{ "data": { "a": { "slug": "breakcold", "name": "Breakcold", "vendor": "Logike SAS", "vendorUrl": "https://www.breakcold.com", "kind": "http-api", "category": "crm", "summary": "Breakcold is a CRM for small sales teams that syncs email, LinkedIn, WhatsApp and Telegram conversations into one pipeline. Agents reach its records, tasks, notes and inbox through a REST API and a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/breakcold", "markdownUrl": "https://www.anchorterminal.com/tools/breakcold.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/breakcold.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/breakcold.json", "dns": "breakcold.grade.anchorterminal.com", "transports": [ "streamable-http" ], "remoteUrl": "https://mcp.breakcold.com/mcp/v1", "packages": [], "auth": "mixed", "authNotes": "API keys (`bc_live_` prefix) are created in Settings \u003e API keys with chosen scopes (records, tasks, notes, inbox, inbox send, CRM metadata and others, read and write separate), an optional workspace limit and an expiry, shown once and revocable, with activity history. MCP clients can instead sign in by OAuth with PKCE through WorkOS AuthKit and dynamic client registration. Multi-organisation users send `X-Breakcold-Organization-Id`.", "pricing": "paid", "pricingNotes": "One plan in three sizes: X1 $99 a month (1 seat), X5 $199 (5 seats) and X20 $499 (20 seats), each with MCP access, 10% off quarterly and 20% off yearly. Extra seats $10 a month. A 14-day trial needs a card. API and MCP calls draw on a weekly AI usage allowance at 0.2 tokens a read and 0.4 a write; a weekly reset costs $50.", "priceSummary": "$99 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the OpenAPI spec, auth.md, the docs or the pricing page (checked 2026-11-06). Calls draw on a plan's weekly usage allowance.", "endpoints": [] }, "toolCount": 72, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.breakcold.com/api/overview", "llmsTxt": "https://docs.breakcold.com/llms.txt", "openapi": "https://docs.breakcold.com/api/openapi.json", "capabilities": [ "crm.records", "crm.pipeline", "crm.activities", "crm.search", "crm.webhooks", "email.send", "email.threads" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "openapi", "llms-txt", "paid", "trial", "webhooks", "idempotency", "eu" ], "lastRelease": "2026-11-06", "graded": true, "anchor": { "graded": true, "score": 58, "grade": "C", "agentReady": false, "rank": 766, "ranked": true, "rankOf": 1486, "categoryRank": 9, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 60, "payments": 15, "reliability": 45, "schema": 90, "security": 60, "transparency": 67 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Breakcold's API and hosted MCP server are built for agents, with an OpenAPI contract, scoped and expiring keys, published rate limits, idempotency keys and message sends that stay drafts until confirmed. No status page, SLA or security certification was found, and the only trial needs a card on a plan from $99 a month.", "bestFor": "Small sales teams who run outreach on email and social channels and want an agent to keep records, tasks and replies in order.", "strengths": [ "API keys take scopes, a workspace limit and an expiry, and MCP also accepts OAuth with PKCE", "Compose and send tools draft by default and send only with an explicit `sendMode`", "OpenAPI 3.1 contract of 70 described operations, llms.txt and Markdown docs", "Rate limits published per organisation, workspace, identity and route, with Retry-After and `retryAfterMs`", "Public DPA with a provider inventory and 30 days' notice of new subprocessors" ], "weaknesses": [ "No status page or SLA was found; status.breakcold.com did not answer", "72 MCP tools by default, and their annotations are not published", "The only trial needs a card, and plans start at $99 a month", "No security.txt, bug bounty or security certification found", "No official SDK, and the CRM MCP server is not in the official MCP registry" ], "agentNotes": [ "Call `capabilities_list` or `tools_search` first to see which tools the granted scopes allow", "Send an Idempotency-Key on REST creates and a stable idempotency key on `records_create`, so retries return the original result", "Leave `sendMode` unset on compose and send tools until the user has confirmed the message", "Pass `fields` on record lists to cut the response to the fields you need", "On 429 wait for Retry-After or `retryAfterMs`; over MCP the error code is -32029" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58 } ], "editorialScores": { "ergonomics": 67, "maintenance": 60, "payments": 15, "reliability": 45, "schema": 90, "security": 60, "transparency": 69 }, "provenanceScore": 64, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl \"https://rest.breakcold.com/api/v1/workspaces\" -H \"Authorization: Bearer YOUR_API_KEY\"", "claudeCode": "claude mcp add --transport http breakcold https://mcp.breakcold.com/mcp/v1", "config": { "mcpServers": { "breakcold": { "url": "https://mcp.breakcold.com/mcp/v1" } } } }, "letme": { "capability": "https://letme.dev/crm.records", "tool": "https://letme.dev/breakcold" }, "area": "business", "unitPrices": [ { "item": "X1 plan (1 seat)", "unit": "month", "usd": 99, "note": "Billed monthly; 10% off quarterly, 20% off yearly" }, { "item": "X5 plan (5 seats)", "unit": "month", "usd": 199, "note": "AI usage five times X1" }, { "item": "X20 plan (20 seats)", "unit": "month", "usd": 499, "note": "AI usage twenty times X1" }, { "item": "Extra seat or connected account", "unit": "seat-month", "usd": 10, "note": "On every plan" } ], "provenance": { "legalEntity": "Logike SAS", "domain": "breakcold.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.breakcold.com/legal/terms-and-conditions", "privacy": "https://www.breakcold.com/legal/privacy", "statusPage": "", "changelog": "https://docs.breakcold.com/api/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and conditions (19 October 2026) name Logike SAS, SIREN 902303395, RCS Paris, share capital EUR 1,000, 128 rue de la Boétie, 75008 Paris, under French law. A services agreement, developer terms (3 September 2026), DPA (27 October 2026) and vulnerability disclosure policy (3 September 2026) sit in the legal centre.", "The developer terms ask integrations to respect published rate limits and not rotate keys to evade them; no clause against reading public pages was found.", "www.breakcold.com/robots.txt allows all but /admin and /api with Content-Signal ai-train=no, search=yes, ai-input=yes; docs.breakcold.com allows all; rest.breakcold.com and mcp.breakcold.com carry only content-signal comments. One unauthenticated GET to rest.breakcold.com/api/v1/openapi.json, sent before its robots.txt was read, answered 401.", "/.well-known/security.txt returns 404. status.breakcold.com failed the TLS handshake. Domain registration date not checked.", "WebFetch received 404 for the pricing and legal pages, which answered 200 to a plain request, so those were read with curl." ], "score": 64 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/breakcold.json", "live": { "slug": "breakcold", "probe": { "target": "https://mcp.breakcold.com/mcp/v1", "method": "get", "lastAt": "2026-11-07T18:20:14.868914805Z", "lastOk": true, "lastStatus": 401, "lastMs": 133, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 62, "p95ms24h": 146, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "securityTxt": { "url": "https://breakcold.