folk API + MCP vs Relaticle

folk API + MCP 60

Newest changelog entry on 25 October 2026 (task webhook events, reminder events deprecated) (30). 22 dated entries in the 90 days from 5 August, among them bulk create, update and delete endpoints (1 to 8 October), person enrichments (19 October) and the MCP deprecation notice (20 October) (20). Public changelog and support. We didn't test support (10 of 15). Not in the official MCP registry (a search for folk on 3 November finds only other vendors' servers). No official SDK (0). No packages to judge (0). 30 + 20 + 10 + 0 + 0 = 60.

Relaticle 90

v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.

folk API + MCP 55

Status page at status.folk.app runs on UptimeRobot. Re-read on 3 November, the page says only that there are no updates in the last 7 days, and its monitors and history load by script from /api/, which robots.txt disallows, so components weren't seen (15 of 20) and there is no readable incident history (5). Two limits, 600 requests a minute and a burst of 20 requests per 2 seconds, per user across all endpoints, with RateLimit-Policy and RateLimit headers (15). 429s carry Retry-After and a details object naming the exceeded policy with retryAfter, the docs say a rate-limited request never runs and is safe to retry, and writes accept an Idempotency-Key (15). No SLA found (0). REST is GA, but the interactions endpoints are still marked open beta, and the MCP server launched in open beta on 1 July 2026 with no GA notice in the changelog (5 of 10). 15 + 5 + 15 + 15 + 0 + 5 = 55.

Relaticle 40

Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

folk API + MCP 45

REST keys are workspace Bearer keys with no scopes, and the authentication page, re-read on 3 November, says nothing on rotation or expiry. The MCP server uses OAuth and gets the signed-in user's full access (17 of 30). No read-only mode. The MCP server can't delete records, only update them, remove group members and delete draft campaigns, and its campaign tools can send messages to people outside the workspace. The docs urge human confirmation of each step (10 of 20). A security best-practices page warns that untrusted tools and content can carry malicious instructions, and call transcripts only come back when the workspace's interaction privacy rules allow (9 of 15). No audit log found. Errors carry a requestId (2 of 15). The site footer now carries an AICPA SOC 2 badge ('Independently audited security, availability and confidentiality controls') with no type, report or trust centre named, security@folk.app is the contact in the privacy policy, security.txt answered 404 on 3 November and no bug bounty was found. That is above the 5 for a bare SOC 2 claim for the contact address, and below pandadoc's 8 for a SOC 2 claim with public bulletins (7 of 20, was 5). 17 + 10 + 9 + 2 + 7 = 45.

Relaticle 57

Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single mcp:use scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.

folk API + MCP 70

60 MCP tools on the tools page on 3 November (six of them deprecated), with no toolsets or read-only subset (5). REST lists take a limit (3 more, 8 of 25). Paginated lists, people and company filters, notes search with date filters, and batch endpoints for up to 100 records (18 of 20). Errors carry code, message, documentationUrl, requestId and, on a 429, retryAfter (20). Idempotency-Key on writes, the MCP docs mark each tool read-only, destructive or idempotent, and no MCP tool deletes a person, company or object (only draft campaigns can be deleted) (18 of 20). Every call needs X-API-Version, and there's no official SDK (6 of 15). 8 + 18 + 20 + 18 + 6 = 70.

Relaticle 59

50 MCP tools, six schema resources and a prompt, with no toolsets or read-only subset (5). Filters combine native fields, custom fields and linked records with $and, $or and $not, plus sort, include, per_page (MCP maximum 25) and cursors (20). Errors come back as HTTP codes and inline MCP error responses such as Invalid ability provided.; no error catalogue was read (12 of 20). Base tool classes set readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and upserts by unique field make creates safe to retry (17 of 20). One URL with OAuth or a token; no official SDK (5 of 15). 5 + 20 + 12 + 17 + 5 = 59.

folk API + MCP 82

Closed service. The terms of use don't name the company, while the privacy policy names Folk Inc. of Delaware, per the 1 October check (12 of 15). Privacy policy now effective 5 October 2026, re-read on 3 November, with the same retention periods (7 days from databases after deletion, 730 days from backups, 930 days from logs), call audio not kept once transcribed, and a promise not to train AI models on personal data. The 24-processor table rests on the 1 October count (28 of 30). Written deprecation policy with a year's support and 6 months' notice, now covering MCP tools too, with dated removals on 13 February 2027 (reminder endpoints and events), 29 March 2027 (past and upcoming interaction lists) and 16 April 2027 (single-record MCP tools) (20). Processors listed with regions, and hosting on AWS in Ireland (20).

Relaticle 73

AGPL-3.0 source with an integration exception, and terms for the Cloud service (30). The privacy policy (4 November 2026) gives retention for server logs (90 days), contact forms (12 months) and paused trial workspaces (deleted after 60 days with notice), and names provider categories; no DPA was found (20 of 30). No deprecation policy or dated notices found (5 of 20). The security page lists each Cloud provider and what it receives, with hosting at Hetzner in Germany, and website analytics through Fathom without CRM content (17 of 20). 30 + 20 + 5 + 17 = 72.

folk API + MCP 91

OpenAPI 3.1 spec per dated API version, 2025-06-09, with 57 paths and 94 operations on 3 November (25). llms.txt with 121 links and Markdown pages (10). Each MCP tool has a purpose, when-to-call guidance and badges for read-only, destructive and idempotent. We read the docs page, not the server's own tools/list (13 of 20). Typed inputs in the spec (13 of 15). Error table with codes, examples and a documentationUrl on every error, per the 1 October check (15). Dated versions in X-API-Version, endpoints kept at least a year, 6 months' notice with Deprecation and Sunset headers, the same policy now applied to MCP tools, and a public changelog (15). 25 + 10 + 13 + 13 + 15 + 15 = 91.

Relaticle 86

OpenAPI 3.1 at /openapi.json and /openapi.yaml with 34 operations (25). llms.txt with a when-to-use and when-not section, and developer pages (10). The llms.txt and MCP docs say what the API is for and what it doesn't do (no email over REST, no meetings), while only 5 of 34 operations carry a description (14 of 20). 114 required lists and typed MCP inputs, but few enums (11 of 15). 661 examples and responses for 401, 402, 403, 404, 409, 422 and 429 (14 of 15). /v1 and frequent tagged releases, with no changelog page (relaticle.com/changelog is 404) (12 of 15). 25 + 10 + 14 + 11 + 14 + 12 = 86.