Coresignal API + MCP vs ZeroBounce

Coresignal API + MCP 86

OpenAPI 3.1 file at api.coresignal.com/cdapi/openapi.json, 56 paths and 247 schemas on 2 November, with apikey header auth (25). llms.txt index of 195 pages and Markdown copies of every docs page (10). Endpoint pages and the MCP tool list state purpose and credit cost per call (15 of 20). Simple filters are typed, but the main search takes Elasticsearch DSL, a free-form JSON body (9 of 15). Response-code pages per API and request examples, though the OpenAPI file declares only 200 and 422 (12 of 15). v2 API paths and monthly release notes with dated entries and flagged breaking changes (15).

ZeroBounce 54

No OpenAPI or other machine-readable contract found; a Postman collection is linked (5 of 25). llms.txt lists marketing pages, and the docs have no Markdown twins (5 of 10). Endpoint pages explain timing, credits and when to use batch or file APIs (14 of 20). Parameter tables and listed status and sub-status values, including the ai_agent_mailbox sub-status added in July 2026 (10 of 15). Examples per endpoint, a sandbox and an error-code page (12 of 15). v2 paths, an API migration page and dated maintenance notices on the status page, with no API changelog (8 of 15). 5+5+14+10+12+8 = 54.

Coresignal API + MCP 60

Better Stack status page at status.coresignal.com with CDAPI, RTAPI and Self-service components (20). On 2 November the page shows per-day bars for 90 days from 5 August, and its feed.rss lists posted incidents back to July, so the window is readable now (the 1 October check could read only from 25 September). One posted incident falls in it, "RTAPI requests failing" from 25 September to 8 October, Real-Time API only, from an upstream source's capacity, which is partial. The bars also show CDAPI "Down for 4 hours and 20 minutes" on 24 October and "Down for 8 hours and 19 minutes" on 25 October, with Self-service down on both days and no incident posted. That is the core Data API down for more than an hour, read as one major (10). Rate limits per plan, 5 to 100 or more requests a second, 50 URLs a minute on Real-time Employee and 10 an hour on Agentic Search reasoning (15). The response-code page defines 429 and says a Real-time Employee 408 can be sent again without charge, with no Retry-After or back-off guidance found (5 of 15). No SLA found (0). The surfaces agents use are generally available (10). 20 + 10 + 15 + 5 + 0 + 10 = 60.

ZeroBounce 75

Hosted lines. Statuspage at status.zerobounce.net with API, API-US, API-EU, Bulk API, website and Cloudflare components (20). The incident feed for 8 August to 6 November shows a 6-minute members platform disruption on 9 September, about 3 minutes of reduced EU API availability on 1 October, and a file upload issue on 26 October resolved within 6 minutes, all minor (20). Limits published per endpoint group with numbers and block lengths (15). 429 is documented with advice to throttle, but no Retry-After, and a block can last an hour or a day (10 of 15). No SLA found (0). Generally available (10). 20+20+15+10+0+10 = 75.

Coresignal API + MCP 20

No x402, MPP or L402 (0). Every plan price, credit allowance and per-endpoint credit cost is public, and only successful collect or enrich calls are charged (20). 7-day trial with 2,000 credits once per company email domain. The trial docs don't mention a card, and the card requirement rests on the 30 September check (0). A person signs up in a browser (0).

ZeroBounce 35

No x402, MPP or L402 (0). Per-credit prices public, from $39 for 2,000 validations (20). Freemium of 100 validations a month for business or premium domains; a card requirement isn't stated, and free webmail addresses don't qualify (15 of 20). A person signs up in a browser (0). 0+20+15+0 = 35.

Coresignal API + MCP 82

Release notes have dated entries to 1 November 2026 (30). 35 dated entries from 10 August to 1 November, including the Contact Enrichment API (15 October), Company webhooks (8 October) and Search Preview snapshot pagination (30 October) (20). Public, detailed release notes, and we didn't test support (12 of 15). Listed in the official MCP registry as com.coresignal/mcp 2.0.0, a domain-verified namespace, published 7 August 2026 (15). No SDK packages to judge (5 of 10). 30 + 20 + 12 + 15 + 5 = 82.

ZeroBounce 70

Closed service. The JavaScript SDK 3.0.0 was published on 25 October 2026 (30). No API changelog; the dated changes found in 90 days are that release and status-page notices, fewer than three releases (10 of 20). Support by email and 24/7 chat per the docs, a public status page; replies not tested (10 of 15). Official SDKs in many languages and an MCP server (15). Package health not checked (5 of 10). 30+10+10+15+5 = 70.

Coresignal API + MCP 71

Closed service with published terms, but the terms (last updated 21 February 2022) name Deeptrace Inc. (Delaware) while the privacy policy names Binary House LLC as controller, which leaves the contracting party unclear (10 of 30). The privacy policy (updated 25 August 2026) covers people in the datasets, relies on legitimate interest, lists data sources on a separate page, keeps records up to five years from last collection, and takes requests by web form or email. No DPA found in the policy (20 of 30). Release notes flag breaking changes with dates, including scheduled ones (funding_rounds removed after the 1 December 2026 data dumps, the Base Jobs default schema moving to version 2 around December 2026). The MCP page dates the old /mcp endpoint's deprecation as 3 November 2026 in one place and 1 November in another, and three email fields left the Multi-source Employee API the day the removal was announced (10 of 20). Subprocessors named in the policy (Stripe, SendGrid, Deeptrace, Google, Meta) with US transfers under contractual clauses (15 of 20).

ZeroBounce 63

Closed service under terms naming Hertza L.L.C. (ZeroBounce) of Nevada; SDKs and MCP server open source (15 of 30). The data protection page says uploaded data is never kept more than 30 days, the privacy policy of 30 June 2026 keeps account data 'as long as needed', and EU and UK DPAs are published (22 of 30). An API migration page, with no dated deprecation policy (6 of 20). A sub-processor list naming each provider and the data exchanged (16 of 20). 15+22+6+16 = 59.

Coresignal API + MCP 58

apikey header on REST. MCP v2 signs in with OAuth 2.1 through the dashboard and keeps the key server-side. We found no key scopes (22 of 30). Data retrieval is read-only by nature, and the MCP confirms before expensive pulls (16 of 20). Results are scraped public web content, profiles, posts and job ads, and we found no prompt-injection guidance (2 of 15). Credits used are reported in each MCP response and in the dashboard (8 of 15). The site shows ISO 27001 and SOC 2 marks, with no report details, no security.txt (coresignal.com/.well-known/security.txt answers 404 on 2 November) and no bug bounty found (10 of 20).

ZeroBounce 65

Several named keys besides a Master key, regeneration, deactivation and IP whitelists (25), less 10 because the documented calls carry the key in the api_key query string (15 of 30). Validation only reads, though file and list endpoints can delete uploads (12 of 20). Results are structured status codes with little free text (10 of 15). API usage and dashboard statistics endpoints (10 of 15). SOC 2 Type 2, ISO/IEC 27001:2022, continuous testing with Intigriti and penetration testing with BitSentinel; no public disclosure policy found (18 of 20). 15+12+10+10+18 = 65.