# Breakcold vs SugarAI (SugarCRM) (slim)

> Breakcold scores 58 (C) to SugarAI's 47.2 (D) for crm records. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/breakcold-vs-sugarcrm.md (~5,150 tokens) · this version ~2,980 tokens · JSON https://www.anchorterminal.com/compare/breakcold-vs-sugarcrm.json · canonical https://www.anchorterminal.com/compare/breakcold-vs-sugarcrm
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Breakcold scores 58 (C) on agent readiness against SugarAI (SugarCRM)'s 47.2 (D), and leads in 4 of 7 scored categories. SugarAI (SugarCRM) leads on reliability. Both do crm records.

- Breakcold: C 58, rank #766 of 1486 · https://www.anchorterminal.com/tools/breakcold.min.md
- SugarAI (SugarCRM): D 47.2, rank #1144 of 1486 · https://www.anchorterminal.com/tools/sugarcrm.min.md
- Breakcold, good for Small sales teams who run outreach on email and social channels and want an agent to keep records, tasks and replies in order. Ahead on Schema & documentation, 90 against 40; Security & auth, 60 against 51; Payments & pricing, 15 against 10; Maintenance & community, 60 against 12. Also A hosted endpoint, with nothing to install.
- SugarAI (SugarCRM), good for Companies already running Sugar Sell, Serve or Enterprise that want an agent to read and write records under a named user's roles, and that have Sugar's approval for the integration. Ahead on Reliability, 61 against 45.

| Category | Breakcold | SugarAI (SugarCRM) |
| --- | --- | --- |
| Reliability (16%) | 45 | 61 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 90 | 40 |
| Agent ergonomics (13%) | 67 | 69 |
| Security & auth (14%) | 60 | 51 |
| Payments & pricing (10%) | 15 | 10 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 60 | 12 |
| Transparency & trust (7%) | 67 | 69 |

| Fact (where they differ) | Breakcold | SugarAI (SugarCRM) |
| --- | --- | --- |
| Vendor | Logike SAS | SugarAI Software Inc. |
| Hosted endpoint | `https://mcp.breakcold.com/mcp/v1` | no (local only) |
| Transports | Streamable HTTP | HTTP |
| Auth | OAuth or key | OAuth |
| Licence | none | Proprietary service under the SugarAI Customer Terms of Service |
| Tools exposed | 72 | none |
| llms.txt | yes | no |
| Last release | 2026-11-06 | none |
| Terms last updated | couldn't be read | not read yet |
| Privacy policy last updated | couldn't be read | no date given |
| Customer content may train models | couldn't be read | not read yet |
| Terms restrict automated access | couldn't be read | not read yet |
| Terms restrict benchmarking | couldn't be read | not read yet |
| Terms or service can change without notice | couldn't be read | not read yet |
| Arbitration or class-action waiver | couldn't be read | not read yet |

