Ayrshare API + MCP vs Pamba

Ayrshare API + MCP 71

Closed service with published terms, last revised 20 August 2026 (15). Privacy policy, now at /privacy/ and updated 29 October 2026, names Neverminds Solution LLC of Wilmington, acknowledges rights requests within five business days and completes them within 30 days, deletes stored YouTube data within 7 days of a disconnect, cites standard contractual clauses for transfers, and names some processors such as Stripe, Cloudflare, Intercom and HubSpot, with no full list. Retention after account deletion is per the 1 October reading (20). Breaking changes and Meta metric retirements are dated in the changelog, with no stated notice period (14). Some subprocessors named, no data locations (8).

Pamba 28

Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.

Ayrshare API + MCP 77

Instatus page at status.ayrshare.com with API, dashboard, link shortener and 13 per-network components (20). In the 90 days to 4 November 2026 it shows two incidents, both minor, 45 minutes of latency on 11 August that errored a small number of posts, and a 46-minute Pinterest partial outage on 14 August that Ayrshare put down to Pinterest. September, October and November show no notices (20). 300 requests per 5 minutes per user profile and 8 profile deletions a second (15). 429s come with x-ratelimit headers and a 5-minute wait, and 1,000 429s in 24 hours suspends the profile. No Retry-After and no idempotency key for posts, but errors carry retryAvailable, Retry a Post resubmits a failed post, the Retry a Post page says to check that a post hasn't already been published before retrying it, and the 27 October changelog entry says to retry only TikTok in a multi-network post when TikTok is briefly unavailable, since the others may already have published. That is safe-retry guidance without idempotency keys (12). The pricing page claims 99.99 per cent API uptime, and no SLA terms were found behind it (0). REST is GA (10). 20+20+15+12+0+10 = 77.

Pamba 45

Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists "SLA guarantees" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Ayrshare API + MCP 30

No x402 or other machine payment (0). Plan prices are public, with per-profile rates on Business, but no per-call price (10). No free plan. The pricing page on 4 November lists a 28-day free trial of Launch and no longer says whether a card is needed, while the help centre said on 30 September that it is, so half credit as before (10). A person has to sign up in a browser and link accounts (0). 0+10+10+0 = 20. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.

Pamba 53

No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

Ayrshare API + MCP 69

No OpenAPI spec. A GraphQL endpoint with a typed schema arrived on 29 September 2026, alongside a Postman collection, so partial credit (15). llms.txt indexes about 300 Markdown pages (10). The MCP tool catalogue gives each of the 27 tools one line and says nothing about when to use or avoid them (8). REST parameters are documented page by page, but the MCP server is closed and we didn't read its input schemas (8). Numbered error codes such as 101, 416, 419, 476 and 479, examples on endpoint pages, and an explain_error tool (13). Dated changelog with entries several times a week and breaking changes called out (15).

Pamba 84

No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.

Ayrshare API + MCP 26

One account API key as a Bearer header, with a Profile-Key header to act for a sub-profile. No scopes, no OAuth on the hosted MCP and no documented rotation, so close to one all-powerful key (12). No read-only mode and no tool annotations. The official Claude Code plugin's confirmation hook covers 12 write tools only from version 0.2.2 (12 October 2026), and validate_post is a dry run (3, an earlier partial kept). get_comments and get_messages hand comments and DMs from strangers to the agent, and we found no prompt-injection guidance (0). Dashboard 3.0 has post history search and a webhook events tab (7). A security help page claims AES encryption at rest and TLS 1.3 with a post-quantum key exchange, and a DPA exists. No security.txt (404 on 4 November), disclosure policy, bug bounty or certification found (4).

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.

Ayrshare API + MCP 77

Last API change on 2 November 2026, the formatUTC option for Instagram online followers (30). Dozens of dated changelog entries in the 90 days to 4 November, 44 in October alone (20). The changelog moves several times a week and support runs by email and chat (12). Official SDKs exist in Node and Python, both at 1.3.0 since May 2026 per clones on 4 November, and the official Claude Code plugin reached 0.2.2 on 12 October (10). The Node package is MIT with node 18 or later stated. Neither SDK repository has a CI workflow (5). 30+20+12+10+5 = 77.

Pamba 70

Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.