Databar vs Dropcontact API + MCP

Databar 73

Closed service. Python SDK 2.9.0 on 30 October 2026, 7 days before this check (30). SDK 2.7.0 and 2.8.0 on 6 October and changelog entries on 23, 24, 27, 28, 29 and 30 September and 1 October (20). A public changelog, roadmap and feedback portal, an email address, and a Slack channel on Scale (10 of 15). An official Python SDK and CLI, no other languages (10 of 15). Package health not checked (3 of 10). 30+20+10+10+3 = 73.

Dropcontact API + MCP 15

No changelog. The newest dated API change found is the API_ERROR option, on by default for accounts created since 1 June 2026, which answers 400 when every record in a request has an error. That is between 90 and 180 days ago (10). The rebuilt docs carry no dated entries, so none fall in the 90 days from 6 August (0). Email support on every plan and no public changelog (5 of 15). No official SDKs and no registry entry we could read (0). No packages to judge (0, an in-between 3 with nothing behind it before). 10 + 0 + 5 + 0 + 0 = 15.

Databar 28

Hosted lines. No status page linked from the site or docs (0). No incident history to read (5). The 20 August changelog says rate limits return 429, but no numbers were found in the docs read (5 of 15). The SDK backs off on 429 per the 28 September entry, tasks can be cancelled with a refund, and no Retry-After or idempotency key is documented (8 of 15). No SLA found (0). The MCP server left beta on 15 July 2026 and the API is generally available (10). 0+5+5+8+0+10 = 28.

Dropcontact API + MCP 85

Atlassian Statuspage at status.dropcontact.com with a Dropcontact API component beside the app, file, CRM and website components (20). Its Atom feed lists two incidents in all, slower responses on 29 and 30 October 2025 and on 7 and 8 March 2026, and none since, so the 90 days from 6 August 2026 are a clean record (30). 60 requests a second, 250 records a request and 15 kB a record (15). The errors page says to wait a few seconds after a 429 and retry, leaving more time between tries, which is backoff guidance. No idempotency key or safe-retry guidance for the enrich call (10). No SLA found (0). The REST API is generally available, and this benchmark reads a GA API beside an MCP server its vendor calls early as GA (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

Databar 84

Each API reference page embeds its OpenAPI 3.1 operation (spec version 0.1.2), with no downloadable file found (20 of 25). llms.txt with 79 API entries and Markdown twins (10). Descriptions say when to use each endpoint, such as headless runs against table runs, and what a delete leaves behind (16 of 20). Typed request bodies with required fields (12 of 15). An error envelope with stable codes and examples for 400, 406 and 422 (14 of 15). v1 paths and a dated changelog, though the API's own versioning isn't described (12 of 15). 20+10+16+12+14+12 = 84.

Dropcontact API + MCP 54

No OpenAPI file or other machine-readable contract published (0). llms.txt and llms-full.txt list Markdown copies of every docs page in English and French (10). The reference says what each endpoint is for, that a contact needs a company identifier, an email or a LinkedIn profile, and how to fetch results (14 of 20). Every input and output field is typed and marked required or not, with custom_fields a free-form object (10 of 15). Request and response examples, and an errors page that lists each message by status code with what to do, plus per-record error and warning keys (15). /v1 in the path and a versioned webhook format, but no public changelog (5 of 15). 0 + 10 + 14 + 10 + 15 + 5 = 54.

Databar 55

Closed service with terms effective 1 October 2026 naming Databar, Inc. of Delaware (15 of 30). The privacy policy keeps data 'for as long as needed' with no periods; the docs give 24 hours for task results; a DPA is part of the agreement but was not read (15 of 30). The changelog flagged breaking API and SDK changes on 20 August 2026, and the terms let Databar retire any form of programmatic access; no notice period stated (8 of 20). Sub-processors are disclosed under the DPA, which was not read; data is processed in the United States (5 of 20). 15+15+8+5 = 43.

Dropcontact API + MCP 72

Closed service with terms (updated 5 August 2025) naming Dropcontact SAS, registered in Bobigny, no. 823 752 647 (15). The personal data charter (updated 5 August 2025) keeps prospecting data 3 years after the relationship plus 4 in intermediate storage, takes rights requests at data@dropcontact.io, says data may be collected from publicly accessible information and hosted in the EU with some subcontractors in the United States under standard contractual clauses, and a DPA is published. The pricing page says processing runs only on Dropcontact's own algorithms on EU servers with no reliance on non-compliant third-party providers, and that it uses no contact databases. It now also says mobile numbers come from signature extraction within internal email flows, with five years of history, which the charter doesn't mention (22 of 30). One dated change for new accounts (1 June 2026) and no deprecation policy (8 of 20). EU hosting and US subcontractors stated, no named subprocessor list found (10 of 20). 15 + 22 + 8 + 10 = 55.

Databar 47

A workspace API key in a header, never in the URL, and OAuth on the MCP with a Connected apps page to revoke access. No scopes found (20 of 30). No read-only key; MCP balance checks and confirmation above 50 credits, a 30-day trash for workbooks and tables, but row, column and table deletes through the tools (12 of 20). Enrichment results include web-scraped and AI researcher text, with no prompt-injection guidance (3 of 15). Credit usage charts, transaction logs and per-request data logs (12 of 15). No security.txt, disclosure policy, bug bounty or certification found (0 of 20). 20+12+3+12+0 = 47.

Dropcontact API + MCP 59

One API key per account in the X-Access-Token header, no scopes found. OAuth or the key as a bearer token on the MCP (20 of 30). Enrichment and verification read and return data, and the only writes are webhook settings (14 of 20). Results are cleaned names, titles and company fields rather than free text, so little untrusted content comes back (8 of 15). Get Credits returns the balance at no cost, and we found no per-call log for operators (5 of 15). security.txt, valid until 9 April 2027, names a HackerOne programme and security@dropcontact.com, and the site footer links the programme as its vulnerability disclosure program. The HackerOne page wasn't re-read. No SOC 2 or ISO 27001 found (12 of 20). No 2025 or 2026 record in the CVE list names Dropcontact. 20 + 14 + 8 + 5 + 12 = 59.

Databar 35

No x402, MPP or L402 (0). Plan prices and credits are public, and each connector's credit cost is shown before a run and in the enrichment's pricing field; credits aren't sold per call outside a plan (15 of 20). A 14-day premium trial with no card, per the pricing FAQ (20). A person signs up in a browser, and API access needs a paid plan (0). 0+15+20+0 = 35.

Dropcontact API + MCP 40

No x402, MPP or L402 (0). Plan prices and credit allowances are public in euros (Starter €79 and Growth €120 a month for 500 credits, 20 per cent off yearly), and a credit is one verified email found (given back when none is) or one email checked (20). 50 free credits at signup with no card (20). A person signs up in a browser and creates the key in the app (0). 0 + 20 + 20 + 0 = 40.