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:18.103639801Z" }, "llmsTxt": { "url": "https://docs.breakcold.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:44.782472776Z" }, "pages": [ { "url": "https://docs.breakcold.com/api/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:05:21.53355824Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f02d2d2285f0" }, { "url": "https://www.breakcold.com/legal/privacy", "kind": "privacy", "status": 404, "checkedAt": "2026-11-07T14:26:05.166026349Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://www.breakcold.com/legal/terms-and-conditions", "kind": "terms", "status": 404, "checkedAt": "2026-11-07T14:26:07.751718301Z", "changedAt": "0001-01-01T00:00:00Z" } ], "mcpTools": { "url": "https://mcp.breakcold.com/mcp/v1", "checkedAt": "2026-11-07T01:42:53.267576496Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:42:53.267576496Z" }, "updatedAt": "2026-11-07T18:20:14.868914805Z" } }, "answer": "Breakcold scores 58 (C) on agent readiness against Twenty API + MCP's 56.3 (C), and leads in 1 of 7 scored categories. Twenty API + MCP leads on reliability, agent ergonomics, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "twenty", "name": "Twenty API + MCP", "vendor": "Twenty", "vendorUrl": "https://twenty.com", "kind": "http-api", "category": "crm", "summary": "Open-source CRM, hosted at twenty.com or self-hosted with Docker.", "url": "https://www.anchorterminal.com/tools/twenty", "markdownUrl": "https://www.anchorterminal.com/tools/twenty.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/twenty.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/twenty.json", "dns": "twenty.grade.anchorterminal.com", "repo": "https://github.com/twentyhq/twenty", "license": "AGPL-3.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.twenty.com/rest", "packages": [ { "registry": "npm", "name": "twenty-sdk" } ], "auth": "mixed", "authNotes": "Bearer API key made under Settings, shown once, and optionally bound to a role to limit what it can touch. OAuth for apps acting for users. The MCP endpoint (https://\u003cworkspace\u003e/mcp) takes OAuth with dynamic client registration or the same API key in the Authorization header.", "pricing": "freemium", "pricingNotes": "Self-hosting the AGPL core is free, and a paid Organization licence can be activated on a self-hosted instance. Cloud Pro $9 a user a month and Organization $39 a user a month, billed yearly (yearly saves 25 per cent on monthly billing), Enterprise from $50,000 a year with an SLA. Pro includes 1 workspace credit a user a month and Organization 4 (1 credit covers 10,000 workflow steps), with credit packs at $1 a credit from $20 a month. API, webhooks and MCP are on every cloud plan. The pricing page says the free trial needs no credit card (https://twenty.com/pricing).", "priceSummary": "$9 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No payments. Access follows the cloud plan or your own server.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 57739, "npmWeekly": 25528, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.twenty.com", "llmsTxt": "https://docs.twenty.com/llms.txt", "capabilities": [ "crm.records", "crm.pipeline", "crm.activities", "crm.search", "crm.webhooks" ], "tags": [ "hosted", "open-source", "self-hosted", "local", "mcp", "llms-txt", "webhooks", "typescript", "freemium" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 56.3, "grade": "C", "agentReady": false, "rank": 829, "ranked": true, "rankOf": 1486, "categoryRank": 10, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 97, "payments": 30, "reliability": 52, "schema": 88, "security": 65, "transparency": 80 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -12, "negativeNotes": [ "-6 for six fixed advisories rated High or Critical and published more than two months ago, at 1 each. CVE-2026-26720 (Critical 9.8, 2 March 2026, code execution through local.driver.ts in v1.15.0 and earlier), CVE-2026-33975 (High 8.3, 5 May, SSRF bypass through IPv4-mapped IPv6), CVE-2026-44729 (High 8.7, 26 May, stored XSS through file serving), CVE-2026-46624 (Critical 9.9, 26 May, SQL injection through the groupBy timeZone parameter, fixed after 1.16.7), CVE-2026-55583 (High 7.6, 24 June, cross-workspace IDOR in AgentTurnResolver, fixed in 2.9.0) and CVE-2026-73069 (Critical 9.1, 11 August, SQL through a field's asExpression setting, fixed in 2.15.0). https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=twenty%20crm", "-2 for CVE-2026-85055 (High 7.1, published 22 September 2026, GHSA-v93q-4jcx-7p9m), a filter oracle that revealed fields a key or member couldn't read, fixed in 2.22.0 and under two months old. https://api.osv.dev/v1/vulns/CVE-2026-85055", "-2 for CVE-2026-105763 (Critical 9.6, published 6 October 2026, GHSA-mq5c-qp77-2cv3), where the metadata connectedAccounts query returned other members' plaintext IMAP, SMTP and CalDAV passwords from 1.20.10 until 2.7.0, fixed and under two months old. https://api.osv.dev/v1/vulns/CVE-2026-105763", "-2 for two fixed Medium advisories Twenty published through GitHub's CNA, at 1 each. CVE-2026-27023 (Medium 5.0, published 5 March 2026, GHSA-wm7q-rvq3-x8q9), where the SSRF protection in SecureHttpClientService didn't check redirect targets, fixed in 1.18, and CVE-2026-35451 (Medium 5.7, published 21 April 2026, GHSA-7w89-7q26-gj7q), a stored XSS in the BlockNote file block, fixed in 1.20.6. https://api.osv.dev/v1/vulns/CVE-2026-27023" ], "verdict": "Six MCP meta-tools by default load schemas on demand, and every workspace generates its own OpenAPI files. Ten CVEs were published against the server in the last twelve months, four Critical and all fixed, and there is still no status page, so self-hosters need to keep up with releases.", "bestFor": "Teams that want an open-source CRM they can self-host or extend with custom objects, and an MCP server that stays cheap in context.", "strengths": [ "Six MCP meta-tools by default with schemas loaded on demand, and `?mode=direct` for clients that load lazily", "Per-workspace OpenAPI for core and metadata, custom objects included", "API keys carry a required expiry, revocation and an optional role binding", "AGPL-3.0 core, self-hostable, with 19 server release tags in October 2026", "Security flaws are published as GitHub advisories with CVE numbers, and the docs give 429 backoff guidance" ], "weaknesses": [ "No status page found", "Ten CVEs in twelve months, including SQL injection (CVE-2026-46624) and plaintext mail passwords exposed to members (CVE-2026-105763), all