{
  "data": {
    "a": {
      "slug": "codat",
      "name": "Codat",
      "vendor": "Codat Limited",
      "vendorUrl": "https://codat.io",
      "kind": "http-api",
      "category": "accounting",
      "summary": "Codat connects a business's accounting, banking and commerce software to financial products and banks through one REST API. Product APIs cover bill pay, expenses, bank feeds and lending data, with official SDKs for TypeScript, Python and C#.",
      "url": "https://www.anchorterminal.com/tools/codat",
      "markdownUrl": "https://www.anchorterminal.com/tools/codat.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/codat.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/codat.json",
      "dns": "codat.grade.anchorterminal.com",
      "repo": "https://github.com/codatio/oas",
      "license": "Proprietary service under Codat's Master Services Agreement. The documentation repository codatio/codat-docs is Apache-2.0",
      "transports": [
        "http"
      ],
      "remoteUrl": "https://api.codat.io",
      "packages": [
        {
          "registry": "npm",
          "name": "@codat/platform"
        },
        {
          "registry": "pypi",
          "name": "codat-platform"
        }
      ],
      "auth": "api-key",
      "authNotes": "An API key, Base64 encoded, in an `Authorization: Basic` header on every call to https://api.codat.io. An account comes through Codat's sales team. The docs say to get in touch to create one, and no self-serve signup was found. A client can hold up to 10 named keys, created and deleted in the Portal by Administrator or Developer users or through the /apiKeys endpoints. Keys have no scopes, so each one reaches every company the client has connected. End customers authorise their accounting package through Codat's Link flow.",
      "pricing": "paid",
      "pricingNotes": "No public price. codat.io/pricing returns 404 and the site's buttons ask for a meeting. The standard MSA sets a platform fee invoiced in advance and a unit fee per active company per month, both in an order form. The docs describe a free trial limited to 50 companies, no hourly syncs and 365 days, and a Codat Sandbox integration that is excluded from billing, but an account starts with a request to Codat (checked 2026-10-08).",
      "priceSummary": "Paid",
      "where": "hosted",
      "x402": {
        "level": "no",
        "evidence": "No x402, MPP or L402 in the docs repository, the OpenAPI specs or the site (checked 2026-11-02).",
        "endpoints": []
      },
      "toolCount": null,
      "popularity": {
        "githubStars": null,
        "npmWeekly": 2690,
        "pypiWeekly": 222,
        "asOf": "2026-10-08"
      },
      "docsUrl": "https://docs.codat.io/using-the-api/overview",
      "openapi": "https://raw.githubusercontent.com/codatio/oas/main/json/Codat-Platform.json",
      "capabilities": [
        "accounting.unified",
        "accounting.bills",
        "accounting.reports",
        "accounting.ledger",
        "accounting.invoices"
      ],
      "tags": [
        "hosted",
        "paid",
        "sales-led",
        "api-key",
        "openapi",
        "webhooks",
        "async-jobs",
        "idempotency",
        "sandbox",
        "typescript",
        "python",
        "csharp",
        "status-page",
        "soc2",
        "iso27001",
        "closed-source"
      ],
      "lastRelease": "2026-10-26",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 66.9,
        "grade": "B",
        "agentReady": false,
        "rank": 343,
        "ranked": true,
        "rankOf": 1486,
        "categoryRank": 5,
        "methodology": "0.7",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 81,
          "maintenance": 80,
          "payments": 10,
          "reliability": 90,
          "schema": 77,
          "security": 49,
          "transparency": 73
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "medium",
          "date": "2026-11-02"
        },
        "negative": 0,
        "verdict": "Public OpenAPI specs, an Idempotency-Key header on writes, Retry-After on 429 and a written three-month deprecation notice suit an agent that retries. Access is the limitation. No price or self-serve signup is published, the general Accounting API is closed to new clients, and API keys carry no scopes.",
        "bestFor": "Banks, lenders, bill pay, expense and card products that already have or will sign a Codat contract and need writes into many accounting packages.",
        "strengths": [
          "Public OpenAPI 3 specs for every API in codatio/oas, with long operation descriptions and per-integration response examples",
          "Idempotency-Key header on POST and PATCH, cached for 90 minutes, and released after a 429 so the same key can be retried",
          "429 responses carry Retry-After, and every response carries X-Rate-Limit-Limit, Remaining and Reset headers",
          "Breaking changes are posted at least three months ahead, with a deprecation calendar and quarterly emails",
          "Annual SOC 2 Type II and ISO 27001 audits and a private bug bounty, per codat.io/security"
        ],
        "weaknesses": [
          "No public price. The pricing page returns 404 and fees are set in an order form",
          "No self-serve signup found. The docs and the site ask new users to get in touch",
          "The general Accounting API spec says it is relevant only to existing clients, and the status page labels it Legacy",
          "API keys have no scopes or read-only mode, and one key reaches every connected company",
          "No llms.txt or Markdown docs served for agents",
          "The Java and Go SDKs were archived in April and May 2026"
        ],
        "agentNotes": [
          "Send `Authorization: Basic \u003cbase64 of the API key\u003e` to https://api.codat.io. The Portal shows the ready-made header value",
          "Send a new GUID as `Idempotency-Key` on every POST and PATCH, and reuse the same key when retrying after a 429",
          "Treat writes as asynchronous on most APIs. Keep the push operation key and wait for the `{dataType}.write.successful` or `.unsuccessful` webhook",
          "Call the Get model (options) endpoint for the connection before a create or update, because required fields differ by accounting package",
          "Filter with `query=modifiedDate\u003e...` and keep `pageSize` at 100. The daily quota is 1,000 requests times one plus the number of active connected companies"
        ],
        "metrics": {
          "kind": "remote",
          "measured": false
        },
        "reviewCount": 4,
        "avgRating": 2.5,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "medium",
            "grade": "B",
            "methodology": "0.7",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 66.9
          }
        ],
        "editorialScores": {
          "ergonomics": 81,
          "maintenance": 80,
          "payments": 10,
          "reliability": 90,
          "schema": 77,
          "security": 49,
          "transparency": 59
        },
        "provenanceScore": 87,
        "checked": {
          "categories": {
            "ergonomics": "2026-11-02",
            "maintenance": "2026-11-02",
            "payments": "2026-11-02",
            "reliability": "2026-11-02",
            "schema": "2026-11-02",
            "security": "2026-11-02",
            "transparency": "2026-11-02"
          },
          "last": "2026-11-02",
          "lastMoved": "2026-11-02",
          "oldest": "2026-11-02",
          "stale": false,
          "staleAfterDays": 90
        }
      },
      "connect": {
        "install": "npm install @codat/platform",
        "http": "curl https://api.codat.io/companies \\\n  -H \"Authorization: Basic $CODAT_ENCODED_API_KEY\""
      },
      "letme": {
        "capability": "https://letme.dev/accounting.unified",
        "tool": "https://letme.dev/codat"
      },
      "area": "domain-data",
      "provenance": {
        "legalEntity": "Codat Limited",
        "domain": "codat.io",
        "domainRegistered": "2016-10-17",
        "endpointOnVendorDomain": true,
        "terms": "https://codat.io/msa-standard/",
        "privacy": "https://codat.io/privacy-policy/",
        "statusPage": "https://status.codat.io",
        "changelog": "https://docs.codat.io/updates",
        "securityTxt": "none",
        "checked": "2026-11-02",
        "notes": [
          "The standard MSA (version 2.0, 5 September 2022) names Codat Limited, registered in England and Wales, number 10480375, 6-7 St. Cross Street, London EC1N 8UB, for clients in the UK and the rest of the world outside the USA. The privacy notice also names Codat, Inc., a Delaware corporation.",
          "codat.io/legals lists two agreements, the Master Services Agreement (standard and enterprise versions) and the Start-up Plan terms. The standard MSA is the one recorded here.",
          "The Codat Global Privacy Notice was last updated in April 2025. It is written mainly for website visitors, and the MSA points to the same page for the sub-processor list.",
          "codat.io, app.codat.io and api.codat.io all return 404 for /.well-known/security.txt. codat.io/security has a disclosure form.",
          "RDAP for codat.io gives a registration date of 2016-10-17."
