Buffer API + MCP vs Xpoz MCP

Buffer API + MCP 75

Status page at status.buffer.com, now on incident.io, with Buffer API and Buffer MCP components (20). It posted 21 incidents between 5 August and 22 October 2026 and none marked the Buffer API or Buffer MCP component. Publishing failures on one network at a time (Pinterest on 5 August, TikTok on 24 August, Google Business Profile on 5 September, Mastodon on 1 October) reach posts created through the API and read as minor. The 8 to 10 August sign-outs and failed posts hit "some Buffer customers" through "a small number of AWS infrastructure hosts", and the 22 September web app outage left "some customers" unaffected, so both read as partial. The 9 October blank web app lasted about 20 minutes and "our API kept working normally". Minor incidents only (20). Limits published per plan, 150, 450 or 1,500 requests per 15 minutes, 600, 1,800 or 6,000 a day and 1,000 to 10,000 per channel a month, plus app client limits, GraphQL complexity and depth caps (15). 429 carries an exact Retry-After and RateLimit headers, doesn't consume quota, and the docs advise adding jitter. No idempotency key for creating posts (10). No SLA found (0). The API and MCP aren't labelled beta (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.

Xpoz MCP 20

No status page found (0). No history (5). Credit allowances, no rate limits found (5 of 15). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 0 + 0 + 10 = 20.

Buffer API + MCP 73

Last schema change on 22 October 2026 (30). 31 dated changelog days between 4 August and 22 October (20). Public changelog and email support (12). No official SDKs, only @bufferapp/cli 1.2.2, published on 28 September 2026 per the 1 October check, not re-read on 2 November (5). The CLI ships from GitHub Actions with npm trusted publishing (6).

Xpoz MCP 25

Registry entry last updated 14 July 2026 and repository commit on 9 September; the live server reports 3.0.0 (10). No dated releases in 90 days (0). Issues not read (0). Official registry entry ai.xpoz/social-insights (15). Docker packaging only (0). 10 + 0 + 0 + 15 + 0 = 25. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Buffer API + MCP 75

Closed service with published terms (15). Buffer, Inc. of San Francisco. Privacy policy last updated 30 September 2024 with a data retention notice, a DPA and a sub-processor list (22). @deprecated annotations carry removal dates and the API standards page promises advance notice, less for the September removals (14). Sub-processors listed in the GDPR section (15).

Xpoz MCP 29

Closed service; terms of use read without a legal entity (10 of 30). Data handling not read (5 of 30). No deprecation policy (0). Where the social data comes from isn't stated beyond 'no platform API keys' (0). 10 + 5 + 0 + 0 = 15.

Buffer API + MCP 86

Typed GraphQL schema open to introspection, and the MCP has an introspect_schema tool (25). llms.txt and Markdown versions of every guide (10). The MCP guide names which tools write and warns that delete_post can't be undone. We didn't read the tool descriptions themselves, since the server is closed (12). Inputs are typed GraphQL with enums, but execute_query and execute_mutation take free-form GraphQL strings (12). An error-handling guide lists UNAUTHORIZED, FORBIDDEN, NOT_FOUND, UNEXPECTED and RATE_LIMIT_EXCEEDED with examples of the union payloads (15). Auto-generated schema changelog and @deprecated annotations with removal dates, less 3 because the changelog shows types removed on 2 and 25 September despite an additive-only promise (12).

Xpoz MCP 64

52 tools read from tools/list with JSON Schema inputs and 42 enums (25). No llms.txt read (0). Server instructions explain paging and field selection (16 of 20). Typed inputs with enums (15). Examples on the home page (5 of 15). Registry 1.4.1 from July, server 3.0.0; no changelog (3 of 15). 25 + 0 + 16 + 15 + 5 + 3 = 64.

Buffer API + MCP 56

Hosted MCP and App Clients use OAuth 2.0 with PKCE and 11 scopes, among them posts:read and insights:read. Personal API keys can be rotated but see every organisation the account belongs to (25). Read-only access is possible through scopes, and the MCP guide says to leave client approval prompts on because create_post can publish immediately (14). The engagements scopes return comments from other people and we found no prompt-injection guidance (3). No audit log or key usage view found (0). buffer.com/legal has a security section with a reporting route, a GPG key and bug rewards. No security.txt per the 30 September check (14).

Xpoz MCP 37

One API key (20 of 30). 49 of 52 tools read-only (15 of 20). Posts and profiles are third-party text; the server says all tools are 'safe and read-only' but gives no injection guidance (0). No audit log (0). No security programme found (2 of 20). 20 + 15 + 0 + 0 + 2 = 37.