Breakcold vs Salesforce API + MCP

Breakcold 90

OpenAPI 3.1 contract at docs.breakcold.com/api/openapi.json with 70 operations, each with a description (25). llms.txt and a Markdown copy of each page, plus auth.md and an MCP server card (10). Tool descriptions say how to use them, such as records_create asking for every required field and a stable idempotency key and the send tools saying to send only after the user confirms (17 of 20). 84 enums and 488 required lists, with typed attribute pages for each field type (13 of 15). Every operation documents 400 to 429 responses and the error body is shown, but the spec carries only two examples (10 of 15). /api/v1, and an API changelog with dated entries and migration steps (15). 25 + 10 + 17 + 13 + 10 + 15 = 90.

Salesforce API + MCP 0

developer.salesforce.com answered robots.txt with an Akamai 403 on 4 November 2026, so the host is blocked and the 1 October readings from it are struck. The hosted MCP references, the API reference, llms.txt and the platform versioning notes were all read there. The release notes on help.salesforce.com load only by script, www.salesforce.com/llms.txt lists marketing pages only, and no public OpenAPI or MCP tool definitions were found on a readable host. Contract, llms.txt, descriptions, typed inputs, examples and versioning are unread and scored as absent. 0 + 0 + 0 + 0 + 0 + 0 = 0.

Breakcold 67

72 MCP tools (5), with tools_search and capabilities_list to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a fields selection on record lists since 3 November (18 of 20). Errors carry a code, message, requestId and retryAfterMs, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.

Salesforce API + MCP 0

developer.salesforce.com answered robots.txt with an Akamai 403 on 4 November 2026, so the host is blocked and the 1 October readings from it are struck. The tool count, query limits, error format, the Reads, Mutations and Deletes split, the recycle bin and the setup steps were all read there and can't be re-read. No official general-purpose REST SDK was found on a readable host. Every line is unread and scored as absent. 0 + 0 + 0 + 0 + 0 = 0.

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

Salesforce API + MCP 4

No dated API or MCP change could be read on 4 November. developer.salesforce.com answered robots.txt with an Akamai 403 on 4 November 2026, so the host is blocked and the 1 October readings from it are struck. The release notes on help.salesforce.com load only by script. The April 2026 GA in the listing is now more than 180 days old in any case (0). No dated change in the 90 days from 6 August could be read (0). Support and help routes are linked from Salesforce's readable pages; the changelog can't be read (4 of 15). Not in the official MCP registry, which lists only third-party Salesforce servers on 4 November, and no official general-purpose REST SDK found (0). No packages to judge (0). 0 + 0 + 4 + 0 + 0 = 4.

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

Salesforce API + MCP 40

developer.salesforce.com answered robots.txt with an Akamai 403 on 4 November 2026, so the host is blocked and the 1 October readings from it are struck. The OAuth 2.0 with PKCE and mcp_api scope reading came from there; no readable page states the API's credential model (0). Salesforce's security model page, read on 4 November, says access is limited at the object, field and record level through profiles, roles and permission sets; the per-risk MCP servers and delete confirmation are struck with the docs (10 of 20). Record text written by outsiders reaches the model. Salesforce's security site publishes prompt-injection advisories that turned on human confirmation for Agentforce actions (14 and 25 August 2025) and an LLM risk whitepaper, none for hosted MCP (4 of 15). The same page lists Setup Audit Trail, Login History and Field History Tracking built in, and Event Monitoring of 90+ event types in the paid Shield add-on (8 of 15). A responsible disclosure policy, an "independent bug bounty program" and SOC 2 Type II, ISO, PCI DSS L1 and FedRAMP claims on the security model page, and a public advisory archive and feed with CVEs (newest 2 October 2025). No security.txt found. Read above twilio-voice (disclosure, bounty, certifications, no advisories, 15) for the public advisories (18 of 20). 0 + 10 + 4 + 8 + 18 = 40.

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

Salesforce API + MCP 30

No x402, MPP or L402 (0). The pricing page, read on 4 November, publishes per-user prices (Starter Suite $25, Pro Suite $100 plus "Web Services API Additional $25", Core $195, Advanced $395, Max $550 a user a month) (10). "Try Sales Cloud free for 30 days. No credit card" (20). The Developer Edition and Flex Credit readings came from the blocked developer host and are struck. A person signs up and an admin configures access (0). 0 + 10 + 20 + 0 = 30.