Dixa vs Drag

Dixa 65

Graded on the REST API at dev.dixa.io, hosted lines. Statuspage at status.dixa.io with component groups for the agent interface, email, telephony, other channels, routing and integrations, including a Dixa API and Exports API component (20). In the window from 6 August 2026 the history page records one full outage of the API. On 23 October every request to the Dixa Public API, across all versions, failed with HTTP 500 from 11:15 to 11:31 CEST (16 minutes), after a faulty deployment of the authentication component, with a post-mortem. It also records intermittent Instagram messaging issues from 28 to 30 October, one channel only, read as minor, and scheduled maintenance on 19 August, 7 September, 1 October and 3 November. One major gives 10 (was 20). The 8 October incident reading came from the Statuspage /api/v2 JSON endpoint, which robots.txt disallows, so it is struck and replaced by the history pages. Rate limits published per token, 10 requests a second, bursts of 4, 864,000 a day (15). 429 is documented, with no Retry-After, backoff guidance or idempotency keys found (5 of 15, held as a partial). The SLA (3 April 2018) covers every plan, with a 5 per cent credit below 99.9 per cent monthly uptime and 10 per cent below 99.0 (10). API v1 is generally available, while the Intelligence API and the MCP server are labelled beta (5 of 10, held). 20 + 10 + 15 + 5 + 10 + 5 = 65.

Drag 28

Graded as a hosted service on the MCP server at app.dragapp.com/mcp and REST API v2. No status page is linked and status.dragapp.com failed the TLS handshake (0). No readable incident history (5). The REST docs say rate limits apply without numbers; the hosted MCP server's source defaults to 60 calls a minute per key (5 of 15). The REST docs say to retry a 429 with exponential backoff, with no idempotency guidance for sends (8 of 15). No SLA found (0). Neither surface is labelled beta (10). 0 + 5 + 5 + 8 + 0 + 10 = 28.

Dixa 12

No dated change to the API could be read. The product release notes at releases.dixa.help/en draw their entries by script, so none were read, and the developer hub has no API changelog. New beta Intelligence API endpoints and an Exports API guide carry no date. The MCP repository's commits on 29 and 30 October 2026 (full v1 endpoint coverage, secret redaction) carry no tag, version change or changelog entry, so under this run's reading they aren't releases. The 8 October recency credit rested on the same kind of evidence, an untagged MCP commit of 10 July, so recency goes to 0 (was 20). Three dated entries in the last 90 days were not found (0). The MCP repository's issues were answered as on 8 October, six closed after replies, and the README says it sits outside official support (10 of 15). No official API client libraries, and the MCP registry wasn't read (0). The MCP server has no CI, no tags and unpinned dependencies, though a test folder now checks secret exposure (2). 0 + 0 + 10 + 0 + 2 = 12.

Drag 43

@dragapp/mcp-server 0.7.0 on npm on 13 August 2026, 85 days before this check; the repository had a commit on 6 November and its package.json reads 0.12.0 with no matching release (20). Only one dated release in the 90 days from 8 August, and no changelog (0). 43 commits since 6 July 2026 by the CTO; issues were not read (8 of 25). Domain-verified com.dragapp/mcp-server namespace, but the entry stops at 0.1.5 and lists only the stdio package, not the hosted remote (10 of 15). A secret-scan workflow and a tarball check before publish; no tests in CI (5 of 10). 20 + 0 + 8 + 10 + 5 = 43.

Dixa 77

Closed service under published terms of service. The MCP repository is described as open source but has no licence file (15). The DPA commits to deleting customer personal data within three months of termination and to breach notice within 48 hours, and the data security page names AWS in Ireland. The privacy policy is dated 25 November 2021, and the terms let Dixa use aggregated, de-identified usage data to improve its services, with no statement on model training found (20). The Integrations API is marked deprecated with a migration guide but no end date, and webhook changes are promised in advance without a stated period (8). The sub-processor list, updated 31 July 2026, gives addresses, purposes and transfer mechanisms, with 30 days' notice of additions (20). 15 + 20 + 8 + 20 = 63.

Drag 49

Closed service under terms naming DragApp.com Ltd, with the MCP server under MIT (20 of 30). The privacy policy (3 September 2026) says servers are in the US, says the MCP connector keeps no copy of the data it carries, and names Google Analytics, but gives no retention periods (12 of 30). No deprecation policy or dated notices found (0). Hosting at AWS in Virginia is stated and the trust centre has a subprocessor section we could not open past its root page (10 of 20). 20 + 12 + 0 + 10 = 42.

Dixa 42

API tokens are created by an administrator in Settings, with permissions chosen per token. No OAuth for the API, and no token expiry or rotation feature was found in the developer docs (22). A token can be limited by permission, but the MCP server has no read-only mode and relies on docstring text telling the model to ask for confirmation before writes (10). Conversations hold customer-written text and no prompt-injection guidance was found (0). Conversation and organisation activity logs are readable through the API and webhook delivery logs are kept, with no per-token call log found (6). security.txt returns 404 (re-read on 4 November), the data security page names no certification beyond Amazon's and Stripe's, and the trust centre on app.vanta.com needs JavaScript and wasn't read (4 of 20, held as a partial). 22 + 10 + 0 + 6 + 4 = 42.

Drag 23

One API key per user that the docs say grants full access to the workspace, revocable in settings; the hosted server wraps it in an OAuth 2.1 flow with PKCE, but the key remains the access token (10). No read-only key or scopes; the server instructions tell the model to confirm sends when intent is unclear, and ChatGPT's plugin asks before sending (5 of 20). Tools return email and WhatsApp text from outside senders, and no prompt-injection guidance was found (0). No audit log of API or MCP actions found (0). Google CASA Tier 2, and the trust centre lists SOC 2 and GDPR, but no security.txt (404) or disclosure policy was found (8 of 20). 10 + 5 + 0 + 0 + 8 = 23.

Dixa 15

No x402, MPP or L402 (0). Plan prices are public in euros and pounds, Growth 89, Ultimate 139 and Prime 179 euros per agent a month, with the Mim AI agent at 0.40 euros a conversation. API calls aren't priced separately (15). The pricing page says there is no self-serve trial (0). Access starts with a demo and an administrator creates the token in the web app (0). 0 + 15 + 0 + 0 = 15.

Drag 30

No x402, MPP or L402 (0). Per-seat plan prices are public, and AI credits are priced at $0.01, with nothing per API call (10). The 7-day trial needs no card and includes every Pro feature, API and MCP among them (20). A person signs up in a browser and copies a key from settings (0). 0 + 10 + 20 + 0 = 30.