fixed", "`execute_tool` isn't flagged destructive even though it can delete records, objects and fields", "Cloud Pro allows 50 API requests a minute, Organization 100", "Self-hosted telemetry is on by default and sends sign-up emails and names" ], "agentNotes": [ "Call `learn_tools` with every tool name you need in one call before `execute_tool`", "Build CRUD names from the grammar (`find_many_companies`, `upsert_many_people`) instead of browsing the catalogue", "Pass one category to `get_tool_catalog`, since an unfiltered call returns hundreds of operations", "Load the matching skill before any workflow or metadata tool, as the server instructions require", "Batch up to 60 records a call and back off on 429, since Cloud Pro allows only 50 requests a minute" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.3 } ], "editorialScores": { "ergonomics": 80, "maintenance": 97, "payments": 30, "reliability": 52, "schema": 88, "security": 65, "transparency": 69 }, "provenanceScore": 91, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl \"https://api.twenty.com/rest/companies?limit=5\" -H \"Authorization: Bearer $TWENTY_API_KEY\"", "claudeCode": "claude mcp add --transport http twenty https://\u003cyour-workspace\u003e.twenty.com/mcp", "config": { "mcpServers": { "twenty": { "headers": { "Authorization": "Bearer $TWENTY_API_KEY" }, "type": "streamable-http", "url": "https://\u003cyour-workspace\u003e.twenty.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/crm.records", "tool": "https://letme.dev/twenty" }, "area": "business", "unitPrices": [ { "item": "Cloud Pro", "unit": "seat-month", "usd": 9, "note": "billed yearly; API and MCP on every plan" }, { "item": "Cloud Organization", "unit": "seat-month", "usd": 39, "note": "billed yearly" }, { "item": "Self-hosted", "unit": "month", "usd": 0, "note": "AGPL core, you pay for your own servers" } ], "provenance": { "legalEntity": "Twenty.com PBC", "domain": "twenty.com", "domainRegistered": "2004-09-01", "domainNote": "twenty.com was registered in 2004, long before the Twenty project started in 2022.", "endpointOnVendorDomain": true, "terms": "https://twenty.com/terms", "privacy": "https://twenty.com/privacy-policy", "statusPage": "", "changelog": "https://twenty.com/releases", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "status.twenty.com serves the Twenty app shell rather than a status page (still so on 1 November 2026), and the website links only a trust centre (trust.twenty.com).", "security.txt has two Contact lines and a Policy line but no Expires field (read 1 November 2026)." ], "score": 91 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/twenty.json", "live": { "slug": "twenty", "probe": { "target": "https://api.twenty.com/rest", "method": "get", "lastAt": "2026-11-07T18:21:02.118104724Z", "lastOk": true, "lastStatus": 404, "lastMs": 70, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 100, "p95ms24h": 255, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.twenty.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-01T20:17:49.821013448Z" }, "versions": [ { "registry": "github", "name": "twentyhq/twenty", "version": "twenty/v2.56.1", "released": "2026-11-05", "seenAt": "2026-11-07T00:13:11.256186279Z" }, { "registry": "npm", "name": "twenty-sdk", "version": "2.56.0", "seenAt": "2026-11-07T00:13:10.490884891Z" } ], "githubStars": 60561, "npmWeekly": 44016, "securityTxt": { "url": "https://twenty.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T15:59:57.770012107Z" }, "llmsTxt": { "url": "https://docs.twenty.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.235967858Z" }, "domain": { "domain": "twenty.com", "registered": "2004-09-01", "source": "https://rdap.verisign.com/com/v1/domain/twenty.com", "checkedAt": "2026-11-01T14:07:13.024610029Z" }, "pages": [ { "url": "https://twenty.com/releases", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:22:48.301179792Z", "changedAt": "2026-11-04T08:35:25.533979642Z", "fingerprint": "0460c92d1348" }, { "url": "https://twenty.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:22:43.952863888Z", "changedAt": "2026-11-05T13:07:06.747468228Z", "fingerprint": "5733d6305a32" }, { "url": "https://twenty.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:22:46.453735087Z", "changedAt": "2026-11-04T08:35:23.62681784Z", "fingerprint": "7f3e5a8c6938" }, { "url": "https://twenty.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:22:50.369456068Z", "changedAt": "2026-11-04T08:35:27.425925234Z", "fingerprint": "98de8692d78b" } ], "github": { "repo": "twentyhq/twenty", "checkedAt": "2026-11-02T09:33:17.881487967Z", "stars": 60290, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:29:37Z", "openIssues": 72, "openPRs": 54, "issuesOpened90d": 432, "issuesClosed90d": 438, "prsMerged90d": 3715, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-02T09:22:09Z" }, "advisories": [ { "ghsa": "GHSA-j86q-q8c2-f8x7", "severity": "medium", "published": "2026-10-27T18:01:24Z" }, { "ghsa": "GHSA-qf3h-pmgc-fcw6", "severity": "medium", "published": "2026-10-22T15:40:31Z" }, { "ghsa": "GHSA-pg47-7c3r-fwfx", "severity": "medium", "published": "2026-10-22T15:03:47Z" }, { "ghsa": "GHSA-m4vm-35cw-44rq", "severity": "high", "published": "2026-10-22T07:27:26Z" }, { "ghsa": "GHSA-9pfj-h2fx-29hg", "severity": "medium", "published": "2026-10-19T22:49:46Z" }, { "ghsa": "GHSA-8w82-h3w4-62r5", "severity": "medium", "published": "2026-10-19T09:20:28Z" }, { "ghsa": "GHSA-v93q-4jcx-7p9m", "cve": "CVE-2026-85055", "severity": "medium", "published": "2026-09-02T12:16:51Z" }, { "ghsa": "GHSA-mq5c-qp77-2cv3", "cve": "CVE-2026-105763", "severity": "critical", "published": "2026-09-01T13:08:08Z" }, { "ghsa": "GHSA-mm7j-q9q3-qqwj", "cve": "CVE-2026-73069", "severity": "critical", "published": "2026-07-27T11:28:05Z" }, { "ghsa": "GHSA-v39r-w5vg-j9pp", "cve": "CVE-2026-55583", "severity": "high", "published": "2026-06-17T16:13:44Z" }, { "ghsa": "GHSA-jgx4-6mr9-9573", "cve": "CVE-2026-46624", "severity": "critical", "published": "2026-05-17T19:36:32Z" }, { "ghsa": "GHSA-f5h2-3qw5-3qp7", "cve": "CVE-2026-44729", "severity": "high", "published": "2026-05-05T09:53:07Z" }, { "ghsa": "GHSA-vrcj-hv2q-c58m", "cve": "CVE-2026-33975", "severity": "medium", "published": "2026-04-27T14:39:41Z" }, { "ghsa": "GHSA-7w89-7q26-gj7q", "cve": "CVE-2026-35451", "severity": "medium", "published": "2026-04-21T15:31:52Z" }, { "ghsa": "GHSA-wm7q-rvq3-x8q9", "cve": "CVE-2026-27023", "severity": "medium", "published": "2026-03-04T13:53:08Z" } ], "replies": { "sampled": 25, "unanswered": 10, "medianDays": 1 } }, "updatedAt": "2026-11-07T18:21:02.118104724Z" } }, "edges": [ { "by": 37, "category": "maintenance", "leads": "twenty", "name": "Maintenance \u0026 community", "reasons": { "a": "API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.", "b": "twenty/v2.54.0 tagged on 30 October 2026, with sdk/v2.54.3 the same day (30). 19 server tags between 2 and 30 October 2026, twenty/v2.45.0 to v2.54.0 (20). Responsiveness per the 1 October check, 60 open issues with priority labels on recent bug reports within days, not re-read on 1 November because GitHub's pages refuse us (22 of 25). Not in the official MCP registry (only a third-party io.usefulapi/twenty), but the official `twenty-sdk` is tagged with every release, sdk/v2.54.3 on 30 October (15). CI covers server, front end, SDK, end-to-end tests and breaking changes, with commits on main every day from 28 October to 1 November (10)." }, "scores": { "a": 60, "b": 97 } }, { "by": 15, "category": "payments", "leads": "twenty", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.", "b": "No x402, MPP or L402 (0). Plan prices public, Cloud Pro $9 or $12 and Organization $19 or $25 a user a month, but nothing per call (10). Self-hosting is free, and the server's billing defaults allow a 7-day cloud trial without a card (20). A person signs up in a browser or deploys a server (0)." }, "scores": { "a": 15, "b": 30 } }, { "by": 13, "category": "ergonomics", "leads": "twenty", "name": "Agent ergonomics", "reasons": { "a": "72 MCP tools (5), with `tools_search` and `capabilities_list` to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a `fields` selection on record lists since 3 November (18 of 20). Errors carry a code, message, `requestId` and `retryAfterMs`, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.", "b": "By default the MCP server lists six meta-tools (`execute_tool`, `learn_tools`, `load_skills`, `list_object_metadata_names`, `list_skills`, `get_tool_catalog`) and loads schemas on demand. `?mode=direct` lists every tool for clients that load lazily (25). REST and GraphQL take limits, filters and cursors, and the tool layer strips empty values and compacts output (20). `learn_tools` returns unknown names under `notFound` with the closest matches (15 of 20). Read-only tools carry `readOnlyHint`. `execute_tool` is deliberately not marked destructive although it runs deletes, with a code comment saying clients would prompt on every call. `upsert_many_*` exists for safe retries (10 of 20). Few required parameters. TypeScript SDKs only (`twenty-sdk`, `twenty-client-sdk`) (10 of 15)." }, "scores": { "a": 67, "b": 80 } }, { "by": 13, "category": "transparency", "leads": "twenty", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service with a legal centre whose terms name Logike SAS, its registration and French law (15 of 30). The privacy policy of 27 October 2026 and the DPA agree, give retention periods for specific copies (deleted record snapshots 30 days, exports 7 days, import rows 90 days, call recordings 30 to 365 days) and promise breach notice without undue delay (27 of 30). The developer terms tie notice of material breaking changes to the services agreement, and the changelog gives migration steps, with no fixed notice period found (12 of 20). DPA Annex C lists providers and their functions with 30 days' notice of changes; locations are said to depend on configuration, with US and EU app regions (15 of 20). 15 + 27 + 12 + 15 = 69.", "b": "AGPL-3.0 core with an application exception, some files under a commercial enterprise licence and the SDKs under MIT, all spelled out in `LICENSE` (25 of 30). Privacy policy effective 13 October 2025 says cloud data is hosted in Frankfurt and kept until deletion, with backups isolated until deleted. No retention periods in days (22 of 30). Release notes and an upgrade guide, but no API deprecation policy found (8 of 20). Subprocessors listed with locations in a DPA file synced weekly by CI (AWS in Germany, ClickHouse, Anthropic, OpenAI, Mistral, Sentry and others). Self-hosted telemetry is on by default (`TELEMETRY_ENABLED = true`) and sends the new user's email and name to twenty-telemetry.com on sign-up. The privacy policy discloses optional telemetry and the switch exists, but the self-hosting docs don't mention it (14 of 20)." }, "scores": { "a": 67, "b": 80 } }, { "by": 7, "category": "reliability", "leads": "twenty", "name": "Reliability", "reasons": { "a": "Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and `retryAfterMs`, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.", "b": "No status page found. status.twenty.com still serves the Twenty app shell on 1 November, and the website links only a trust centre (0). No readable incident history (5). Limits published with numbers, 100 requests a minute and 60 records per batch in the API docs, and 50 a minute on Cloud Pro and 100 on Organization in the pricing table (15). The data-import guide says to use exponential backoff and watch for 429 responses, the apps guide says to retry a 429 with backoff and a cap on attempts, and GraphQL batch upserts and the MCP `upsert_many_*` tools give a safe retry for creates, with no idempotency keys (12 of 15, as e2b). The Enterprise plan lists 'Dedicated support \u0026 SLA' on the pricing page (10). REST, GraphQL and MCP carry no beta label (10). 0 + 5 + 15 + 12 + 10 + 10 = 52." }, "scores": { "a": 45, "b": 52 } }, { "by": 5, "category": "security", "leads": "twenty", "name": "Security \u0026 auth", "reasons": { "a": "API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until `sendMode` is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.", "b": "API keys are Bearer tokens with a required expiry date, a revoked flag and an optional role binding. OAuth with dynamic client registration for MCP and apps. Tokens stay out of URLs (30). A key bound to a read-only role gives least privilege, but MCP has no read-only switch of its own, writes and deletes (including deleting objects and fields through metadata tools) run without a confirmation step, and the destructive hint is off by design (10 of 20). Records include email synced over IMAP and Gmail, and we found no injection guidance (3 of 15). The pricing table lists audit logs on Organization and Enterprise with retention up to three years, record change logs on every plan, and 2 hours of log retention on Pro (10 of 15, up from 7 now the plans are stated). security.txt with two contacts and a policy link but no Expires field, a SECURITY.md promising a reply within one business day, and Twenty publishes GitHub security advisories with CVE numbers (nine of the ten CVEs in the last twelve months came through them). No SOC 2 or bug bounty found, and SECURITY.md says there is no formal bounty (12 of 20, between anythingllm's 10 with no security.txt and open-webui's 14 with a dated one). 30 + 10 + 3 + 10 + 12 = 65." }, "scores": { "a": 60, "b": 65 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Logike SAS", "b": "Twenty", "name": "Vendor" }, { "a": "https://mcp.breakcold.com/mcp/v1", "b": "https://api.twenty.com/rest", "name": "Hosted endpoint" }, { "a": "Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "AGPL-3.0", "name": "Licence" }, { "a": "72", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-06", "b": "2026-10-30", "name": "Last release" }, { "a": "couldn't be read", "b": "2026-08-07", "name": "Terms last updated" }, { "a": "couldn't be read", "b": "2025-10-13", "name": "Privacy policy last updated" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "58k stars, 26k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Breakcold scores 58 (C) on agent readiness against Twenty API + MCP's 56.3 (C), and leads in 1 of 7 scored categories. Twenty API + MCP leads on reliability, agent ergonomics, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, Breakcold or Twenty API + MCP?