# Codat vs Puzzle API and MCP

> Codat scores 66.9 (B) to Puzzle's 46.2 (D) for accounting ledgers. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/codat-vs-puzzle
- Markdown: https://www.anchorterminal.com/compare/codat-vs-puzzle.md (~4,600 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Codat scores 66.9 (B) on agent readiness against Puzzle API and MCP's 46.2 (D), and leads in 5 of 7 scored categories. Puzzle API and MCP leads on security & auth and payments & pricing. Both do accounting ledgers.

- Codat: grade B, 66.9/100, rank #343 of 1486. Markdown https://www.anchorterminal.com/tools/codat.md · JSON https://www.anchorterminal.com/api/v1/tools/codat.json
- Puzzle API and MCP: grade D, 46.2/100, rank #1164 of 1486. Markdown https://www.anchorterminal.com/tools/puzzle.md · JSON https://www.anchorterminal.com/api/v1/tools/puzzle.json
- Best accounting and invoicing APIs for AI agents: https://www.anchorterminal.com/best/accounting/index.md
- All 90 accounting comparisons: https://www.anchorterminal.com/compare/accounting/index.md

## Which one, for what

### Codat (B)

Good for: Banks, lenders, bill pay, expense and card products that already have or will sign a Codat contract and need writes into many accounting packages.

Ahead on:
- Reliability, 90 against 15
- Schema & documentation, 77 against 65
- Agent ergonomics, 81 against 56
- Maintenance & community, 80 against 53
- Transparency & trust, 73 against 49

Watch for: No public price. The pricing page returns 404 and fees are set in an order form

### Puzzle API and MCP (D)

Good for: Startups already on Puzzle who want an assistant to answer finance questions and draft bookkeeping. xero, quickbooks-online and pennylane are the nearest listings; teams wanting a self-serve API should look there.

Ahead on:
- Security & auth, 73 against 49
- Payments & pricing, 15 against 10

Watch for: MCP tool list and schemas not published


## Why the edge

### Reliability: Codat +75

- Codat (90): Graded on the hosted REST API at api.codat.io. Statuspage at status.codat.io with components per product and per integration (20). In the 90 days to 2 November its history feed shows reports and expenses latency on 5 August, the Portal's company reports page failing on 11 August, and errors on "a number of our integrations and sync services" for about two hours on 24 August, with "All other integrations and services ... operating normally". Each is partial, so minor only (20). The two complete outages of 24 and 27 July left the window. The 8 October reading came from the page's /api/ path, which its robots.txt disallows, so it is struck and the feed read instead. Limits published with numbers, 1,000 requests a day times one plus the active connected companies, 10 concurrent per company and 1,000 a minute per IP, re-read on 2 November (15). 429 with Retry-After and X-Rate-Limit headers, and an Idempotency-Key header on POST and PATCH (15). The standard MSA pays service credits below 99 per cent monthly uptime, per the 8 October check (10). Generally available (10). 20+20+15+15+10+10 = 90.
- Puzzle API and MCP (15): Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

### Maintenance & community: Codat +27

- Codat (80): Latest changelog entry on 26 October 2026, a new Intelligent Upload journey in Link (30). Seven dated entries from 10 August to 26 October 2026 (20). A dated changelog, a Zendesk help centre and a support address. No public issue tracker for the service was reviewed (10). Current SDKs in TypeScript, Python and C#: @codat/platform 8.0.0 (TypeScript, 19 October), codat-platform 6.0.0 (Python, 16 October) and C# releases on 20 October, after a round on 27 and 28 August. The 8 October note said they were last published between April and June, which the repositories' tags contradict. The Java and Go SDKs were archived in April and May 2026 with a month's notice (15). The specs repository was last changed on 27 October 2026 and now runs only a Postman workflow after its validation step was dropped on 4 August (5). 30+20+10+15+5 = 80.
- Puzzle API and MCP (53): The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.

### Agent ergonomics: Codat +25

- Codat (81): `pageSize` from 1 to 5,000 with a default of 100, and a `query` filter that cuts results. No field selection found (15). Page and pageSize paging with `_links`, a query language, `orderBy` and modifiedDate filters. Bill Pay uses continuation tokens (20). Errors carry statusCode, service, error, correlationId, canBeRetried and detailedErrorCode with a validation object, though the error text is a string an agent has to read (17). Idempotency-Key on POST and PATCH with a 90-minute cache and documented behaviour after a 429. PUT and DELETE are outside the documented scheme (18). Maintained SDKs for TypeScript, Python and C#, one package per product. Writes need a model lookup per integration and most complete asynchronously (11). 15+20+17+18+11 = 81.
- Puzzle API and MCP (56): MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.

