Capsule CRM vs Relaticle

Capsule CRM 28

Last change on 25 September 2026, the hosted MCP server, 40 days before 4 November, and the changelog has no later entry (20, was 30, cause time). Two dated entries in the 90 days from 6 August, 19 August and 25 September 2026, which is short of three (0). A public changelog, a support address and a Google group for API questions. We did not test support (8 of 15). No official SDK, and the MCP server is not in the official MCP registry per the 8 October check (0). No packages to judge (0). 20+0+8+0+0 = 28.

Relaticle 90

v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.

Capsule CRM 83

Graded on REST API v2, with the hosted lines. Status page at status.capsulecrm.com on Statuspage with Capsule and Drop Box components on its page and history back to 2023 in its feed (20). history.atom, read on 4 November, has no incident after 8 July 2026. The last, a minor delay to reports and dashboards, ran from 6 to 8 July 2026, a scheduled maintenance window was announced for 4 July, and a major outage of about 15 hours fell on 27 March 2026, all outside the 90 days from 6 August, and the page shows "No incidents reported" for each day to 4 November (30). The 8 October incident reading came from the page's /api/v2/incidents.json, which its robots.txt disallows, so it is struck and replaced by the feed. Limit published, 4,000 requests an hour per user (15). A 429 carries X-RateLimit-Reset and the docs say to wait until that time and suggest one second between calls, but there is no Retry-After header, no idempotency key and no safe-retry advice for writes (10 of 15). No SLA found, and the Customer Terms disclaim liability for unavailability (0). The REST API is generally available. The MCP server was announced on 25 September 2026 and the Claude connector is labelled beta on one support page (8 of 10). 20+30+15+10+0+8 = 83.

Relaticle 40

Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Capsule CRM 48

No OpenAPI or other machine-readable contract was found. Four likely paths on developer.capsulecrm.com returned 404 and the docs link none. The MCP server's tool schemas sit behind OAuth and were not read (0 of 25). No llms.txt on either domain (0). Each of the 132 operations has a short description, and some say when to prefer another endpoint, such as filters over search (12 of 20). Parameter tables give types, ranges and defaults, and each resource has a model page, with filter conditions as JSON bodies (10 of 15). Request and response examples on every operation, and an errors page with bodies for 400, 401, 403, 422 and 429 (13 of 15). A /api/v2 path and a dated changelog with five entries in the last 12 months (13 of 15).

Relaticle 86

OpenAPI 3.1 at /openapi.json and /openapi.yaml with 34 operations (25). llms.txt with a when-to-use and when-not section, and developer pages (10). The llms.txt and MCP docs say what the API is for and what it doesn't do (no email over REST, no meetings), while only 5 of 34 operations carry a description (14 of 20). 114 required lists and typed MCP inputs, but few enums (11 of 15). 661 examples and responses for 401, 402, 403, 404, 409, 422 and 429 (14 of 15). /v1 and frequent tagged releases, with no changelog page (relaticle.com/changelog is 404) (12 of 15). 25 + 10 + 14 + 11 + 14 + 12 = 86.

Capsule CRM 46

OAuth 2 authorisation code grant with scopes read, write and user_preference, access tokens of about seven days, refresh tokens and a revocation endpoint, per the authentication docs. The 8 October reading of the OAuth server metadata on api.capsulecrm.com came from the product's own endpoint and is struck. Personal tokens are also accepted on the REST API, and their scope is not documented. Tokens travel only in the header (24 of 30, partly met, kept). A read scope exists, and the MCP server acts with the connecting user's access controls. No server-side confirmation for writes was found, and the AI Terms put review of each tool call on the customer (12 of 20). Notes and stored emails reach the model, and no injection guidance was found (2 of 15). No API audit log was found, and the support page says MCP update tools keep no change history of their own (2 of 15). A reporting address (support+sensitive@capsulecrm.com), regular penetration tests by outside specialists per the security page and PCI-DSS for card collection. No security.txt, no bug bounty and no certification named on the pages read. The security page, re-read on 4 November, is unchanged, and security.txt still answers 404. The trust centre at trust.zestia.com is drawn by script and was not read (6 of 20).

Relaticle 57

Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single mcp:use scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.