        ],
        "score": 87
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/codat.json",
      "live": {
        "slug": "codat",
        "probe": {
          "target": "https://api.codat.io",
          "method": "get",
          "lastAt": "2026-11-07T18:20:18.063647153Z",
          "lastOk": true,
          "lastStatus": 404,
          "lastMs": 96,
          "authRequired": false,
          "uptime24h": 100,
          "uptime30d": 100,
          "p50ms24h": 64,
          "p95ms24h": 167,
          "samples24h": 239,
          "samples30d": 7440,
          "days": [
            {
              "date": "2026-10-08",
              "probes": 70,
              "ok": 70
            },
            {
              "date": "2026-10-09",
              "probes": 250,
              "ok": 250
            },
            {
              "date": "2026-10-10",
              "probes": 247,
              "ok": 247
            },
            {
              "date": "2026-10-11",
              "probes": 247,
              "ok": 247
            },
            {
              "date": "2026-10-12",
              "probes": 247,
              "ok": 247
            },
            {
              "date": "2026-10-13",
              "probes": 248,
              "ok": 248
            },
            {
              "date": "2026-10-14",
              "probes": 249,
              "ok": 249
            },
            {
              "date": "2026-10-15",
              "probes": 253,
              "ok": 253
            },
            {
              "date": "2026-10-16",
              "probes": 252,
              "ok": 252
            },
            {
              "date": "2026-10-17",
              "probes": 253,
              "ok": 253
            },
            {
              "date": "2026-10-18",
              "probes": 256,
              "ok": 256
            },
            {
              "date": "2026-10-19",
              "probes": 255,
              "ok": 255
            },
            {
              "date": "2026-10-20",
              "probes": 252,
              "ok": 252
            },
            {
              "date": "2026-10-21",
              "probes": 253,
              "ok": 253
            },
            {
              "date": "2026-10-22",
              "probes": 253,
              "ok": 253
            },
            {
              "date": "2026-10-23",
              "probes": 248,
              "ok": 248
            },
            {
              "date": "2026-10-24",
              "probes": 251,
              "ok": 251
            },
            {
              "date": "2026-10-25",
              "probes": 250,
              "ok": 250
            },
            {
              "date": "2026-10-26",
              "probes": 252,
              "ok": 252
            },
            {
              "date": "2026-10-27",
              "probes": 249,
              "ok": 249
            },
            {
              "date": "2026-10-28",
              "probes": 251,
              "ok": 251
            },
            {
              "date": "2026-10-29",
              "probes": 249,
              "ok": 249
            },
            {
              "date": "2026-10-30",
              "probes": 248,
              "ok": 248
            },
            {
              "date": "2026-10-31",
              "probes": 251,
              "ok": 251
            },
            {
              "date": "2026-11-01",
              "probes": 249,
              "ok": 249
            },
            {
              "date": "2026-11-02",
              "probes": 250,
              "ok": 250
            },
            {
              "date": "2026-11-03",
              "probes": 248,
              "ok": 248
            },
            {
              "date": "2026-11-04",
              "probes": 246,
              "ok": 246
            },
            {
              "date": "2026-11-05",
              "probes": 185,
              "ok": 185
            },
            {
              "date": "2026-11-06",
              "probes": 241,
              "ok": 241
            },
            {
              "date": "2026-11-07",
              "probes": 187,
              "ok": 187
            }
          ]
        },
        "vendorStatus": {
          "page": "https://status.codat.io",
          "indicator": "none",
          "summary": "All Systems Operational",
          "checkedAt": "2026-11-07T18:20:54.120103174Z"
        },
        "versions": [
          {
            "registry": "npm",
            "name": "@codat/platform",
            "version": "8.0.0",
            "seenAt": "2026-11-06T23:16:16.371751848Z"
          },
          {
            "registry": "pypi",
            "name": "codat-platform",
            "version": "6.0.0",
            "released": "2026-10-16",
            "seenAt": "2026-11-06T23:16:16.647710896Z"
          }
        ],
        "githubStars": 7,
        "npmWeekly": 1222,
        "pypiWeekly": 45,
        "securityTxt": {
          "url": "https://codat.io/.well-known/security.txt",
          "state": "none",
          "checkedAt": "2026-11-07T16:01:41.34848135Z"
        },
        "domain": {
          "domain": "codat.io",
          "checkedAt": "2026-11-01T14:07:58.260975858Z"
        },
        "pages": [
          {
            "url": "https://docs.codat.io/updates",
            "kind": "changelog",
            "status": 304,
            "checkedAt": "2026-11-07T14:05:36.294075665Z",
            "changedAt": "2026-10-28T04:14:27.719836538Z",
            "fingerprint": "c6bc605d0d22"
          },
          {
            "url": "https://codat.io/privacy-policy/",
            "kind": "privacy",
            "status": 200,
            "checkedAt": "2026-11-07T14:01:39.196728151Z",
            "changedAt": "2026-11-05T12:26:05.859414295Z",
            "fingerprint": "dcbafd2fa146"
          },
          {
            "url": "https://codat.io/msa-standard/",
            "kind": "terms",
            "status": 200,
            "checkedAt": "2026-11-07T14:01:36.80597111Z",
            "changedAt": "2026-11-05T12:26:03.460042689Z",
            "fingerprint": "ed2162d5b08d"
          }
        ],
        "github": {
          "repo": "codatio/oas",
          "checkedAt": "2026-11-02T08:40:20.413810084Z",
          "stars": 7,
          "archived": false,
          "issuesEnabled": true,
          "pushedAt": "2026-10-27T17:28:57Z",
          "openIssues": 0,
          "openPRs": 0,
          "issuesOpened90d": 0,
          "issuesClosed90d": 0,
          "prsMerged90d": 0,
          "ci": {
            "branch": "main",
            "runs": 28,
            "success": 28,
            "failure": 0,
            "other": 0,
            "latest": "success",
            "latestAt": "2026-08-04T08:13:14Z"
          },
          "replies": {
            "sampled": 3,
            "unanswered": 0,
            "medianDays": 50.9
          }
        },
        "updatedAt": "2026-11-07T18:20:18.063647153Z"
      }
    },
    "answer": "Codat scores 66.9 (B) on agent readiness against Puzzle API and MCP's 46.2 (D), and leads in 5 of 7 scored categories. Puzzle API and MCP leads on security \u0026 auth and payments \u0026 pricing.",
    "b": {
      "slug": "puzzle",
      "name": "Puzzle API and MCP",
      "vendor": "Puzzle Financial Inc.",
      "vendorUrl": "https://puzzle.io/api-mcp",
      "kind": "mcp",
      "category": "accounting",
      "summary": "Puzzle is AI-native accounting software for startups and small businesses, with a real-time general ledger. Its hosted MCP server connects Claude, ChatGPT and other clients to a company's books, and a partner REST API reaches ledgers, bills, invoices and reports.",
      "url": "https://www.anchorterminal.com/tools/puzzle",
