Codat vs Puzzle API and MCP

Codat 90

Graded on the hosted REST API at api.codat.io. Statuspage at status.codat.io with components per product and per integration (20). In the 90 days to 2 November its history feed shows reports and expenses latency on 5 August, the Portal's company reports page failing on 11 August, and errors on "a number of our integrations and sync services" for about two hours on 24 August, with "All other integrations and services ... operating normally". Each is partial, so minor only (20). The two complete outages of 24 and 27 July left the window. The 8 October reading came from the page's /api/ path, which its robots.txt disallows, so it is struck and the feed read instead. Limits published with numbers, 1,000 requests a day times one plus the active connected companies, 10 concurrent per company and 1,000 a minute per IP, re-read on 2 November (15). 429 with Retry-After and X-Rate-Limit headers, and an Idempotency-Key header on POST and PATCH (15). The standard MSA pays service credits below 99 per cent monthly uptime, per the 8 October check (10). Generally available (10). 20+20+15+15+10+10 = 90.

Puzzle API and MCP 15

Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

Codat 80

Latest changelog entry on 26 October 2026, a new Intelligent Upload journey in Link (30). Seven dated entries from 10 August to 26 October 2026 (20). A dated changelog, a Zendesk help centre and a support address. No public issue tracker for the service was reviewed (10). Current SDKs in TypeScript, Python and C#: @codat/platform 8.0.0 (TypeScript, 19 October), codat-platform 6.0.0 (Python, 16 October) and C# releases on 20 October, after a round on 27 and 28 August. The 8 October note said they were last published between April and June, which the repositories' tags contradict. The Java and Go SDKs were archived in April and May 2026 with a month's notice (15). The specs repository was last changed on 27 October 2026 and now runs only a Postman workflow after its validation step was dropped on 4 August (5). 30+20+10+15+5 = 80.

Puzzle API and MCP 53

The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.

Codat 81

pageSize from 1 to 5,000 with a default of 100, and a query filter that cuts results. No field selection found (15). Page and pageSize paging with _links, a query language, orderBy and modifiedDate filters. Bill Pay uses continuation tokens (20). Errors carry statusCode, service, error, correlationId, canBeRetried and detailedErrorCode with a validation object, though the error text is a string an agent has to read (17). Idempotency-Key on POST and PATCH with a 90-minute cache and documented behaviour after a 429. PUT and DELETE are outside the documented scheme (18). Maintained SDKs for TypeScript, Python and C#, one package per product. Writes need a model lookup per integration and most complete asynchronously (11). 15+20+17+18+11 = 81.

Puzzle API and MCP 56

MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.

Codat 49

Plain API keys in a Basic header, up to 10 per client, named, revocable in the Portal or through the API. No scopes and no documented expiry (20). No read-only key and no confirmation step for writes or deletes. Portal users have roles, and only Administrator and Developer roles see keys (4). The API returns ledger text written by third parties, such as invoice descriptions and supplier names, and no injection guidance was found (3). Read and write history per company and data type in the Portal and through the data history and push endpoints. No log of calls per API key was found (7). Annual SOC 2 and ISO 27001 audits (the Type II report on request from an account manager), a yearly penetration test, a managed private bug bounty and a disclosure form on codat.io/security, re-read on 2 November. No security.txt (404 on 2 November). The trust centre page did not render for us (15). 20+4+3+7+15 = 49.

Puzzle API and MCP 73

OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.

Codat 73

Closed service with a published Master Services Agreement, versioned and dated, naming Codat Limited and its company number (15). The MSA has a data processing schedule and deletes company data five business days after termination. The privacy notice of April 2025 is written mainly for website visitors and gives general retention wording, with six years for customer records (16). A change policy with at least three months' notice of breaking changes, a deprecation calendar, quarterly emails, defined lifecycle states and dated notices (20). The privacy notice names Microsoft Azure in the UK as a sub-processor and the MSA promises 10 days' notice of changes. No fuller list or choice of data location was found (8). Not re-read on 2 November, per the 8 October check. 15+16+20+8 = 59.

Puzzle API and MCP 49

Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.

Codat 77

Public OpenAPI 3 specs for every API in codatio/oas, in JSON and YAML (25). docs.codat.io/llms.txt still returns 404 on 2 November. The docs source is Markdown in a public repository, which is not the same as serving it to agents (0). Operation descriptions are long and state prerequisites, useful queries and traps, for example that data must be refreshed before a list call (16). Typed schemas with enums, but filters go through a free-text query string and the required fields of a write differ by accounting package and have to be fetched from an options endpoint (11). Response examples per integration on most operations and a documented status code table with sample error bodies (13). Dated changelog at docs.codat.io/updates and a change policy. The API has no version in the path or a header (12). 25+0+16+11+13+12 = 77.

Puzzle API and MCP 65

The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.