Breakcold vs Twenty API + MCP

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

Twenty API + MCP 97

twenty/v2.54.0 tagged on 30 October 2026, with sdk/v2.54.3 the same day (30). 19 server tags between 2 and 30 October 2026, twenty/v2.45.0 to v2.54.0 (20). Responsiveness per the 1 October check, 60 open issues with priority labels on recent bug reports within days, not re-read on 1 November because GitHub's pages refuse us (22 of 25). Not in the official MCP registry (only a third-party io.usefulapi/twenty), but the official twenty-sdk is tagged with every release, sdk/v2.54.3 on 30 October (15). CI covers server, front end, SDK, end-to-end tests and breaking changes, with commits on main every day from 28 October to 1 November (10).

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

Twenty API + MCP 30

No x402, MPP or L402 (0). Plan prices public, Cloud Pro $9 or $12 and Organization $19 or $25 a user a month, but nothing per call (10). Self-hosting is free, and the server's billing defaults allow a 7-day cloud trial without a card (20). A person signs up in a browser or deploys a server (0).

Breakcold 67

72 MCP tools (5), with tools_search and capabilities_list to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a fields selection on record lists since 3 November (18 of 20). Errors carry a code, message, requestId and retryAfterMs, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.

Twenty API + MCP 80

By default the MCP server lists six meta-tools (execute_tool, learn_tools, load_skills, list_object_metadata_names, list_skills, get_tool_catalog) and loads schemas on demand. ?mode=direct lists every tool for clients that load lazily (25). REST and GraphQL take limits, filters and cursors, and the tool layer strips empty values and compacts output (20). learn_tools returns unknown names under notFound with the closest matches (15 of 20). Read-only tools carry readOnlyHint. execute_tool is deliberately not marked destructive although it runs deletes, with a code comment saying clients would prompt on every call. upsert_many_* exists for safe retries (10 of 20). Few required parameters. TypeScript SDKs only (twenty-sdk, twenty-client-sdk) (10 of 15).

Breakcold 67

Closed service with a legal centre whose terms name Logike SAS, its registration and French law (15 of 30). The privacy policy of 27 October 2026 and the DPA agree, give retention periods for specific copies (deleted record snapshots 30 days, exports 7 days, import rows 90 days, call recordings 30 to 365 days) and promise breach notice without undue delay (27 of 30). The developer terms tie notice of material breaking changes to the services agreement, and the changelog gives migration steps, with no fixed notice period found (12 of 20). DPA Annex C lists providers and their functions with 30 days' notice of changes; locations are said to depend on configuration, with US and EU app regions (15 of 20). 15 + 27 + 12 + 15 = 69.

Twenty API + MCP 80

AGPL-3.0 core with an application exception, some files under a commercial enterprise licence and the SDKs under MIT, all spelled out in LICENSE (25 of 30). Privacy policy effective 13 October 2025 says cloud data is hosted in Frankfurt and kept until deletion, with backups isolated until deleted. No retention periods in days (22 of 30). Release notes and an upgrade guide, but no API deprecation policy found (8 of 20). Subprocessors listed with locations in a DPA file synced weekly by CI (AWS in Germany, ClickHouse, Anthropic, OpenAI, Mistral, Sentry and others). Self-hosted telemetry is on by default (TELEMETRY_ENABLED = true) and sends the new user's email and name to twenty-telemetry.com on sign-up. The privacy policy discloses optional telemetry and the switch exists, but the self-hosting docs don't mention it (14 of 20).

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Twenty API + MCP 52

No status page found. status.twenty.com still serves the Twenty app shell on 1 November, and the website links only a trust centre (0). No readable incident history (5). Limits published with numbers, 100 requests a minute and 60 records per batch in the API docs, and 50 a minute on Cloud Pro and 100 on Organization in the pricing table (15). The data-import guide says to use exponential backoff and watch for 429 responses, the apps guide says to retry a 429 with backoff and a cap on attempts, and GraphQL batch upserts and the MCP upsert_many_* tools give a safe retry for creates, with no idempotency keys (12 of 15, as e2b). The Enterprise plan lists 'Dedicated support & SLA' on the pricing page (10). REST, GraphQL and MCP carry no beta label (10). 0 + 5 + 15 + 12 + 10 + 10 = 52.

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

Twenty API + MCP 65

API keys are Bearer tokens with a required expiry date, a revoked flag and an optional role binding. OAuth with dynamic client registration for MCP and apps. Tokens stay out of URLs (30). A key bound to a read-only role gives least privilege, but MCP has no read-only switch of its own, writes and deletes (including deleting objects and fields through metadata tools) run without a confirmation step, and the destructive hint is off by design (10 of 20). Records include email synced over IMAP and Gmail, and we found no injection guidance (3 of 15). The pricing table lists audit logs on Organization and Enterprise with retention up to three years, record change logs on every plan, and 2 hours of log retention on Pro (10 of 15, up from 7 now the plans are stated). security.txt with two contacts and a policy link but no Expires field, a SECURITY.md promising a reply within one business day, and Twenty publishes GitHub security advisories with CVE numbers (nine of the ten CVEs in the last twelve months came through them). No SOC 2 or bug bounty found, and SECURITY.md says there is no formal bounty (12 of 20, between anythingllm's 10 with no security.txt and open-webui's 14 with a dated one). 30 + 10 + 3 + 10 + 12 = 65.