Buffer API + MCP vs Pamba

Buffer API + MCP 75

Closed service with published terms (15). Buffer, Inc. of San Francisco. Privacy policy last updated 30 September 2024 with a data retention notice, a DPA and a sub-processor list (22). @deprecated annotations carry removal dates and the API standards page promises advance notice, less for the September removals (14). Sub-processors listed in the GDPR section (15).

Pamba 28

Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.

Buffer API + MCP 75

Status page at status.buffer.com, now on incident.io, with Buffer API and Buffer MCP components (20). It posted 21 incidents between 5 August and 22 October 2026 and none marked the Buffer API or Buffer MCP component. Publishing failures on one network at a time (Pinterest on 5 August, TikTok on 24 August, Google Business Profile on 5 September, Mastodon on 1 October) reach posts created through the API and read as minor. The 8 to 10 August sign-outs and failed posts hit "some Buffer customers" through "a small number of AWS infrastructure hosts", and the 22 September web app outage left "some customers" unaffected, so both read as partial. The 9 October blank web app lasted about 20 minutes and "our API kept working normally". Minor incidents only (20). Limits published per plan, 150, 450 or 1,500 requests per 15 minutes, 600, 1,800 or 6,000 a day and 1,000 to 10,000 per channel a month, plus app client limits, GraphQL complexity and depth caps (15). 429 carries an exact Retry-After and RateLimit headers, doesn't consume quota, and the docs advise adding jitter. No idempotency key for creating posts (10). No SLA found (0). The API and MCP aren't labelled beta (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.

Pamba 45

Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists "SLA guarantees" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Buffer API + MCP 56

Hosted MCP and App Clients use OAuth 2.0 with PKCE and 11 scopes, among them posts:read and insights:read. Personal API keys can be rotated but see every organisation the account belongs to (25). Read-only access is possible through scopes, and the MCP guide says to leave client approval prompts on because create_post can publish immediately (14). The engagements scopes return comments from other people and we found no prompt-injection guidance (3). No audit log or key usage view found (0). buffer.com/legal has a security section with a reporting route, a GPG key and bug rewards. No security.txt per the 30 September check (14).

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.

Buffer API + MCP 65

19 MCP tools (17 named in the MCP guide, which says two generic tools reach the rest of the GraphQL API) with no toolsets (15), and GraphQL field selection lets an agent size each response (3). List tools page with first and after (20 by default, 100 at most), tag queries are filterable and posts can be listed by channel (16). Typed union errors such as InvalidInputError and LimitReachedError say what to fix, and every MCP response carries the remaining quota (18). No idempotency key and, per the docs, no readOnly or destructive annotations. saveToDraft and addToQueue modes keep posts from going out by accident (6). No official SDK in two languages, only the npm CLI (7).

Pamba 75

Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.

Buffer API + MCP 45

No x402 or other machine payment (0). Per-channel plan prices are public, with request quotas per plan rather than per-call prices (10). The free plan includes the API, 1 key and 3,000 requests a month with no card (20). A person has to sign up in a browser to get a key (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 30 is 45.

Pamba 53

No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.