Drag vs HelpDesk

Drag 43

@dragapp/mcp-server 0.7.0 on npm on 13 August 2026, 85 days before this check; the repository had a commit on 6 November and its package.json reads 0.12.0 with no matching release (20). Only one dated release in the 90 days from 8 August, and no changelog (0). 43 commits since 6 July 2026 by the CTO; issues were not read (8 of 25). Domain-verified com.dragapp/mcp-server namespace, but the entry stops at 0.1.5 and lists only the stdio package, not the hosted remote (10 of 15). A secret-scan workflow and a tarball check before publish; no tests in CI (5 of 10). 20 + 0 + 8 + 10 + 5 = 43.

HelpDesk 9

Text's API changelog runs to 28 October 2026, but none of its entries since 6 August names the Ticketing API, and no dated change to this API was found anywhere (recency 0, 90-day line 0). Entries for other Text APIs don't count for this one, as for an umbrella SDK. Closed service with a developer email, Discord and 24-hour email support, per the 9 October check (9, kept as the earlier partial). No official SDK (0), no package (0). 0 + 0 + 9 + 0 + 0 = 9.

Drag 28

Graded as a hosted service on the MCP server at app.dragapp.com/mcp and REST API v2. No status page is linked and status.dragapp.com failed the TLS handshake (0). No readable incident history (5). The REST docs say rate limits apply without numbers; the hosted MCP server's source defaults to 60 calls a minute per key (5 of 15). The REST docs say to retry a 429 with exponential backoff, with no idempotency guidance for sends (8 of 15). No SLA found (0). Neither surface is labelled beta (10). 0 + 5 + 5 + 8 + 0 + 10 = 28.

HelpDesk 60

Graded on the hosted Ticketing REST API. Status page at status.helpdesk.com on incident.io with components for the Agent app, API, Integrations, support chat and subprocessors, and a 90-day history (20). From 6 August to 4 November the history and feed list no incidents, only scheduled maintenance on 30 September and 15 October (30). No rate limit found in the Ticketing reference or Text's docs (0). No 429, backoff or idempotency guidance (0). The pricing page lists SLAs under Enterprise, but no SLA document was found (0). v1 public API (10). 20 + 30 + 0 + 0 + 0 + 10 = 60.

Drag 23

One API key per user that the docs say grants full access to the workspace, revocable in settings; the hosted server wraps it in an OAuth 2.1 flow with PKCE, but the key remains the access token (10). No read-only key or scopes; the server instructions tell the model to confirm sends when intent is unclear, and ChatGPT's plugin asks before sending (5 of 20). Tools return email and WhatsApp text from outside senders, and no prompt-injection guidance was found (0). No audit log of API or MCP actions found (0). Google CASA Tier 2, and the trust centre lists SOC 2 and GDPR, but no security.txt (404) or disclosure policy was found (8 of 20). 10 + 5 + 0 + 0 + 8 = 23.

HelpDesk 44

OAuth 2.1 authorisation code grant with PKCE or personal access tokens as Basic auth, asking only for accounts--my:ro, so a token carries its user's whole role (20). Three roles, settings read-only for Agents and Viewers, deleted tickets kept 30 days in trash, no confirmation step (10). Ticket text is customer-written and no prompt-injection guidance was found (0). Audit log endpoint with an api author type covering configuration changes (9, kept as the earlier partial). SOC 2 Type 2 is claimed on the pricing page, with no security.txt on www.helpdesk.com or www.text.com (both 404) and no disclosure policy or bounty found, so a bare SOC 2 claim (5). 20 + 10 + 0 + 9 + 5 = 44.

Drag 49

Closed service under terms naming DragApp.com Ltd, with the MCP server under MIT (20 of 30). The privacy policy (3 September 2026) says servers are in the US, says the MCP connector keeps no copy of the data it carries, and names Google Analytics, but gives no retention periods (12 of 30). No deprecation policy or dated notices found (0). Hosting at AWS in Virginia is stated and the trust centre has a subprocessor section we could not open past its root page (10 of 20). 20 + 12 + 0 + 10 = 42.

HelpDesk 67

Closed service under Terms of Use dated 3 July 2026 naming Text, Inc. and covering APIs (15). Privacy Policy, DPA and Data Storage Policy placing HelpDesk data in the United States, per the 9 October check, not re-read on 4 November; DPA section 2.4 allows training on Client Data while the AI FAQ limits it to per-account internal models (17). Text's version lifecycle doesn't list this API and one webhook event is deprecated without a date (5, partial). 10 days' notice of new sub-processors and a stated storage location, with the sub-processor list on a script-drawn trust centre (12). 15 + 17 + 5 + 12 = 49.

Drag 71

No OpenAPI or other contract for REST v2 was found. Every MCP tool carries a JSON input schema in the open-source server (20 of 25). llms.txt for the site (10). Tool descriptions say which ID to pass, which tool to call first and when WhatsApp free text fails, and the server instructions add tips (17 of 20). Inputs are typed in the schemas, with IDs as strings and few enums (10 of 15). The REST docs show request and response examples for 24 endpoints and a shared error shape with 401, 429 and 500 (9 of 15). REST is v2, but no changelog was found; versions are visible only on npm and in the repository (5 of 15). 20 + 10 + 17 + 10 + 9 + 5 = 71.

HelpDesk 63

api.helpdesk.com refuses our reader in robots.txt, so the 9 October readings from its Redoc page are struck and the API was re-read from Text's copy. Text's docs embed the OpenAPI 3.0.3 operation (Ticketing API 1.0.0, server api.helpdesk.com) on each of 133 method pages, and llms.txt links the Ticketing openapi.json (25). llms.txt and Markdown pages (10). Few operations carry descriptions, though the index explains silos, attachments and date ranges (7, kept as the earlier partial). Enums, UUID formats and required fields with some free-form objects (11, partial). Examples on the pages read, with only 200 responses documented (5, partial). Path versioned at v1, and Text's API changelog has no entry for this API (5). 25 + 10 + 7 + 11 + 5 + 5 = 63.

Drag 30

No x402, MPP or L402 (0). Per-seat plan prices are public, and AI credits are priced at $0.01, with nothing per API call (10). The 7-day trial needs no card and includes every Pro feature, API and MCP among them (20). A person signs up in a browser and copies a key from settings (0). 0 + 10 + 20 + 0 = 30.

HelpDesk 35

No x402, MPP or L402 (0). Seat prices public ($19 and $79 a user a month billed yearly, $25 and $99 monthly, Enterprise by quote). Text's API pricing page meters every request except those answered 500 and sells 100,000 more calls for $29.50, and platform.text.com listed $0.27 per 1,000 private requests per the 9 October check, not re-read on 4 November (15, kept as the earlier partial). 14-day trial with no card (20). Browser signup and a console token (0). 0 + 15 + 20 + 0 = 35.