Buffer API + MCP vs TwitterAPI.io MCP

Buffer API + MCP 75

Status page at status.buffer.com, now on incident.io, with Buffer API and Buffer MCP components (20). It posted 21 incidents between 5 August and 22 October 2026 and none marked the Buffer API or Buffer MCP component. Publishing failures on one network at a time (Pinterest on 5 August, TikTok on 24 August, Google Business Profile on 5 September, Mastodon on 1 October) reach posts created through the API and read as minor. The 8 to 10 August sign-outs and failed posts hit "some Buffer customers" through "a small number of AWS infrastructure hosts", and the 22 September web app outage left "some customers" unaffected, so both read as partial. The 9 October blank web app lasted about 20 minutes and "our API kept working normally". Minor incidents only (20). Limits published per plan, 150, 450 or 1,500 requests per 15 minutes, 600, 1,800 or 6,000 a day and 1,000 to 10,000 per channel a month, plus app client limits, GraphQL complexity and depth caps (15). 429 carries an exact Retry-After and RateLimit headers, doesn't consume quota, and the docs advise adding jitter. No idempotency key for creating posts (10). No SLA found (0). The API and MCP aren't labelled beta (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.

TwitterAPI.io MCP 40

No status page found (0). No incident history (5). Per-account QPS limits documented by tier (15). 'Hitting the ceiling returns an HTTP 429 (no Retry-After header is sent). Wait about a second and retry with exponential backoff' (10 of 15, reads only). No SLA; the terms disclaim uninterrupted service (0). Not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Buffer API + MCP 75

Closed service with published terms (15). Buffer, Inc. of San Francisco. Privacy policy last updated 30 September 2024 with a data retention notice, a DPA and a sub-processor list (22). @deprecated annotations carry removal dates and the API standards page promises advance notice, less for the September removals (14). Sub-processors listed in the GDPR section (15).

TwitterAPI.io MCP 41

The MCP package is MIT on npm; the service is closed under terms from September 2025 that don't name the company, which appears in the footer as Prism Digital, LLC of Newark, Delaware (15). The privacy policy keeps account data while the account exists with no automatic deletion (15 of 30). No deprecation policy (0). Subprocessors not listed in the pages read (5 of 20). 15 + 15 + 0 + 5 = 35.

Buffer API + MCP 73

Last schema change on 22 October 2026 (30). 31 dated changelog days between 4 August and 22 October (20). Public changelog and email support (12). No official SDKs, only @bufferapp/cli 1.2.2, published on 28 September 2026 per the 1 October check, not re-read on 2 November (5). The CLI ships from GitHub Actions with npm trusted publishing (6).

TwitterAPI.io MCP 40

Registry entry io.twitterapi/mcp-server updated 6 November 2026 (30). No dated changelog (0). Support channel not checked (0 of 15). Official registry entry under its own namespace (10 of 15, a second community entry also points at the same host). No package health read (0). 30 + 0 + 0 + 10 + 0 = 40. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Buffer API + MCP 86

Typed GraphQL schema open to introspection, and the MCP has an introspect_schema tool (25). llms.txt and Markdown versions of every guide (10). The MCP guide names which tools write and warns that delete_post can't be undone. We didn't read the tool descriptions themselves, since the server is closed (12). Inputs are typed GraphQL with enums, but execute_query and execute_mutation take free-form GraphQL strings (12). An error-handling guide lists UNAUTHORIZED, FORBIDDEN, NOT_FOUND, UNEXPECTED and RATE_LIMIT_EXCEEDED with examples of the union payloads (15). Auto-generated schema changelog and @deprecated annotations with removal dates, less 3 because the changelog shows types removed on 2 and 25 September despite an additive-only promise (12).

TwitterAPI.io MCP 62

12 tools read from tools/list with JSON Schema inputs (25). llms.txt (10). Short descriptions of what each returns (10 of 20). Typed inputs with two enums (10 of 15). Examples on the docs page, errors described only as 429 (7 of 15). No changelog found (404); registry version 1.0.1 (0). 25 + 10 + 10 + 10 + 7 + 0 = 62.

Buffer API + MCP 56

Hosted MCP and App Clients use OAuth 2.0 with PKCE and 11 scopes, among them posts:read and insights:read. Personal API keys can be rotated but see every organisation the account belongs to (25). Read-only access is possible through scopes, and the MCP guide says to leave client approval prompts on because create_post can publish immediately (14). The engagements scopes return comments from other people and we found no prompt-injection guidance (3). No audit log or key usage view found (0). buffer.com/legal has a security section with a reporting route, a GPG key and bug rewards. No security.txt per the 30 September check (14).

TwitterAPI.io MCP 37

OAuth or a single API key per account (20 of 30). All tools are reads (12 of 20). Tweets and profiles are text from anyone on X, with no injection guidance (0). No audit log (0). No security.txt or programme found (5 of 20). 20 + 12 + 0 + 0 + 5 = 37.

Buffer API + MCP 65

19 MCP tools (17 named in the MCP guide, which says two generic tools reach the rest of the GraphQL API) with no toolsets (15), and GraphQL field selection lets an agent size each response (3). List tools page with first and after (20 by default, 100 at most), tag queries are filterable and posts can be listed by channel (16). Typed union errors such as InvalidInputError and LimitReachedError say what to fix, and every MCP response carries the remaining quota (18). No idempotency key and, per the docs, no readOnly or destructive annotations. saveToDraft and addToQueue modes keep posts from going out by accident (6). No official SDK in two languages, only the npm CLI (7).

TwitterAPI.io MCP 78

12 compact tools, about 12 KB (15). Cursor-based paging on followers and search (18 of 20). 429 handling documented (10 of 20). All 12 annotated read-only (20). Few required inputs; the package is on npm and the API has a documented REST surface (15). 15 + 18 + 10 + 20 + 15 = 78.