Dixa vs FreeScout

Dixa 12

No dated change to the API could be read. The product release notes at releases.dixa.help/en draw their entries by script, so none were read, and the developer hub has no API changelog. New beta Intelligence API endpoints and an Exports API guide carry no date. The MCP repository's commits on 29 and 30 October 2026 (full v1 endpoint coverage, secret redaction) carry no tag, version change or changelog entry, so under this run's reading they aren't releases. The 8 October recency credit rested on the same kind of evidence, an untagged MCP commit of 10 July, so recency goes to 0 (was 20). Three dated entries in the last 90 days were not found (0). The MCP repository's issues were answered as on 8 October, six closed after replies, and the README says it sits outside official support (10 of 15). No official API client libraries, and the MCP registry wasn't read (0). The MCP server has no CI, no tags and unpinned dependencies, though a test folder now checks secret exposure (2). 0 + 0 + 10 + 0 + 2 = 12.

FreeScout 70

Core v1.8.249 tagged on 31 October 2026 (30). Twelve tags from 30 August to 31 October (20). Issue responsiveness was not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). No official SDK, and no MCP server from the project (0). CI with tests on MySQL and PostgreSQL, and a Laravel dependency advisory taken on 31 October (10). 30 + 20 + 10 + 0 + 10 = 70.

Dixa 77

Closed service under published terms of service. The MCP repository is described as open source but has no licence file (15). The DPA commits to deleting customer personal data within three months of termination and to breach notice within 48 hours, and the data security page names AWS in Ireland. The privacy policy is dated 25 November 2021, and the terms let Dixa use aggregated, de-identified usage data to improve its services, with no statement on model training found (20). The Integrations API is marked deprecated with a migration guide but no end date, and webhook changes are promised in advance without a stated period (8). The sub-processor list, updated 31 July 2026, gives addresses, purposes and transfer mechanisms, with 30 days' notice of additions (20). 15 + 20 + 8 + 20 = 63.

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.

Dixa 73

Public OpenAPI 3.0.3 file for v1, linked as a download from llms.txt, with 93 paths and 126 operations (3 marked deprecated), plus separate beta and Exports API files (25). llms.txt, llms-full.txt and a Markdown copy of every docs and reference page (10). Endpoint descriptions state purpose and some limits, such as 100 child conversations per parent, but rarely say when not to use a call (12). Typed fields with enumerated values on many, though message content is typed any and the MCP search tool takes free-form filter dictionaries (10). Request and response examples in the spec, while error responses are 400, 404 and 500 with a single message string (9). The API is versioned in the path as v1 and beta, and deprecated endpoints name their replacements, but no API changelog was found in the developer hub (7). 25 + 10 + 12 + 10 + 9 + 7 = 73.

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

Dixa 15

No x402, MPP or L402 (0). Plan prices are public in euros and pounds, Growth 89, Ultimate 139 and Prime 179 euros per agent a month, with the Mim AI agent at 0.40 euros a conversation. API calls aren't priced separately (15). The pricing page says there is no self-serve trial (0). Access starts with a demo and an administrator creates the token in the web app (0). 0 + 15 + 0 + 0 = 15.

FreeScout 0

Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.

Dixa 42

API tokens are created by an administrator in Settings, with permissions chosen per token. No OAuth for the API, and no token expiry or rotation feature was found in the developer docs (22). A token can be limited by permission, but the MCP server has no read-only mode and relies on docstring text telling the model to ask for confirmation before writes (10). Conversations hold customer-written text and no prompt-injection guidance was found (0). Conversation and organisation activity logs are readable through the API and webhook delivery logs are kept, with no per-token call log found (6). security.txt returns 404 (re-read on 4 November), the data security page names no certification beyond Amazon's and Stripe's, and the trust centre on app.vanta.com needs JavaScript and wasn't read (4 of 20, held as a partial). 22 + 10 + 0 + 6 + 4 = 42.

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

Dixa 65

Graded on the REST API at dev.dixa.io, hosted lines. Statuspage at status.dixa.io with component groups for the agent interface, email, telephony, other channels, routing and integrations, including a Dixa API and Exports API component (20). In the window from 6 August 2026 the history page records one full outage of the API. On 23 October every request to the Dixa Public API, across all versions, failed with HTTP 500 from 11:15 to 11:31 CEST (16 minutes), after a faulty deployment of the authentication component, with a post-mortem. It also records intermittent Instagram messaging issues from 28 to 30 October, one channel only, read as minor, and scheduled maintenance on 19 August, 7 September, 1 October and 3 November. One major gives 10 (was 20). The 8 October incident reading came from the Statuspage /api/v2 JSON endpoint, which robots.txt disallows, so it is struck and replaced by the history pages. Rate limits published per token, 10 requests a second, bursts of 4, 864,000 a day (15). 429 is documented, with no Retry-After, backoff guidance or idempotency keys found (5 of 15, held as a partial). The SLA (3 April 2018) covers every plan, with a 5 per cent credit below 99.9 per cent monthly uptime and 10 per cent below 99.0 (10). API v1 is generally available, while the Intelligence API and the MCP server are labelled beta (5 of 10, held). 20 + 10 + 15 + 5 + 10 + 5 = 65.

FreeScout 73

Read with the local-software lines, because FreeScout runs only on the operator's server; there is no first-party hosted service. Installs from official releases with a web installer and updater, with PHP and MySQL or PostgreSQL requirements stated (20). Public CI in test.yml, test-pgsql.yml and phpcs.yml with feature tests; pass status not read (18 of 25). Open crash and regression issues were not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). Patch releases v1.8.238 to v1.8.249 with notes on GitHub, and module versions tied to a required core version (10 of 15). Past 1.0 (15). 20 + 18 + 10 + 10 + 15 = 73.