Breakcold vs Payani AI

Breakcold 90

OpenAPI 3.1 contract at docs.breakcold.com/api/openapi.json with 70 operations, each with a description (25). llms.txt and a Markdown copy of each page, plus auth.md and an MCP server card (10). Tool descriptions say how to use them, such as records_create asking for every required field and a stable idempotency key and the send tools saying to send only after the user confirms (17 of 20). 84 enums and 488 required lists, with typed attribute pages for each field type (13 of 15). Every operation documents 400 to 429 responses and the error body is shown, but the spec carries only two examples (10 of 15). /api/v1, and an API changelog with dated entries and migration steps (15). 25 + 10 + 17 + 13 + 10 + 15 = 90.

Payani AI 13

The server answers 401 without a token, so tools/list and its JSON Schemas were not read. The OAuth and protected-resource metadata are machine-readable, but they describe sign-in, not tools (2 of 25). payani.ai/llms.txt exists but indexes marketing pages, with nothing on the MCP server (3 of 10). The MCP page states what the server is for and what it can't do (no edits, deletes or sends), in eight capability areas rather than per tool (5 of 20). Typed inputs not read (0). The 401 returns a JSON error and error_description and a WWW-Authenticate header naming the resource metadata. No examples of calls (3 of 15). No versioning or changelog found (0).

Breakcold 67

72 MCP tools (5), with tools_search and capabilities_list to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a fields selection on record lists since 3 November (18 of 20). Errors carry a code, message, requestId and retryAfterMs, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.

Payani AI 26

Tool count and definition sizes are unknown. The MCP page lists eight read areas, which suggests a small toolset, unconfirmed (10 of 25). No pagination, filters or size controls could be confirmed (0). The 401 message says what to do (connect a Payani account), and nothing else is documented (3 of 20). Every call reads and nothing writes, so retries are safe by design. Annotations unread (10 of 20). Connecting is one URL and an OAuth consent, with no SDK (3 of 15).

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Payani AI 15

Graded as a hosted MCP server. No status page found, and status.payani.ai did not answer (0). No incident history to read (5). No rate limits found on the MCP page, the help centre or the terms (0). No 429, Retry-After or backoff guidance found (0). The terms of 8 October 2026 say there is no uptime guarantee on any plan (0). Nothing calls the MCP server or Ask Payani beta (10).

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

Payani AI 35

Read as a closed service. The launch release of 20 October 2026 and the terms and privacy policy of 8 October 2026 are within 30 days (30). No changelog, release notes or dated product updates found, so no count of changes in 90 days (0). Support by email and a form, said to reply usually within one business day, untested, and no public changelog (5 of 25). Not in the official MCP registry (a search for payani returned no servers) and no SDKs (0). No packages to judge (0).

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

Payani AI 30

No x402, MPP or L402 (0). Plan prices are public, $49, $99 and $249 a month, with credit packs priced and nothing per MCP call (10). 14-day trial with no card, and the MCP page links to a free account for connecting (20). A person signs up in a browser and approves the OAuth consent. Dynamic client registration lets a client register itself, but not get access without the person (0).

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

Payani AI 47

OAuth authorisation code with PKCE (S256), dynamic client registration, refresh tokens, a revocation endpoint and a single read scope, with access limited to the workspace the person picks (26 of 30). The whole server is read-only per the MCP page, so an agent has no destructive actions to approve (18 of 20). The data it returns includes contact records, form submissions and website-visitor details that outsiders write, and no injection guidance was found (3 of 15). No audit log or per-call view found in the reviewed pages (0). No security.txt (the path returns the HTML site), no disclosure policy, bug bounty or certification found. The privacy policy states encryption in transit only (0).