Chatwoot API vs Drag

Chatwoot API 68

Better Stack status page with 13 components, among them Application (Dashboard & API), and monthly incident history at status.chatwoot.com/incidents (20). In the 90 days to 4 November 2026 the history lists no incident for any component; the last ones were email delivery disruptions on 20 and 26 July and a Meta permissions incident on Instagram, Messenger and WhatsApp that began on 24 July and was resolved on 5 August, all before the window, and the Application bar reads 99.987% for 30 days (30). Rate limits are published only for self-hosted installs (3,000 requests a minute per IP by default, widget routes from 6 requests per 12 hours to 60 an hour), not for Cloud (8, partly met, kept). No documented 429 or Retry-After behaviour and no idempotency guidance (0). No SLA found on any Cloud plan (0). The Application API is GA (10).

Drag 28

Graded as a hosted service on the MCP server at app.dragapp.com/mcp and REST API v2. No status page is linked and status.dragapp.com failed the TLS handshake (0). No readable incident history (5). The REST docs say rate limits apply without numbers; the hosted MCP server's source defaults to 60 calls a minute per key (5 of 15). The REST docs say to retry a 429 with exponential backoff, with no idempotency guidance for sends (8 of 15). No SLA found (0). Neither surface is labelled beta (10). 0 + 5 + 5 + 8 + 0 + 10 = 28.

Chatwoot API 77

v4.19.1 tagged on 24 October 2026, 11 days before this check (30). Five releases since 6 August, v4.17.0 (19 August), v4.17.1 (27 August), v4.18.0 (17 September), v4.19.0 (20 October) and v4.19.1 (24 October) (20). Commits land daily (last on 4 November); issue replies per the 1 October check, not re-read on 4 November, when 936 issues were open and the newest open ones were from July without visible maintainer replies (12, partly met, kept). An official CLI, no official REST SDKs (5). CircleCI and GitHub Actions spec runs, Dependabot and a bundler audit config (10).

Drag 43

@dragapp/mcp-server 0.7.0 on npm on 13 August 2026, 85 days before this check; the repository had a commit on 6 November and its package.json reads 0.12.0 with no matching release (20). Only one dated release in the 90 days from 8 August, and no changelog (0). 43 commits since 6 July 2026 by the CTO; issues were not read (8 of 25). Domain-verified com.dragapp/mcp-server namespace, but the entry stops at 0.1.5 and lists only the stdio package, not the hosted remote (10 of 15). A secret-scan workflow and a tarball check before publish; no tests in CI (5 of 10). 20 + 0 + 8 + 10 + 5 = 43.

Chatwoot API 52

Per-user access tokens that act with the user's full role, revocable by reset, header only. Bearer auth shipped in v4.19.0 (20 October 2026) and the spec says the api_access_token header will be deprecated in a future release (20). Agent bot tokens can reach only bot-permitted endpoints (show and toggle status or priority, create messages, assignments and labels), which is a usable least-privilege mode. No approval step for writes (10). Conversations carry customer-written text straight to the model and we found no injection guidance (0). Audit logs on Enterprise with an audit_logs API endpoint (10). SECURITY.md routes reports through GitHub advisories and mentions rewards, and Chatwoot has published advisories in public, three of them in 2026 (CVE-2026-44706, CVE-2026-44707, CVE-2026-72719). No security.txt, and the trust centre at trust.chatwoot.com rendered nothing we could read (12).

Drag 23

One API key per user that the docs say grants full access to the workspace, revocable in settings; the hosted server wraps it in an OAuth 2.1 flow with PKCE, but the key remains the access token (10). No read-only key or scopes; the server instructions tell the model to confirm sends when intent is unclear, and ChatGPT's plugin asks before sending (5 of 20). Tools return email and WhatsApp text from outside senders, and no prompt-injection guidance was found (0). No audit log of API or MCP actions found (0). Google CASA Tier 2, and the trust centre lists SOC 2 and GDPR, but no security.txt (404) or disclosure policy was found (8 of 20). 10 + 5 + 0 + 0 + 8 = 23.

Chatwoot API 78

MIT core with an enterprise directory under a separate licence (25). Privacy policy (16 April 2025) keeps data while the account is active, plan retention runs from 30 days to 3 years on the pricing page, and the policy says customer data doesn't train generalised AI models. No DPA link in the policy (18). Dated deprecations exist, such as Captain V1 retiring on 28 September 2026 and the header auth flagged in the spec, with no general deprecation policy (12). US processing stated and a subprocessor list linked at trust.chatwoot.com, which we couldn't read (12).

Drag 49

Closed service under terms naming DragApp.com Ltd, with the MCP server under MIT (20 of 30). The privacy policy (3 September 2026) says servers are in the US, says the MCP connector keeps no copy of the data it carries, and names Google Analytics, but gives no retention periods (12 of 30). No deprecation policy or dated notices found (0). Hosting at AWS in Virginia is stated and the trust centre has a subprocessor section we could not open past its root page (10 of 20). 20 + 12 + 0 + 10 = 42.

Chatwoot API 81

Four OpenAPI 3.1 files in the repo. The Application one has 124 operations (25). llms.txt with about 200 links and Markdown copies of each docs page (10). Every operation has a description, though the API introduction says the reference can trail the real behaviour and suggests reading the web app's own requests (12). 88 enums and typed request bodies in the Application spec (12). 380 examples and 401, 403, 404 and 422 responses in the spec, no 429 (12). Product changelog with dated entries and tagged GitHub releases, but the API itself sits at v1 with no API-specific changelog (10).

Drag 71

No OpenAPI or other contract for REST v2 was found. Every MCP tool carries a JSON input schema in the open-source server (20 of 25). llms.txt for the site (10). Tool descriptions say which ID to pass, which tool to call first and when WhatsApp free text fails, and the server instructions add tips (17 of 20). Inputs are typed in the schemas, with IDs as strings and few enums (10 of 15). The REST docs show request and response examples for 24 endpoints and a shared error shape with 401, 429 and 500 (9 of 15). REST is v2, but no changelog was found; versions are visible only on npm and in the repository (5 of 15). 20 + 10 + 17 + 10 + 9 + 5 = 71.

Chatwoot API 40

No x402, MPP or L402 (0). Cloud prices are public per agent per month, $0, $19, $39 and $99, with Captain AI credits at $20 per 1,000, but nothing per API call (10). Free Hacker plan for 2 agents and 500 conversations a month, and the self-hosted Community Edition is free (20). Cloud needs a person to sign up. On a self-hosted install the Platform API can create accounts, users and tokens with no human step, so we gave half (10).

Drag 30

No x402, MPP or L402 (0). Per-seat plan prices are public, and AI credits are priced at $0.01, with nothing per API call (10). The 7-day trial needs no card and includes every Pro feature, API and MCP among them (20). A person signs up in a browser and copies a key from settings (0). 0 + 10 + 20 + 0 = 30.