# Chatway MCP vs FreeScout (slim)

> Chatway MCP scores 58.6 (C) to FreeScout's 27.9 (F) for support conversations. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/chatway-mcp-vs-freescout.md (~5,350 tokens) · this version ~3,080 tokens · JSON https://www.anchorterminal.com/compare/chatway-mcp-vs-freescout.json · canonical https://www.anchorterminal.com/compare/chatway-mcp-vs-freescout
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Chatway MCP scores 58.6 (C) on agent readiness against FreeScout's 27.9 (F), and leads in 6 of 7 scored categories. FreeScout leads on reliability. Both do support conversations.

- Chatway MCP: C 58.6, rank #740 of 1510 · https://www.anchorterminal.com/tools/chatway-mcp.min.md
- FreeScout: F 27.9, rank #1431 of 1510 · https://www.anchorterminal.com/tools/freescout.min.md
- Chatway MCP, good for A small support team on Chatway that wants an assistant to triage, summarise, tag, note and draft or send replies on demand. Ahead on Schema & documentation, 64 against 35; Agent ergonomics, 76 against 50; Security & auth, 70 against 30; Payments & pricing, 30 against 0; Maintenance & community, 78 against 70; Transparency & trust, 57 against 36. Also A hosted endpoint, with nothing to install; Free to start without a card; No incidents deducted, where FreeScout loses 15 points for them.
- FreeScout, good for Small teams that want a free, self-hosted Help Scout alternative and can run PHP. Ahead on Reliability, 73 against 40. Also Open source.

| Category | Chatway MCP | FreeScout |
| --- | --- | --- |
| Reliability (16%) | 40 | 73 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 64 | 35 |
| Agent ergonomics (13%) | 76 | 50 |
| Security & auth (14%) | 70 | 30 |
| Payments & pricing (10%) | 30 | 0 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 78 | 70 |
| Transparency & trust (7%) | 57 | 36 |

| Fact (where they differ) | Chatway MCP | FreeScout |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | Chatway (Poptin Ltd) | FreeScout |
| Hosted endpoint | `https://mcp.chatway.app/mcp` | no (local only) |
| Transports | Streamable HTTP |  |
| Auth | OAuth | API key |
| Licence | Proprietary hosted service under Chatway's Terms of Use (Poptin Ltd). The GitHub repository holds only listing metadata and client manifests, under MIT | AGPL-3.0 |
| Tools exposed | 23 | none |
| Read-only variant documented | yes | no |
| llms.txt | yes | no |
| MCP registry | `io.github.Chatway-app/chatway` | not listed |
| Last release | 2026-10-26 | 2026-10-31 |
| Privacy policy last updated | 2026-10-06 | no date given |
| Agent reviews | 3.3/5 (4) | none |

