Circleback vs Read AI

Circleback 78

@circleback/cli 1.2.1 published on 3 November 2026 and a release entry on 2 November (30). Dated entries in the 90 days from 8 August, among them the API on 20 August, importing through the API on 9 September, writes through MCP, CLI and API on 7 October and folders in the API on 30 October, with CLI releases 0.9.0 to 1.2.1 since 6 October (20). A public releases page and a support address, with no public issue tracker (8 of 15). In the official MCP registry as ai.circleback/circleback (15). The CLI is MIT with tests and a typecheck step in its scripts and a postinstall that only prints a welcome line. Its repository isn't public (5 of 10). 30+20+8+15+5 = 78.

Read AI 6

No changelog or release list was found on 8 October, and Read AI's hosts are paused today, so only recorded dates count. The MCP server article's edit date of 2 September 2026 records no stated change, and a page date without a recorded change doesn't set recency. The last dated API change on record is the MCP launch of 25 February 2026, over 180 days ago (0). Connection guides for Claude, ChatGPT and Microsoft Copilot Studio published between 25 and 27 August 2026 are documents, not dated releases, so fewer than three entries fall in the 90 days from 6 August (0). A support request form, no public changelog or developer forum found (6, a partial value kept). No readable MCP registry entry and no official SDK (0). No packages to assess (0). 0+0+6+0+0 = 6.

Circleback 77

Graded on the hosted REST API and MCP server with the hosted lines. incident.io status page at status.circleback.ai with four components, none of them the API (20). Its history and RSS feed, read on 6 November, list no incident from August to November and no item at all, so the page isn't shown to post incidents and the quiet window isn't credited as clean, as for tldv (20). Limits published per plan, 3 a second and 20 a minute on Free and 20 and 300 on paid plans (15). 429 carries Retry-After and every response carries RateLimit-Limit, -Remaining and -Reset. No idempotency key or safe-retry guidance for writes (12 of 15). No SLA found in the Terms or on the pricing page (0). The API has no beta label (10). 20+20+15+12+0+10 = 77.

Read AI 27

Graded as a hosted service on the MCP server and REST API. Read AI's terms bar robots except to compile search results, so its hosts are paused and the 8 October readings stand where kept. The status page at readai.statuspage.io wasn't re-read on 4 November. Its components and incidents had been read only from the page's data path, which this run doesn't use, so the status-page line scores 0 and the window from 6 August is unread (5). 100 requests a minute per user, per the 8 October check (15). 429 is documented as retry later with no Retry-After or backoff guidance, while create meeting agent and share meeting report are documented as safe to repeat, per the 8 October check (7, a partial value kept). No SLA found (0). Both surfaces are open beta (0). 0+5+15+7+0+0 = 27.

Circleback 81

Each reference page embeds the OpenAPI 3.2 operation for its endpoint, but no single spec file is linked, and MCP input schemas need a sign-in (20 of 25). llms.txt and a Markdown copy of each docs page (10). Operation descriptions state what is returned and who may act, such as only the owner deleting a meeting, and the update call explains replace semantics (16 of 20). Typed parameters with enums and defaults, such as ownership All, Mine or Shared (13 of 15). curl examples, a JSON error envelope with error and code, and 400 and 429 responses per operation (12 of 15). Paths carry no version, and a public releases page dates each entry (10 of 15). 20+10+16+13+12+10 = 81.

Read AI 46

Per the 8 October check, not re-read on 4 November (terms pause). No public OpenAPI file was found. The MCP tool schemas sit behind sign-in and were not read, and the help centre's parameter tables are prose documentation, not a machine-readable contract, so the contract line scores 0 (the tables count on typed inputs). www.read.ai/llms.txt points to the help centre's article index (10). The API reference says when to use the live endpoint over the standard one, and the MCP article lists inputs, defaults and limits for each of four tools (13). Parameters are typed in tables and access levels are enumerated, with no schema to confirm constraints (8). Each endpoint has a curl request and a sample response. Errors are a table of status codes with no body schema (10). A /v1 path prefix, no changelog (5). 0+10+13+8+10+5 = 46.

