CleverTap vs Dreamlit

CleverTap 56

Up to 100 named account passcodes with optional expiry, shown once and deletable, or per-user passcodes an admin can reset and revoke. No scopes or OAuth were found, and the secret travels in a header (22). No read-only passcode was found. The docs say campaigns created via API are not restricted by RBAC settings. A dashboard approval workflow exists, and draft lets an API caller save without sending (6). The API returns customer-supplied profile and event content, and no guidance for agents reading it was found (3). Audit logs record API key creation and revocation and API access logs, with CSV download and a daily export for SIEM tools (13). ISO/IEC 27001, ISO/IEC 27017, SOC 2 Type II, CSA STAR Level 2 and HIPAA are named on the pricing and security pages. The pricing page, re-read on 4 November, still names ISO/IEC 27001, ISO/IEC 27017, SOC 2 Type II and CSA STAR Level 2 and says reports are on the trust portal. clevertap.com/.well-known/security.txt answered 404 on 4 November, no disclosure policy or bug bounty was found, and the trust portal answered 403 on 9 October (12). Total 56.

Dreamlit 74

OAuth to one workspace with four scopes, and project-scoped personal access tokens with chosen scopes, shown once (30). A read-only grant is possible, publishing needs its own scope, confirm_publish runs only after the user approves the prepared payload, and a dedicated least-privilege database user reads the customer's data (20). The docs warn that AI clients can be tricked by untrusted prompts and tell users to review edit, publish and unpublish calls (8 of 15). The security page lists access logs for database operations and for the platform, and analytics expose run rows; no customer-facing log of MCP calls was described (8 of 15). The security page claims penetration testing and a bug bounty programme without a link, SOC 2 is coming soon, no security.txt (404), and the MCP repository's SECURITY.md routes reports to support (8 of 20). Total 74.

CleverTap 25

No x402, MPP or L402 (0). The Core plan's entry price is public at 85 dollars a month, re-read on 4 November, for up to 5,000 monthly active users. The larger tiers were not readable and Pro and Ultimate need a demo, so this is plan-only pricing (10). Core has a 30-day free trial. The account docs say billing details are needed before the last seven days, so 5 of the 20 points come off (15). A person signs up in a browser and creates the passcode in the dashboard (0). Total 25.

Dreamlit 10

No x402, MPP or L402 (0). Plan prices with included emails are public in pricing.md, no per-email overage price (10 of 20). No free plan for new accounts (0). Signup, database connection and payment happen in the web app (0). Total 10.

CleverTap 37

Graded on the REST API, with the hosted lines. No status page is linked from the home page, the pricing, security, terms or privacy pages or either docs index, re-read on 4 November, and no address was guessed (0). With no page there is no readable incident history, which this run scores 5 (from 0). Concurrent request limits are published with numbers for 23 API groups (15 on uploads, 3 elsewhere) with 1,000 records a call, re-read on 4 November, but the Create Campaign page gives 3 requests a second, per the 9 October check, and the Get User Profiles page, re-read on 4 November, says limits are account-specific (13). HTTP 429 is in the errors table, re-read on 4 November, and the Get User Profiles page asks for exponential backoff of 1 to 16 seconds with at most 5 retries and says a cursor survives a timeout. That page, re-read on 4 November (updated 3 July 2026), still gives the backoff schedule for 429, 500 and 503. No Retry-After header and no idempotency key or safe-retry guidance for writes were found, so this run's value for backoff guidance alone applies (10, from 8). The terms, re-read on 4 November, leave service levels to each order, and no SLA is published (0). The API is generally available, with the External Trigger API in Public Beta, per the 9 October check (9). 0+5+13+10+0+9 = 37.

