Databar vs Dievio

Databar 73

Closed service. Python SDK 2.9.0 on 30 October 2026, 7 days before this check (30). SDK 2.7.0 and 2.8.0 on 6 October and changelog entries on 23, 24, 27, 28, 29 and 30 September and 1 October (20). A public changelog, roadmap and feedback portal, an email address, and a Slack channel on Scale (10 of 15). An official Python SDK and CLI, no other languages (10 of 15). Package health not checked (3 of 10). 30+20+10+10+3 = 73.

Dievio 28

Closed service with no changelog, release notes or version numbers. The latest dated changes on the vendor's pages are the terms and privacy policy of 31 October 2026, which describe the agent integration, token lifetimes and export expiry, and blog posts of 21 and 30 October 2026 on API billing; the MCP server, absent from the February and May 2026 archived copies, carries no date, and the API landing pages say content reviewed May 2026 (20 of 30). No release record, so no three dated entries in 90 days; 84 dated blog posts from 29 March to 30 October 2026 are articles, not releases (0). Support is one address, support@dievio.com, with email support on Starter and priority support on Growth; no public changelog, community channel, forum or issue tracker, and the Fazier launch page's comments are from other makers (3 of 15). Not in the official MCP registry and no official SDKs (0). No packages to judge (5 of 10). 20+0+3+0+5 = 28.

Databar 84

Each API reference page embeds its OpenAPI 3.1 operation (spec version 0.1.2), with no downloadable file found (20 of 25). llms.txt with 79 API entries and Markdown twins (10). Descriptions say when to use each endpoint, such as headless runs against table runs, and what a delete leaves behind (16 of 20). Typed request bodies with required fields (12 of 15). An error envelope with stable codes and examples for 400, 406 and 422 (14 of 15). v1 paths and a dated changelog, though the API's own versioning isn't described (12 of 15). 20+10+16+12+14+12 = 84.

Dievio 50

API reading, with the MCP server described. No OpenAPI or other machine-readable contract for the REST API; the MCP tool reference says clients discover exact input schemas through tools/list, that unknown fields and unlisted arguments are rejected, and the server publishes a dievio://schema/search-filters JSON resource, but no session was opened to read them (10 of 25). llms.txt and llms-full.txt on docs.dievio.com, generated on each build, plus llms.txt, pricing.md and product.md on dievio.com (10). The MCP reference says what each tool does, which tools are free, which scope each needs, when to prefer export_list_file over export_list and how to retry; the REST pages say what each endpoint returns and little about when to use search against lookup, and the MCP page says a preview does not unlock contacts and a count is not a guaranteed result (12 of 20). Filters are typed as strings, string arrays, booleans and integers with enumerations listed for seniority, department, employee size, business model, salary and email_status, bounds on page, limit, max_results and array length, and UUID ids; industries and locations are examples only, the funding dates are a year over REST and an ISO date over MCP, and the contact object for add_leads_to_list carries a free JSON lead_data field (10 of 15). curl examples with example responses for both REST endpoints, a pagination loop and six MCP worked prompts; errors are four status codes with one line each and no documented body, and the MCP error shape is not shown (8 of 15). No version in the path (/api/public), no changelog or release notes on either host, and plan allowances and API prices changed between the May and October 2026 copies of the pricing pages with no dated notice (0 of 15). 10+10+12+10+8+0 = 50.

Databar 55

Closed service with terms effective 1 October 2026 naming Databar, Inc. of Delaware (15 of 30). The privacy policy keeps data 'for as long as needed' with no periods; the docs give 24 hours for task results; a DPA is part of the agreement but was not read (15 of 30). The changelog flagged breaking API and SDK changes on 20 August 2026, and the terms let Databar retire any form of programmatic access; no notice period stated (8 of 20). Sub-processors are disclosed under the DPA, which was not read; data is processed in the United States (5 of 20). 15+15+8+5 = 43.

Dievio 27

Closed service. The terms (last updated 31 October 2026) cover use, credits, connected agents, a 30-day refund and availability in about 300 words but name no legal entity, address, governing law or jurisdiction, so the contracting party is unknown (8 of 30). The privacy policy (31 October 2026) lists the categories processed, the purposes, recipients by category, the agent connection data, and the access periods (authorization requests 10 minutes, codes 5, access tokens an hour, refresh 30 days, export links 15 minutes), says lead search uses Dievio's own contact database without saying where records are collected from, lets people in the database ask for access, correction, deletion or suppression by email, keeps records for as long as needed with no periods, and agrees with the terms and the docs on credits, revocation and link expiry; no DPA was found (14 of 30). No deprecation policy or notices; the terms allow the service to change at any time, and plan allowances and API prices changed between the 20 May and 31 October 2026 copies of the pricing pages with no dated notice (0 of 20). Service providers are named by category only (hosting, databases, authentication, contact processing, analytics, email delivery, payments), with no names, locations or transfer basis (4 of 20). 8+14+0+4 = 26.

Databar 47

A workspace API key in a header, never in the URL, and OAuth on the MCP with a Connected apps page to revoke access. No scopes found (20 of 30). No read-only key; MCP balance checks and confirmation above 50 credits, a 30-day trash for workbooks and tables, but row, column and table deletes through the tools (12 of 20). Enrichment results include web-scraped and AI researcher text, with no prompt-injection guidance (3 of 15). Credit usage charts, transaction logs and per-request data logs (12 of 15). No security.txt, disclosure policy, bug bounty or certification found (0 of 20). 20+12+3+12+0 = 47.

Dievio 56

MCP uses OAuth with the authorization code flow, PKCE S256, dynamic registration of public clients, refresh tokens of 30 days, a revocation endpoint and six scopes, revoked per connection on the dashboard; REST uses a plain API key from the dashboard as a bearer or X-API-Key header, with no documented scopes, rotation, expiry or revocation, and nothing documents a secret in a query string (25 of 30). mcp:read is the required baseline and cannot spend credits, leads:search, lists:write, leads:export and team:manage are separate consents, team:manage works for the owner only, the permissions page asks agents to confirm before deleting saved data and to invite or remove people only when asked, and the terms ask users to review filters and the maximum result count before authorising a paid operation; nothing asks for confirmation inside the server and REST keys have no least-privilege mode (16 of 20). Returned records are third-party contact data, and the permissions page says to treat names, descriptions, URLs and other field values as data rather than instructions, with no further mitigation (8 of 15). get_account reports the selected account, permissions and balances, list_search_jobs lists recent jobs, the dashboard lists and revokes each connection, and the privacy policy says operation results are kept to prevent duplicate actions; no audit log or per-call record is exposed to the operator (7 of 15). No security.txt on either host (404), no disclosure policy, bug bounty, SOC 2 or ISO 27001 (0 of 20). 25+16+8+7+0 = 56.