Blotato vs Pamba

Blotato 30

No changelog, release notes or versioned package release in the 90 days. The newest dated change to the API is the comments and messaging API post of 7 August 2026, 90 days before this check (20). The 8 October recency rested on the official MCP registry entry of 10 September, read from the registry's JSON API, which this run doesn't use, so it is struck. The site llms.txt (updated 20 October) and the 4 November post on the ChatGPT plugin directory record no change to the API or its tools. Only one dated change falls in the 90 days from 7 August, so the line scores 0. Support is in-app chat and email, weekly office hours have ended, and no public issue tracker for the API was read (6). The registry entry com.blotato/mcp couldn't be read on a registry page, and there is no SDK (0). The n8n node @blotato/n8n-nodes-blotato 1.0.10 dates from 29 January 2026, per its repository's last commit (4). Total 30.

Pamba 70

Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.

Blotato 15

No x402, MPP or L402 (0). Plan prices are public without a login at $29, $97 and $499 a month, and extra credits cost $6 per 1,000. The API has no price per call, so this is plan pricing (10). The 7-day trial needs a card and excludes the API and MCP, and generating a key starts the paid plan (0). A person signs up in a browser and copies the key from settings (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 10 is 15.

Pamba 53

No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

Blotato 47

Closed service under Terms of Use dated 18 May 2026 that name Blotato Inc. and Utah law. The terms take a perpetual, irrevocable, sub-licensable licence to user content (15). The privacy policy names Blotato Inc. with a Salt Lake City address and says data from third-party APIs is not used to train general models. It gives no retention period, repeats sections 8 to 15 of the terms inside it, and shows both 18 May 2026 and an effective date of 17 October 2024. No DPA was found (8). No deprecation policy, and the terms allow changes or discontinuation with or without notice (0). The help pages name Stripe for payments and ElevenLabs for voices, and the policy says the company is based in the United States. No sub-processor list or data locations were found (4).

Pamba 28

Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.

Blotato 57

35 MCP tools (36 on 8 October) with no toolsets or read-only subset found. REST and MCP lists take a limit with a default of 50 and a maximum of 250, with no field selection (8). Cursor pagination with since, until, status and platform filters on posts (20). Errors carry code, reqId, message, action and details, and the error reference gives a fix for each code (17). No idempotency key. DM automations start as inactive drafts, and MCP tool annotations were not read (5). blotato_create_post needs three arguments. There are official n8n and Make nodes and no SDK in any language (7).

Pamba 75

Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.

Blotato 29

The MCP server takes OAuth through a browser flow, and its protected-resource metadata names a Supabase authorisation server. No scopes are documented. REST takes one key per account in a header, with full access, revoked only by regenerating it (15). No read-only key, scope or approval step enforced by the server. The help pages tell agents to get the user's approval before activating an automation or sending, and automations start as drafts (5). Tools return comments and direct messages from strangers and text extracted from URLs, and no injection guidance was found (0). A Logs page in the dashboard shows each request's payload, response and error, and responses carry a request ID. Team access means sharing the owner's login code, which the help page says leaves no audit trail (9). No security.txt, disclosure route, bug bounty or certification was found (0). Automation webhooks reject private and loopback addresses, which is noted and not scored.

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.