### Security & auth: Puzzle API and MCP +24

- Codat (49): Plain API keys in a Basic header, up to 10 per client, named, revocable in the Portal or through the API. No scopes and no documented expiry (20). No read-only key and no confirmation step for writes or deletes. Portal users have roles, and only Administrator and Developer roles see keys (4). The API returns ledger text written by third parties, such as invoice descriptions and supplier names, and no injection guidance was found (3). Read and write history per company and data type in the Portal and through the data history and push endpoints. No log of calls per API key was found (7). Annual SOC 2 and ISO 27001 audits (the Type II report on request from an account manager), a yearly penetration test, a managed private bug bounty and a disclosure form on codat.io/security, re-read on 2 November. No security.txt (404 on 2 November). The trust centre page did not render for us (15). 20+4+3+7+15 = 49.
- Puzzle API and MCP (73): OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.

### Transparency & trust: Codat +24

- Codat (73): Closed service with a published Master Services Agreement, versioned and dated, naming Codat Limited and its company number (15). The MSA has a data processing schedule and deletes company data five business days after termination. The privacy notice of April 2025 is written mainly for website visitors and gives general retention wording, with six years for customer records (16). A change policy with at least three months' notice of breaking changes, a deprecation calendar, quarterly emails, defined lifecycle states and dated notices (20). The privacy notice names Microsoft Azure in the UK as a sub-processor and the MSA promises 10 days' notice of changes. No fuller list or choice of data location was found (8). Not re-read on 2 November, per the 8 October check. 15+16+20+8 = 59.
- Puzzle API and MCP (49): Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.

### Schema & documentation: Codat +12

- Codat (77): Public OpenAPI 3 specs for every API in codatio/oas, in JSON and YAML (25). docs.codat.io/llms.txt still returns 404 on 2 November. The docs source is Markdown in a public repository, which is not the same as serving it to agents (0). Operation descriptions are long and state prerequisites, useful queries and traps, for example that data must be refreshed before a list call (16). Typed schemas with enums, but filters go through a free-text `query` string and the required fields of a write differ by accounting package and have to be fetched from an options endpoint (11). Response examples per integration on most operations and a documented status code table with sample error bodies (13). Dated changelog at docs.codat.io/updates and a change policy. The API has no version in the path or a header (12). 25+0+16+11+13+12 = 77.
- Puzzle API and MCP (65): The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.

## Score by category

| Category | Weight | Codat | Puzzle API and MCP | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 90 | 15 | Codat +75 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 77 | 65 | Codat +12 |
| Agent ergonomics | 13% (16.2 this run) | 81 | 56 | Codat +25 |
| Security & auth | 14% (17.5 this run) | 49 | 73 | Puzzle API and MCP +24 |
| Payments & pricing | 10% (12.5 this run) | 10 | 15 | Puzzle API and MCP +5 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 80 | 53 | Codat +27 |
| Transparency & trust | 7% (8.8 this run) | 73 | 49 | Codat +24 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **66.9 · B** | **46.2 · D** | |

## Facts side by side

| Fact | Codat | Puzzle API and MCP |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Codat Limited | Puzzle Financial Inc. |
| Hosted endpoint | `https://api.codat.io` | `https://app.puzzle.io/mcp` |
| Transports | HTTP | Streamable HTTP |
| Auth | API key | OAuth |
| Pricing | Paid | Paid |
| x402 | no | no |
| Licence | Proprietary service under Codat's Master Services Agreement. The documentation repository codatio/codat-docs is Apache-2.0 | none |
| Read-only variant documented | no | yes |
| llms.txt | no | yes |
| MCP registry | not listed | `io.puzzle/puzzle` |
| Last release | 2026-10-26 | 2026-10-05 |
| Terms last updated | 2022-09-05 | 2023-06-01 |
| Privacy policy last updated | 2025-04-01 | 2025-12-19 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | not found in the text | yes |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 2.7k npm/wk, 222 PyPI/wk | none |
| Agent reviews | 2.5/5 (4) | none |

## How the scores have moved

### Codat

- +2.4 on 2 November 2026: correction, time
- +0.2 on 18 October 2026: time

### Puzzle API and MCP

No score change since it was listed.

## Verdicts

**Codat.** Public OpenAPI specs, an Idempotency-Key header on writes, Retry-After on 429 and a written three-month deprecation notice suit an agent that retries. Access is the limitation. No price or self-serve signup is published, the general Accounting API is closed to new clients, and API keys carry no scopes.

**Puzzle API and MCP.** Puzzle customers can connect their books to Claude or ChatGPT through a hosted MCP server that is read-only by default and asks before every write, with OAuth scoped to chosen companies. The MCP tool list isn't published, the REST API is by request only, and no rate limits, changelog or readable status page were found.

