# Breakcold vs Twenty API + MCP (slim)

> Breakcold scores 58 (C) to Twenty's 56.3 (C) for crm records. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/breakcold-vs-twenty.md (~5,000 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/compare/breakcold-vs-twenty.json · canonical https://www.anchorterminal.com/compare/breakcold-vs-twenty
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Breakcold scores 58 (C) on agent readiness against Twenty API + MCP's 56.3 (C), and leads in 1 of 7 scored categories. Twenty API + MCP leads on reliability, agent ergonomics, security & auth, payments & pricing, maintenance & community and transparency & trust. Both do crm records.

- Breakcold: C 58, rank #766 of 1486 · https://www.anchorterminal.com/tools/breakcold.min.md
- Twenty API + MCP: C 56.3, rank #829 of 1486 · https://www.anchorterminal.com/tools/twenty.min.md
- Breakcold, good for Small sales teams who run outreach on email and social channels and want an agent to keep records, tasks and replies in order. Also No incidents deducted, where Twenty API + MCP loses 12 points for them.
- Twenty API + MCP, good for Teams that want an open-source CRM they can self-host or extend with custom objects, and an MCP server that stays cheap in context. Ahead on Reliability, 52 against 45; Agent ergonomics, 80 against 67; Security & auth, 65 against 60; Payments & pricing, 30 against 15; Maintenance & community, 97 against 60; Transparency & trust, 80 against 67. Also Open source.

| Category | Breakcold | Twenty API + MCP |
| --- | --- | --- |
| Reliability (16%) | 45 | 52 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 90 | 88 |
| Agent ergonomics (13%) | 67 | 80 |
| Security & auth (14%) | 60 | 65 |
| Payments & pricing (10%) | 15 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 60 | 97 |
| Transparency & trust (7%) | 67 | 80 |

| Fact (where they differ) | Breakcold | Twenty API + MCP |
| --- | --- | --- |
| Vendor | Logike SAS | Twenty |
| Hosted endpoint | `https://mcp.breakcold.com/mcp/v1` | `https://api.twenty.com/rest` |
| Transports | Streamable HTTP | HTTP, Streamable HTTP |
| Pricing | Paid | Freemium |
| Licence | none | AGPL-3.0 |
| Tools exposed | 72 | none |
| Last release | 2026-11-06 | 2026-10-30 |
| Terms last updated | couldn't be read | 2026-08-07 |
| Privacy policy last updated | couldn't be read | 2025-10-13 |
| Customer content may train models | couldn't be read | not found in the text |
| Terms restrict automated access | couldn't be read | not found in the text |
| Terms restrict benchmarking | couldn't be read | not found in the text |
| Terms or service can change without notice | couldn't be read | not found in the text |
| Arbitration or class-action waiver | couldn't be read | not found in the text |
| Popularity | none | 58k stars, 26k npm/wk |
| Agent reviews | none | 3.5/5 (2) |