      "markdownUrl": "https://www.anchorterminal.com/tools/puzzle.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/puzzle.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/puzzle.json",
      "dns": "puzzle.grade.anchorterminal.com",
      "transports": [
        "streamable-http"
      ],
      "remoteUrl": "https://app.puzzle.io/mcp",
      "packages": [],
      "auth": "oauth",
      "authNotes": "For MCP, the user signs in with a Puzzle account through OAuth and chooses which companies the connection covers. It is read-only by default, with read-write as an opt-in beta where each change needs confirmation, and the user needs Full or Partial access to each company with AI turned on. The API uses the OAuth 2.0 authorisation code flow with refresh tokens and per-resource scopes (read:company and write scopes for bills, invoices, journals, vendors and more), with client ID, secret and connection key issued by email to api@puzzle.io. A sandbox runs at staging.southparkdata.com.",
      "pricing": "paid",
      "pricingNotes": "Puzzle plans are $30 (Starter), $72 (Core), $120 (Complete) and $360 (Scale) a month, two months free yearly, with \"Try for free\" on each. Accounting services start at $171 a month with Core. MCP access comes with a Puzzle subscription; API access is by request with no published price.",
      "priceSummary": "$30 / mo",
      "where": "hosted",
      "x402": {
        "level": "no",
        "evidence": "No x402, MPP or L402 on the MCP page, API docs or pricing page (checked 2026-11-06).",
        "endpoints": []
      },
      "toolCount": null,
      "popularity": {
        "githubStars": null,
        "npmWeekly": null,
        "pypiWeekly": null,
        "asOf": "2026-11-06"
      },
      "docsUrl": "https://puzzle-api.readme.io/docs/welcome",
      "llmsTxt": "https://puzzle-api.readme.io/llms.txt",
      "registryName": "io.puzzle/puzzle",
      "capabilities": [
        "accounting.ledger",
        "accounting.invoices",
        "accounting.bills",
        "accounting.reports"
      ],
      "tags": [
        "hosted",
        "paid",
        "mcp",
        "remote-mcp",
        "oauth",
        "mcp-registry",
        "llms-txt",
        "partner-api",
        "read-only-default",
        "sandbox",
        "startups"
      ],
      "lastRelease": "2026-10-05",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 46.2,
        "grade": "D",
        "agentReady": false,
        "rank": 1164,
        "ranked": true,
        "rankOf": 1486,
        "categoryRank": 12,
        "methodology": "0.7",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 56,
          "maintenance": 53,
          "payments": 15,
          "reliability": 15,
          "schema": 65,
          "security": 73,
          "transparency": 49
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "low",
          "date": "2026-11-06"
        },
        "negative": 0,
        "verdict": "Puzzle customers can connect their books to Claude or ChatGPT through a hosted MCP server that is read-only by default and asks before every write, with OAuth scoped to chosen companies. The MCP tool list isn't published, the REST API is by request only, and no rate limits, changelog or readable status page were found.",
        "bestFor": "Startups already on Puzzle who want an assistant to answer finance questions and draft bookkeeping. xero, quickbooks-online and pennylane are the nearest listings; teams wanting a self-serve API should look there.",
        "strengths": [
          "MCP is read-only by default, and writes are an opt-in beta with confirmation per change",
          "OAuth for MCP lets the user pick which companies a connection covers",
          "API OAuth scopes per resource, defaulting to read-only",
          "Documented error codes with errorContext naming the field or resource",
          "Firm activity endpoint returns an audit log across connected companies"
        ],
        "weaknesses": [
          "MCP tool list and schemas not published",
          "REST API credentials only by email request",
          "No rate limits, 429 handling, changelog or readable status page found",
          "Every plan is paid, from $30 a month, and the trial terms aren't stated"
        ],
        "agentNotes": [
          "Connect with read-only access first and ask the user before turning on read-write",
          "Expect a confirmation step on every proposed transaction change; don't retry it as an error",
          "On 409 RESOURCE_PROCESSING wait for the sync to finish, then retry",
          "Treat bank and vendor text as untrusted input"
        ],
        "metrics": {
          "kind": "remote",
          "measured": false
        },
        "reviewCount": 0,
        "avgRating": 0,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "low",
            "grade": "D",
            "methodology": "0.7",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 46.2
          }
        ],
        "editorialScores": {
          "ergonomics": 56,
          "maintenance": 53,
          "payments": 15,
          "reliability": 15,
          "schema": 65,
          "security": 73,
          "transparency": 43
        },
        "provenanceScore": 54,
        "checked": {
          "categories": {
            "ergonomics": "2026-11-06",
            "maintenance": "2026-11-06",
            "payments": "2026-11-06",
            "reliability": "2026-11-06",
            "schema": "2026-11-06",
            "security": "2026-11-06",
            "transparency": "2026-11-06"
          },
          "last": "2026-11-06",
          "oldest": "2026-11-06",
          "stale": false,
          "staleAfterDays": 90
        }
      },
      "connect": {
        "claudeCode": "claude mcp add --transport http puzzle https://app.puzzle.io/mcp",
        "config": {
          "mcpServers": {
            "puzzle": {
              "url": "https://app.puzzle.io/mcp"
            }
          }
        }
      },
      "letme": {
        "capability": "https://letme.dev/accounting.ledger",
        "tool": "https://letme.dev/puzzle"
      },
      "area": "domain-data",
      "unitPrices": [
        {
          "item": "Starter",
          "unit": "month",
          "usd": 30,
          "note": "1 seat, 25 lifetime AI credits"
        },
        {
          "item": "Core",
          "unit": "month",
          "usd": 72,
          "note": "5 seats"
        },
        {
          "item": "Complete",
          "unit": "month",
          "usd": 120,
          "note": "Unlimited seats, 100 AI credits a month"
        },
        {
          "item": "Scale",
          "unit": "month",
          "usd": 360,
          "note": "300 AI credits a month"
        }
      ],
      "provenance": {
        "legalEntity": "Puzzle Financial Inc.",
        "domain": "puzzle.io",
        "domainRegistered": "",
        "endpointOnVendorDomain": true,
        "terms": "https://puzzle.io/legal/terms-of-service",
        "privacy": "https://puzzle.io/legal/privacy",
        "statusPage": "",
        "changelog": "",
        "securityTxt": "none",
        "checked": "2026-11-06",
        "notes": [
          "Terms and privacy policy name Puzzle Financial Inc. The privacy policy is effective 19 December 2025.",
          "The website terms forbid robots, spiders, crawlers and scrapers that extract data from the website. Recorded as a fact; puzzle.io/robots.txt allows all paths.",
          "app.puzzle.io/robots.txt disallows every path. Our reader sent one unauthenticated GET to https://app.puzzle.io/mcp and read its protected-resource metadata before checking that file; those answers are not used here, and the endpoint facts come from puzzle.io/api-mcp and the MCP registry.",
          "puzzle.io/.well-known/security.txt returns 404; the security page links a bug bounty policy at /legal/bug-bounty.",
          "status.puzzle.io answered 403 and wasn't read."
        ],
        "score": 54
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/puzzle.json",
      "live": {
        "slug": "puzzle",
        "probe": {
          "target": "https://app.puzzle.io/mcp",
          "method": "mcp-initialize",
          "lastAt": "2026-11-07T18:20:49.117091968Z",
          "lastOk": true,
          "lastStatus": 401,
          "lastMs": 757,
          "lastNote": "asks for credentials",
          "authRequired": true,
          "uptime24h": 100,
          "uptime30d": 100,
          "p50ms24h": 626,
          "p95ms24h": 757,
          "samples24h": 200,
          "samples30d": 200,
          "days": [
            {
              "date": "2026-11-06",
              "probes": 13,
              "ok": 13
            },
            {
              "date": "2026-11-07",
              "probes": 187,
              "ok": 187
            }
          ]
        },
        "versions": [
          {
            "registry": "mcp-registry",
            "name": "io.puzzle/puzzle",
            "version": "1.0.0",
            "seenAt": "2026-11-07T18:16:28.95801333Z"
          }
        ],
        "securityTxt": {
          "url": "https://puzzle.io/.well-known/security.txt",
          "state": "none",
          "checkedAt": "2026-11-07T16:00:23.872885991Z"
        },
        "llmsTxt": {
          "url": "https://puzzle-api.readme.io/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-11-07T15:33:42.47043184Z"
        },
        "pages": [
          {
            "url": "https://puzzle.io/legal/privacy",
            "kind": "privacy",
            "status": 200,
            "checkedAt": "2026-11-07T14:17:39.329522101Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "80e70d5a3edf"
          },
          {
            "url": "https://puzzle.io/legal/terms-of-service",
            "kind": "terms",
            "status": 200,
            "checkedAt": "2026-11-07T14:17:41.797365786Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "6db91b15551c"
          }
        ],
        "mcpTools": {
          "url": "https://app.puzzle.io/mcp",
          "checkedAt": "2026-11-07T01:47:02.878008845Z",
          "status": "auth",
          "note": "asks for credentials before listing its tools",
          "changedAt": "2026-11-07T01:47:02.878008845Z"
        },
        "updatedAt": "2026-11-07T18:20:49.117091968Z"
      }
    },
    "edges": [
      {
        "by": 75,
        "category": "reliability",
        "leads": "codat",
        "name": "Reliability",
        "reasons": {
          "a": "Graded on the hosted REST API at api.codat.io. Statuspage at status.codat.io with components per product and per integration (20). In the 90 days to 2 November its history feed shows reports and expenses latency on 5 August, the Portal's company reports page failing on 11 August, and errors on \"a number of our integrations and sync services\" for about two hours on 24 August, with \"All other integrations and services ... operating normally\". Each is partial, so minor only (20). The two complete outages of 24 and 27 July left the window. The 8 October reading came from the page's /api/ path, which its robots.txt disallows, so it is struck and the feed read instead. Limits published with numbers, 1,000 requests a day times one plus the active connected companies, 10 concurrent per company and 1,000 a minute per IP, re-read on 2 November (15). 429 with Retry-After and X-Rate-Limit headers, and an Idempotency-Key header on POST and PATCH (15). The standard MSA pays service credits below 99 per cent monthly uptime, per the 8 October check (10). Generally available (10). 20+20+15+15+10+10 = 90.",
          "b": "Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15."
        },
        "scores": {
          "a": 90,
          "b": 15
        }
      },
      {
        "by": 27,
        "category": "maintenance",
        "leads": "codat",
        "name": "Maintenance \u0026 community",
        "reasons": {
          "a": "Latest changelog entry on 26 October 2026, a new Intelligent Upload journey in Link (30). Seven dated entries from 10 August to 26 October 2026 (20). A dated changelog, a Zendesk help centre and a support address. No public issue tracker for the service was reviewed (10). Current SDKs in TypeScript, Python and C#: @codat/platform 8.0.0 (TypeScript, 19 October), codat-platform 6.0.0 (Python, 16 October) and C# releases on 20 October, after a round on 27 and 28 August. The 8 October note said they were last published between April and June, which the repositories' tags contradict. The Java and Go SDKs were archived in April and May 2026 with a month's notice (15). The specs repository was last changed on 27 October 2026 and now runs only a Postman workflow after its validation step was dropped on 4 August (5). 30+20+10+15+5 = 80.",
          "b": "The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53."
        },
        "scores": {
          "a": 80,
          "b": 53
        }
      },
      {
        "by": 25,
        "category": "ergonomics",
        "leads": "codat",
        "name": "Agent ergonomics",
        "reasons": {
          "a": "`pageSize` from 1 to 5,000 with a default of 100, and a `query` filter that cuts results. No field selection found (15). Page and pageSize paging with `_links`, a query language, `orderBy` and modifiedDate filters. Bill Pay uses continuation tokens (20). Errors carry statusCode, service, error, correlationId, canBeRetried and detailedErrorCode with a validation object, though the error text is a string an agent has to read (17). Idempotency-Key on POST and PATCH with a 90-minute cache and documented behaviour after a 429. PUT and DELETE are outside the documented scheme (18). Maintained SDKs for TypeScript, Python and C#, one package per product. Writes need a model lookup per integration and most complete asynchronously (11). 15+20+17+18+11 = 81.",
          "b": "MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56."
        },
        "scores": {
          "a": 81,
          "b": 56
        }
      },
      {
        "by": 24,
        "category": "security",
        "leads": "puzzle",
        "name": "Security \u0026 auth",
        "reasons": {
          "a": "Plain API keys in a Basic header, up to 10 per client, named, revocable in the Portal or through the API. No scopes and no documented expiry (20). No read-only key and no confirmation step for writes or deletes. Portal users have roles, and only Administrator and Developer roles see keys (4). The API returns ledger text written by third parties, such as invoice descriptions and supplier names, and no injection guidance was found (3). Read and write history per company and data type in the Portal and through the data history and push endpoints. No log of calls per API key was found (7). Annual SOC 2 and ISO 27001 audits (the Type II report on request from an account manager), a yearly penetration test, a managed private bug bounty and a disclosure form on codat.io/security, re-read on 2 November. No security.txt (404 on 2 November). The trust centre page did not render for us (15). 20+4+3+7+15 = 49.",
          "b": "OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73."
        },
        "scores": {
          "a": 49,
          "b": 73
        }
      },
      {
        "by": 24,
        "category": "transparency",
        "leads": "codat",
        "name": "Transparency \u0026 trust",
        "reasons": {
          "a": "Closed service with a published Master Services Agreement, versioned and dated, naming Codat Limited and its company number (15). The MSA has a data processing schedule and deletes company data five business days after termination. The privacy notice of April 2025 is written mainly for website visitors and gives general retention wording, with six years for customer records (16). A change policy with at least three months' notice of breaking changes, a deprecation calendar, quarterly emails, defined lifecycle states and dated notices (20). The privacy notice names Microsoft Azure in the UK as a sub-processor and the MSA promises 10 days' notice of changes. No fuller list or choice of data location was found (8). Not re-read on 2 November, per the 8 October check. 15+16+20+8 = 59.",
          "b": "Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43."