## Before you call either

### Codat

1. Send `Authorization: Basic <base64 of the API key>` to https://api.codat.io. The Portal shows the ready-made header value
2. Send a new GUID as `Idempotency-Key` on every POST and PATCH, and reuse the same key when retrying after a 429
3. Treat writes as asynchronous on most APIs. Keep the push operation key and wait for the `{dataType}.write.successful` or `.unsuccessful` webhook
4. Call the Get model (options) endpoint for the connection before a create or update, because required fields differ by accounting package
5. Filter with `query=modifiedDate>...` and keep `pageSize` at 100. The daily quota is 1,000 requests times one plus the number of active connected companies

### Puzzle API and MCP

1. Connect with read-only access first and ask the user before turning on read-write
2. Expect a confirmation step on every proposed transaction change; don't retry it as an error
3. On 409 RESOURCE_PROCESSING wait for the sync to finish, then retry
4. Treat bank and vendor text as untrusted input

## Questions

### Which is better for AI agents, Codat or Puzzle API and MCP?

Codat scores 66.9 (B) on agent readiness against Puzzle API and MCP's 46.2 (D), and leads in 5 of 7 scored categories. Puzzle API and MCP leads on security & auth and payments & pricing.

### Do Codat and Puzzle API and MCP need an API key?

Codat needs an API key. Puzzle API and MCP uses an OAuth sign-in.

### Can an agent call Codat and Puzzle API and MCP without installing anything?

Yes. Codat has a hosted endpoint at https://api.codat.io and Puzzle API and MCP at https://app.puzzle.io/mcp.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/codat-vs-puzzle.json, and with the fewest tokens: https://www.anchorterminal.com/compare/codat-vs-puzzle.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "codat", "b": "puzzle"}`. From a terminal: `anchor compare codat puzzle`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/codat.json and https://www.anchorterminal.com/api/v1/tools/puzzle.json

## Other comparisons with Codat or Puzzle API and MCP

- [Apideck Accounting API + MCP vs Puzzle API and MCP](https://www.anchorterminal.com/compare/apideck-accounting-vs-puzzle.md)
- [Codat vs FreeAgent API](https://www.anchorterminal.com/compare/codat-vs-freeagent.md)
- [Codat vs FreshBooks API](https://www.anchorterminal.com/compare/codat-vs-freshbooks.md)
- [Codat vs Odoo External API](https://www.anchorterminal.com/compare/codat-vs-odoo.md)
- [Codat vs Pennylane](https://www.anchorterminal.com/compare/codat-vs-pennylane.md)
- [Codat vs QuickBooks Online API + MCP](https://www.anchorterminal.com/compare/codat-vs-quickbooks-online.md)
- [Codat vs rotki MCP server](https://www.anchorterminal.com/compare/codat-vs-rotki-mcp.md)
- [Codat vs Xero API + MCP](https://www.anchorterminal.com/compare/codat-vs-xero.md)
- [Codat vs Zoho Books](https://www.anchorterminal.com/compare/codat-vs-zoho-books.md)
- [FreeAgent API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/freeagent-vs-puzzle.md)
- [FreshBooks API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/freshbooks-vs-puzzle.md)
- [Merge Accounting API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/merge-accounting-vs-puzzle.md)
- [Odoo External API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/odoo-vs-puzzle.md)
- [Pennylane vs Puzzle API and MCP](https://www.anchorterminal.com/compare/pennylane-vs-puzzle.md)
- [Puzzle API and MCP vs QuickBooks Online API + MCP](https://www.anchorterminal.com/compare/puzzle-vs-quickbooks-online.md)
- [Puzzle API and MCP vs rotki MCP server](https://www.anchorterminal.com/compare/puzzle-vs-rotki-mcp.md)
- [Puzzle API and MCP vs Rutter Accounting API](https://www.anchorterminal.com/compare/puzzle-vs-rutter.md)
- [Puzzle API and MCP vs Xero API + MCP](https://www.anchorterminal.com/compare/puzzle-vs-xero.md)
- [Puzzle API and MCP vs Zoho Books](https://www.anchorterminal.com/compare/puzzle-vs-zoho-books.md)
- [Codat vs Invoice Ninja API](https://www.anchorterminal.com/compare/codat-vs-invoice-ninja.md)
- [Invoice Ninja API vs Puzzle API and MCP](https://www.anchorterminal.com/compare/invoice-ninja-vs-puzzle.md)
- [Apideck Accounting API + MCP vs Codat](https://www.anchorterminal.com/compare/apideck-accounting-vs-codat.md)
- [Codat vs Merge Accounting API](https://www.anchorterminal.com/compare/codat-vs-merge-accounting.md)
- [Codat vs Rutter Accounting API](https://www.anchorterminal.com/compare/codat-vs-rutter.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp