Breakcold vs SugarAI (SugarCRM)

Breakcold 90

OpenAPI 3.1 contract at docs.breakcold.com/api/openapi.json with 70 operations, each with a description (25). llms.txt and a Markdown copy of each page, plus auth.md and an MCP server card (10). Tool descriptions say how to use them, such as records_create asking for every required field and a stable idempotency key and the send tools saying to send only after the user confirms (17 of 20). 84 enums and 488 required lists, with typed attribute pages for each field type (13 of 15). Every operation documents 400 to 429 responses and the error body is shown, but the spec carries only two examples (10 of 15). /api/v1, and an API changelog with dated entries and migration steps (15). 25 + 10 + 17 + 13 + 10 + 15 = 90.

SugarAI (SugarCRM) 40

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. No OpenAPI file was found. A Postman collection was read on 9 October behind the viewer page at rest.apidocs.sugarcrm.com, with no download link recorded, so it isn't counted as a published contract. Each instance serves its own reference at /rest/v{version}/help and a /metadata endpoint, which we could not read without an instance (0). llms.txt on support.sugarai.com returned 404 and no Markdown docs were found (0). The 26.1 Developer Guide lists 350 endpoint pages. The five sampled carry an overview and a summary, and the filter page warns about unindexed filters, but none says when not to use an endpoint (11 of 20). Arguments are tabled with type and required flag. Record bodies are described only as <record field>, and filters are a free-form expression (7 of 15). Every sampled page has a request and response example, and a separate page lists 21 exception classes with HTTP codes and error labels. The examples carry dates from 2013 and 2014 (10 of 15). The API is versioned in the path, a table maps each Sugar release to its REST version, and each endpoint page has a change log. No dated API changelog was found (12 of 15). 0 + 0 + 11 + 7 + 10 + 12 = 40.

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

SugarAI (SugarCRM) 12

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. The newest dated evidence of an API release is the 26.1 Developer Guide, whose REST pages are stamped 15 May 2026. A page stamp records no change, and no release note or dated API change was read, so no recency is credited (0). Three releases in the last 90 days were not established (0). The support site and its policy pages are current, with a support portal. The SugarClub community answered with a bot check on 9 October and was not read (7 of 25). No current SDKs in several languages. ventana, the JavaScript client, was last tagged 1.1.25 on 16 January 2026 (clone read 4 November), a partial held (5 of 15). No package was checked on a registry (0). 0 + 0 + 7 + 5 + 0 = 12.

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

SugarAI (SugarCRM) 61

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. Read with the hosted lines, for the SugarCloud REST API. Status page at status.cloud.sugarai.com on Better Stack with more than 100 components by region and cluster, and incident history (20). The RSS feed, read on 9 October, shows about 18 dated incidents between 15 July and 4 October 2026, most of them one to three minutes on a single cluster. The longest were 41 minutes on Sugar Cloud Premium DE 02 on 21 September and 39 minutes on US 02 on 16 July. On 24 July, 15 services including SugarIdentity global login and eight US clusters were down for about 11 minutes. No outage of an hour was found, and the wide one is why this sits below the minor band (14 of 30). The 24 July incident is now outside the 90 days from 6 August, and the window from 5 October is unread, so the line keeps its recorded value as a partial. The SugarCloud Policy Guide gives 20 requests a second as the level above which traffic may be blocked, and ends SELECT queries after 120 seconds. The limit is enforced at Sugar's discretion (12 of 15). No 429 or Retry-After behaviour is documented. Blocked traffic is lifted through a support case. Upsert by sync_key and a 409 edit_conflict error give some retry safety (5 of 15). No SLA was found in the Customer Terms of Service, which do not warrant uninterrupted service (0). The REST API is GA and versioned (10). 20 + 14 + 12 + 5 + 0 + 10 = 61.

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

SugarAI (SugarCRM) 51

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. Tokens come from an OAuth 2.0 password grant that sends a user's username and plaintext password. The default client_id is sugar with an empty secret, the reference says there is no scope implementation, and an admin can obtain a token as any user through /oauth2/sudo/:user_name. Access tokens last 60 minutes and refresh tokens up to two weeks, both configurable in SugarIdentity (12 of 30). A token is limited by the user's roles and teams. No read-only token type or confirmation step for destructive calls was found (10 of 20). Records hold emails, notes and case text, and no prompt-injection guidance was found (3 of 15). SugarIdentity keeps an exportable audit log of logins, record audit endpoints exist (/:module/:record/audit), and access logs are available in SugarCloud Insights (10 of 15). security.txt is valid until 1 April 2027. The trust page lists SOC 2 Type II, ISO/IEC 27001:2022 and a CSA STAR listing, and the security FAQ states a bug bounty programme and patch targets of 14 days for critical flaws. The advisories page is closed to us by robots.txt and was not read (16 of 20). 12 + 10 + 3 + 10 + 16 = 51.

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

SugarAI (SugarCRM) 10

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. No x402, MPP or L402 (0). Plan prices are public for Sugar Sell, at $68, $98 and $155 a user a month billed annually, with Precision+ bundles quoted by sales and nothing per call (10). No free tier or self-serve trial was found. The site's buttons ask for a demo, and a 30-day Evaluation Agreement exists for evaluations Sugar arranges (0). A person buys through sales and an admin creates the user an agent logs in as (0).