Why the edge:
- Schema & documentation, Breakcold +50: Breakcold 90 (OpenAPI 3.1 contract at docs.breakcold.com/api/openapi.json with 70 operations, each with a description (25). llms.txt and a Markdown copy of each page, plus auth.md and an MCP server card (10). Tool descriptions say how to use them, such as `records_create` asking for every required field and a stable idempotency key and the send tools saying to send only after the user confirms (17 of 20). 84 enums and 488 required lists, with typed attribute pages for each field type (13 of 15). Every operation documents 400 to 429 responses and the error body is shown, but the spec carries only two examples (10 of 15). /api/v1, and an API changelog with dated entries and migration steps (15). 25 + 10 + 17 + 13 + 10 + 15 = 90.); SugarAI (SugarCRM) 40 (SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. No OpenAPI file was found. A Postman collection was read on 9 October behind the viewer page at rest.apidocs.sugarcrm.com, with no download link recorded, so it isn't counted as a published contract. Each instance serves its own reference at `/rest/v{version}/help` and a `/metadata` endpoint, which we could not read without an instance (0). `llms.txt` on support.sugarai.com returned 404 and no Markdown docs were found (0). The 26.1 Developer Guide lists 350 endpoint pages. The five sampled carry an overview and a summary, and the filter page warns about unindexed filters, but none says when not to use an endpoint (11 of 20). Arguments are tabled with type and required flag. Record bodies are described only as `<record field>`, and filters are a free-form expression (7 of 15). Every sampled page has a request and response example, and a separate page lists 21 exception classes with HTTP codes and error labels. The examples carry dates from 2013 and 2014 (10 of 15). The API is versioned in the path, a table maps each Sugar release to its REST version, and each endpoint page has a change log. No dated API changelog was found (12 of 15). 0 + 0 + 11 + 7 + 10 + 12 = 40.)
- Maintenance & community, Breakcold +48: Breakcold 60 (API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.); SugarAI (SugarCRM) 12 (SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. The newest dated evidence of an API release is the 26.1 Developer Guide, whose REST pages are stamped 15 May 2026. A page stamp records no change, and no release note or dated API change was read, so no recency is credited (0). Three releases in the last 90 days were not established (0). The support site and its policy pages are current, with a support portal. The SugarClub community answered with a bot check on 9 October and was not read (7 of 25). No current SDKs in several languages. `ventana`, the JavaScript client, was last tagged 1.1.25 on 16 January 2026 (clone read 4 November), a partial held (5 of 15). No package was checked on a registry (0). 0 + 0 + 7 + 5 + 0 = 12.)
- Reliability, SugarAI (SugarCRM) +16: Breakcold 45 (Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and `retryAfterMs`, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.); SugarAI (SugarCRM) 61 (SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. Read with the hosted lines, for the SugarCloud REST API. Status page at status.cloud.sugarai.com on Better Stack with more than 100 components by region and cluster, and incident history (20). The RSS feed, read on 9 October, shows about 18 dated incidents between 15 July and 4 October 2026, most of them one to three minutes on a single cluster. The longest were 41 minutes on Sugar Cloud Premium DE 02 on 21 September and 39 minutes on US 02 on 16 July. On 24 July, 15 services including SugarIdentity global login and eight US clusters were down for about 11 minutes. No outage of an hour was found, and the wide one is why this sits below the minor band (14 of 30). The 24 July incident is now outside the 90 days from 6 August, and the window from 5 October is unread, so the line keeps its recorded value as a partial. The SugarCloud Policy Guide gives 20 requests a second as the level above which traffic may be blocked, and ends SELECT queries after 120 seconds. The limit is enforced at Sugar's discretion (12 of 15). No 429 or Retry-After behaviour is documented. Blocked traffic is lifted through a support case. Upsert by `sync_key` and a 409 `edit_conflict` error give some retry safety (5 of 15). No SLA was found in the Customer Terms of Service, which do not warrant uninterrupted service (0). The REST API is GA and versioned (10). 20 + 14 + 12 + 5 + 0 + 10 = 61.)
- Security & auth, Breakcold +9: Breakcold 60 (API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until `sendMode` is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.); SugarAI (SugarCRM) 51 (SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. Tokens come from an OAuth 2.0 password grant that sends a user's username and plaintext password. The default `client_id` is `sugar` with an empty secret, the reference says there is no scope implementation, and an admin can obtain a token as any user through `/oauth2/sudo/:user_name`. Access tokens last 60 minutes and refresh tokens up to two weeks, both configurable in SugarIdentity (12 of 30). A token is limited by the user's roles and teams. No read-only token type or confirmation step for destructive calls was found (10 of 20). Records hold emails, notes and case text, and no prompt-injection guidance was found (3 of 15). SugarIdentity keeps an exportable audit log of logins, record audit endpoints exist (`/:module/:record/audit`), and access logs are available in SugarCloud Insights (10 of 15). security.txt is valid until 1 April 2027. The trust page lists SOC 2 Type II, ISO/IEC 27001:2022 and a CSA STAR listing, and the security FAQ states a bug bounty programme and patch targets of 14 days for critical flaws. The advisories page is closed to us by robots.txt and was not read (16 of 20). 12 + 10 + 3 + 10 + 16 = 51.)
- Payments & pricing, Breakcold +5: Breakcold 15 (No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.); SugarAI (SugarCRM) 10 (SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. No x402, MPP or L402 (0). Plan prices are public for Sugar Sell, at $68, $98 and $155 a user a month billed annually, with Precision+ bundles quoted by sales and nothing per call (10). No free tier or self-serve trial was found. The site's buttons ask for a demo, and a 30-day Evaluation Agreement exists for evaluations Sugar arranges (0). A person buys through sales and an admin creates the user an agent logs in as (0).)