8 August. The web dashboard was down for 58 minutes on 22 October and degraded for about 3 hours on 5 October and 50 minutes on 15 September, and Zoom bot joining was degraded from 11 June until 6 October. None hit the API, so minor only (20). Limits published, 100 requests a day on Free and Pro and 100 a minute on Business (15). 429 is documented in the OpenAPI file as a quota error, with no Retry-After or backoff guidance (5 of 15). No SLA found (0). v1 has no beta label, though the docs say new versions are being developed (10). 20+20+15+5+0+10 = 70.

Attendee 48

Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The OpenAPI 3.1.1 file at docs.attendee.dev/api-reference/openapi.json was read on 9 October in place of the rendered reference, but no docs page read then was recorded as linking it as a visible download, and the docs host is now paused, so it isn't counted as a published contract (0). The repository carries the spec as docs/openapi.yml (OpenAPI 3.0.3, 30 operations, last changed 28 October 2026), which no read page links for download either. llms.txt and a Markdown twin of each docs page (10). Most operations have a short description, and a few state when a call is allowed, such as delete_data only after a bot has ended (9). Enums, required fields and typed settings objects, with a free-form metadata object and no security scheme, since the key is declared as a header parameter (11). The only error responses are 400 and 404 with no schema, and 401 and 429 are absent, as the repository's docs/openapi.yml also shows on 4 November (8). The path is versioned as v1, info.version stays 1.0.0, and the site changelog has dated entries up to 24 March 2026 while repository tags continue to 30 October 2026 (10). 0 + 10 + 9 + 11 + 8 + 10 = 48.

MeetGeek 70

Public OpenAPI 3.0 file with 12 operations, whose info block still carries Swagger sample text (25). llms.txt and Markdown pages (10). Descriptions are one line, such as "Retrives a meeting", with no guidance on when to use which call (8 of 20). Few parameters, typed, with limit and cursor on lists (10 of 15). Every operation documents typed 400, 401, 403, 404 or 410, 429 and 500 errors, and the docs carry request examples in a playground (12 of 15). Paths under /v1, with no changelog found (5 of 15). 25+10+8+10+12+5 = 70.

Attendee 40

No x402, MPP or L402 (0). The hosted price is public without a login at $0.50 a bot hour, down to $0.35 by volume (20). Five free hours at signup. The signup page asks for an email address and password or a Google sign-in and no card, and we created no account to confirm (20). A person signs up in a browser to get a key (0). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 0 + 20 + 20 + 0 = 40.

MeetGeek 30

No x402, MPP or L402 (0). Plan prices are public but inconsistent, $15.99 and $27 a user a month on the plan cards and $9.99 and $17 in the page's calculator, with nothing priced per call (10). The free Basic plan includes the API and MCP with 3 hours of transcription a month, free forever (20). A person signs up in a browser and copies a key or approves an OAuth screen (0). 0+10+20+0 = 30.

Attendee 61

The source is public under the Elastic License 2.0, which is clear but not an OSI licence and bars offering the software as a hosted service. The site and README call it open source (20). The privacy policy of 1 June 2025 states 5 days for audio and video, indefinite retention for transcripts and participant data, and deletion on request. No DPA was found, and the terms describe themselves as covering the web pages (18). No deprecation policy or dated removal notice was found (0). A sub-processor page lists seven vendors with roles and no locations, and the privacy policy says data is stored in the United States (12). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 20 + 18 + 0 + 12 = 50.

MeetGeek 67

Closed service with clear terms of 12 August 2026 naming the contracting entity for each instance (15 of 30). The Terms and the Privacy Policy (9 September 2026) agree that customer content isn't used to train models without a written opt-in, give retention per data type with deletion windows (30 days, then 35 days from backups), and refer to a DPA (26 of 30). No deprecation policy, though the Terms promise notice by email or in the app before changes take effect (5 of 20). EU and US instances with data in the chosen region, and a sub-processor list linked from the security page, not read (15 of 20). 15+26+5+15 = 61.

Attendee 33

Project API keys sent in a header, stored as SHA-256 hashes, several per project and each can be disabled. No scopes, expiry or rotation tooling was found (20). No read-only key and no confirmation before delete_data, which the docs call irreversible. Dashboard users are admins or regular users limited to assigned projects (5). Transcripts and chat are participant-written, and no injection guidance was found (0). Bot events and a bot_logs.update webhook give per-bot visibility. No audit log of API calls is documented (5). No security.txt, SECURITY.md, disclosure address, bug bounty or certification was found. The source is public and dependency updates are automated (3). Per the 9 October check, re-read from the repository on 4 November. Commits of 11 and 15 September add dashboard permissions such as who may manage API keys; API keys still carry no scopes. OSV lists nothing for this project (its one hit, MAL-2022-6154, is an unrelated npm package named attendee). 20 + 5 + 0 + 5 + 3 = 33.

MeetGeek 38

Plain bearer API keys per region with no scopes or rotation guidance found. The cloud MCP uses an OAuth sign-in through auth.meetgeek.ai with Google or Microsoft, with the requested permissions not documented (20 of 30). No read-only key. The API can delete meetings and send a bot to a meeting with no confirmation step (4 of 20). Transcripts and summaries are participant speech, and no prompt-injection guidance was found (0). No audit log of API or MCP use found (0 of 15). Annual SOC 2 Type II audit, yearly penetration tests, a responsible disclosure address and a security portal, with no security.txt (404) or bug bounty (14 of 20). 20+4+0+0+14 = 38.