Chatway MCP vs FreeScout

Chatway MCP 70

OAuth 2.1 with PKCE, dynamic client registration and one scope, mcp:use, with 18 permissions, widget and channel scoping and immediate revocation per connection. Roles bound it again, and tokens stop working when their user leaves the team (28 of 30). A connection can be read-only and members can't connect. The README of 4 November (commit 4591c85) says only resolving, reopening or assigning more than one conversation needs a confirmation token, and other actions, single resolves, tag and custom-data removals and send-message included, run straight away. On 17 October five tools needed the token (14 of 20, from 16). Tools return visitor-written text. The Gemini extension, Cursor rule and llms-install.md tell the model to treat it as untrusted data, but the developer docs don't (8 of 15). Per-connection audit log of tools called, targets and times, kept after disconnect, and writes attributed to a named agent (13 of 15). SECURITY.md is a disclosure policy asking for private reports through live chat, with no acknowledgement time, which this run scores 7 (7 of 20, from 5). No security.txt on chatway.app or mcp.chatway.app on 17 October, and no bug bounty, SOC 2 or ISO 27001 found. Total 70.

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

Chatway MCP 40

Graded with the hosted lines. No status page found, linked or at status.chatway.app, which did not resolve on 17 October (0 of 20). So there is no readable incident history (5 of 30). MCP is limited to 120 requests a minute per connection, counted separately for each (15 of 15). Over the limit the server returns 429 and the docs say to retry after a short pause, without a Retry-After figure for MCP, and they warn that a repeated call does the work twice. That is retry guidance alone, which this run scores 10 (10 of 15). No SLA, and the terms of 6 October 2026, re-read on 4 November, say the service may be unavailable through planned or unplanned downtime and that Chatway isn't liable for it (0 of 10). Live since 12 October 2026 with no beta or preview label (10 of 10). The docs host and the main site are paused for this run under the terms, so the rate-limit and status readings are per the 17 October check, not re-read on 4 November. Total 40.

FreeScout 73

Read with the local-software lines, because FreeScout runs only on the operator's server; there is no first-party hosted service. Installs from official releases with a web installer and updater, with PHP and MySQL or PostgreSQL requirements stated (20). Public CI in test.yml, test-pgsql.yml and phpcs.yml with feature tests; pass status not read (18 of 25). Open crash and regression issues were not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). Patch releases v1.8.238 to v1.8.249 with notes on GitHub, and module versions tied to a required core version (10 of 15). Past 1.0 (15). 20 + 18 + 10 + 10 + 15 = 73.

Chatway MCP 30

No x402, MPP or L402 (0 of 40). Plan prices and conversation allowances are public, with no per-call or per-conversation price for MCP use (10 of 20). The Free plan includes MCP with 50 conversations a month and no card (20 of 20), and the README of 4 November still says every plan, with tag and custom-data tools on paid plans only. A person has to sign up and an owner or admin has to approve OAuth in a browser (0 of 20). Pricing is per the 17 October check, not re-read on 4 November. Total 30.

FreeScout 0

Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.

Chatway MCP 64

The tool definitions are only served after OAuth, so the served JSON Schemas couldn't be read. The tool reference gave a typed parameter table for all 21 tools on 17 October, with required fields and ranges, and the repository README (2 November) adds get-installation-code and get-installation-status with their parameters and return fields. 15 of 25 for a documented, unverified contract. developers.chatway.app/llms.txt covered the REST API and webhooks but not MCP on 17 October. The repository's llms-install.md covers MCP setup (6 of 10). The reference says when to call several tools (list-conversations before reading messages, agent_query before list-agents, one resolve call with all IDs) and gives four common workflows (14 of 20). Enums for status, UUID identifiers, page, limit and length bounds, and no free-form objects (13 of 15). Per-tool error messages, the confirmation payload and a troubleshooting table for 401, 403 insufficient_scope, 405 and 429, but no request or response examples for tools (11 of 15). Registry versions run from 1.0.0 to 1.2.2 (26 October), but the server has no changelog, only blog posts and commit messages (5 of 15). Docs readings are per the 17 October check, not re-read on 4 November. Total 64.

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

Chatway MCP 76

23 tools (21 in the 17 October tool reference plus the two installation tools in the README of 2 November) sits in the 11 to 30 band (15). Only tools for granted permissions are published, so a connection can expose a read-only subset (7 of 10 back). Definition sizes couldn't be measured without a token. Total 22 of 25. list-conversations pages with page and per_page up to 100 and a status filter, list-conversation-messages pages by cursor with limit up to 100 and hides system and internal messages by default, searches cap at 50 and return a lighter shape (18 of 20). Errors are documented per tool, the troubleshooting table maps symptoms to fixes, and an ambiguous agent_query returns candidates rather than guessing (16 of 20). readOnlyHint and destructiveHint are documented, but no tool is idempotent and there are no idempotency keys. Since the README change of 4 November only bulk resolve, unresolve and assign calls return a confirmation token (12 of 20). Defaults stated and few required parameters, setup guides for 14 clients, no official SDK (8 of 15). Docs readings are per the 17 October check, not re-read on 4 November. Total 76.

FreeScout 50

Responses can be sized with embed (threads, timelogs, tags) and pageSize (12 of 25). Page and pageSize paging, with conversation filters by mailbox, folder, status, state, type, assignee, customer email and phone (16 of 20). Errors return a status code, an errorCode and a list of messages, with each code explained (14 of 20). The docs say a timed-out call is safe to retry; no idempotency keys for creates (3 of 20). No official SDK; few required parameters on most calls (5 of 15). 12 + 16 + 14 + 3 + 5 = 50.

Chatway MCP 57

Closed hosted service under Terms of Use of 6 October 2026 naming Poptin Ltd, with a clause on MCP connections (re-read on 4 November). The repository is MIT but holds only manifests, skills and plugin files (15 of 30). Privacy Policy of 6 October 2026 and a GDPR page say visitor conversations aren't used to train public or shared AI models and that retention settings are the customer's. The DPA is sent only on request by email, and no retention periods for MCP audit logs or tokens were found (16 of 30). No deprecation policy. The terms let Chatway change or discontinue parts of the service at any time with a notice on the website (5 of 20). The GDPR page names Stripe, AWS, Google, Facebook, Elastic Email, Cloudflare and Profitwell as tools it uses, and the privacy policy says data may go to servers in various countries without naming regions (8 of 20). Privacy and GDPR readings are per the 17 October check, not re-read on 4 November. Total 44.

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.