Breakcold vs Microsoft Dynamics 365 Sales

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Microsoft Dynamics 365 Sales 65

Graded on the Dataverse Web API, with the Dataverse MCP server noted. Service health for a tenant is in the Power Platform and Microsoft 365 admin centres, behind an admin sign-in. The unauthenticated page at status.cloud.microsoft exists, and Microsoft's docs describe it as the place for updates when the admin portals are unavailable. It rendered no components for our reader on 8 October, and on 1 November its robots.txt answered an empty 401, so the host is treated as blocked and wasn't read (10 of 20, a departure from the full 20 because the page with history needs a login). No readable incident history. The Azure status history, which the Azure listings are read from, names no Dynamics 365, Dataverse or Power Platform incident in the 90 days to 1 November and doesn't cover these services (5). Service protection limits are published per user and web server at 6,000 requests and 20 minutes of execution time per five-minute window, and 52 concurrent requests, plus 40,000 requests per licensed user per 24 hours (15). 429 responses carry Retry-After with retry guidance, and upsert on alternate keys with If-Match gives safe retries for writes (15). The SLA for Microsoft Online Services dated 1 October 2026 pays a 25 per cent credit below 99.9 per cent uptime for Sales Enterprise and Professional, per the 8 October check (10). Web API v9.2 and the MCP endpoint /api/mcp are generally available (10).

Breakcold 67

72 MCP tools (5), with tools_search and capabilities_list to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a fields selection on record lists since 3 November (18 of 20). Errors carry a code, message, requestId and retryAfterMs, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.

Microsoft Dynamics 365 Sales 86

$select, $top and Prefer: odata.maxpagesize size responses. The MCP server has 15 tools, some of them for schema changes and files (22 of 25). $filter, @odata.nextLink paging with pages up to 5,000 rows, and no $skip (20). Errors are JSON with a code and message, a documented status code table and optional annotations with a help link (17 of 20). PATCH on an alternate key upserts, If-Match and If-None-Match limit it to update or create, and ETags give optimistic concurrency. The MCP delete tools are described as running only after explicit user approval. We did not read the live tool list, so readOnlyHint and destructiveHint are unconfirmed (15 of 20). Official SDKs for .NET (Microsoft.PowerPlatform.Dataverse.Client 1.2.27) and Python (PowerPlatform-Dataverse-Client 1.1.0). The docs say Microsoft ships no other language libraries for the Web API (12 of 15).

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

Microsoft Dynamics 365 Sales 79

Dataverse service update 9.2.26103 went to early release on 23 October 2026, with production rollout from 30 October (30). Service updates are weekly, with 9.2.26081 to 9.2.26103 listed from August to October 2026, each with release notes, and Python SDK 1.0.1 (8 September) and 1.1.0 (7 October) and .NET SDK 1.2.27 (4 September) in the window (20). Public release notes and community forums. We did not check how issues on the SDK repositories are answered (10 of 15). Current official SDKs for .NET and Python and the npm MCP proxy @microsoft/dataverse, whose 1.0.81 of 26 September 2026 rests on the 8 October check. The official MCP registry lists only third-party Dataverse and Dynamics servers, per the 8 October check (13 of 15). The Python SDK is marked Production/Stable for Python 3.10 and later and has a python-package workflow, but its runs weren't readable because github.com refused us (6 of 10).

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

Microsoft Dynamics 365 Sales 74

OAuth 2.0 through Microsoft Entra ID is the only route, with delegated sign-in or an application user holding a client secret or certificate. The OAuth scopes are coarse (user_impersonation, .default, mcp.tools) and the limits come from Dataverse security roles (26 of 30). Security roles set privileges per table and the MCP server follows them and row-level security. Each MCP client app must be allowed per environment by an administrator, and only Copilot Studio is on by default. The delete tools are described as needing explicit user approval, but Microsoft's sample agent instructions on the configuration page tell the agent not to ask before deleting (17 of 20). Lead, contact and email text written by outsiders reaches the model, and the MCP pages we read give no injection guidance (3 of 15). Dataverse auditing logs record changes and user access, readable through the Web API, once an administrator turns it on. It does not cover retrieve operations (13 of 15). SOC 2 Type 2 lists Dynamics 365, per the 8 October check, and security.txt points to MSRC and the bounty policy, but the file's Expires date of 23 September 2026 had still passed on 1 November. MSRC publishes CVEs for service-side flaws in Dynamics 365 and Dataverse. Three Critical ones in the last 12 months name Dynamics 365 (online) or Dataverse and are counted under negative events, and a fourth names only Dynamics 365 without the app (15 of 20).

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

Microsoft Dynamics 365 Sales 25

No x402, MPP or L402 (0). Seat prices are public at $65, $105 and $150 a user a month, paid yearly. MCP calls from agents built outside Copilot Studio are billed in Copilot Credits at published credit counts, and we did not read a dollar price per credit (10). The Dynamics 365 trial page states 30 days free and the Power Apps Developer Plan is a free Dataverse environment with Web API access. Neither page says whether a card is needed (15 of 20). A person registers an app in Entra ID and an administrator creates the application user or allows the MCP client (0).

Breakcold 90

OpenAPI 3.1 contract at docs.breakcold.com/api/openapi.json with 70 operations, each with a description (25). llms.txt and a Markdown copy of each page, plus auth.md and an MCP server card (10). Tool descriptions say how to use them, such as records_create asking for every required field and a stable idempotency key and the send tools saying to send only after the user confirms (17 of 20). 84 enums and 488 required lists, with typed attribute pages for each field type (13 of 15). Every operation documents 400 to 429 responses and the error body is shown, but the spec carries only two examples (10 of 15). /api/v1, and an API changelog with dated entries and migration steps (15). 25 + 10 + 17 + 13 + 10 + 15 = 90.

Microsoft Dynamics 365 Sales 81

Each environment serves an OData v4 service document and a CSDL $metadata document at /api/data/v9.2/$metadata, and Learn publishes a table reference. No public OpenAPI document was found (18 of 25). learn.microsoft.com/llms.txt returns 404, but Learn returns Markdown for requests with Accept: text/markdown, which is how we read every page (10). The docs state purpose and limits, such as no $skip and a 5,000-row page ceiling. The published MCP tool descriptions are one line each (15 of 20). Entity types are typed in CSDL, but queries are OData strings and the MCP read_query tool takes a SQL SELECT string (12 of 15). Request and response examples on each page, a status code table with named errors, and a JSON error format with optional detail annotations (13 of 15). The version is in the URL (v9.2), with weekly Dataverse service update release notes. The MCP tool changes are noted without a date (13 of 15).