Breakcold vs Copper API

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

Copper API 16

Last API change on 2 July 2026 (S3 upload token), 126 days before this check. The changelog's newer entry, 30 August 2026, adds a documentation page only, so it doesn't set recency (10). Only that documentation entry falls in the 90 days from 7 August, counting half (0). Public changelog with three entries in 2026 and a support centre. We didn't test support (6 of 15, the earlier partial, kept). No official SDK in any language (0). No packages to judge (0). 10+0+6+0+0 = 16.

Breakcold 90

OpenAPI 3.1 contract at docs.breakcold.com/api/openapi.json with 70 operations, each with a description (25). llms.txt and a Markdown copy of each page, plus auth.md and an MCP server card (10). Tool descriptions say how to use them, such as records_create asking for every required field and a stable idempotency key and the send tools saying to send only after the user confirms (17 of 20). 84 enums and 488 required lists, with typed attribute pages for each field type (13 of 15). Every operation documents 400 to 429 responses and the error body is shown, but the spec carries only two examples (10 of 15). /api/v1, and an API changelog with dated entries and migration steps (15). 25 + 10 + 17 + 13 + 10 + 15 = 90.

Copper API 48

No OpenAPI spec. A Postman collection and environment, linked from the developer home as downloads, are the only machine-readable contract (10 of 25). No llms.txt or Markdown docs on the developer site. The website's llms.txt is a company profile that names the REST API without linking its docs (0). Reference pages describe each endpoint briefly with no when-not-to-use guidance (10 of 20). Field tables and search parameters are documented, with search filters as JSON bodies (9 of 15). Request and response examples, but no error code reference (7 of 15). Dated changelog, a single v1 path and a published change policy. Only three entries in 2026 (12 of 15). 10+0+10+9+7+12 = 48.

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Copper API 79

Status page at status.copper.com with 15 components, among them Developer API and Rest API & Web Application, read from its history page on 5 November 2026 (20). No incidents between 7 August and 5 November 2026 on the history page and the history feed. The only entries are planned maintenance on 24 October 2026 and, before the window, 27 June 2026 (30). Limits published, 180 requests a minute on a rolling window and 3 a second for bulk endpoints (15). 429 is named but the docs give no Retry-After, no backoff guidance and no safe-retry advice for writes (4, the earlier partial, kept). No SLA found (0). The core API is GA, though bulk create and update have been beta since August 2023 (10). 20+30+15+4+0+10 = 79.

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

Copper API 28

Personal API keys sent in X-PW-AccessToken with the owner's email, carrying that user's full rights. Admins can see every user's keys. OAuth 2.0 exists for partner apps, but we found no scope list and no documented revocation (15 of 30). No read-only or scoped keys. Access follows the user's role (3 of 20). Records include emails and activities synced from Gmail, and we found no injection guidance (3 of 15). No API audit log found (0 of 15). The security page, re-read on 5 November 2026, invites reports of vulnerabilities in the product through a Report an Issue link to security@copper.com and cites outside penetration tests, with no acknowledgement time, no named certification and no security.txt (404 on 1 October). That is a disclosure route with no stated time (7). The trust centre at trust.copper.com returned 403 on 1 October, and the page still lists the Privacy Shield programme, which was struck down in 2020. 15+3+3+0+7 = 28.

Breakcold 67

72 MCP tools (5), with tools_search and capabilities_list to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a fields selection on record lists since 3 November (18 of 20). Errors carry a code, message, requestId and retryAfterMs, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.

Copper API 40

No MCP server. Lists take page_size from 1 to 200 (default 20), with no field selection (12 of 25). Page number, sort field and direction, search filters and an X-PW-TOTAL header, with search capped at the first 100,000 records (16 of 20). Error responses aren't documented beyond the 429 (5 of 20). No idempotency keys or upserts found (3 of 20). Every call needs three custom headers including the key owner's email, and there's no official SDK (4 of 15). 12+16+5+3+4 = 40.

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

Copper API 30

No x402, MPP or L402 (0). Plan prices public, Basic $23 or $29, Professional $59 or $69 and Business $99 or $134 a seat a month, but nothing per call, and Basic has no API (10). Free trial, and the pricing page says 'no credit card required' (20). A person signs up in a browser and generates the key (0). Prices and the no-card trial re-read on 5 November 2026. 0+10+20+0 = 30.