Databar vs LeadMagic API + MCP

Databar 28

Hosted lines. No status page linked from the site or docs (0). No incident history to read (5). The 20 August changelog says rate limits return 429, but no numbers were found in the docs read (5 of 15). The SDK backs off on 429 per the 28 September entry, tasks can be cancelled with a refund, and no Retry-After or idempotency key is documented (8 of 15). No SLA found (0). The MCP server left beta on 15 July 2026 and the API is generally available (10). 0+5+5+8+0+10 = 28.

LeadMagic API + MCP 52

Own status page at leadmagic.io/status listing the REST API, web app, Email Finder, Mobile Finder, Email Validation and integrations, with a live API health check but no incident history, re-read on 4 November (10 of 20). No history to read (5). Per-second and per-minute limits published, 5 or 10 requests a second for credit-free search with a fair-use ceiling of 13,333 searches a day, and 300 or 600 Email Finder and Validation lookups a minute by plan (15). 429 carries Retry-After with advice to back off, a rejected 429 consumes no credits, and 400s aren't charged. Bulk job submissions and the MCP's Tables tools write data, and no idempotency key or safe-retry guidance for writes was found, so safe-retry guidance without keys, as runway and fal-video read retries of billed jobs (12). The Service Level and Availability Policy states there's no guaranteed uptime and service credits are discretionary, per the 1 October check (0). Generally available (10). 10 + 5 + 15 + 12 + 0 + 10 = 52.

Databar 47

A workspace API key in a header, never in the URL, and OAuth on the MCP with a Connected apps page to revoke access. No scopes found (20 of 30). No read-only key; MCP balance checks and confirmation above 50 credits, a 30-day trash for workbooks and tables, but row, column and table deletes through the tools (12 of 20). Enrichment results include web-scraped and AI researcher text, with no prompt-injection guidance (3 of 15). Credit usage charts, transaction logs and per-request data logs (12 of 15). No security.txt, disclosure policy, bug bounty or certification found (0 of 20). 20+12+3+12+0 = 47.

LeadMagic API + MCP 63

REST keys prefixed lm_ in the X-API-Key header. The hosted MCP is OAuth only, with one mcp_all scope in its server card, and refuses static keys. No key scopes found (22 of 30). Tables tools now edit cells and delete rows and columns. The MCP docs say those deletions, cell edits, cancelling a run, enabling automatic runs and table runs over 5 credits need confirmation, but there's no read-only mode, and a focused connection 'is not a narrower authorization scope' (15 of 20). Results include ad copy, job posts and company descriptions from the open web, and we found no injection guidance beyond telling the model to report only what tools returned (4 of 15). X-Credits-Cost and X-Credits-Remaining on every response, request_id on errors, and an account analytics tool (12 of 15). security.txt valid per the 30 September check. The DPA promises breach notice within 72 hours. No SOC 2 or bug bounty found (10 of 20). 22 + 15 + 4 + 12 + 10 = 63.

Databar 35

No x402, MPP or L402 (0). Plan prices and credits are public, and each connector's credit cost is shown before a run and in the enrichment's pricing field; credits aren't sold per call outside a plan (15 of 20). A 14-day premium trial with no card, per the pricing FAQ (20). A person signs up in a browser, and API access needs a paid plan (0). 0+15+20+0 = 35.

LeadMagic API + MCP 20

No x402, MPP or L402 (0). Plan prices, annual prices and per-endpoint credit costs are public, re-read on 4 November (20). There are no free credits, the pricing FAQ now calls payments non-refundable except where law or a signed agreement says otherwise, and a 14-day Search trial 'with no automatic charge' covers search only, with no word on whether a card is needed (0). A person signs up and pays in a browser (0).

Databar 55

Closed service with terms effective 1 October 2026 naming Databar, Inc. of Delaware (15 of 30). The privacy policy keeps data 'for as long as needed' with no periods; the docs give 24 hours for task results; a DPA is part of the agreement but was not read (15 of 30). The changelog flagged breaking API and SDK changes on 20 August 2026, and the terms let Databar retire any form of programmatic access; no notice period stated (8 of 20). Sub-processors are disclosed under the DPA, which was not read; data is processed in the United States (5 of 20). 15+15+8+5 = 43.

LeadMagic API + MCP 65

Closed service with terms naming Lead Magic Corporation, Massachusetts (15). The privacy policy covers people returned by the API and links a request form, a do-not-sell page and privacy@leadmagic.io. We found no stated legal basis, data sources or retention periods in it. The DPA uses SCCs and the UK IDTA (14 of 30). Changelog entries are dated, but no deprecation policy or notices found (6 of 20). The DPA points to a subprocessor list with 15 days' notice of changes and says data is processed in the US and elsewhere (12 of 20).

Databar 84

Each API reference page embeds its OpenAPI 3.1 operation (spec version 0.1.2), with no downloadable file found (20 of 25). llms.txt with 79 API entries and Markdown twins (10). Descriptions say when to use each endpoint, such as headless runs against table runs, and what a delete leaves behind (16 of 20). Typed request bodies with required fields (12 of 15). An error envelope with stable codes and examples for 400, 406 and 422 (14 of 15). v1 paths and a dated changelog, though the API's own versioning isn't described (12 of 15). 20+10+16+12+14+12 = 84.

LeadMagic API + MCP 93

OpenAPI file at leadmagic.io/openapi.json, per the 30 September check (25). llms.txt (10). MCP tools state their purpose and credit cost, and the server tells the model to report only data the tools returned (16 of 20). Typed request bodies (12 of 15). RFC 9457 problem details with a request_id on every error, and documented 400, 401, 402 and 429 cases (15). A dated changelog versioned per component, api 3.3.1 on 2026-09-17 (15).

Databar 73

Closed service. Python SDK 2.9.0 on 30 October 2026, 7 days before this check (30). SDK 2.7.0 and 2.8.0 on 6 October and changelog entries on 23, 24, 27, 28, 29 and 30 September and 1 October (20). A public changelog, roadmap and feedback portal, an email address, and a Slack channel on Scale (10 of 15). An official Python SDK and CLI, no other languages (10 of 15). Package health not checked (3 of 10). 30+20+10+10+3 = 73.

LeadMagic API + MCP 80

The hosted MCP server is in the official MCP registry as io.leadmagic/server (and io.leadmagic/sheets) since 3 October 2026, with 2.23.5 published on 15 October 2026, 20 days before 4 November (30). The changelog's newest entry is api 3.3.1 on 17 September, which alone would give 20. In the 90 days from 6 August, changelog entries on 25 August (web 3.2.0 and api 3.3.0) and 17 September (api 3.3.1), and ten io.leadmagic/server versions between 3 and 15 October (20). Public changelog and support, issue handling not visible (10 of 15). In the official MCP registry under the verified io.leadmagic namespace (15). No packages to judge (5 of 10). 30 + 20 + 10 + 15 + 5 = 80. The MCP section of the changelog stops at mcp 2.5.0 (2 May 2026), while the server card reports 2.23.6, undated.