# Breakcold vs folk API + MCP (slim)

> folk API + MCP and Breakcold score within a point of each other for crm records, 58.2 and 58 out of 100. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/breakcold-vs-folk.md (~4,250 tokens) · this version ~2,230 tokens · JSON https://www.anchorterminal.com/compare/breakcold-vs-folk.json · canonical https://www.anchorterminal.com/compare/breakcold-vs-folk
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

folk API + MCP and Breakcold score within a point of each other on agent readiness, 58.2 (C) and 58 (C). Breakcold leads on security & auth. Both do crm records.

- Breakcold: C 58, rank #766 of 1486 · https://www.anchorterminal.com/tools/breakcold.min.md
- folk API + MCP: C 58.2, rank #756 of 1486 · https://www.anchorterminal.com/tools/folk.min.md
- Breakcold, good for Small sales teams who run outreach on email and social channels and want an agent to keep records, tasks and replies in order. Ahead on Security & auth, 60 against 45. Also No incidents deducted, where folk API + MCP loses 3 points for them.
- folk API + MCP, good for Small teams running a relationship CRM (founders, agencies, investors) who want an agent to keep contacts, notes and follow-ups current. Ahead on Reliability, 55 against 45; Payments & pricing, 30 against 15; Transparency & trust, 82 against 67. Also Free to start without a card.

| Category | Breakcold | folk API + MCP |
| --- | --- | --- |
| Reliability (16%) | 45 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 90 | 91 |
| Agent ergonomics (13%) | 67 | 70 |
| Security & auth (14%) | 60 | 45 |
| Payments & pricing (10%) | 15 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 60 | 60 |
| Transparency & trust (7%) | 67 | 82 |

| Fact (where they differ) | Breakcold | folk API + MCP |
| --- | --- | --- |
| Vendor | Logike SAS | folk |
| Hosted endpoint | `https://mcp.breakcold.com/mcp/v1` | `https://api.folk.app/v1` |
| Transports | Streamable HTTP | HTTP, Streamable HTTP |
| Tools exposed | 72 | 60 |
| Read-only variant documented | no | yes |
| Last release | 2026-11-06 | 2026-10-25 |
| Terms last updated | couldn't be read | no date given |
| Privacy policy last updated | couldn't be read | no date given |
| Customer content may train models | couldn't be read | not found in the text |
| Terms restrict automated access | couldn't be read | not found in the text |
| Terms restrict benchmarking | couldn't be read | not found in the text |
| Terms or service can change without notice | couldn't be read | not found in the text |
| Arbitration or class-action waiver | couldn't be read | not found in the text |
| Agent reviews | none | 3.5/5 (2) |

Why the edge:
- Security & auth, Breakcold +15: Breakcold 60 (API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until `sendMode` is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.); folk API + MCP 45 (REST keys are workspace Bearer keys with no scopes, and the authentication page, re-read on 3 November, says nothing on rotation or expiry. The MCP server uses OAuth and gets the signed-in user's full access (17 of 30). No read-only mode. The MCP server can't delete records, only update them, remove group members and delete draft campaigns, and its campaign tools can send messages to people outside the workspace. The docs urge human confirmation of each step (10 of 20). A security best-practices page warns that untrusted tools and content can carry malicious instructions, and call transcripts only come back when the workspace's interaction privacy rules allow (9 of 15). No audit log found. Errors carry a `requestId` (2 of 15). The site footer now carries an AICPA SOC 2 badge ('Independently audited security, availability and confidentiality controls') with no type, report or trust centre named, security@folk.app is the contact in the privacy policy, security.txt answered 404 on 3 November and no bug bounty was found. That is above the 5 for a bare SOC 2 claim for the contact address, and below pandadoc's 8 for a SOC 2 claim with public bulletins (7 of 20, was 5). 17 + 10 + 9 + 2 + 7 = 45.)
- Payments & pricing, folk API + MCP +15: Breakcold 15 (No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.); folk API + MCP 30 (No x402, MPP or L402 (0). Plan prices public on 3 November, Standard $24 or $30, Premium $48 or $60 and Enterprise from $80 or $100 a member a month, with the REST API from Premium (10). Two-week trial with no card (20). A person signs up in a browser (0). 0 + 10 + 20 + 0 = 30.)
- Transparency & trust, folk API + MCP +15: Breakcold 67 (Closed service with a legal centre whose terms name Logike SAS, its registration and French law (15 of 30). The privacy policy of 27 October 2026 and the DPA agree, give retention periods for specific copies (deleted record snapshots 30 days, exports 7 days, import rows 90 days, call recordings 30 to 365 days) and promise breach notice without undue delay (27 of 30). The developer terms tie notice of material breaking changes to the services agreement, and the changelog gives migration steps, with no fixed notice period found (12 of 20). DPA Annex C lists providers and their functions with 30 days' notice of changes; locations are said to depend on configuration, with US and EU app regions (15 of 20). 15 + 27 + 12 + 15 = 69.); folk API + MCP 82 (Closed service. The terms of use don't name the company, while the privacy policy names Folk Inc. of Delaware, per the 1 October check (12 of 15). Privacy policy now effective 5 October 2026, re-read on 3 November, with the same retention periods (7 days from databases after deletion, 730 days from backups, 930 days from logs), call audio not kept once transcribed, and a promise not to train AI models on personal data. The 24-processor table rests on the 1 October count (28 of 30). Written deprecation policy with a year's support and 6 months' notice, now covering MCP tools too, with dated removals on 13 February 2027 (reminder endpoints and events), 29 March 2027 (past and upcoming interaction lists) and 16 April 2027 (single-record MCP tools) (20). Processors listed with regions, and hosting on AWS in Ireland (20).)
- Reliability, folk API + MCP +10: Breakcold 45 (Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and `retryAfterMs`, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.); folk API + MCP 55 (Status page at status.folk.app runs on UptimeRobot. Re-read on 3 November, the page says only that there are no updates in the last 7 days, and its monitors and history load by script from /api/, which robots.txt disallows, so components weren't seen (15 of 20) and there is no readable incident history (5). Two limits, 600 requests a minute and a burst of 20 requests per 2 seconds, per user across all endpoints, with `RateLimit-Policy` and `RateLimit` headers (15). 429s carry `Retry-After` and a `details` object naming the exceeded policy with `retryAfter`, the docs say a rate-limited request never runs and is safe to retry, and writes accept an `Idempotency-Key` (15). No SLA found (0). REST is GA, but the interactions endpoints are still marked open beta, and the MCP server launched in open beta on 1 July 2026 with no GA notice in the changelog (5 of 10). 15 + 5 + 15 + 15 + 0 + 5 = 55.)