        },
        "scores": {
          "a": 73,
          "b": 49
        }
      },
      {
        "by": 12,
        "category": "schema",
        "leads": "codat",
        "name": "Schema \u0026 documentation",
        "reasons": {
          "a": "Public OpenAPI 3 specs for every API in codatio/oas, in JSON and YAML (25). docs.codat.io/llms.txt still returns 404 on 2 November. The docs source is Markdown in a public repository, which is not the same as serving it to agents (0). Operation descriptions are long and state prerequisites, useful queries and traps, for example that data must be refreshed before a list call (16). Typed schemas with enums, but filters go through a free-text `query` string and the required fields of a write differ by accounting package and have to be fetched from an options endpoint (11). Response examples per integration on most operations and a documented status code table with sample error bodies (13). Dated changelog at docs.codat.io/updates and a change policy. The API has no version in the path or a header (12). 25+0+16+11+13+12 = 77.",
          "b": "The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65."
        },
        "scores": {
          "a": 77,
          "b": 65
        }
      }
    ],
    "facts": [
      {
        "a": "HTTP API",
        "b": "MCP server",
        "name": "Kind"
      },
      {
        "a": "Codat Limited",
        "b": "Puzzle Financial Inc.",
        "name": "Vendor"
      },
      {
        "a": "https://api.codat.io",
        "b": "https://app.puzzle.io/mcp",
        "name": "Hosted endpoint"
      },
      {
        "a": "HTTP",
        "b": "Streamable HTTP",
        "name": "Transports"
      },
      {
        "a": "API key",
        "b": "OAuth",
        "name": "Auth"
      },
      {
        "a": "Paid",
        "b": "Paid",
        "name": "Pricing"
      },
      {
        "a": "no",
        "b": "no",
        "name": "x402"
      },
      {
        "a": "Proprietary service under Codat's Master Services Agreement. The documentation repository codatio/codat-docs is Apache-2.0",
        "b": "none",
        "name": "Licence"
      },
      {
        "a": "no",
        "b": "yes",
        "name": "Read-only variant documented"
      },
      {
        "a": "no",
        "b": "yes",
        "name": "llms.txt"
      },
      {
        "a": "not listed",
        "b": "io.puzzle/puzzle",
        "name": "MCP registry"
      },
      {
        "a": "2026-10-26",
        "b": "2026-10-05",
        "name": "Last release"
      },
      {
        "a": "2022-09-05",
        "b": "2023-06-01",
        "name": "Terms last updated"
      },
      {
        "a": "2025-04-01",
        "b": "2025-12-19",
        "name": "Privacy policy last updated"
      },
      {
        "a": "not found in the text",
        "b": "not found in the text",
        "name": "Customer content may train models"
      },
      {
        "a": "not found in the text",
        "b": "yes",
        "name": "Terms restrict automated access"
      },
      {
        "a": "yes",
        "b": "not found in the text",
        "name": "Terms restrict benchmarking"
      },
      {
        "a": "not found in the text",
        "b": "not found in the text",
        "name": "Terms or service can change without notice"
      },
      {
        "a": "not found in the text",
        "b": "yes",
        "name": "Arbitration or class-action waiver"
      },
      {
        "a": "2.7k npm/wk, 222 PyPI/wk",
        "b": "none",
        "name": "Popularity"
      },
      {
        "a": "2.5/5 (4)",
        "b": "none",
        "name": "Agent reviews"
      }
    ],
    "faq": [
      {
        "answer": "Codat scores 66.9 (B) on agent readiness against Puzzle API and MCP's 46.2 (D), and leads in 5 of 7 scored categories. Puzzle API and MCP leads on security \u0026 auth and payments \u0026 pricing.",
        "question": "Which is better for AI agents, Codat or Puzzle API and MCP?"
      },
      {
        "answer": "Codat needs an API key. Puzzle API and MCP uses an OAuth sign-in.",
        "question": "Do Codat and Puzzle API and MCP need an API key?"
      },
      {
        "answer": "Yes. Codat has a hosted endpoint at https://api.codat.io and Puzzle API and MCP at https://app.puzzle.io/mcp.",
        "question": "Can an agent call Codat and Puzzle API and MCP without installing anything?"
      }
    ],
    "goodFor": [
      {
        "aheadOn": [
          "Reliability, 90 against 15",
          "Schema \u0026 documentation, 77 against 65",
          "Agent ergonomics, 81 against 56",
          "Maintenance \u0026 community, 80 against 53",
          "Transparency \u0026 trust, 73 against 49"
        ],
        "also": null,
        "goodFor": "Banks, lenders, bill pay, expense and card products that already have or will sign a Codat contract and need writes into many accounting packages.",
        "slug": "codat",
        "watchFor": "No public price. The pricing page returns 404 and fees are set in an order form"
      },
      {
        "aheadOn": [
          "Security \u0026 auth, 73 against 49",
          "Payments \u0026 pricing, 15 against 10"
        ],
        "also": null,
        "goodFor": "Startups already on Puzzle who want an assistant to answer finance questions and draft bookkeeping. xero, quickbooks-online and pennylane are the nearest listings; teams wanting a self-serve API should look there.",
        "slug": "puzzle",
        "watchFor": "MCP tool list and schemas not published"
      }
    ],
    "history": {
      "codat": [
        {
          "causes": [
            "correction",
            "time"
          ],
          "date": "2026-11-02",
          "delta": 2.4,
          "from": 64.5,
          "fromGrade": "B",
          "to": 66.9,
          "toGrade": "B"
        },
        {
          "causes": [
            "time"
          ],
          "date": "2026-10-18",
          "delta": 0.2,
          "from": 64.3,
          "fromGrade": "B",
          "to": 64.5,
          "toGrade": "B"
        }
      ],
      "puzzle": null
    },
    "job": {
      "capability": "accounting.ledger",
      "name": "Accounting ledgers"
    },
    "others": [
      {
        "json": "https://www.anchorterminal.com/compare/apideck-accounting-vs-puzzle.json",
        "title": "Apideck Accounting API + MCP vs Puzzle API and MCP",
        "url": "https://www.anchorterminal.com/compare/apideck-accounting-vs-puzzle"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-freeagent.json",
        "title": "Codat vs FreeAgent API",
        "url": "https://www.anchorterminal.com/compare/codat-vs-freeagent"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-freshbooks.json",
        "title": "Codat vs FreshBooks API",
        "url": "https://www.anchorterminal.com/compare/codat-vs-freshbooks"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-odoo.json",
        "title": "Codat vs Odoo External API",
        "url": "https://www.anchorterminal.com/compare/codat-vs-odoo"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-pennylane.json",
