# Buffer API + MCP vs Xpoz MCP (slim)

> Buffer scores 66 (B) to Xpoz MCP's 39.6 (E) for social analytics. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/buffer-vs-xpoz-mcp.md (~3,800 tokens) · this version ~1,930 tokens · JSON https://www.anchorterminal.com/compare/buffer-vs-xpoz-mcp.json · canonical https://www.anchorterminal.com/compare/buffer-vs-xpoz-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Buffer API + MCP scores 66 (B) on agent readiness against Xpoz MCP's 39.6 (E), and leads in 6 of 7 scored categories. Both do social analytics.

- Buffer API + MCP: B 66, rank #390 of 1510 · https://www.anchorterminal.com/tools/buffer.min.md
- Xpoz MCP: E 39.6, rank #1339 of 1510 · https://www.anchorterminal.com/tools/xpoz-mcp.min.md
- Buffer API + MCP, good for Personal and small-team posting where the free plan and OAuth MCP are enough. Ahead on Reliability, 75 against 20; Schema & documentation, 86 against 64; Security & auth, 56 against 37; Maintenance & community, 73 against 25; Transparency & trust, 75 against 29. Also Free to start without a card.
- Xpoz MCP, good for Agents doing social listening and brand monitoring across several networks, where a third-party source is acceptable.

| Category | Buffer API + MCP | Xpoz MCP |
| --- | --- | --- |
| Reliability (16%) | 75 | 20 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 86 | 64 |
| Agent ergonomics (13%) | 65 | 63 |
| Security & auth (14%) | 56 | 37 |
| Payments & pricing (10%) | 30 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 73 | 25 |
| Transparency & trust (7%) | 75 | 29 |

| Fact (where they differ) | Buffer API + MCP | Xpoz MCP |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Buffer | XPOZ |
| Hosted endpoint | `https://api.buffer.com` | `https://mcp.xpoz.ai/mcp` |
| Transports | HTTP, Streamable HTTP | Streamable HTTP |
| Auth | OAuth or key | API key |
| Tools exposed | 19 | 52 |
| llms.txt | yes | no |
| MCP registry | not listed | `ai.xpoz/social-insights` |
| Last release | 2026-10-22 | none |
| Terms last updated | 2024-09-30 | not read yet |
| Privacy policy last updated | 2024-09-30 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | yes | not read yet |
| Terms or service can change without notice | yes | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | 687 npm/wk | none |
| Agent reviews | 3/5 (2) | none |

Why the edge:
- Reliability, Buffer API + MCP +55: Buffer API + MCP 75 (Status page at status.buffer.com, now on incident.io, with Buffer API and Buffer MCP components (20). It posted 21 incidents between 5 August and 22 October 2026 and none marked the Buffer API or Buffer MCP component. Publishing failures on one network at a time (Pinterest on 5 August, TikTok on 24 August, Google Business Profile on 5 September, Mastodon on 1 October) reach posts created through the API and read as minor. The 8 to 10 August sign-outs and failed posts hit "some Buffer customers" through "a small number of AWS infrastructure hosts", and the 22 September web app outage left "some customers" unaffected, so both read as partial. The 9 October blank web app lasted about 20 minutes and "our API kept working normally". Minor incidents only (20). Limits published per plan, 150, 450 or 1,500 requests per 15 minutes, 600, 1,800 or 6,000 a day and 1,000 to 10,000 per channel a month, plus app client limits, GraphQL complexity and depth caps (15). 429 carries an exact Retry-After and RateLimit headers, doesn't consume quota, and the docs advise adding jitter. No idempotency key for creating posts (10). No SLA found (0). The API and MCP aren't labelled beta (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.); Xpoz MCP 20 (No status page found (0). No history (5). Credit allowances, no rate limits found (5 of 15). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 0 + 0 + 10 = 20.)
- Maintenance & community, Buffer API + MCP +48: Buffer API + MCP 73 (Last schema change on 22 October 2026 (30). 31 dated changelog days between 4 August and 22 October (20). Public changelog and email support (12). No official SDKs, only @bufferapp/cli 1.2.2, published on 28 September 2026 per the 1 October check, not re-read on 2 November (5). The CLI ships from GitHub Actions with npm trusted publishing (6).); Xpoz MCP 25 (Registry entry last updated 14 July 2026 and repository commit on 9 September; the live server reports 3.0.0 (10). No dated releases in 90 days (0). Issues not read (0). Official registry entry ai.xpoz/social-insights (15). Docker packaging only (0). 10 + 0 + 0 + 15 + 0 = 25. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.)
- Transparency & trust, Buffer API + MCP +46: Buffer API + MCP 75 (Closed service with published terms (15). Buffer, Inc. of San Francisco. Privacy policy last updated 30 September 2024 with a data retention notice, a DPA and a sub-processor list (22). @deprecated annotations carry removal dates and the API standards page promises advance notice, less for the September removals (14). Sub-processors listed in the GDPR section (15).); Xpoz MCP 29 (Closed service; terms of use read without a legal entity (10 of 30). Data handling not read (5 of 30). No deprecation policy (0). Where the social data comes from isn't stated beyond 'no platform API keys' (0). 10 + 5 + 0 + 0 = 15.)
- Schema & documentation, Buffer API + MCP +22: Buffer API + MCP 86 (Typed GraphQL schema open to introspection, and the MCP has an introspect_schema tool (25). llms.txt and Markdown versions of every guide (10). The MCP guide names which tools write and warns that delete_post can't be undone. We didn't read the tool descriptions themselves, since the server is closed (12). Inputs are typed GraphQL with enums, but execute_query and execute_mutation take free-form GraphQL strings (12). An error-handling guide lists UNAUTHORIZED, FORBIDDEN, NOT_FOUND, UNEXPECTED and RATE_LIMIT_EXCEEDED with examples of the union payloads (15). Auto-generated schema changelog and @deprecated annotations with removal dates, less 3 because the changelog shows types removed on 2 and 25 September despite an additive-only promise (12).); Xpoz MCP 64 (52 tools read from tools/list with JSON Schema inputs and 42 enums (25). No llms.txt read (0). Server instructions explain paging and field selection (16 of 20). Typed inputs with enums (15). Examples on the home page (5 of 15). Registry 1.4.1 from July, server 3.0.0; no changelog (3 of 15). 25 + 0 + 16 + 15 + 5 + 3 = 64.)
- Security & auth, Buffer API + MCP +19: Buffer API + MCP 56 (Hosted MCP and App Clients use OAuth 2.0 with PKCE and 11 scopes, among them posts:read and insights:read. Personal API keys can be rotated but see every organisation the account belongs to (25). Read-only access is possible through scopes, and the MCP guide says to leave client approval prompts on because create_post can publish immediately (14). The engagements scopes return comments from other people and we found no prompt-injection guidance (3). No audit log or key usage view found (0). buffer.com/legal has a security section with a reporting route, a GPG key and bug rewards. No security.txt per the 30 September check (14).); Xpoz MCP 37 (One API key (20 of 30). 49 of 52 tools read-only (15 of 20). Posts and profiles are third-party text; the server says all tools are 'safe and read-only' but gives no injection guidance (0). No audit log (0). No security programme found (2 of 20). 20 + 15 + 0 + 0 + 2 = 37.)