Breakcold vs Capsule CRM

Breakcold 90

OpenAPI 3.1 contract at docs.breakcold.com/api/openapi.json with 70 operations, each with a description (25). llms.txt and a Markdown copy of each page, plus auth.md and an MCP server card (10). Tool descriptions say how to use them, such as records_create asking for every required field and a stable idempotency key and the send tools saying to send only after the user confirms (17 of 20). 84 enums and 488 required lists, with typed attribute pages for each field type (13 of 15). Every operation documents 400 to 429 responses and the error body is shown, but the spec carries only two examples (10 of 15). /api/v1, and an API changelog with dated entries and migration steps (15). 25 + 10 + 17 + 13 + 10 + 15 = 90.

Capsule CRM 48

No OpenAPI or other machine-readable contract was found. Four likely paths on developer.capsulecrm.com returned 404 and the docs link none. The MCP server's tool schemas sit behind OAuth and were not read (0 of 25). No llms.txt on either domain (0). Each of the 132 operations has a short description, and some say when to prefer another endpoint, such as filters over search (12 of 20). Parameter tables give types, ranges and defaults, and each resource has a model page, with filter conditions as JSON bodies (10 of 15). Request and response examples on every operation, and an errors page with bodies for 400, 401, 403, 422 and 429 (13 of 15). A /api/v2 path and a dated changelog with five entries in the last 12 months (13 of 15).

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Capsule CRM 83

Graded on REST API v2, with the hosted lines. Status page at status.capsulecrm.com on Statuspage with Capsule and Drop Box components on its page and history back to 2023 in its feed (20). history.atom, read on 4 November, has no incident after 8 July 2026. The last, a minor delay to reports and dashboards, ran from 6 to 8 July 2026, a scheduled maintenance window was announced for 4 July, and a major outage of about 15 hours fell on 27 March 2026, all outside the 90 days from 6 August, and the page shows "No incidents reported" for each day to 4 November (30). The 8 October incident reading came from the page's /api/v2/incidents.json, which its robots.txt disallows, so it is struck and replaced by the feed. Limit published, 4,000 requests an hour per user (15). A 429 carries X-RateLimit-Reset and the docs say to wait until that time and suggest one second between calls, but there is no Retry-After header, no idempotency key and no safe-retry advice for writes (10 of 15). No SLA found, and the Customer Terms disclaim liability for unavailability (0). The REST API is generally available. The MCP server was announced on 25 September 2026 and the Claude connector is labelled beta on one support page (8 of 10). 20+30+15+10+0+8 = 83.

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

Capsule CRM 28

Last change on 25 September 2026, the hosted MCP server, 40 days before 4 November, and the changelog has no later entry (20, was 30, cause time). Two dated entries in the 90 days from 6 August, 19 August and 25 September 2026, which is short of three (0). A public changelog, a support address and a Google group for API questions. We did not test support (8 of 15). No official SDK, and the MCP server is not in the official MCP registry per the 8 October check (0). No packages to judge (0). 20+0+8+0+0 = 28.

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

Capsule CRM 30

No x402, MPP or L402 (0). Plans are public but priced per user, with nothing per call, and the pricing page draws the numbers by script. The Starter price of $18 and the $0 to $72 range came from Capsule's comparison pages (10). A Free plan for two users and 250 contacts and a 14-day trial with no card. Whether the Free plan includes the API was not found (20). A person signs up in a browser and creates the token, and registering an OAuth app needs a GitHub sign-in (0).

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

Capsule CRM 46

OAuth 2 authorisation code grant with scopes read, write and user_preference, access tokens of about seven days, refresh tokens and a revocation endpoint, per the authentication docs. The 8 October reading of the OAuth server metadata on api.capsulecrm.com came from the product's own endpoint and is struck. Personal tokens are also accepted on the REST API, and their scope is not documented. Tokens travel only in the header (24 of 30, partly met, kept). A read scope exists, and the MCP server acts with the connecting user's access controls. No server-side confirmation for writes was found, and the AI Terms put review of each tool call on the customer (12 of 20). Notes and stored emails reach the model, and no injection guidance was found (2 of 15). No API audit log was found, and the support page says MCP update tools keep no change history of their own (2 of 15). A reporting address (support+sensitive@capsulecrm.com), regular penetration tests by outside specialists per the security page and PCI-DSS for card collection. No security.txt, no bug bounty and no certification named on the pages read. The security page, re-read on 4 November, is unchanged, and security.txt still answers 404. The trust centre at trust.zestia.com is drawn by script and was not read (6 of 20).

Breakcold 67

Closed service with a legal centre whose terms name Logike SAS, its registration and French law (15 of 30). The privacy policy of 27 October 2026 and the DPA agree, give retention periods for specific copies (deleted record snapshots 30 days, exports 7 days, import rows 90 days, call recordings 30 to 365 days) and promise breach notice without undue delay (27 of 30). The developer terms tie notice of material breaking changes to the services agreement, and the changelog gives migration steps, with no fixed notice period found (12 of 20). DPA Annex C lists providers and their functions with 30 days' notice of changes; locations are said to depend on configuration, with US and EU app regions (15 of 20). 15 + 27 + 12 + 15 = 69.

Capsule CRM 76

Closed service with Customer Terms naming Zestia Limited, registered in England (15). The privacy policy of 21 August 2025, the DPA and the terms agree on a 14-day restore window after cancellation, deletion after that and backups for up to 50 days, with hosting on AWS in the United States. The AI Terms say inputs are not used to train models. The Claude connector page calls Anthropic a sub-processor, while the sub-processor list names OpenAI and not Anthropic (24 of 30). No deprecation policy. The changelog says Capsule tries to avoid breaking changes without notice, and the 19 August 2026 entry on the pictureURL change gives no date for the switch (8 of 20, partly met, kept; the changelog dates its entries, but the only notice with a switch date is the 2019 TLS change, so this isn't read as dated notices). Eleven sub-processors listed with location, transfer mechanism and safeguards, and 30 days' notice of changes in the DPA (17 of 20).