Drag vs Freshdesk API + MCP

Drag 49

Closed service under terms naming DragApp.com Ltd, with the MCP server under MIT (20 of 30). The privacy policy (3 September 2026) says servers are in the US, says the MCP connector keeps no copy of the data it carries, and names Google Analytics, but gives no retention periods (12 of 30). No deprecation policy or dated notices found (0). Hosting at AWS in Virginia is stated and the trust centre has a subprocessor section we could not open past its root page (10 of 20). 20 + 12 + 0 + 10 = 42.

Freshdesk API + MCP 85

Closed service with published terms, effective 1 April 2026 (15). Privacy notice effective 1 March 2026 says service data is generally kept up to six years and call recordings help train speech recognition, with a sub-processor list and a data hosting page, per the 1 October check (20). The API reference's Deprecation Policy says that when a new major version is generally available, deprecated parts cease to function after six months, and v1 is closed to new users. A written policy with a stated period meets the line, and beta APIs are excluded from it, so the EAP MCP stop on GA day costs nothing (20). Sub-processors and data centre locations published (18). 15 + 20 + 20 + 18 = 73.

Drag 23

One API key per user that the docs say grants full access to the workspace, revocable in settings; the hosted server wraps it in an OAuth 2.1 flow with PKCE, but the key remains the access token (10). No read-only key or scopes; the server instructions tell the model to confirm sends when intent is unclear, and ChatGPT's plugin asks before sending (5 of 20). Tools return email and WhatsApp text from outside senders, and no prompt-injection guidance was found (0). No audit log of API or MCP actions found (0). Google CASA Tier 2, and the trust centre lists SOC 2 and GDPR, but no security.txt (404) or disclosure policy was found (8 of 20). 10 + 5 + 0 + 0 + 8 = 23.

Freshdesk API + MCP 49

One API key per agent, sent as HTTP Basic on REST and as the raw Authorization value on MCP. It carries that agent's role, which is narrower than an account key but has no scopes, and the MCP security article confirms OAuth isn't supported (15). MCP inherits the key's permissions, and the write tools include createAgent, updateAgent and createTicketBulkUpdate, with no read-only mode or approval step (5). Tickets return customer-written text and we found no injection guidance (0). MCP actions show in the activity history like API and UI changes, and audit logs come with Enterprise (12). HackerOne disclosure programme, a security.txt with a contact but no Expires field, ISO and AICPA logos on the security page and a trust centre. security.txt, re-read on 4 November, also links an acknowledgements page and the HackerOne policy (17). 15 + 5 + 0 + 12 + 17 = 49.

Drag 71

No OpenAPI or other contract for REST v2 was found. Every MCP tool carries a JSON input schema in the open-source server (20 of 25). llms.txt for the site (10). Tool descriptions say which ID to pass, which tool to call first and when WhatsApp free text fails, and the server instructions add tips (17 of 20). Inputs are typed in the schemas, with IDs as strings and few enums (10 of 15). The REST docs show request and response examples for 24 endpoints and a shared error shape with 401, 429 and 500 (9 of 15). REST is v2, but no changelog was found; versions are visible only on npm and in the repository (5 of 15). 20 + 10 + 17 + 10 + 9 + 5 = 71.

Freshdesk API + MCP 50

No OpenAPI file, and the MCP tool schemas need an API key to read (0). No llms.txt (404 on developers.freshdesk.com on 4 November) (0). The API reference describes every endpoint, and the MCP article lists the 37 tool names with one-line descriptions (10). Attribute types and the numeric values for status, priority and source are documented (10). curl examples on each endpoint and 20 machine-readable error codes with field and message (15). The API is versioned (v2), and the reference carries a public changelog with month-dated entries from 2016 to November 2026, which the 1 October check missed (15). 0 + 0 + 10 + 10 + 15 + 15 = 50.

Drag 43

@dragapp/mcp-server 0.7.0 on npm on 13 August 2026, 85 days before this check; the repository had a commit on 6 November and its package.json reads 0.12.0 with no matching release (20). Only one dated release in the 90 days from 8 August, and no changelog (0). 43 commits since 6 July 2026 by the CTO; issues were not read (8 of 25). Domain-verified com.dragapp/mcp-server namespace, but the entry stops at 0.1.5 and lists only the stdio package, not the hosted remote (10 of 15). A secret-scan workflow and a tarball check before publish; no tests in CI (5 of 10). 20 + 0 + 8 + 10 + 5 = 43.

Freshdesk API + MCP 26

The last dated API change we count is the MCP server going GA on 10 September 2026, 55 days before this check (20). The API changelog's November 2026 entry documents API group and sublimit rate-limit headers in the Rate Limit section, a documentation change that can't set recency on its own, and the next newest entry is June 2022. Standard MCP pricing and limits took effect for EAP users on 5 October, a pricing date rather than an API change. One documentation entry in the 90 days from 6 August, not three (0). A public API changelog, a support portal and a community forum, no public issue tracker (6). No official SDKs (0). No package to assess (0). 20 + 0 + 6 + 0 + 0 = 26.

Drag 28

Graded as a hosted service on the MCP server at app.dragapp.com/mcp and REST API v2. No status page is linked and status.dragapp.com failed the TLS handshake (0). No readable incident history (5). The REST docs say rate limits apply without numbers; the hosted MCP server's source defaults to 60 calls a minute per key (5 of 15). The REST docs say to retry a 429 with exponential backoff, with no idempotency guidance for sends (8 of 15). No SLA found (0). Neither surface is labelled beta (10). 0 + 5 + 5 + 8 + 0 + 10 = 28.

Freshdesk API + MCP 40

status.freshworks.com exists but renders only with JavaScript, re-read on 4 November, and the only component reading on 1 October came from its JSON, which this run doesn't read. A status-page line whose components were never read scores 0 in this run (0), and there is no incident record we could read (5). REST limits are published per plan (100, 400 and 700 calls a minute on Growth, Pro and Enterprise, with lower caps on ticket create, update and list) and MCP limits are 25, 50 and 100 actions a minute (15). Every response carries X-RateLimit-Total, -Remaining and -Used-CurrentRequest, and since a November 2026 changelog entry the docs also describe API group and sublimit headers. A 429 carries Retry-After, and the best-practice notes say to retry after the Retry-After time. There is no idempotency key or safe-retry guidance for ticket creation, so Retry-After alone (10). No uptime SLA found. The SLA rows on the pricing page are ticket SLA policies (0). API v2 is GA and the MCP server went GA on 10 September 2026 (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Drag 43

47 MCP tools load by default, with no toolsets (5). Search and filter tools by label, assignee or status, and bulk moves; paging controls were not documented (10 of 20). REST errors return error and message with standard codes, and MCP error shapes weren't documented (8 of 20). Every tool sets readOnlyHint and destructiveHint, with sends marked destructive and open-world; no idempotency keys (15 of 20). One URL for the hosted server; the docs say official SDKs and a CLI are coming soon (5 of 15). 5 + 10 + 8 + 15 + 5 = 43.

Freshdesk API + MCP 48

37 MCP tools, 20 read and 17 write, with no toolsets or read-only subset (5). REST lists take per_page up to 100, return a Link header for the next page and support filter queries and ticket search (18). Errors return code, field and message from a documented list of 20 codes (20). No idempotency key, and we couldn't read MCP tool annotations. Failed calls count against the rate limit (0). No official SDKs (5). 5 + 18 + 20 + 0 + 5 = 48.