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Breakcold and Twenty API + MCP need an API key?" }, { "answer": "Yes. Breakcold has a hosted endpoint at https://mcp.breakcold.com/mcp/v1 and Twenty API + MCP at https://api.twenty.com/rest.", "question": "Can an agent call Breakcold and Twenty API + MCP without installing anything?" }, { "answer": "No open-source release is listed for Breakcold. Twenty API + MCP is open source (AGPL-3.0).", "question": "Are Breakcold and Twenty API + MCP open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where Twenty API + MCP loses 12 points for them" ], "goodFor": "Small sales teams who run outreach on email and social channels and want an agent to keep records, tasks and replies in order.", "slug": "breakcold", "watchFor": "No status page or SLA was found; status.breakcold.com did not answer" }, { "aheadOn": [ "Reliability, 52 against 45", "Agent ergonomics, 80 against 67", "Security \u0026 auth, 65 against 60", "Payments \u0026 pricing, 30 against 15", "Maintenance \u0026 community, 97 against 60", "Transparency \u0026 trust, 80 against 67" ], "also": [ "Open source" ], "goodFor": "Teams that want an open-source CRM they can self-host or extend with custom objects, and an MCP server that stays cheap in context.", "slug": "twenty", "watchFor": "No status page found" } ], "history": { "breakcold": null, "twenty": [ { "causes": [ "evidence" ], "date": "2026-11-01", "delta": -9.6, "from": 65.9, "fromGrade": "B", "to": 56.3, "toGrade": "C" } ] }, "job": { "capability": "crm.records", "name": "CRM records" }, "others": [ { "json": "https://www.anchorterminal.com/compare/affinity-vs-breakcold.json", "title": "Affinity vs Breakcold", "url": "https://www.anchorterminal.com/compare/affinity-vs-breakcold" }, { "json": "https://www.anchorterminal.com/compare/affinity-vs-twenty.json", "title": "Affinity vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/affinity-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/attio-vs-breakcold.json", "title": "Attio API + MCP vs Breakcold", "url": "https://www.anchorterminal.com/compare/attio-vs-breakcold" }, { "json": "https://www.anchorterminal.com/compare/attio-vs-twenty.json", "title": "Attio API + MCP vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/attio-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-capsule-crm.json", "title": "Breakcold vs Capsule CRM", "url": "https://www.anchorterminal.com/compare/breakcold-vs-capsule-crm" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-close.json", "title": "Breakcold vs Close API + MCP", "url": "https://www.anchorterminal.com/compare/breakcold-vs-close" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-copper.json", "title": "Breakcold vs Copper API", "url": "https://www.anchorterminal.com/compare/breakcold-vs-copper" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-dynamics-365-sales.json", "title": "Breakcold vs Microsoft Dynamics 365 Sales", "url": "https://www.anchorterminal.com/compare/breakcold-vs-dynamics-365-sales" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-folk.json", "title": "Breakcold vs folk API + MCP", "url": "https://www.anchorterminal.com/compare/breakcold-vs-folk" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-freshsales.json", "title": "Breakcold vs Freshsales API", "url": "https://www.anchorterminal.com/compare/breakcold-vs-freshsales" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-hubspot-mcp.json", "title": "Breakcold vs HubSpot API + MCP", "url": "https://www.anchorterminal.com/compare/breakcold-vs-hubspot-mcp" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-nutshell.json", "title": "Breakcold vs Nutshell", "url": "https://www.anchorterminal.com/compare/breakcold-vs-nutshell" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-payani-ai.json", "title": "Breakcold vs Payani AI", "url": "https://www.anchorterminal.com/compare/breakcold-vs-payani-ai" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-pipedrive.json", "title": "Breakcold vs Pipedrive API + MCP", "url": "https://www.anchorterminal.com/compare/breakcold-vs-pipedrive" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-relaticle.json", "title": "Breakcold vs Relaticle", "url": "https://www.anchorterminal.com/compare/breakcold-vs-relaticle" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-salesflare.json", "title": "Breakcold vs Salesflare", "url": "https://www.anchorterminal.com/compare/breakcold-vs-salesflare" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-salesforce.json", "title": "Breakcold vs Salesforce API + MCP", "url": "https://www.anchorterminal.com/compare/breakcold-vs-salesforce" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-streak.json", "title": "Breakcold vs Streak API + MCP", "url": "https://www.anchorterminal.com/compare/breakcold-vs-streak" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-sugarcrm.json", "title": "Breakcold vs SugarAI (SugarCRM)", "url": "https://www.anchorterminal.com/compare/breakcold-vs-sugarcrm" }, { "json": "https://www.anchorterminal.com/compare/breakcold-vs-zoho-crm.json", "title": "Breakcold vs Zoho CRM", "url": "https://www.anchorterminal.com/compare/breakcold-vs-zoho-crm" }, { "json": "https://www.anchorterminal.com/compare/capsule-crm-vs-twenty.json", "title": "Capsule CRM vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/capsule-crm-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/close-vs-twenty.json", "title": "Close API + MCP vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/close-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/copper-vs-twenty.json", "title": "Copper API vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/copper-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/dynamics-365-sales-vs-twenty.json", "title": "Microsoft Dynamics 365 Sales vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/dynamics-365-sales-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/folk-vs-twenty.json", "title": "folk API + MCP vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/folk-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/freshsales-vs-twenty.json", "title": "Freshsales API vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/freshsales-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/hubspot-mcp-vs-twenty.json", "title": "HubSpot API + MCP vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/hubspot-mcp-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/nutshell-vs-twenty.json", "title": "Nutshell vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/nutshell-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/payani-ai-vs-twenty.json", "title": "Payani AI vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/payani-ai-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/pipedrive-vs-twenty.json", "title": "Pipedrive API + MCP vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/pipedrive-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/relaticle-vs-twenty.json", "title": "Relaticle vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/relaticle-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/salesflare-vs-twenty.json", "title": "Salesflare vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/salesflare-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/salesforce-vs-twenty.json", "title": "Salesforce API + MCP vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/salesforce-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/streak-vs-twenty.json", "title": "Streak API + MCP vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/streak-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/sugarcrm-vs-twenty.json", "title": "SugarAI (SugarCRM) vs Twenty API + MCP", "url": "https://www.anchorterminal.com/compare/sugarcrm-vs-twenty" }, { "json": "https://www.anchorterminal.com/compare/twenty-vs-zoho-crm.json", "title": "Twenty API + MCP vs Zoho CRM", "url": "https://www.anchorterminal.com/compare/twenty-vs-zoho-crm" } ], "panel": null, "scores": [ { "breakcold": 45, "by": 7, "edge": "twenty", "key": "reliability", "name": "Reliability", "twenty": 52, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "breakcold": 90, "by": 2, "edge": "breakcold", "key": "schema", "name": "Schema \u0026 documentation", "twenty": 88, "weight": 13 }, { "breakcold": 67, "by": 13, "edge": "twenty", "key": "ergonomics", "name": "Agent ergonomics", "twenty": 80, "weight": 13 }, { "breakcold": 60, "by": 5, "edge": "twenty", "key": "security", "name": "Security \u0026 auth", "twenty": 65, "weight": 14 }, { "breakcold": 15, "by": 15, "edge": "twenty", "key": "payments", "name": "Payments \u0026 pricing", "twenty": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "breakcold": 60, "by": 37, "edge": "twenty", "key": "maintenance", "name": "Maintenance \u0026 community", "twenty": 97, "weight": 7 }, { "breakcold": 67, "by": 13, "edge": "twenty", "key": "transparency", "name": "Transparency \u0026 trust", "twenty": 80, "weight": 7 } ], "summary": "Breakcold scores 58 (C) on agent readiness against Twenty API + MCP's 56.3 (C), and leads in 1 of 7 scored categories. Twenty API + MCP leads on reliability, agent ergonomics, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do crm records.", "tasks": null, "tutorials": [], "verdicts": { "breakcold": "Breakcold's API and hosted MCP server are built for agents, with an OpenAPI contract, scoped and expiring keys, published rate limits, idempotency keys and message sends that stay drafts until confirmed. No status page, SLA or security certification was found, and the only trial needs a card on a plan from $99 a month.", "twenty": "Six MCP meta-tools by default load schemas on demand, and every workspace generates its own OpenAPI files. Ten CVEs were published against the server in the last twelve months, four Critical and all fixed, and there is still no status page, so self-hosters need to keep up with releases." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/breakcold-vs-twenty", "json": "https://www.anchorterminal.com/compare/breakcold-vs-twenty.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/breakcold-vs-twenty.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/breakcold-vs-twenty.min.md" }, "markdown": "Breakcold scores 58 (C) on agent readiness against Twenty API + MCP's 56.3 (C), and leads in 1 of 7 scored categories. Twenty API + MCP leads on reliability, agent ergonomics, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do crm records.\n\n- Breakcold: grade C, 58/100, rank #766 of 1486. Markdown https://www.anchorterminal.com/tools/breakcold.md · JSON https://www.anchorterminal.com/api/v1/tools/breakcold.json\n- Twenty API + MCP: grade C, 56.3/100, rank #829 of 1486. Markdown https://www.anchorterminal.com/tools/twenty.md · JSON https://www.anchorterminal.com/api/v1/tools/twenty.json\n- Best CRM and customer-platform tools for AI agents: https://www.anchorterminal.com/best/crm/index.md\n- All 190 crm comparisons: https://www.anchorterminal.com/compare/crm/index.md\n\n## Which one, for what\n\n### Breakcold (C)\n\nGood for: Small sales teams who run outreach on email and social channels and want an agent to keep records, tasks and replies in order.\n\nAlso in its favour:\n- No incidents deducted, where Twenty API + MCP loses 12 points for them\n\nWatch for: No status page or SLA was found; status.breakcold.com did not answer\n\n### Twenty API + MCP (C)\n\nGood for: Teams that want an open-source CRM they can self-host or extend with custom objects, and an MCP server that stays cheap in context.\n\nAhead on:\n- Reliability, 52 against 45\n- Agent ergonomics, 80 against 67\n- Security \u0026 auth, 65 against 60\n- Payments \u0026 pricing, 30 against 15\n- Maintenance \u0026 community, 97 against 60\n- Transparency \u0026 trust, 80 against 67\n\nAlso in its favour:\n- Open source\n\nWatch for: No status page found\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Twenty API + MCP +37\n\n- Breakcold (60): API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.\n- Twenty API + MCP (97): twenty/v2.54.0 tagged on 30 October 2026, with sdk/v2.54.3 the same day (30). 19 server tags between 2 and 30 October 2026, twenty/v2.45.0 to v2.54.0 (20). Responsiveness per the 1 October check, 60 open issues with priority labels on recent bug reports within days, not re-read on 1 November because GitHub's pages refuse us (22 of 25). Not in the official MCP registry (only a third-party io.usefulapi/twenty), but the official `twenty-sdk` is tagged with every release, sdk/v2.54.3 on 30 October (15). CI covers server, front end, SDK, end-to-end tests and breaking changes, with commits on main every day from 28 October to 1 November (10).\n\n### Payments \u0026 pricing: Twenty API + MCP +15\n\n- Breakcold (15): No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.\n- Twenty API + MCP (30): No x402, MPP or L402 (0). Plan prices public, Cloud Pro $9 or $12 and Organization $19 or $25 a user a month, but nothing per call (10). Self-hosting is free, and the server's billing defaults allow a 7-day cloud trial without a card (20). A person signs up in a browser or deploys a server (0).\n\n### Agent ergonomics: Twenty API + MCP +13\n\n- Breakcold (67): 72 MCP tools (5), with `tools_search` and `capabilities_list` to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a `fields` selection on record lists since 3 November (18 of 20). Errors carry a code, message, `requestId` and `retryAfterMs`, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.