Breakcold vs Pipedrive API + MCP

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

Pipedrive API + MCP 83

Node client v36.1.0 on 21 October 2026 (30). Node releases on 6 August, 13 August, twice on 8 September, and 13 more from 9 to 21 October, counted half as SDK tags (20). Public changelog with dated entries, the newest announced on 29 July and effective 1 August 2026. We didn't test support (10 of 15). Not in the official MCP registry (only third-party Pipedrive servers), but official SDKs are current (15). The Node client publishes from CI, and a workflow auto-closes stale issues (8 of 10).

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

Pipedrive API + MCP 30

No x402, MPP or L402 (0). Plan prices public, Lite $14 to Ultimate $79 a seat a month billed yearly, with token top-ups from $100 a month. No per-call price for the API (10). 14-day trial with no card (20). A person signs up in a browser (0).

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Pipedrive API + MCP 58

Status page at status.pipedrive.com (run on Sorry), linked from Pipedrive's developer pages, with components including REST API v1 but nothing for API v2 or the MCP server, per the 1 October check (20). On 4 November its robots.txt answered an empty 406, which this run reads as a refusal, so the 1 October incident readings from it are struck and no part of the window from 6 August could be read (5). Rate limits documented in detail, a daily token budget per company plus burst limits per 2 seconds by plan and auth type (15). Responses carry x-ratelimit-* and x-daily-requests-left headers and a 429 when the budget runs out. The rate-limit page gives no Retry-After or safe-retry guidance for writes, though the Node client's 36.1.0 notes (21 October) mention Retry-After on a 429 (8 of 15). No SLA found (0). REST is GA, and the MCP setup article for Claude, updated on 22 October 2026, no longer labels the server beta (10).

Breakcold 90

OpenAPI 3.1 contract at docs.breakcold.com/api/openapi.json with 70 operations, each with a description (25). llms.txt and a Markdown copy of each page, plus auth.md and an MCP server card (10). Tool descriptions say how to use them, such as records_create asking for every required field and a stable idempotency key and the send tools saying to send only after the user confirms (17 of 20). 84 enums and 488 required lists, with typed attribute pages for each field type (13 of 15). Every operation documents 400 to 429 responses and the error body is shown, but the spec carries only two examples (10 of 15). /api/v1, and an API changelog with dated entries and migration steps (15). 25 + 10 + 17 + 13 + 10 + 15 = 90.

Pipedrive API + MCP 80

OpenAPI 3.0.1 file for v2, re-read on 4 November with 158 operations and the token in the x-api-token header (25). llms.txt on the readme.io docs (10). Pipedrive's MCP tools article (updated 22 October 2026) lists 51 tools by resource, each with its action and some with a use case; the server's own tool definitions weren't read. API reference descriptions are adequate (10 of 20). Typed parameters in the OpenAPI (12 of 15). Examples on every reference page. We didn't read an error reference (10 of 15). v1 and v2 paths and a dated changelog that flags breaking changes and deprecations (13 of 15).

Breakcold 67

Closed service with a legal centre whose terms name Logike SAS, its registration and French law (15 of 30). The privacy policy of 27 October 2026 and the DPA agree, give retention periods for specific copies (deleted record snapshots 30 days, exports 7 days, import rows 90 days, call recordings 30 to 365 days) and promise breach notice without undue delay (27 of 30). The developer terms tie notice of material breaking changes to the services agreement, and the changelog gives migration steps, with no fixed notice period found (12 of 20). DPA Annex C lists providers and their functions with 30 days' notice of changes; locations are said to depend on configuration, with US and EU app regions (15 of 20). 15 + 27 + 12 + 15 = 69.

Pipedrive API + MCP 76

Closed service with terms naming Pipedrive Inc. in the US and Pipedrive OÜ in the EU (15). Privacy notice updated 2 July 2026, with DPF and SCCs and a subprocessor link, but no retention periods after closure and no clear statement on training AI with customer data (18 of 30). Dated deprecations with notice, such as the Channels API (announced 14 November 2025, effective 1 February 2026) and deprecated v1 endpoints out of support from 1 August 2026 (16 of 20). Subprocessor list maintained, including Anthropic and Recall.ai, on AWS in several regions (17 of 20).

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

Pipedrive API + MCP 53

Personal API tokens carry the user's full rights, one active per user per company, and per the 30 September check older docs still show the token as an api_token query parameter. OAuth 2.0 with scopes for apps, and the MCP server is OAuth only with scopes for deals, contacts, leads, activities, products and search (25, less 10 for the query-string option, 15 of 30). No read-only mode or write confirmation documented for MCP (7 of 20). Email sync and notes reach the model, and we found no injection guidance (3 of 15). The launch post says every MCP action is recorded in Pipedrive's change logs (12 of 15). ISO 27001:2022, ISO 27701, SOC 2 Type 2 and SOC 3 in the trust centre, with a responsible disclosure programme. No security.txt (404) (16 of 20).