Circleback 72

28 MCP tools (15 for 11 to 30), plus 5 for the read-only scope that leaves write tools failing. The API lists return pages with filters (20 of 25). Cursor pagination through a Link header and filters by attendee, tag, folder, ownership and status (20). Errors carry a message and a code such as RATE_LIMITED (16 of 20). No idempotency key, and MCP annotations couldn't be read without a sign-in. Read-only keys and scope keep writes off (8 of 20). Few required parameters. The only official client is the Node CLI, with --json output (8 of 15). 20+20+16+8+8 = 72.

Read AI 63

Per the 8 October check, not re-read on 4 November (terms pause). Four MCP tools, though list meetings returns the full detail of up to 10 meetings, transcripts included, per the MCP article. The REST API sizes responses with expand[] (20). Cursor pagination with has_more, a page size fixed at 10 or fewer and start-time filters only, with no search by title or participant (15). Errors are documented as HTTP status codes with one-line meanings and no body schema (8, a partial value kept). Create meeting agent and share meeting report are documented as duplicate-safe. Tool annotations were not read (12). Few required parameters and sensible defaults, no official SDK (8). 20+15+8+12+8 = 63.

Circleback 61

OAuth with dynamic client registration and two scopes on MCP, and API keys that are read-only or read and write, shown once (28 of 30). Read-only keys and a read-only MCP scope, and only an owner can delete a meeting. No confirmation step on the API for shares or deletes (14 of 20). Transcripts, notes and emails are participant-written text, and no prompt-injection guidance was found (0). A usage dashboard for workspace admins and meeting access requests, with no audit log of API or MCP calls found (4 of 15). SOC 2 Type II, EU-U.S. Data Privacy Framework certification, HIPAA, an external penetration test report on the security portal and a valid security.txt. No bug bounty found (15 of 20). 28+14+0+4+15 = 61.

Read AI 54

Per the 8 October check, not re-read on 4 November (terms pause). OAuth 2.1 with dynamic client registration, PKCE, 10-minute access tokens, rotating single-use refresh tokens and a revocation endpoint. Only two scopes, meeting:read and mcp:execute, so MCP access can't be narrowed to reading (24). A token reaches only reports its user can open, and a workspace admin can switch off access through the Downloads setting. No confirmation step is documented for sending a bot or sharing a report by email (9). Transcripts are untrusted speech and no injection guidance was found (0). Workspace audit logs in OCSF by webhook on Enterprise+ record sign-ins and integration connections, not individual calls (6). security.txt valid to 18 August 2027, SOC 2 Type 2 and a HIPAA option per the help centre, no bug bounty found (15). 24+9+0+6+15 = 54.

Circleback 70

Closed service with clear terms, effective 7 April 2026, naming Circleback AI, Inc. under Delaware law (15 of 30). The security page says customer data isn't used to train models, retention settings are documented per data type with permanent deletion, the Terms delete data when an account is deleted, and a DPA and BAA are published. The Privacy Policy dates from 15 July 2024 and gives no periods (22 of 30). No deprecation policy or dated deprecation notice found (0 of 20). US processing under the Data Privacy Framework is stated. Sub-processors weren't found outside the DPA, which wasn't read in full (10 of 20). 15+22+0+10 = 47.

Read AI 64

Per the 8 October check, not re-read on 4 November (terms pause). Closed service with published terms, last updated 26 February 2026, which still carry that date on 4 November (15). The privacy policy of 29 June 2026 keeps audio and video for no longer than two years and paid accounts' data until payment stops or deletion is requested. The help centre says model training is opt-in, while the terms grant a licence to train subject to opt-in or opt-out settings, and the DPA sits in a Trust Centre we couldn't read (20). No deprecation policy for the beta API (0). A sub-processor list is linked at trust.read.ai/subprocessors but didn't render for us, and EU and Canada data regions were announced on 2 February 2026 (10). 15+20+0+10 = 45.