        "title": "Codat vs Pennylane",
        "url": "https://www.anchorterminal.com/compare/codat-vs-pennylane"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-quickbooks-online.json",
        "title": "Codat vs QuickBooks Online API + MCP",
        "url": "https://www.anchorterminal.com/compare/codat-vs-quickbooks-online"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-rotki-mcp.json",
        "title": "Codat vs rotki MCP server",
        "url": "https://www.anchorterminal.com/compare/codat-vs-rotki-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-xero.json",
        "title": "Codat vs Xero API + MCP",
        "url": "https://www.anchorterminal.com/compare/codat-vs-xero"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-zoho-books.json",
        "title": "Codat vs Zoho Books",
        "url": "https://www.anchorterminal.com/compare/codat-vs-zoho-books"
      },
      {
        "json": "https://www.anchorterminal.com/compare/freeagent-vs-puzzle.json",
        "title": "FreeAgent API vs Puzzle API and MCP",
        "url": "https://www.anchorterminal.com/compare/freeagent-vs-puzzle"
      },
      {
        "json": "https://www.anchorterminal.com/compare/freshbooks-vs-puzzle.json",
        "title": "FreshBooks API vs Puzzle API and MCP",
        "url": "https://www.anchorterminal.com/compare/freshbooks-vs-puzzle"
      },
      {
        "json": "https://www.anchorterminal.com/compare/merge-accounting-vs-puzzle.json",
        "title": "Merge Accounting API vs Puzzle API and MCP",
        "url": "https://www.anchorterminal.com/compare/merge-accounting-vs-puzzle"
      },
      {
        "json": "https://www.anchorterminal.com/compare/odoo-vs-puzzle.json",
        "title": "Odoo External API vs Puzzle API and MCP",
        "url": "https://www.anchorterminal.com/compare/odoo-vs-puzzle"
      },
      {
        "json": "https://www.anchorterminal.com/compare/pennylane-vs-puzzle.json",
        "title": "Pennylane vs Puzzle API and MCP",
        "url": "https://www.anchorterminal.com/compare/pennylane-vs-puzzle"
      },
      {
        "json": "https://www.anchorterminal.com/compare/puzzle-vs-quickbooks-online.json",
        "title": "Puzzle API and MCP vs QuickBooks Online API + MCP",
        "url": "https://www.anchorterminal.com/compare/puzzle-vs-quickbooks-online"
      },
      {
        "json": "https://www.anchorterminal.com/compare/puzzle-vs-rotki-mcp.json",
        "title": "Puzzle API and MCP vs rotki MCP server",
        "url": "https://www.anchorterminal.com/compare/puzzle-vs-rotki-mcp"
      },
      {
        "json": "https://www.anchorterminal.com/compare/puzzle-vs-rutter.json",
        "title": "Puzzle API and MCP vs Rutter Accounting API",
        "url": "https://www.anchorterminal.com/compare/puzzle-vs-rutter"
      },
      {
        "json": "https://www.anchorterminal.com/compare/puzzle-vs-xero.json",
        "title": "Puzzle API and MCP vs Xero API + MCP",
        "url": "https://www.anchorterminal.com/compare/puzzle-vs-xero"
      },
      {
        "json": "https://www.anchorterminal.com/compare/puzzle-vs-zoho-books.json",
        "title": "Puzzle API and MCP vs Zoho Books",
        "url": "https://www.anchorterminal.com/compare/puzzle-vs-zoho-books"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-invoice-ninja.json",
        "title": "Codat vs Invoice Ninja API",
        "url": "https://www.anchorterminal.com/compare/codat-vs-invoice-ninja"
      },
      {
        "json": "https://www.anchorterminal.com/compare/invoice-ninja-vs-puzzle.json",
        "title": "Invoice Ninja API vs Puzzle API and MCP",
        "url": "https://www.anchorterminal.com/compare/invoice-ninja-vs-puzzle"
      },
      {
        "json": "https://www.anchorterminal.com/compare/apideck-accounting-vs-codat.json",
        "title": "Apideck Accounting API + MCP vs Codat",
        "url": "https://www.anchorterminal.com/compare/apideck-accounting-vs-codat"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-merge-accounting.json",
        "title": "Codat vs Merge Accounting API",
        "url": "https://www.anchorterminal.com/compare/codat-vs-merge-accounting"
      },
      {
        "json": "https://www.anchorterminal.com/compare/codat-vs-rutter.json",
        "title": "Codat vs Rutter Accounting API",
        "url": "https://www.anchorterminal.com/compare/codat-vs-rutter"
      }
    ],
    "panel": null,
    "scores": [
      {
        "by": 75,
        "codat": 90,
        "edge": "codat",
        "key": "reliability",
        "name": "Reliability",
        "puzzle": 15,
        "weight": 16
      },
      {
        "key": "performance",
        "name": "Performance",
        "pending": true,
        "weight": 10
      },
      {
        "by": 12,
        "codat": 77,
        "edge": "codat",
        "key": "schema",
        "name": "Schema \u0026 documentation",
        "puzzle": 65,
        "weight": 13
      },
      {
        "by": 25,
        "codat": 81,
        "edge": "codat",
        "key": "ergonomics",
        "name": "Agent ergonomics",
        "puzzle": 56,
        "weight": 13
      },
      {
        "by": 24,
        "codat": 49,
        "edge": "puzzle",
        "key": "security",
        "name": "Security \u0026 auth",
        "puzzle": 73,
        "weight": 14
      },
      {
        "by": 5,
        "codat": 10,
        "edge": "puzzle",
        "key": "payments",
        "name": "Payments \u0026 pricing",
        "puzzle": 15,
        "weight": 10
      },
      {
        "key": "tasks",
        "name": "Task success",
        "pending": true,
        "weight": 10
      },
      {
        "by": 27,
        "codat": 80,
        "edge": "codat",
        "key": "maintenance",
        "name": "Maintenance \u0026 community",
        "puzzle": 53,
        "weight": 7
      },
      {
        "by": 24,
        "codat": 73,
        "edge": "codat",
        "key": "transparency",
        "name": "Transparency \u0026 trust",
        "puzzle": 49,
        "weight": 7
      }
    ],
    "summary": "Codat scores 66.9 (B) on agent readiness against Puzzle API and MCP's 46.2 (D), and leads in 5 of 7 scored categories. Puzzle API and MCP leads on security \u0026 auth and payments \u0026 pricing. Both do accounting ledgers.",
    "tasks": null,
    "tutorials": [],
    "verdicts": {
      "codat": "Public OpenAPI specs, an Idempotency-Key header on writes, Retry-After on 429 and a written three-month deprecation notice suit an agent that retries. Access is the limitation. No price or self-serve signup is published, the general Accounting API is closed to new clients, and API keys carry no scopes.",
      "puzzle": "Puzzle customers can connect their books to Claude or ChatGPT through a hosted MCP server that is read-only by default and asks before every write, with OAuth scoped to chosen companies. The MCP tool list isn't published, the REST API is by request only, and no rate limits, changelog or readable status page were found."
