Breakcold vs Salesflare

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

Salesflare 5

No API changelog or release notes found. The 9 October recency credit rested on the spec file's Last-Modified header (8 October), and on 4 November the same header read 4 November 2026 with the operation count unchanged, so it is a deployment stamp that records no change and sets no recency (20 to 0). No dated changelog entries (0). Support by chat and email per the help centre, untested, and no public issue tracker for the API (5 of 25). No official SDK. No official MCP registry entry was read (0). No packages to judge (0). Total 5.

Breakcold 90

OpenAPI 3.1 contract at docs.breakcold.com/api/openapi.json with 70 operations, each with a description (25). llms.txt and a Markdown copy of each page, plus auth.md and an MCP server card (10). Tool descriptions say how to use them, such as records_create asking for every required field and a stable idempotency key and the send tools saying to send only after the user confirms (17 of 20). 84 enums and 488 required lists, with typed attribute pages for each field type (13 of 15). Every operation documents 400 to 429 responses and the error body is shown, but the spec carries only two examples (10 of 15). /api/v1, and an API changelog with dated entries and migration steps (15). 25 + 10 + 17 + 13 + 10 + 15 = 90.

Salesflare 57

Public Swagger 2.0 file with 71 operations, linked as a download from the API introduction ("You can download it here") and from llms.txt, re-read on 4 November (25). llms.txt on the main site and help centre, with a Markdown twin for every page. The API reference itself is a Redoc page drawn from the spec (10). 17 of 71 operations have a description, and most repeat the summary (5 of 20). Enums, formats, minimums and required fields are widespread, but custom fields travel as a string, alternatives use a non-standard x-alternatives key, and the help centre says phone number arrays are not well described (10 of 15). No examples. 47 operations document only a default response, and errors appear only as a table of five status codes (4 of 15). The spec is version 1.0.0 with no changelog. Old fields are marked deprecated in their descriptions (3 of 15). Total 57.

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Salesflare 18

Read with the hosted lines. Salesflare links a status page at status.salesflare.com, but on 4 November its robots.txt answered an empty 406, which this run reads as a refusal (as pipedrive's), so the 9 October readings of its components and history are struck and the line has no readable component history (20 to 0). No part of the window from 6 August could be read (30 to 5). No rate limit numbers found (0). The API introduction, re-read on 4 November, lists 429 with no Retry-After or backoff guidance, and there are no idempotency keys. update_if_exists on account creation and force=false on contact creation allow a safe retry of two writes (3 of 15, partial kept). No SLA found, and the terms promise reasonable endeavours without a figure (0). The REST API carries no beta label (10). 0+5+0+3+0+10 = 18.

Breakcold 67

72 MCP tools (5), with tools_search and capabilities_list to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a fields selection on record lists since 3 November (18 of 20). Errors carry a code, message, requestId and retryAfterMs, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.

Salesflare 49

Graded on the REST API. The MCP tool definitions sit behind OAuth and were not read. Lists take limit and offset, and details=false on accounts and opportunities trims the response, with no field selection (14 of 25). search, order_by, typed field filters and a q rule builder on every main list, with no documented maximum page size or total count (16 of 20). The docs list five status codes without causes and 47 operations type their response only as default; the 9 October reading of an error body came from an unauthenticated request to the API, which is struck. The status-code table still partly meets the line, so the earlier partial is kept (8 of 20, partial kept). No idempotency keys. update_if_exists and force=false cover account and contact creation only (5 of 20). Few required fields, and no official SDK was found among the vendor's 47 public repositories (6 of 15). 14+16+8+5+6 = 49.

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

Salesflare 44

REST uses API keys sent as a Bearer header, created in Settings with no documented scopes, expiry or rotation. The MCP server uses OAuth authorisation code with PKCE (S256) and dynamic client registration, and its metadata lists only openid and offline_access, so tokens are not scoped by resource (22 of 30). Viewer, team member, manager and admin roles with data scopes exist on the Pro plan, but whether an API key inherits its creator's role is not documented. The MCP guide tells users to start with read-only requests and review writes (8 of 20). Account feeds return email and message content, with no injection guidance found (3 of 15). No audit log found (0). A disclosure programme with bounties generally of $20 to $80 and reports to security@salesflare.com (re-read on 4 November), CASA Tier 2 verification revalidated yearly and testing by an independent lab per the help centre. No SOC 2 or ISO 27001 of its own and no security.txt (11 of 20). Total 44.

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

Salesflare 30

No x402, MPP or L402 (0). Plan prices are public and unchanged on 4 November, $29 to $99 a user a month billed annually ($39 to $124 monthly), with nothing per call (10). 30-day trial with no card, and an API key can be created on a trial account (20). A person signs up in a browser and creates the key, or signs in to approve the OAuth connection (0). Total 30.