Blotato vs Xpoz MCP

Blotato 42

Graded as a hosted service. No status page was found. The help pages link none and status.blotato.com had no DNS record on 5 November (0). With no page there is no incident history to read (5). Request limits are published per route, such as 30 a minute for creating posts, 60 for status reads and 120 for upload URLs (15). After a 429 the help pages say to stop requests to that route, wait for the retry interval when one is given and reduce concurrency, with no Retry-After header documented. They also say there is no client idempotency header for creating posts and that a timed-out create should be checked against existing posts and schedules before another is sent. Backoff with safe-retry guidance and no idempotency key (12). No SLA was found and the terms supply the service as is (0). The API and MCP server are not labelled beta (10). Total 42.

Xpoz MCP 20

No status page found (0). No history (5). Credit allowances, no rate limits found (5 of 15). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 0 + 0 + 10 = 20.

Blotato 10

No x402, MPP or L402 (0). Plan prices are public without a login at $29, $97 and $499 a month, and extra credits cost $6 per 1,000. The API has no price per call, so this is plan pricing (10). The 7-day trial needs a card and excludes the API and MCP, and generating a key starts the paid plan (0). A person signs up in a browser and copies the key from settings (0).

Xpoz MCP 30

No machine payment protocol (0). Plan prices public (10). Free 500 credits (20). A person signs in for a key (0). 0 + 10 + 20 + 0 = 30.

Blotato 82

Public OpenAPI 3.0.3 document at backend.blotato.com/openapi.json, linked from the help centre's OpenAPI Reference page, with 45 operations per the 8 October check. The help pages say account usage and schedule slots are implemented but absent from it (25). llms.txt on both hosts, a full export, a Markdown twin of every help page and a documentation MCP endpoint (10). The MCP tools reference and the agent workflow pages state purpose, order of calls and what not to do, such as not resubmitting an unresolved post (17). The document has 214 enums and typed targets per platform, though error details is a free-form object. The hosted MCP tool schemas were not read (12). 320 examples in the document, error responses on most operations and an error reference with numeric codes (13). The version is in the path and info.version is 2.0.0, with no changelog found (5). Total 82.

Xpoz MCP 64

52 tools read from tools/list with JSON Schema inputs and 42 enums (25). No llms.txt read (0). Server instructions explain paging and field selection (16 of 20). Typed inputs with enums (15). Examples on the home page (5 of 15). Registry 1.4.1 from July, server 3.0.0; no changelog (3 of 15). 25 + 0 + 16 + 15 + 5 + 3 = 64.

Blotato 47

Closed service under Terms of Use dated 18 May 2026 that name Blotato Inc. and Utah law. The terms take a perpetual, irrevocable, sub-licensable licence to user content (15). The privacy policy names Blotato Inc. with a Salt Lake City address and says data from third-party APIs is not used to train general models. It gives no retention period, repeats sections 8 to 15 of the terms inside it, and shows both 18 May 2026 and an effective date of 17 October 2024. No DPA was found (8). No deprecation policy, and the terms allow changes or discontinuation with or without notice (0). The help pages name Stripe for payments and ElevenLabs for voices, and the policy says the company is based in the United States. No sub-processor list or data locations were found (4).

Xpoz MCP 29

Closed service; terms of use read without a legal entity (10 of 30). Data handling not read (5 of 30). No deprecation policy (0). Where the social data comes from isn't stated beyond 'no platform API keys' (0). 10 + 5 + 0 + 0 = 15.

Blotato 29

The MCP server takes OAuth through a browser flow, and its protected-resource metadata names a Supabase authorisation server. No scopes are documented. REST takes one key per account in a header, with full access, revoked only by regenerating it (15). No read-only key, scope or approval step enforced by the server. The help pages tell agents to get the user's approval before activating an automation or sending, and automations start as drafts (5). Tools return comments and direct messages from strangers and text extracted from URLs, and no injection guidance was found (0). A Logs page in the dashboard shows each request's payload, response and error, and responses carry a request ID. Team access means sharing the owner's login code, which the help page says leaves no audit trail (9). No security.txt, disclosure route, bug bounty or certification was found (0). Automation webhooks reject private and loopback addresses, which is noted and not scored.

Xpoz MCP 37

One API key (20 of 30). 49 of 52 tools read-only (15 of 20). Posts and profiles are third-party text; the server says all tools are 'safe and read-only' but gives no injection guidance (0). No audit log (0). No security programme found (2 of 20). 20 + 15 + 0 + 0 + 2 = 37.

Blotato 57

35 MCP tools (36 on 8 October) with no toolsets or read-only subset found. REST and MCP lists take a limit with a default of 50 and a maximum of 250, with no field selection (8). Cursor pagination with since, until, status and platform filters on posts (20). Errors carry code, reqId, message, action and details, and the error reference gives a fix for each code (17). No idempotency key. DM automations start as inactive drafts, and MCP tool annotations were not read (5). blotato_create_post needs three arguments. There are official n8n and Make nodes and no SDK in any language (7).

Xpoz MCP 63

52 tools totalling about 238 KB (5). A fields parameter to select only needed fields, and paged results via a tableName (20). No documented errors (3 of 20). All annotated, 49 read-only (20). SDKs and a CLI (15). 5 + 20 + 3 + 20 + 15 = 63.