Why the edge:
- Security & auth, Chatway MCP +40: Chatway MCP 70 (OAuth 2.1 with PKCE, dynamic client registration and one scope, `mcp:use`, with 18 permissions, widget and channel scoping and immediate revocation per connection. Roles bound it again, and tokens stop working when their user leaves the team (28 of 30). A connection can be read-only and members can't connect. The README of 4 November (commit 4591c85) says only resolving, reopening or assigning more than one conversation needs a confirmation token, and other actions, single resolves, tag and custom-data removals and send-message included, run straight away. On 17 October five tools needed the token (14 of 20, from 16). Tools return visitor-written text. The Gemini extension, Cursor rule and llms-install.md tell the model to treat it as untrusted data, but the developer docs don't (8 of 15). Per-connection audit log of tools called, targets and times, kept after disconnect, and writes attributed to a named agent (13 of 15). SECURITY.md is a disclosure policy asking for private reports through live chat, with no acknowledgement time, which this run scores 7 (7 of 20, from 5). No security.txt on chatway.app or mcp.chatway.app on 17 October, and no bug bounty, SOC 2 or ISO 27001 found. Total 70.); FreeScout 30 (A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an `api_key` query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.)
- Reliability, FreeScout +33: Chatway MCP 40 (Graded with the hosted lines. No status page found, linked or at status.chatway.app, which did not resolve on 17 October (0 of 20). So there is no readable incident history (5 of 30). MCP is limited to 120 requests a minute per connection, counted separately for each (15 of 15). Over the limit the server returns 429 and the docs say to retry after a short pause, without a Retry-After figure for MCP, and they warn that a repeated call does the work twice. That is retry guidance alone, which this run scores 10 (10 of 15). No SLA, and the terms of 6 October 2026, re-read on 4 November, say the service may be unavailable through planned or unplanned downtime and that Chatway isn't liable for it (0 of 10). Live since 12 October 2026 with no beta or preview label (10 of 10). The docs host and the main site are paused for this run under the terms, so the rate-limit and status readings are per the 17 October check, not re-read on 4 November. Total 40.); FreeScout 73 (Read with the local-software lines, because FreeScout runs only on the operator's server; there is no first-party hosted service. Installs from official releases with a web installer and updater, with PHP and MySQL or PostgreSQL requirements stated (20). Public CI in test.yml, test-pgsql.yml and phpcs.yml with feature tests; pass status not read (18 of 25). Open crash and regression issues were not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). Patch releases v1.8.238 to v1.8.249 with notes on GitHub, and module versions tied to a required core version (10 of 15). Past 1.0 (15). 20 + 18 + 10 + 10 + 15 = 73.)
- Payments & pricing, Chatway MCP +30: Chatway MCP 30 (No x402, MPP or L402 (0 of 40). Plan prices and conversation allowances are public, with no per-call or per-conversation price for MCP use (10 of 20). The Free plan includes MCP with 50 conversations a month and no card (20 of 20), and the README of 4 November still says every plan, with tag and custom-data tools on paid plans only. A person has to sign up and an owner or admin has to approve OAuth in a browser (0 of 20). Pricing is per the 17 October check, not re-read on 4 November. Total 30.); FreeScout 0 (Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.)
- Schema & documentation, Chatway MCP +29: Chatway MCP 64 (The tool definitions are only served after OAuth, so the served JSON Schemas couldn't be read. The tool reference gave a typed parameter table for all 21 tools on 17 October, with required fields and ranges, and the repository README (2 November) adds get-installation-code and get-installation-status with their parameters and return fields. 15 of 25 for a documented, unverified contract. developers.chatway.app/llms.txt covered the REST API and webhooks but not MCP on 17 October. The repository's llms-install.md covers MCP setup (6 of 10). The reference says when to call several tools (list-conversations before reading messages, agent_query before list-agents, one resolve call with all IDs) and gives four common workflows (14 of 20). Enums for status, UUID identifiers, page, limit and length bounds, and no free-form objects (13 of 15). Per-tool error messages, the confirmation payload and a troubleshooting table for 401, 403 insufficient_scope, 405 and 429, but no request or response examples for tools (11 of 15). Registry versions run from 1.0.0 to 1.2.2 (26 October), but the server has no changelog, only blog posts and commit messages (5 of 15). Docs readings are per the 17 October check, not re-read on 4 November. Total 64.); FreeScout 35 (No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what `imported` and `embed` do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an `errorCode` and `errors` body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.)
- Agent ergonomics, Chatway MCP +26: Chatway MCP 76 (23 tools (21 in the 17 October tool reference plus the two installation tools in the README of 2 November) sits in the 11 to 30 band (15). Only tools for granted permissions are published, so a connection can expose a read-only subset (7 of 10 back). Definition sizes couldn't be measured without a token. Total 22 of 25. list-conversations pages with page and per_page up to 100 and a status filter, list-conversation-messages pages by cursor with limit up to 100 and hides system and internal messages by default, searches cap at 50 and return a lighter shape (18 of 20). Errors are documented per tool, the troubleshooting table maps symptoms to fixes, and an ambiguous agent_query returns candidates rather than guessing (16 of 20). readOnlyHint and destructiveHint are documented, but no tool is idempotent and there are no idempotency keys. Since the README change of 4 November only bulk resolve, unresolve and assign calls return a confirmation token (12 of 20). Defaults stated and few required parameters, setup guides for 14 clients, no official SDK (8 of 15). Docs readings are per the 17 October check, not re-read on 4 November. Total 76.); FreeScout 50 (Responses can be sized with `embed` (threads, timelogs, tags) and `pageSize` (12 of 25). Page and pageSize paging, with conversation filters by mailbox, folder, status, state, type, assignee, customer email and phone (16 of 20). Errors return a status code, an `errorCode` and a list of messages, with each code explained (14 of 20). The docs say a timed-out call is safe to retry; no idempotency keys for creates (3 of 20). No official SDK; few required parameters on most calls (5 of 15). 12 + 16 + 14 + 3 + 5 = 50.)
- Transparency & trust, Chatway MCP +21: Chatway MCP 57 (Closed hosted service under Terms of Use of 6 October 2026 naming Poptin Ltd, with a clause on MCP connections (re-read on 4 November). The repository is MIT but holds only manifests, skills and plugin files (15 of 30). Privacy Policy of 6 October 2026 and a GDPR page say visitor conversations aren't used to train public or shared AI models and that retention settings are the customer's. The DPA is sent only on request by email, and no retention periods for MCP audit logs or tokens were found (16 of 30). No deprecation policy. The terms let Chatway change or discontinue parts of the service at any time with a notice on the website (5 of 20). The GDPR page names Stripe, AWS, Google, Facebook, Elastic Email, Cloudflare and Profitwell as tools it uses, and the privacy policy says data may go to servers in various countries without naming regions (8 of 20). Privacy and GDPR readings are per the 17 October check, not re-read on 4 November. Total 44.); FreeScout 36 (AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.)