Drag vs Help Scout API + MCP

Drag 28

Graded as a hosted service on the MCP server at app.dragapp.com/mcp and REST API v2. No status page is linked and status.dragapp.com failed the TLS handshake (0). No readable incident history (5). The REST docs say rate limits apply without numbers; the hosted MCP server's source defaults to 60 calls a minute per key (5 of 15). The REST docs say to retry a 429 with exponential backoff, with no idempotency guidance for sends (8 of 15). No SLA found (0). Neither surface is labelled beta (10). 0 + 5 + 5 + 8 + 0 + 10 = 28.

Help Scout API + MCP 75

Atlassian Statuspage at status.helpscout.com with an Inbox API component and history in its Atom feed (20). In the 90 days to 4 November 2026 the feed has six incidents, slow reports on 6 August, SLA errors on 13 August, slow Live Chat on 14 August, Inbox and AI Drafts errors for some customers on 18 August (11:38 to 14:50 EDT), and wrong Inbox counts on 31 August and 22 September, plus scheduled database maintenance on 14 and 27 August and up to two hours of announced downtime on 26 September. None took the Inbox API down, so minor only (20). The pricing page gives 200, 400 and 800 calls a minute on Standard, Plus and Pro, and writes and v3 searches count as two requests (15). 429 with X-RateLimit-Retry-After and per-minute limit and remaining headers, with no idempotency or safe-retry guidance for writes (10, the value this run gives Retry-After alone). No SLA found (0). Inbox API 2.0 and the v3 endpoints are GA and the MCP server left beta on 28 July 2026 (10).

Drag 23

One API key per user that the docs say grants full access to the workspace, revocable in settings; the hosted server wraps it in an OAuth 2.1 flow with PKCE, but the key remains the access token (10). No read-only key or scopes; the server instructions tell the model to confirm sends when intent is unclear, and ChatGPT's plugin asks before sending (5 of 20). Tools return email and WhatsApp text from outside senders, and no prompt-injection guidance was found (0). No audit log of API or MCP actions found (0). Google CASA Tier 2, and the trust centre lists SOC 2 and GDPR, but no security.txt (404) or disclosure policy was found (8 of 20). 10 + 5 + 0 + 0 + 8 = 23.

Help Scout API + MCP 63

Inbox API uses OAuth 2.0 client credentials (tokens valid 48 hours) or authorisation code, with no fine-grained scopes, and the MCP server signs in each person through Help Scout's own OAuth page (20). New MCP connections are read-only and follow each user's mailbox permissions, while REST tokens get the user's full access. There's no account-wide switch to turn MCP off (15). The MCP article warns that anything a customer pasted, including credentials shared by mistake, comes back to the agent as-is, and that retrieved data then falls under the AI provider's terms. That's guidance, not a mitigation (8). Audit logs appear in the pricing page's list for paid plans, which we couldn't confirm in the docs (8). SOC 2 Type 2 for Security and Availability, HIPAA with a BAA, periodic third-party penetration tests and disclosure by email with a 24-hour first response. No security.txt and no bug bounty found (12).

Drag 49

Closed service under terms naming DragApp.com Ltd, with the MCP server under MIT (20 of 30). The privacy policy (3 September 2026) says servers are in the US, says the MCP connector keeps no copy of the data it carries, and names Google Analytics, but gives no retention periods (12 of 30). No deprecation policy or dated notices found (0). Hosting at AWS in Virginia is stated and the trust centre has a subprocessor section we could not open past its root page (10 of 20). 20 + 12 + 0 + 10 = 42.

Help Scout API + MCP 75

Closed service with published terms, effective June 2026 (15). Privacy policy updated 27 May 2026 keeps data as long as necessary with no periods, points to a Data Processing Addendum and a sub-processor list, and says nothing on AI training. The MCP article states that retrieved data falls under the AI provider's terms and that HIPAA customers need a separate BAA with that provider (16, per the 1 October check). The backward-compatibility page says breaking changes get a new version prefix, and the changelog dates its notices, such as the web attachment link marked deprecated on 29 January 2026 with removal set for 31 May and removed on 10 June, and V2 webhook payloads deprecated on 20 May. No notice period is stated, so this sits below a written deprecation policy with notice periods (15). Sub-processor list published and processing in the US on AWS (16).

Drag 43

@dragapp/mcp-server 0.7.0 on npm on 13 August 2026, 85 days before this check; the repository had a commit on 6 November and its package.json reads 0.12.0 with no matching release (20). Only one dated release in the 90 days from 8 August, and no changelog (0). 43 commits since 6 July 2026 by the CTO; issues were not read (8 of 25). Domain-verified com.dragapp/mcp-server namespace, but the entry stops at 0.1.5 and lists only the stdio package, not the hosted remote (10 of 15). A secret-scan workflow and a tarball check before publish; no tests in CI (5 of 10). 20 + 0 + 8 + 10 + 5 = 43.

Help Scout API + MCP 61

The developer changelog's latest entry is dated 29 October 2026, 6 days before this check (30). Six dated entries since 6 August, on 24 August, 23 September, 5, 15, 20 and 29 October (20). Support answers through the product, no public tracker (6, partly met, kept). One official SDK, for PHP, last tagged 3.10.3 on 15 June 2026 (5, partly met, kept). No package to assess (0).

Drag 43

47 MCP tools load by default, with no toolsets (5). Search and filter tools by label, assignee or status, and bulk moves; paging controls were not documented (10 of 20). REST errors return error and message with standard codes, and MCP error shapes weren't documented (8 of 20). Every tool sets readOnlyHint and destructiveHint, with sends marked destructive and open-world; no idempotency keys (15 of 20). One URL for the hosted server; the docs say official SDKs and a CLI are coming soon (5 of 15). 5 + 10 + 8 + 15 + 5 = 43.

Help Scout API + MCP 58

The MCP tool list isn't published (the help article lists 15 or more across conversations, customers, inboxes, users, workflows, reports and Docs). REST responses embed resources and page through links (12). Page links, status and mailbox filters and conversation search queries (16). Documented error responses (14). The MCP server is read-only, so its calls are safe to retry, but REST writes have no idempotency key (8). One official SDK, for PHP, plus a Laravel adapter (8).

Drag 71

No OpenAPI or other contract for REST v2 was found. Every MCP tool carries a JSON input schema in the open-source server (20 of 25). llms.txt for the site (10). Tool descriptions say which ID to pass, which tool to call first and when WhatsApp free text fails, and the server instructions add tips (17 of 20). Inputs are typed in the schemas, with IDs as strings and few enums (10 of 15). The REST docs show request and response examples for 24 endpoints and a shared error shape with 401, 429 and 500 (9 of 15). REST is v2, but no changelog was found; versions are visible only on npm and in the repository (5 of 15). 20 + 10 + 17 + 10 + 9 + 5 = 71.

Help Scout API + MCP 59

No OpenAPI file, and the MCP tool schemas need a sign-in to read (0). developer.helpscout.com/llms.txt serves the API docs as Markdown for agents (10). The Inbox API reference describes each endpoint (12). Fields and types documented per endpoint (10). An errors section and request and response examples (12). The API is versioned (v2, with v3 list and search endpoints since 23 September 2026) under a backward-compatibility page, and the developer changelog at developer.helpscout.com/mailbox-api/changelog/ has dated entries from 2025 to 29 October 2026 (15).