FreeAgent API vs Puzzle API and MCP

FreeAgent API 85

Statuspage at status.freeagent.com with history back to September 2024 (20). Nothing between the scheduled database maintenance on 17 June and the next one, posted on 29 October for 22:00 to 23:00 GMT on 4 November, so the 90 days from 6 August are clean (30). 120 requests a minute and 3,600 an hour per user, plus 15 token refreshes a minute (15). 429 with Retry-After 60, a request to back off before retrying, and an X-RateLimit-Test header that drops the sandbox to 5 a minute so a client can rehearse the back-off. No guidance on retrying writes and no idempotency keys (10). No SLA found (0). GA (10).

Puzzle API and MCP 15

Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

FreeAgent API 44

OAuth 2.0 authorisation code, one-hour access tokens, refresh tokens that rotate on each refresh, and a client secret rotation guide. No scopes, so a token can do whatever the authorising user can (22). No read-only mode. Invoices are drafts until a transition endpoint marks them sent, which works as a confirmation step (5). Returns the business's own records plus bank descriptions and contact text from third parties, with no injection guidance (3). No per-app audit log or API activity view found (0). Valid security.txt to April 2027, a disclosure policy with discretionary rewards and Cyber Essentials Plus. No ISO 27001 or SOC 2 found (14).

Puzzle API and MCP 73

OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.

FreeAgent API 74

Closed service with API terms v2.1 dated 28 February 2025, under Scots law, naming FreeAgent Central Limited, SC316774 (15). A privacy hub with a general notice, a customer DPA, a subprocessor list and a GDPR page, and API terms that bar clients from keeping data longer than the function needs. The landing page gives no retention periods (20). Dated changelog and a versioning guide, and the terms promise email notice of material changes but set no deprecation period (8). Subprocessor list published. We didn't read the locations (12).

Puzzle API and MCP 49

Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.

FreeAgent API 50

No OpenAPI or other machine-readable spec (0). No llms.txt or Markdown docs. The HTML is server-rendered and reads cleanly to a plain fetch, which the checklist doesn't score (0). Each resource page explains purpose and workflow, such as invoices created as drafts and moved by transition endpoints (14). Attribute tables give types, required markers and enums such as invoice status values (12). JSON and XML request and response examples on every page, but no error body format or error catalogue (9). Dated API changelog and a versioning guide (15).

Puzzle API and MCP 65

The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.

FreeAgent API 30

No x402, MPP or L402 (0). The API is free under section 4.1 of the terms with 30 days' notice before any fee, and a live company needs a subscription with public prices (£33 a month for a limited company, half for the first six months). We scored it as plan-only pricing (10). Free sandbox account at signup.sandbox.freeagent.com and a 30-day product trial (20). Browser signup and a developer app registration (0).

Puzzle API and MCP 15

No x402, MPP or L402 (0). Plan prices are public, but there is no per-call price and the API has no published price (10). "Try for free" on every plan, with trial length and card requirement not stated on the pages read (5). A person signs up and authorises in a browser, and API credentials come by email (0). 0 + 10 + 5 + 0 = 15.

FreeAgent API 60

Last dated API change on 7 October 2026, employee and employer pension percentages on the Payroll endpoint (30). Five dated entries in the 90 days from 6 August (17 August, 20 August, 1 September, 5 October, 7 October) (20). Closed service with a public changelog and a developer discussion group at api-discuss.freeagent.com that isn't official support (10). No official SDKs and no MCP server (0). No packages to judge (0).

Puzzle API and MCP 53

The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.