Dreamlit 51

Graded with the hosted lines. A Better Stack status page at status.dreamlit.ai with 90 days of history for the Web App and the Workflow Engine, but no component for the MCP server (16 of 20). The record shows 100% for the web app and 99.992% for the workflow engine over 90 days, about ten minutes, with no written incidents (25 of 30). No rate limits found in the MCP or pricing docs (0). No 429, retry or idempotency guidance found (0). Scale includes dedicated support with an SLA and Enterprise has custom SLAs, but no published availability commitment (0). The MCP server, introduced on 5 May 2026, carries no beta label (10). Total 51.

CleverTap 53

Get User Profiles takes batch_size and app, events and profile flags, and reports take date ranges. No field selection was found (12). Profiles and events page by cursor with next_cursor, valid for 4 days. Get Campaigns filters only by date range and lists only API-created campaigns (14). Errors use status, error and code with per-API code lists and per-record results on uploads, but Get User Profiles returns some throttling errors with HTTP 200 (13). No idempotency key was found. dryRun=1 validates uploads, estimate_only and draft hold a campaign back, and stopping a stopped campaign returns success (8). One current server library, Node.js clevertap 1.3.1. The linked Python wrapper was last changed in 2017 (6). Total 53.

Dreamlit 67

16 tools, the 11 to 30 band; tools follow the granted scopes, so a read-only grant sees fewer (20 of 25). Analytics take filters, sorting and pagination, and brand styles paginate (18 of 20). The docs describe the errors an agent will meet, such as authorization required, choose a project and browser hand-off, without codes (12 of 20). Publishing is prepare then confirm, and tests don't publish; no idempotency or annotations documented (10 of 20). Empty scope requests default to the v1 scopes and get_status gives a first call; no SDK or REST route (7 of 15). Total 67.

CleverTap 73

The Web SDK tagged v3.1.2 on 2 November 2026, and the iOS SDK 7.9.1 on 30 October (30). Since 6 August the Web SDK has tagged v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.1.0, v3.1.1 and v3.1.2, the Android SDK core 8.4.1, push templates 2.6.0 and core 8.5.0 with templates 2.7.0, and the iOS SDK 7.8.1, 7.8.2, 7.9.0 and 7.9.1, read from clones on 4 November (20). Public monthly SDK changelogs (September 2026 is the newest page) and product release notes, with support through a dashboard ticket. GitHub issue handling was not read (9). Client SDKs are current. The Node.js server library's last release is still 1.3.1 (7 July 2026), and the Python wrapper dates from 2017 (10). The Node.js library ships a Travis CI file and depends on node-fetch 2. Its CI state was not read (4). 30+20+9+10+4 = 73.

Dreamlit 80

The latest changelog entry is 12 October 2026, custom repeating schedules (30). Eight dated entries between 10 August and 12 October (20). Priority support on Pro, dedicated support on Scale and a public changelog (10 of 15). ai.dreamlit/mcp is in the official MCP registry under its domain namespace (15). The metadata repository has validate and publish workflows; there's no package to check (5 of 10). Total 80.

CleverTap 66

Closed service with public Terms of Service, last updated 30 April 2021 and re-read on 4 November, that name WizRocket Inc. and state the restrictions plainly (15). The privacy policy of 9 April 2026, unchanged on 4 November, covers CleverTap as processor, with deletion within 60 days of termination, and the docs give three years' default retention on Core and backup deletion within 60 days. The Data Processing Addendum the policy cites was not found in public (22). No API deprecation policy was found. The only dated notice read is the 2021 end of TLS 1.1 (3). Six hosting regions are documented and AWS is named as host. The sub-processor list sits on the trust portal, which answered 403 and was not read (10). Total 50.

Dreamlit 59

A closed service under terms that name Notika AI (d/b/a Dreamlit AI) (15 of 30). The privacy policy keeps workflow execution history and delivery events for up to a year, while the security docs say Dreamlit retains no copy of customer data and cleans up after processing, which don't agree (15 of 30). No deprecation policy or dated notices found (0). The privacy policy points to a current subprocessor list and SCCs in a DPA, and names the United States and other countries as locations (12 of 20). Total 42.