Drag vs LiveAgent

Drag 28

Graded as a hosted service on the MCP server at app.dragapp.com/mcp and REST API v2. No status page is linked and status.dragapp.com failed the TLS handshake (0). No readable incident history (5). The REST docs say rate limits apply without numbers; the hosted MCP server's source defaults to 60 calls a minute per key (5 of 15). The REST docs say to retry a 429 with exponential backoff, with no idempotency guidance for sends (8 of 15). No SLA found (0). Neither surface is labelled beta (10). 0 + 5 + 5 + 8 + 0 + 10 = 28.

LiveAgent 75

Graded as a hosted service, on API v3. status.liveagent.com shows four components (admin panel, call and video, ticket operations, email services) with 90-day bars, an archive and an RSS feed (20). In the 90 days from 6 August 2026 the feed lists announced billing maintenance on 8 September and a PHP security update on 21 October, patched in 2 hours 48 minutes with no downtime, and no incident. The 24 July Singapore outage has left the window, so the record is clean (30). The help centre states 180 requests a minute for each API key (15). No 429 status, rate-limit header, retry guidance or idempotency key was found in the articles read (0). No uptime SLA was found in the terms, the pricing page or the security page (0). API v3 is generally available (10).

Drag 23

One API key per user that the docs say grants full access to the workspace, revocable in settings; the hosted server wraps it in an OAuth 2.1 flow with PKCE, but the key remains the access token (10). No read-only key or scopes; the server instructions tell the model to confirm sends when intent is unclear, and ChatGPT's plugin asks before sending (5 of 20). Tools return email and WhatsApp text from outside senders, and no prompt-injection guidance was found (0). No audit log of API or MCP actions found (0). Google CASA Tier 2, and the trust centre lists SOC 2 and GDPR, but no security.txt (404) or disclosure policy was found (8 of 20). 10 + 5 + 0 + 0 + 8 = 23.

LiveAgent 52

API v3 keys are created by an admin with per-key permissions, plans allow 1, 5, 10 or unlimited keys, and a key is replaced by regenerating it. MCP uses OAuth 2.1 with PKCE or bearer tokens that expire after two years and are revoked one by one (28). Less 10 because the legacy v1 API documents its key as a URL or form parameter (18). Read-only permissions exist per key and MCP calls run under the agent's role, but a personal MCP token gets every tool the role allows and no confirmation step for writes was found. submit_answer_suggestion leaves a draft for review (13). Tickets hold customer-written text and no prompt-injection guidance was found (0). An audit log on the Business and Enterprise plans, and MCP actions recorded in ticket history under the agent's name (11). A bug bounty of $100 a verified vulnerability with reports by email and no stated acknowledgement time, fixes tagged [Security] in the changelog, and no security.txt. The sub-processor page says LiveAgent holds no SOC 2 or ISO 27001 yet and a SOC 2 Type II audit is under way (10).

Drag 43

@dragapp/mcp-server 0.7.0 on npm on 13 August 2026, 85 days before this check; the repository had a commit on 6 November and its package.json reads 0.12.0 with no matching release (20). Only one dated release in the 90 days from 8 August, and no changelog (0). 43 commits since 6 July 2026 by the CTO; issues were not read (8 of 25). Domain-verified com.dragapp/mcp-server namespace, but the entry stops at 0.1.5 and lists only the stdio package, not the hosted remote (10 of 15). A secret-scan workflow and a tarball check before publish; no tests in CI (5 of 10). 20 + 0 + 8 + 10 + 5 = 43.

LiveAgent 69

The newest changelog build is 5.70.3, dated 2 November 2026 (30). More than three dated builds since 6 August 2026, 30 in all (20). A public changelog that names API fixes, a status page and support by email, chat and phone. No public issue tracker (10). The Python client was regenerated on 6 October 2026 but is not on a package registry (7, kept). The client repository has tests and no visible CI run (2).

Drag 71

No OpenAPI or other contract for REST v2 was found. Every MCP tool carries a JSON input schema in the open-source server (20 of 25). llms.txt for the site (10). Tool descriptions say which ID to pass, which tool to call first and when WhatsApp free text fails, and the server instructions add tips (17 of 20). Inputs are typed in the schemas, with IDs as strings and few enums (10 of 15). The REST docs show request and response examples for 24 endpoints and a shared error shape with 401, 429 and 500 (9 of 15). REST is v2, but no changelog was found; versions are visible only on npm and in the repository (5 of 15). 20 + 10 + 17 + 10 + 9 + 5 = 71.

LiveAgent 48

The v3 Swagger definition and the v4 OpenAPI document are loaded by the Swagger UI script on the docs pages, with no visible download link, so this run doesn't read them and the 9 October reading is struck (0). www.liveagent.com/llms.txt now answers, indexing the site's product pages and linking the API documentation (10). The Python client Quality Unit generates for v3 lists its operations with one-line summaries, and the MCP tools reference is fuller, with when-to-use notes on each tool (9, kept). The client's models carry 165 enumerated values and ticket creation names its required fields, but _filters is a JSON string and status codes are single letters (9, kept). The v1 reference and the MCP reference carry examples and return fields, and the MCP reference documents its error objects (7). Versions sit in the path (v1, v3, v4), and a public changelog lists dated builds with API fixes, without a separate API changelog (13).

Drag 49

Closed service under terms naming DragApp.com Ltd, with the MCP server under MIT (20 of 30). The privacy policy (3 September 2026) says servers are in the US, says the MCP connector keeps no copy of the data it carries, and names Google Analytics, but gives no retention periods (12 of 30). No deprecation policy or dated notices found (0). Hosting at AWS in Virginia is stated and the trust centre has a subprocessor section we could not open past its root page (10 of 20). 20 + 12 + 0 + 10 = 42.

LiveAgent 68

Closed service under published terms that cover the API. The terms carry no date, can change without notice, and name Quality Unit, s. r. o. under Delaware law while the site footer names Quality Unit, LLC (13). The privacy policy deletes account data within 30 days of termination with a cold backup kept 30 days more, and the GDPR page gives the same periods. Since 29 October the GDPR page and the sub-processor list agree that accounts are hosted on AWS in the region chosen at signup, and both say AI providers are chosen and connected by the customer under its own terms. The DPA templates are DOCX downloads we didn't read (25). API changes are announced in help centre articles tied to a version, such as the ticket limit from 5.51. No deprecation policy or notice period was found (7, kept). The sub-processor list of 29 October 2026 names a location and a transfer safeguard for every entry, with a dated change log and written notice before a new one (20).