Breakcold vs folk API + MCP

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

folk API + MCP 45

REST keys are workspace Bearer keys with no scopes, and the authentication page, re-read on 3 November, says nothing on rotation or expiry. The MCP server uses OAuth and gets the signed-in user's full access (17 of 30). No read-only mode. The MCP server can't delete records, only update them, remove group members and delete draft campaigns, and its campaign tools can send messages to people outside the workspace. The docs urge human confirmation of each step (10 of 20). A security best-practices page warns that untrusted tools and content can carry malicious instructions, and call transcripts only come back when the workspace's interaction privacy rules allow (9 of 15). No audit log found. Errors carry a requestId (2 of 15). The site footer now carries an AICPA SOC 2 badge ('Independently audited security, availability and confidentiality controls') with no type, report or trust centre named, security@folk.app is the contact in the privacy policy, security.txt answered 404 on 3 November and no bug bounty was found. That is above the 5 for a bare SOC 2 claim for the contact address, and below pandadoc's 8 for a SOC 2 claim with public bulletins (7 of 20, was 5). 17 + 10 + 9 + 2 + 7 = 45.

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

folk API + MCP 30

No x402, MPP or L402 (0). Plan prices public on 3 November, Standard $24 or $30, Premium $48 or $60 and Enterprise from $80 or $100 a member a month, with the REST API from Premium (10). Two-week trial with no card (20). A person signs up in a browser (0). 0 + 10 + 20 + 0 = 30.

Breakcold 67

Closed service with a legal centre whose terms name Logike SAS, its registration and French law (15 of 30). The privacy policy of 27 October 2026 and the DPA agree, give retention periods for specific copies (deleted record snapshots 30 days, exports 7 days, import rows 90 days, call recordings 30 to 365 days) and promise breach notice without undue delay (27 of 30). The developer terms tie notice of material breaking changes to the services agreement, and the changelog gives migration steps, with no fixed notice period found (12 of 20). DPA Annex C lists providers and their functions with 30 days' notice of changes; locations are said to depend on configuration, with US and EU app regions (15 of 20). 15 + 27 + 12 + 15 = 69.

folk API + MCP 82

Closed service. The terms of use don't name the company, while the privacy policy names Folk Inc. of Delaware, per the 1 October check (12 of 15). Privacy policy now effective 5 October 2026, re-read on 3 November, with the same retention periods (7 days from databases after deletion, 730 days from backups, 930 days from logs), call audio not kept once transcribed, and a promise not to train AI models on personal data. The 24-processor table rests on the 1 October count (28 of 30). Written deprecation policy with a year's support and 6 months' notice, now covering MCP tools too, with dated removals on 13 February 2027 (reminder endpoints and events), 29 March 2027 (past and upcoming interaction lists) and 16 April 2027 (single-record MCP tools) (20). Processors listed with regions, and hosting on AWS in Ireland (20).

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

folk API + MCP 55

Status page at status.folk.app runs on UptimeRobot. Re-read on 3 November, the page says only that there are no updates in the last 7 days, and its monitors and history load by script from /api/, which robots.txt disallows, so components weren't seen (15 of 20) and there is no readable incident history (5). Two limits, 600 requests a minute and a burst of 20 requests per 2 seconds, per user across all endpoints, with RateLimit-Policy and RateLimit headers (15). 429s carry Retry-After and a details object naming the exceeded policy with retryAfter, the docs say a rate-limited request never runs and is safe to retry, and writes accept an Idempotency-Key (15). No SLA found (0). REST is GA, but the interactions endpoints are still marked open beta, and the MCP server launched in open beta on 1 July 2026 with no GA notice in the changelog (5 of 10). 15 + 5 + 15 + 15 + 0 + 5 = 55.