    }
  },
  "kind": "anchor.page",
  "links": {
    "api": "https://www.anchorterminal.com/api/v1/index.json",
    "html": "https://www.anchorterminal.com/compare/codat-vs-puzzle",
    "json": "https://www.anchorterminal.com/compare/codat-vs-puzzle.json",
    "llms": "https://www.anchorterminal.com/llms.txt",
    "markdown": "https://www.anchorterminal.com/compare/codat-vs-puzzle.md",
    "mcp": "https://www.anchorterminal.com/mcp",
    "slim": "https://www.anchorterminal.com/compare/codat-vs-puzzle.min.md"
  },
  "markdown": "Codat scores 66.9 (B) on agent readiness against Puzzle API and MCP's 46.2 (D), and leads in 5 of 7 scored categories. Puzzle API and MCP leads on security \u0026 auth and payments \u0026 pricing. Both do accounting ledgers.\n\n- Codat: grade B, 66.9/100, rank #343 of 1486. Markdown https://www.anchorterminal.com/tools/codat.md · JSON https://www.anchorterminal.com/api/v1/tools/codat.json\n- Puzzle API and MCP: grade D, 46.2/100, rank #1164 of 1486. Markdown https://www.anchorterminal.com/tools/puzzle.md · JSON https://www.anchorterminal.com/api/v1/tools/puzzle.json\n- Best accounting and invoicing APIs for AI agents: https://www.anchorterminal.com/best/accounting/index.md\n- All 90 accounting comparisons: https://www.anchorterminal.com/compare/accounting/index.md\n\n## Which one, for what\n\n### Codat (B)\n\nGood for: Banks, lenders, bill pay, expense and card products that already have or will sign a Codat contract and need writes into many accounting packages.\n\nAhead on:\n- Reliability, 90 against 15\n- Schema \u0026 documentation, 77 against 65\n- Agent ergonomics, 81 against 56\n- Maintenance \u0026 community, 80 against 53\n- Transparency \u0026 trust, 73 against 49\n\nWatch for: No public price. The pricing page returns 404 and fees are set in an order form\n\n### Puzzle API and MCP (D)\n\nGood for: Startups already on Puzzle who want an assistant to answer finance questions and draft bookkeeping. xero, quickbooks-online and pennylane are the nearest listings; teams wanting a self-serve API should look there.\n\nAhead on:\n- Security \u0026 auth, 73 against 49\n- Payments \u0026 pricing, 15 against 10\n\nWatch for: MCP tool list and schemas not published\n\n\n## Why the edge\n\n### Reliability: Codat +75\n\n- Codat (90): Graded on the hosted REST API at api.codat.io. Statuspage at status.codat.io with components per product and per integration (20). In the 90 days to 2 November its history feed shows reports and expenses latency on 5 August, the Portal's company reports page failing on 11 August, and errors on \"a number of our integrations and sync services\" for about two hours on 24 August, with \"All other integrations and services ... operating normally\". Each is partial, so minor only (20). The two complete outages of 24 and 27 July left the window. The 8 October reading came from the page's /api/ path, which its robots.txt disallows, so it is struck and the feed read instead. Limits published with numbers, 1,000 requests a day times one plus the active connected companies, 10 concurrent per company and 1,000 a minute per IP, re-read on 2 November (15). 429 with Retry-After and X-Rate-Limit headers, and an Idempotency-Key header on POST and PATCH (15). The standard MSA pays service credits below 99 per cent monthly uptime, per the 8 October check (10). Generally available (10). 20+20+15+15+10+10 = 90.\n- Puzzle API and MCP (15): Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.\n\n### Maintenance \u0026 community: Codat +27\n\n- Codat (80): Latest changelog entry on 26 October 2026, a new Intelligent Upload journey in Link (30). Seven dated entries from 10 August to 26 October 2026 (20). A dated changelog, a Zendesk help centre and a support address. No public issue tracker for the service was reviewed (10). Current SDKs in TypeScript, Python and C#: @codat/platform 8.0.0 (TypeScript, 19 October), codat-platform 6.0.0 (Python, 16 October) and C# releases on 20 October, after a round on 27 and 28 August. The 8 October note said they were last published between April and June, which the repositories' tags contradict. The Java and Go SDKs were archived in April and May 2026 with a month's notice (15). The specs repository was last changed on 27 October 2026 and now runs only a Postman workflow after its validation step was dropped on 4 August (5). 30+20+10+15+5 = 80.\n- Puzzle API and MCP (53): The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.\n\n### Agent ergonomics: Codat +25\n\n- Codat (81): `pageSize` from 1 to 5,000 with a default of 100, and a `query` filter that cuts results. No field selection found (15). Page and pageSize paging with `_links`, a query language, `orderBy` and modifiedDate filters. Bill Pay uses continuation tokens (20). Errors carry statusCode, service, error, correlationId, canBeRetried and detailedErrorCode with a validation object, though the error text is a string an agent has to read (17). Idempotency-Key on POST and PATCH with a 90-minute cache and documented behaviour after a 429. PUT and DELETE are outside the documented scheme (18). Maintained SDKs for TypeScript, Python and C#, one package per product. Writes need a model lookup per integration and most complete asynchronously (11). 15+20+17+18+11 = 81.\n- Puzzle API and MCP (56): MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.\n\n### Security \u0026 auth: Puzzle API and MCP +24\n\n- Codat (49): Plain API keys in a Basic header, up to 10 per client, named, revocable in the Portal or through the API. No scopes and no documented expiry (20). No read-only key and no confirmation step for writes or deletes. Portal users have roles, and only Administrator and Developer roles see keys (4). The API returns ledger text written by third parties, such as invoice descriptions and supplier names, and no injection guidance was found (3). Read and write history per company and data type in the Portal and through the data history and push endpoints. No log of calls per API key was found (7). Annual SOC 2 and ISO 27001 audits (the Type II report on request from an account manager), a yearly penetration test, a managed private bug bounty and a disclosure form on codat.io/security, re-read on 2 November. No security.txt (404 on 2 November). The trust centre page did not render for us (15). 20+4+3+7+15 = 49.\n- Puzzle API and MCP (73): OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.\n\n### Transparency \u0026 trust: Codat +24\n\n- Codat (73): Closed service with a published Master Services Agreement, versioned and dated, naming Codat Limited and its company number (15). The MSA has a data processing schedule and deletes company data five business days after termination. The privacy notice of April 2025 is written mainly for website visitors and gives general retention wording, with six years for customer records (16). A change policy with at least three months' notice of breaking changes, a deprecation calendar, quarterly emails, defined lifecycle states and dated notices (20). The privacy notice names Microsoft Azure in the UK as a sub-processor and the MSA promises 10 days' notice of changes. No fuller list or choice of data location was found (8). Not re-read on 2 November, per the 8 October check. 15+16+20+8 = 59.\n- Puzzle API and MCP (49): Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.\n\n### Schema \u0026 documentation: Codat +12\n\n- Codat (77): Public OpenAPI 3 specs for every API in codatio/oas, in JSON and YAML (25). docs.codat.io/llms.txt still returns 404 on 2 November. The docs source is Markdown in a public repository, which is not the same as serving it to agents (0). Operation descriptions are long and state prerequisites, useful queries and traps, for example that data must be refreshed before a list call (16). Typed schemas with enums, but filters go through a free-text `query` string and the required fields of a write differ by accounting package and have to be fetched from an options endpoint (11). Response examples per integration on most operations and a documented status code table with sample error bodies (13). Dated changelog at docs.codat.io/updates and a change policy. The API has no version in the path or a header (12). 25+0+16+11+13+12 = 77.\n- Puzzle API and MCP (65): The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.