Close API + MCP vs Relaticle

Close API + MCP 49

Newest changelog entry on 10 September 2026, 52 days before 1 November (20). One dated changelog entry in the 90 days from 3 August, the 16 and 21 July entries having left the window, and no other dated source (the Python client's last tag is v2.1 from July 2023 and the MCP registry entry is 1.0.1 from 22 September 2025), so fewer than three (0). Public changelog and support by email and phone. We didn't test support (10 of 15). In the official MCP registry as com.close/close-mcp, last version 1.0.1 published on 22 September 2025 (15). The Python client's CI was updated on 10 June 2026 (4 of 10). 20 + 0 + 10 + 15 + 4 = 49.

Relaticle 90

v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.

Close API + MCP 56

Statuspage at status.close.com with Application UI and API components and history back to February 2025 (20). In the 90 days from 3 August, read from history.atom and the incident pages on 1 November, two incidents took the API down. On 11 August Close was intermittently unavailable for about 2.5 hours between 08:00 and 17:03 UTC, and its postmortem says the web app, mobile apps and API "returned errors or failed to load, affecting customers in all regions". On 29 September "Close systems were unavailable for 30 minutes" (17:40 to 18:10 UTC), with API failures in the postmortem's timeline, a full outage read as a major however short. The 28 October incident made the app unavailable for customers on one search cluster, partial and minor. Two majors (5). The 1 October check found nothing after 3 July. Limits are set per endpoint group, per key and per organisation (3 times the key limit), but the docs only give 20 a second as an example rather than a table (10 of 15). Every response carries a RateLimit header, and every 429 has both RateLimit and retry-after, with guidance to sleep for the reset value. No idempotency keys or safe-retry guidance for writes (11 of 15). No SLA found on the pricing page (0). REST and MCP carry no beta label (10). 20 + 5 + 10 + 11 + 0 + 10 = 56.

Relaticle 40

Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Close API + MCP 66

REST keys act as one user in one organisation over HTTP Basic and can be deleted. OAuth for apps has only all.full_access plus offline_access, with 1-hour access tokens and a revoke endpoint. The MCP server adds three scopes, mcp.read, mcp.write_safe and mcp.write_destructive, over OAuth with dynamic client registration or a key header (24 of 30). A read-only MCP connection is one header. Safe-write can create but not update or delete. Email tools only make drafts a person sends, and delete tools tell the model to act only on an explicit instruction (18 of 20). The MCP server reads emails, SMS and call transcripts written by outsiders, and we found no injection guidance. Draft-only email closes one exfiltration route (4 of 15). The event log API records changes and is on every plan (12 of 15). SOC 2 Type 2 on the security page. No security.txt (404 on 1 November), and no disclosure policy or bug bounty found (8 of 20). 24 + 18 + 4 + 12 + 8 = 66.

Relaticle 57

Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single mcp:use scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.

Close API + MCP 68

Closed service with terms and a privacy policy, run by Elastic Inc (15). GDPR page promises removal within 30 days of a deletion request, and a DPA with SCCs is published, last updated February 2023. Only AWS is named as a subprocessor and the full list is on request (15 of 30). Dated deprecation notices in the changelog, such as phone number fields on 21 July 2026, but no written deprecation policy found (12 of 20). No public subprocessor list or hosting region found (5 of 20). 15 + 15 + 12 + 5 = 47. The privacy, GDPR and DPA pages rest on the 1 October check.

Relaticle 73

AGPL-3.0 source with an integration exception, and terms for the Cloud service (30). The privacy policy (4 November 2026) gives retention for server logs (90 days), contact forms (12 months) and paused trial workspaces (deleted after 60 days with notice), and names provider categories; no DPA was found (20 of 30). No deprecation policy or dated notices found (5 of 20). The security page lists each Cloud provider and what it receives, with hosting at Hetzner in Germany, and website analytics through Fathom without CRM content (17 of 20). 30 + 20 + 5 + 17 = 72.