\n- Twenty API + MCP (80): By default the MCP server lists six meta-tools (`execute_tool`, `learn_tools`, `load_skills`, `list_object_metadata_names`, `list_skills`, `get_tool_catalog`) and loads schemas on demand. `?mode=direct` lists every tool for clients that load lazily (25). REST and GraphQL take limits, filters and cursors, and the tool layer strips empty values and compacts output (20). `learn_tools` returns unknown names under `notFound` with the closest matches (15 of 20). Read-only tools carry `readOnlyHint`. `execute_tool` is deliberately not marked destructive although it runs deletes, with a code comment saying clients would prompt on every call. `upsert_many_*` exists for safe retries (10 of 20). Few required parameters. TypeScript SDKs only (`twenty-sdk`, `twenty-client-sdk`) (10 of 15).\n\n### Transparency \u0026 trust: Twenty API + MCP +13\n\n- Breakcold (67): Closed service with a legal centre whose terms name Logike SAS, its registration and French law (15 of 30). The privacy policy of 27 October 2026 and the DPA agree, give retention periods for specific copies (deleted record snapshots 30 days, exports 7 days, import rows 90 days, call recordings 30 to 365 days) and promise breach notice without undue delay (27 of 30). The developer terms tie notice of material breaking changes to the services agreement, and the changelog gives migration steps, with no fixed notice period found (12 of 20). DPA Annex C lists providers and their functions with 30 days' notice of changes; locations are said to depend on configuration, with US and EU app regions (15 of 20). 15 + 27 + 12 + 15 = 69.\n- Twenty API + MCP (80): AGPL-3.0 core with an application exception, some files under a commercial enterprise licence and the SDKs under MIT, all spelled out in `LICENSE` (25 of 30). Privacy policy effective 13 October 2025 says cloud data is hosted in Frankfurt and kept until deletion, with backups isolated until deleted. No retention periods in days (22 of 30). Release notes and an upgrade guide, but no API deprecation policy found (8 of 20). Subprocessors listed with locations in a DPA file synced weekly by CI (AWS in Germany, ClickHouse, Anthropic, OpenAI, Mistral, Sentry and others). Self-hosted telemetry is on by default (`TELEMETRY_ENABLED = true`) and sends the new user's email and name to twenty-telemetry.com on sign-up. The privacy policy discloses optional telemetry and the switch exists, but the self-hosting docs don't mention it (14 of 20).\n\n### Reliability: Twenty API + MCP +7\n\n- Breakcold (45): Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and `retryAfterMs`, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.\n- Twenty API + MCP (52): No status page found. status.twenty.com still serves the Twenty app shell on 1 November, and the website links only a trust centre (0). No readable incident history (5). Limits published with numbers, 100 requests a minute and 60 records per batch in the API docs, and 50 a minute on Cloud Pro and 100 on Organization in the pricing table (15). The data-import guide says to use exponential backoff and watch for 429 responses, the apps guide says to retry a 429 with backoff and a cap on attempts, and GraphQL batch upserts and the MCP `upsert_many_*` tools give a safe retry for creates, with no idempotency keys (12 of 15, as e2b). The Enterprise plan lists 'Dedicated support \u0026 SLA' on the pricing page (10). REST, GraphQL and MCP carry no beta label (10). 0 + 5 + 15 + 12 + 10 + 10 = 52.\n\n### Security \u0026 auth: Twenty API + MCP +5\n\n- Breakcold (60): API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until `sendMode` is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.\n- Twenty API + MCP (65): API keys are Bearer tokens with a required expiry date, a revoked flag and an optional role binding. OAuth with dynamic client registration for MCP and apps. Tokens stay out of URLs (30). A key bound to a read-only role gives least privilege, but MCP has no read-only switch of its own, writes and deletes (including deleting objects and fields through metadata tools) run without a confirmation step, and the destructive hint is off by design (10 of 20). Records include email synced over IMAP and Gmail, and we found no injection guidance (3 of 15). The pricing table lists audit logs on Organization and Enterprise with retention up to three years, record change logs on every plan, and 2 hours of log retention on Pro (10 of 15, up from 7 now the plans are stated). security.txt with two contacts and a policy link but no Expires field, a SECURITY.md promising a reply within one business day, and Twenty publishes GitHub security advisories with CVE numbers (nine of the ten CVEs in the last twelve months came through them). No SOC 2 or bug bounty found, and SECURITY.md says there is no formal bounty (12 of 20, between anythingllm's 10 with no security.txt and open-webui's 14 with a dated one). 30 + 10 + 3 + 10 + 12 = 65.\n\n## Score by category\n\n| Category | Weight | Breakcold | Twenty API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 45 | 52 | Twenty API + MCP +7 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 90 | 88 | Breakcold +2 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 80 | Twenty API + MCP +13 |\n| Security \u0026 auth | 14% (17.5 this run) | 60 | 65 | Twenty API + MCP +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 15 | 30 | Twenty API + MCP +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 60 | 97 | Twenty API + MCP +37 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 67 | 80 | Twenty API + MCP +13 |\n| Negative events | ≤15 | 0 | -12 | |\n| **Total** | | **58 · C** | **56.3 · C** | |\n\n## Facts side by side\n\n| Fact | Breakcold | Twenty API + MCP |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Logike SAS | Twenty |\n| Hosted endpoint | `https://mcp.breakcold.com/mcp/v1` | `https://api.twenty.com/rest` |\n| Transports | Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | none | AGPL-3.0 |\n| Tools exposed | 72 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-11-06 | 2026-10-30 |\n| Terms last updated | couldn't be read | 2026-08-07 |\n| Privacy policy last updated | couldn't be read | 2025-10-13 |\n| Customer content may train models | couldn't be read | not found in the text |\n| Terms restrict automated access | couldn't be read | not found in the text |\n| Terms restrict benchmarking | couldn't be read | not found in the text |\n| Terms or service can change without notice | couldn't be read | not found in the text |\n| Arbitration or class-action waiver | couldn't be read | not found in the text |\n| Popularity | none | 58k stars, 26k npm/wk |\n| Agent reviews | none | 3.5/5 (2) |\n\n## How the scores have moved\n\n### Breakcold\n\nNo score change since it was listed.\n\n### Twenty API + MCP\n\n- -9.6 on 1 November 2026 (B to C): new evidence\n\n## Verdicts\n\n**Breakcold.