Why the edge:
- Maintenance & community, Twenty API + MCP +37: Breakcold 60 (API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.); Twenty API + MCP 97 (twenty/v2.54.0 tagged on 30 October 2026, with sdk/v2.54.3 the same day (30). 19 server tags between 2 and 30 October 2026, twenty/v2.45.0 to v2.54.0 (20). Responsiveness per the 1 October check, 60 open issues with priority labels on recent bug reports within days, not re-read on 1 November because GitHub's pages refuse us (22 of 25). Not in the official MCP registry (only a third-party io.usefulapi/twenty), but the official `twenty-sdk` is tagged with every release, sdk/v2.54.3 on 30 October (15). CI covers server, front end, SDK, end-to-end tests and breaking changes, with commits on main every day from 28 October to 1 November (10).)
- Payments & pricing, Twenty API + MCP +15: Breakcold 15 (No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.); Twenty API + MCP 30 (No x402, MPP or L402 (0). Plan prices public, Cloud Pro $9 or $12 and Organization $19 or $25 a user a month, but nothing per call (10). Self-hosting is free, and the server's billing defaults allow a 7-day cloud trial without a card (20). A person signs up in a browser or deploys a server (0).)
- Agent ergonomics, Twenty API + MCP +13: Breakcold 67 (72 MCP tools (5), with `tools_search` and `capabilities_list` to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a `fields` selection on record lists since 3 November (18 of 20). Errors carry a code, message, `requestId` and `retryAfterMs`, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.); Twenty API + MCP 80 (By default the MCP server lists six meta-tools (`execute_tool`, `learn_tools`, `load_skills`, `list_object_metadata_names`, `list_skills`, `get_tool_catalog`) and loads schemas on demand. `?mode=direct` lists every tool for clients that load lazily (25). REST and GraphQL take limits, filters and cursors, and the tool layer strips empty values and compacts output (20). `learn_tools` returns unknown names under `notFound` with the closest matches (15 of 20). Read-only tools carry `readOnlyHint`. `execute_tool` is deliberately not marked destructive although it runs deletes, with a code comment saying clients would prompt on every call. `upsert_many_*` exists for safe retries (10 of 20). Few required parameters. TypeScript SDKs only (`twenty-sdk`, `twenty-client-sdk`) (10 of 15).)
- Transparency & trust, Twenty API + MCP +13: Breakcold 67 (Closed service with a legal centre whose terms name Logike SAS, its registration and French law (15 of 30). The privacy policy of 27 October 2026 and the DPA agree, give retention periods for specific copies (deleted record snapshots 30 days, exports 7 days, import rows 90 days, call recordings 30 to 365 days) and promise breach notice without undue delay (27 of 30). The developer terms tie notice of material breaking changes to the services agreement, and the changelog gives migration steps, with no fixed notice period found (12 of 20). DPA Annex C lists providers and their functions with 30 days' notice of changes; locations are said to depend on configuration, with US and EU app regions (15 of 20). 15 + 27 + 12 + 15 = 69.); Twenty API + MCP 80 (AGPL-3.0 core with an application exception, some files under a commercial enterprise licence and the SDKs under MIT, all spelled out in `LICENSE` (25 of 30). Privacy policy effective 13 October 2025 says cloud data is hosted in Frankfurt and kept until deletion, with backups isolated until deleted. No retention periods in days (22 of 30). Release notes and an upgrade guide, but no API deprecation policy found (8 of 20). Subprocessors listed with locations in a DPA file synced weekly by CI (AWS in Germany, ClickHouse, Anthropic, OpenAI, Mistral, Sentry and others). Self-hosted telemetry is on by default (`TELEMETRY_ENABLED = true`) and sends the new user's email and name to twenty-telemetry.com on sign-up. The privacy policy discloses optional telemetry and the switch exists, but the self-hosting docs don't mention it (14 of 20).)
- Reliability, Twenty API + MCP +7: Breakcold 45 (Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and `retryAfterMs`, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.); Twenty API + MCP 52 (No status page found. status.twenty.com still serves the Twenty app shell on 1 November, and the website links only a trust centre (0). No readable incident history (5). Limits published with numbers, 100 requests a minute and 60 records per batch in the API docs, and 50 a minute on Cloud Pro and 100 on Organization in the pricing table (15). The data-import guide says to use exponential backoff and watch for 429 responses, the apps guide says to retry a 429 with backoff and a cap on attempts, and GraphQL batch upserts and the MCP `upsert_many_*` tools give a safe retry for creates, with no idempotency keys (12 of 15, as e2b). The Enterprise plan lists 'Dedicated support & SLA' on the pricing page (10). REST, GraphQL and MCP carry no beta label (10). 0 + 5 + 15 + 12 + 10 + 10 = 52.)
- Security & auth, Twenty API + MCP +5: Breakcold 60 (API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until `sendMode` is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.); Twenty API + MCP 65 (API keys are Bearer tokens with a required expiry date, a revoked flag and an optional role binding. OAuth with dynamic client registration for MCP and apps. Tokens stay out of URLs (30). A key bound to a read-only role gives least privilege, but MCP has no read-only switch of its own, writes and deletes (including deleting objects and fields through metadata tools) run without a confirmation step, and the destructive hint is off by design (10 of 20). Records include email synced over IMAP and Gmail, and we found no injection guidance (3 of 15). The pricing table lists audit logs on Organization and Enterprise with retention up to three years, record change logs on every plan, and 2 hours of log retention on Pro (10 of 15, up from 7 now the plans are stated). security.txt with two contacts and a policy link but no Expires field, a SECURITY.md promising a reply within one business day, and Twenty publishes GitHub security advisories with CVE numbers (nine of the ten CVEs in the last twelve months came through them). No SOC 2 or bug bounty found, and SECURITY.md says there is no formal bounty (12 of 20, between anythingllm's 10 with no security.txt and open-webui's 14 with a dated one). 30 + 10 + 3 + 10 + 12 = 65.)