Circleback vs Fathom

Circleback 78

@circleback/cli 1.2.1 published on 3 November 2026 and a release entry on 2 November (30). Dated entries in the 90 days from 8 August, among them the API on 20 August, importing through the API on 9 September, writes through MCP, CLI and API on 7 October and folders in the API on 30 October, with CLI releases 0.9.0 to 1.2.1 since 6 October (20). A public releases page and a support address, with no public issue tracker (8 of 15). In the official MCP registry as ai.circleback/circleback (15). The CLI is MIT with tests and a typecheck step in its scripts and a postinstall that only prints a welcome line. Its repository isn't public (5 of 10). 30+20+8+15+5 = 78.

Fathom 37

The newest dated release on record is SDK version 0.0.43 on 29 July 2026, per the 8 October check, 98 days before this check. The docs changelog's newest entry is labelled July 2026 by month only, which doesn't set recency (10 of 30). SDK 0.0.42 (23 July) and 0.0.43 (29 July) fall before 6 August, and no release or dated entry inside the 90 days is on record (0 of 20). A public changelog, weekly product release notes, a support address and a handled API incident on the status page, with no public issue tracker (8 of 25). Listed in the official MCP registry as ai.fathom.api/mcp, with current TypeScript and Python SDKs (15). The SDKs are generated with Speakeasy, at 0.0.x, with no public repository or licence in the package metadata (4 of 10).

Circleback 77

Graded on the hosted REST API and MCP server with the hosted lines. incident.io status page at status.circleback.ai with four components, none of them the API (20). Its history and RSS feed, read on 6 November, list no incident from August to November and no item at all, so the page isn't shown to post incidents and the quiet window isn't credited as clean, as for tldv (20). Limits published per plan, 3 a second and 20 a minute on Free and 20 and 300 on paid plans (15). 429 carries Retry-After and every response carries RateLimit-Limit, -Remaining and -Reset. No idempotency key or safe-retry guidance for writes (12 of 15). No SLA found in the Terms or on the pricing page (0). The API has no beta label (10). 20+20+15+12+0+10 = 77.

Fathom 58

Graded on the hosted REST API and MCP server, per the 8 October check, not re-read on 4 November. Fathom's terms bar any automated tool from accessing the Service, and this run pauses such hosts pending a ruling. status.fathom.video is a Statuspage site, per the 8 October check (20). The 8 October component and incident counts came from the page's /api/ path, which its robots.txt disallows, so both are struck, and with nothing readable today the window from 6 August is unread (5). Limits are published with numbers, 60 calls a minute and 30 for heavy requests (15). 429 carries Retry-After and RateLimit-* headers and the SDKs retry. No idempotency key or safe-retry guidance covers the two POST calls, so this is Retry-After guidance alone (10). No uptime SLA was found. Enterprise lists priority support SLAs only (0). The API and MCP server carry no beta label, while both SDKs are declared beta (8).

Circleback 61

OAuth with dynamic client registration and two scopes on MCP, and API keys that are read-only or read and write, shown once (28 of 30). Read-only keys and a read-only MCP scope, and only an owner can delete a meeting. No confirmation step on the API for shares or deletes (14 of 20). Transcripts, notes and emails are participant-written text, and no prompt-injection guidance was found (0). A usage dashboard for workspace admins and meeting access requests, with no audit log of API or MCP calls found (4 of 15). SOC 2 Type II, EU-U.S. Data Privacy Framework certification, HIPAA, an external penetration test report on the security portal and a valid security.txt. No bug bounty found (15 of 20). 28+14+0+4+15 = 61.

Fathom 42

API keys are per user, sent in a header, with no scopes. An admin cannot revoke another user's key. OAuth apps get one scope, public_api, with rotating single-use refresh tokens. The MCP server uses OAuth with S256 PKCE and dynamic client registration and one scope, mcp (20 of 30). The API cannot edit or delete meetings and a key never reaches other users' private meetings. A key can still create a webhook or pass destination_url, which sends transcripts to any URL with no approval step (12 of 20). Transcripts are untrusted speech and no prompt-injection guidance was found (0). No audit log or per-call visibility for API use was found in the reviewed documentation (0). SOC 2 Type II, HIPAA and GDPR claims on the help centre and a Vanta trust centre we could not read. No security.txt and no bug bounty found (10 of 20). Per the 8 October check, not re-read on 4 November.

Circleback 72

28 MCP tools (15 for 11 to 30), plus 5 for the read-only scope that leaves write tools failing. The API lists return pages with filters (20 of 25). Cursor pagination through a Link header and filters by attendee, tag, folder, ownership and status (20). Errors carry a message and a code such as RATE_LIMITED (16 of 20). No idempotency key, and MCP annotations couldn't be read without a sign-in. Read-only keys and scope keep writes off (8 of 20). Few required parameters. The only official client is the Node CLI, with --json output (8 of 15). 20+20+16+8+8 = 72.

Fathom 64

Responses are sized with include_transcript, include_summary, include_action_items, include_highlights and include_crm_matches, all off by default, and separate summary and transcript endpoints. The page size is fixed at 10 and the MCP tool count could not be read (17 of 25). Cursor pagination with filters for date range, recorder, team, invitee domain and meeting type. No page-size parameter, attendee filter or text search (15 of 20). Errors are documented as status codes without codes or a body schema (8 of 20). Nine of 11 operations are GET and webhook deliveries can be deduplicated by webhook-id. No idempotency keys, and MCP annotations could not be read (10 of 20). Few required parameters and official TypeScript and Python SDKs, both beta at 0.0.43 (14 of 15). Per the 8 October check, not re-read on 4 November.