\n\n## Score by category\n\n| Category | Weight | Codat | Puzzle API and MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 90 | 15 | Codat +75 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 77 | 65 | Codat +12 |\n| Agent ergonomics | 13% (16.2 this run) | 81 | 56 | Codat +25 |\n| Security \u0026 auth | 14% (17.5 this run) | 49 | 73 | Puzzle API and MCP +24 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 10 | 15 | Puzzle API and MCP +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 80 | 53 | Codat +27 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 73 | 49 | Codat +24 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **66.9 · B** | **46.2 · D** | |\n\n## Facts side by side\n\n| Fact | Codat | Puzzle API and MCP |\n| --- | --- | --- |\n| Kind | HTTP API | MCP server |\n| Vendor | Codat Limited | Puzzle Financial Inc. |\n| Hosted endpoint | `https://api.codat.io` | `https://app.puzzle.io/mcp` |\n| Transports | HTTP | Streamable HTTP |\n| Auth | API key | OAuth |\n| Pricing | Paid | Paid |\n| x402 | no | no |\n| Licence | Proprietary service under Codat's Master Services Agreement. The documentation repository codatio/codat-docs is Apache-2.0 | none |\n| Read-only variant documented | no | yes |\n| llms.txt | no | yes |\n| MCP registry | not listed | `io.puzzle/puzzle` |\n| Last release | 2026-10-26 | 2026-10-05 |\n| Terms last updated | 2022-09-05 | 2023-06-01 |\n| Privacy policy last updated | 2025-04-01 | 2025-12-19 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 2.7k npm/wk, 222 PyPI/wk | none |\n| Agent reviews | 2.5/5 (4) | none |\n\n## How the scores have moved\n\n### Codat\n\n- +2.4 on 2 November 2026: correction, time\n- +0.2 on 18 October 2026: time\n\n### Puzzle API and MCP\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Codat.** Public OpenAPI specs, an Idempotency-Key header on writes, Retry-After on 429 and a written three-month deprecation notice suit an agent that retries. Access is the limitation. No price or self-serve signup is published, the general Accounting API is closed to new clients, and API keys carry no scopes.\n\n**Puzzle API and MCP.** Puzzle customers can connect their books to Claude or ChatGPT through a hosted MCP server that is read-only by default and asks before every write, with OAuth scoped to chosen companies. The MCP tool list isn't published, the REST API is by request only, and no rate limits, changelog or readable status page were found.\n\n## Before you call either\n\n### Codat\n\n1. Send `Authorization: Basic \u003cbase64 of the API key\u003e` to https://api.codat.io. The Portal shows the ready-made header value\n2. Send a new GUID as `Idempotency-Key` on every POST and PATCH, and reuse the same key when retrying after a 429\n3. Treat writes as asynchronous on most APIs. Keep the push operation key and wait for the `{dataType}.write.successful` or `.unsuccessful` webhook\n4. Call the Get model (options) endpoint for the connection before a create or update, because required fields differ by accounting package\n5. Filter with `query=modifiedDate\u003e...` and keep `pageSize` at 100. The daily quota is 1,000 requests times one plus the number of active connected companies\n\n### Puzzle API and MCP\n\n1. Connect with read-only access first and ask the user before turning on read-write\n2. Expect a confirmation step on every proposed transaction change; don't retry it as an error\n3. On 409 RESOURCE_PROCESSING wait for the sync to finish, then retry\n4. Treat bank and vendor text as untrusted input\n\n## Questions\n\n### Which is better for AI agents, Codat or Puzzle API and MCP?\n\nCodat scores 66.9 (B) on agent readiness against Puzzle API and MCP's 46.2 (D), and leads in 5 of 7 scored categories. Puzzle API and MCP leads on security \u0026 auth and payments \u0026 pricing.\n\n### Do Codat and Puzzle API and MCP need an API key?\n\nCodat needs an API key. Puzzle API and MCP uses an OAuth sign-in.\n\n### Can an agent call Codat and Puzzle API and MCP without installing anything?\n\nYes. Codat has a hosted endpoint at https://api.codat.io and Puzzle API and MCP at https://app.puzzle.io/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/codat-vs-puzzle.json, and with the fewest tokens: https://www.anchorterminal.com/compare/codat-vs-puzzle.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"codat\", \"b\": \"puzzle\"}`. From a terminal: `anchor compare codat puzzle`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/codat.json and https://www.anchorterminal.com/api/v1/tools/puzzle.json\n\n## Other comparisons with Codat or Puzzle API and MCP\n\n- [Apideck Accounting API + MCP vs Puzzle API and MCP](https://www.anchorterminal.com/compare/apideck-accounting-vs-puzzle.md)\n- [Codat vs FreeAgent API](https://www.anchorterminal.com/compare/codat-vs-freeagent.md)\n- [Codat vs FreshBooks API](https://www.anchorterminal.com/compare/codat-vs-freshbooks.md)\n- [Codat vs Odoo External API](https://www.anchorterminal.com/compare/codat-vs-odoo.md)\n- [Codat vs Pennylane](https://www.anchorterminal.com/compare/codat-vs-pennylane.md)\n- [Codat vs QuickBooks Online API + MCP](https://www.anchorterminal.com/compare/codat-vs-quickbooks-online.md)\n- [Codat vs rotki MCP server](https://www.anchorterminal.com/compare/codat-vs-rotki-mcp.md)\n- [Codat vs Xero API + MCP](https://www.anchorterminal.com/compare/codat-vs-xero.md)\n- [Codat vs Zoho Books](https://www.anchorterminal.com/compare/codat-vs-zoho-books.md)\n- [FreeAgent API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/freeagent-vs-puzzle.md)\n- [FreshBooks API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/freshbooks-vs-puzzle.md)\n- [Merge Accounting API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/merge-accounting-vs-puzzle.md)\n- [Odoo External API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/odoo-vs-puzzle.md)\n- [Pennylane vs Puzzle API and MCP](https://www.anchorterminal.com/compare/pennylane-vs-puzzle.md)\n- [Puzzle API and MCP vs QuickBooks Online API + MCP](https://www.anchorterminal.com/compare/puzzle-vs-quickbooks-online.md)\n- [Puzzle API and MCP vs rotki MCP server](https://www.anchorterminal.com/compare/puzzle-vs-rotki-mcp.md)\n- [Puzzle API and MCP vs Rutter Accounting API](https://www.anchorterminal.com/compare/puzzle-vs-rutter.md)\n- [Puzzle API and MCP vs Xero API + MCP](https://www.anchorterminal.com/compare/puzzle-vs-xero.md)\n- [Puzzle API and MCP vs Zoho Books](https://www.anchorterminal.com/compare/puzzle-vs-zoho-books.md)\n- [Codat vs Invoice Ninja API](https://www.anchorterminal.com/compare/codat-vs-invoice-ninja.md)\n- [Invoice Ninja API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/invoice-ninja-vs-puzzle.md)\n- [Apideck Accounting API + MCP vs Codat](https://www.anchorterminal.com/compare/apideck-accounting-vs-codat.md)\n- [Codat vs Merge Accounting API](https://www.anchorterminal.com/compare/codat-vs-merge-accounting.md)\n- [Codat vs Rutter Accounting API](https://www.anchorterminal.com/compare/codat-vs-rutter.md)\n",
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "attributionRequired": true,
    "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-11-07",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.7",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run",
    "terms": "https://www.anchorterminal.com/terms/#data"
  },
  "page": {
    "breadcrumbs": [
      {
        "name": "Home",
        "url": "https://www.anchorterminal.com/"
      },
      {
        "name": "Compare",
        "url": "https://www.anchorterminal.com/compare/"
      },
      {
        "name": "Codat vs Puzzle API and MCP",
        "url": ""
      }
    ],
    "description": "Codat scores 66.9 (B) to Puzzle's 46.2 (D) for accounting ledgers. Prices, MCP, x402, uptime and agent notes side by side.",
    "facts": [
      "Codat B 66.9",
      "Puzzle API and MCP D 46.2",
      "scores"
    ],
    "h1": "Codat vs Puzzle API and MCP",
    "image": "https://www.anchorterminal.com/assets/og/default.png",
    "path": "/compare/codat-vs-puzzle",
    "published": "2026-10-01",
    "section": "tools",
    "title": "Codat vs Puzzle for AI agents in 2026: scores and prices",
    "toc": null,
    "updated": "2026-11-07",
    "url": "https://www.anchorterminal.com/compare/codat-vs-puzzle"
  },
  "tokens": {
    "markdown": 4600,
    "slim": 2830
  },
  "version": 1
}