** Breakcold's API and hosted MCP server are built for agents, with an OpenAPI contract, scoped and expiring keys, published rate limits, idempotency keys and message sends that stay drafts until confirmed. No status page, SLA or security certification was found, and the only trial needs a card on a plan from $99 a month.\n\n**Twenty API + MCP.** Six MCP meta-tools by default load schemas on demand, and every workspace generates its own OpenAPI files. Ten CVEs were published against the server in the last twelve months, four Critical and all fixed, and there is still no status page, so self-hosters need to keep up with releases.\n\n## Before you call either\n\n### Breakcold\n\n1. Call `capabilities_list` or `tools_search` first to see which tools the granted scopes allow\n2. Send an Idempotency-Key on REST creates and a stable idempotency key on `records_create`, so retries return the original result\n3. Leave `sendMode` unset on compose and send tools until the user has confirmed the message\n4. Pass `fields` on record lists to cut the response to the fields you need\n5. On 429 wait for Retry-After or `retryAfterMs`; over MCP the error code is -32029\n\n### Twenty API + MCP\n\n1. Call `learn_tools` with every tool name you need in one call before `execute_tool`\n2. Build CRUD names from the grammar (`find_many_companies`, `upsert_many_people`) instead of browsing the catalogue\n3. Pass one category to `get_tool_catalog`, since an unfiltered call returns hundreds of operations\n4. Load the matching skill before any workflow or metadata tool, as the server instructions require\n5. Batch up to 60 records a call and back off on 429, since Cloud Pro allows only 50 requests a minute\n\n## Questions\n\n### Which is better for AI agents, Breakcold or Twenty API + MCP?\n\nBreakcold scores 58 (C) on agent readiness against Twenty API + MCP's 56.3 (C), and leads in 1 of 7 scored categories. Twenty API + MCP leads on reliability, agent ergonomics, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.\n\n### Do Breakcold and Twenty API + MCP need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Breakcold and Twenty API + MCP without installing anything?\n\nYes. Breakcold has a hosted endpoint at https://mcp.breakcold.com/mcp/v1 and Twenty API + MCP at https://api.twenty.com/rest.\n\n### Are Breakcold and Twenty API + MCP open source?\n\nNo open-source release is listed for Breakcold. Twenty API + MCP is open source (AGPL-3.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/breakcold-vs-twenty.json, and with the fewest tokens: https://www.anchorterminal.com/compare/breakcold-vs-twenty.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"breakcold\", \"b\": \"twenty\"}`. From a terminal: `anchor compare breakcold twenty`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/breakcold.json and https://www.anchorterminal.com/api/v1/tools/twenty.json\n\n## Other comparisons with Breakcold or Twenty API + MCP\n\n- [Affinity vs Breakcold](https://www.anchorterminal.com/compare/affinity-vs-breakcold.md)\n- [Affinity vs Twenty API + MCP](https://www.anchorterminal.com/compare/affinity-vs-twenty.md)\n- [Attio API + MCP vs Breakcold](https://www.anchorterminal.com/compare/attio-vs-breakcold.md)\n- [Attio API + MCP vs Twenty API + MCP](https://www.anchorterminal.com/compare/attio-vs-twenty.md)\n- [Breakcold vs Capsule CRM](https://www.anchorterminal.com/compare/breakcold-vs-capsule-crm.md)\n- [Breakcold vs Close API + MCP](https://www.anchorterminal.com/compare/breakcold-vs-close.md)\n- [Breakcold vs Copper API](https://www.anchorterminal.com/compare/breakcold-vs-copper.md)\n- [Breakcold vs Microsoft Dynamics 365 Sales](https://www.anchorterminal.com/compare/breakcold-vs-dynamics-365-sales.md)\n- [Breakcold vs folk API + MCP](https://www.anchorterminal.com/compare/breakcold-vs-folk.md)\n- [Breakcold vs Freshsales API](https://www.anchorterminal.com/compare/breakcold-vs-freshsales.md)\n- [Breakcold vs HubSpot API + MCP](https://www.anchorterminal.com/compare/breakcold-vs-hubspot-mcp.md)\n- [Breakcold vs Nutshell](https://www.anchorterminal.com/compare/breakcold-vs-nutshell.md)\n- [Breakcold vs Payani AI](https://www.anchorterminal.com/compare/breakcold-vs-payani-ai.md)\n- [Breakcold vs Pipedrive API + MCP](https://www.anchorterminal.com/compare/breakcold-vs-pipedrive.md)\n- [Breakcold vs Relaticle](https://www.anchorterminal.com/compare/breakcold-vs-relaticle.md)\n- [Breakcold vs Salesflare](https://www.anchorterminal.com/compare/breakcold-vs-salesflare.md)\n- [Breakcold vs Salesforce API + MCP](https://www.anchorterminal.com/compare/breakcold-vs-salesforce.md)\n- [Breakcold vs Streak API + MCP](https://www.anchorterminal.com/compare/breakcold-vs-streak.md)\n- [Breakcold vs SugarAI (SugarCRM)](https://www.anchorterminal.com/compare/breakcold-vs-sugarcrm.md)\n- [Breakcold vs Zoho CRM](https://www.anchorterminal.com/compare/breakcold-vs-zoho-crm.md)\n- [Capsule CRM vs Twenty API + MCP](https://www.anchorterminal.com/compare/capsule-crm-vs-twenty.md)\n- [Close API + MCP vs Twenty API + MCP](https://www.anchorterminal.com/compare/close-vs-twenty.md)\n- [Copper API vs Twenty API + MCP](https://www.anchorterminal.com/compare/copper-vs-twenty.md)\n- [Microsoft Dynamics 365 Sales vs Twenty API + MCP](https://www.anchorterminal.com/compare/dynamics-365-sales-vs-twenty.md)\n- [folk API + MCP vs Twenty API + MCP](https://www.anchorterminal.com/compare/folk-vs-twenty.md)\n- [Freshsales API vs Twenty API + MCP](https://www.anchorterminal.com/compare/freshsales-vs-twenty.md)\n- [HubSpot API + MCP vs Twenty API + MCP](https://www.anchorterminal.com/compare/hubspot-mcp-vs-twenty.md)\n- [Nutshell vs Twenty API + MCP](https://www.anchorterminal.com/compare/nutshell-vs-twenty.md)\n- [Payani AI vs Twenty API + MCP](https://www.anchorterminal.com/compare/payani-ai-vs-twenty.md)\n- [Pipedrive API + MCP vs Twenty API + MCP](https://www.anchorterminal.com/compare/pipedrive-vs-twenty.md)\n- [Relaticle vs Twenty API + MCP](https://www.anchorterminal.com/compare/relaticle-vs-twenty.md)\n- [Salesflare vs Twenty API + MCP](https://www.anchorterminal.com/compare/salesflare-vs-twenty.md)\n- [Salesforce API + MCP vs Twenty API + MCP](https://www.anchorterminal.com/compare/salesforce-vs-twenty.md)\n- [Streak API + MCP vs Twenty API + MCP](https://www.anchorterminal.com/compare/streak-vs-twenty.md)\n- [SugarAI (SugarCRM) vs Twenty API + MCP](https://www.anchorterminal.com/compare/sugarcrm-vs-twenty.md)\n- [Twenty API + MCP vs Zoho CRM](https://www.anchorterminal.com/compare/twenty-vs-zoho-crm.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Breakcold vs Twenty API + MCP", "url": "" } ], "description": "Breakcold scores 58 (C) to Twenty's 56.3 (C) for crm records. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Breakcold C 58", "Twenty API + MCP C 56.3", "scores" ], "h1": "Breakcold vs Twenty API + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/breakcold-vs-twenty", "published": "2026-10-01", "section": "tools", "title": "Breakcold vs Twenty for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/breakcold-vs-twenty" }, "tokens": { "markdown": 5000, "slim": 2930 }, "version": 1 }