FreeScout vs Freshdesk API + MCP

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.

Freshdesk API + MCP 85

Closed service with published terms, effective 1 April 2026 (15). Privacy notice effective 1 March 2026 says service data is generally kept up to six years and call recordings help train speech recognition, with a sub-processor list and a data hosting page, per the 1 October check (20). The API reference's Deprecation Policy says that when a new major version is generally available, deprecated parts cease to function after six months, and v1 is closed to new users. A written policy with a stated period meets the line, and beta APIs are excluded from it, so the EAP MCP stop on GA day costs nothing (20). Sub-processors and data centre locations published (18). 15 + 20 + 20 + 18 = 73.

FreeScout 70

Core v1.8.249 tagged on 31 October 2026 (30). Twelve tags from 30 August to 31 October (20). Issue responsiveness was not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). No official SDK, and no MCP server from the project (0). CI with tests on MySQL and PostgreSQL, and a Laravel dependency advisory taken on 31 October (10). 30 + 20 + 10 + 0 + 10 = 70.

Freshdesk API + MCP 26

The last dated API change we count is the MCP server going GA on 10 September 2026, 55 days before this check (20). The API changelog's November 2026 entry documents API group and sublimit rate-limit headers in the Rate Limit section, a documentation change that can't set recency on its own, and the next newest entry is June 2022. Standard MCP pricing and limits took effect for EAP users on 5 October, a pricing date rather than an API change. One documentation entry in the 90 days from 6 August, not three (0). A public API changelog, a support portal and a community forum, no public issue tracker (6). No official SDKs (0). No package to assess (0). 20 + 0 + 6 + 0 + 0 = 26.

FreeScout 0

Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.

Freshdesk API + MCP 35

No x402, MPP or L402 (0). Seats are public at $19, $55 and $89 an agent a month billed yearly, and MCP actions beyond the allowance cost $15 per 1,000, which is per-call pricing for the MCP route only, re-read on 4 November (15). 14-day trial of Enterprise with no card until it ends (20). A person signs up and copies the key from Profile Settings (0). 0 + 15 + 20 + 0 = 35.

FreeScout 73

Read with the local-software lines, because FreeScout runs only on the operator's server; there is no first-party hosted service. Installs from official releases with a web installer and updater, with PHP and MySQL or PostgreSQL requirements stated (20). Public CI in test.yml, test-pgsql.yml and phpcs.yml with feature tests; pass status not read (18 of 25). Open crash and regression issues were not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). Patch releases v1.8.238 to v1.8.249 with notes on GitHub, and module versions tied to a required core version (10 of 15). Past 1.0 (15). 20 + 18 + 10 + 10 + 15 = 73.

Freshdesk API + MCP 40

status.freshworks.com exists but renders only with JavaScript, re-read on 4 November, and the only component reading on 1 October came from its JSON, which this run doesn't read. A status-page line whose components were never read scores 0 in this run (0), and there is no incident record we could read (5). REST limits are published per plan (100, 400 and 700 calls a minute on Growth, Pro and Enterprise, with lower caps on ticket create, update and list) and MCP limits are 25, 50 and 100 actions a minute (15). Every response carries X-RateLimit-Total, -Remaining and -Used-CurrentRequest, and since a November 2026 changelog entry the docs also describe API group and sublimit headers. A 429 carries Retry-After, and the best-practice notes say to retry after the Retry-After time. There is no idempotency key or safe-retry guidance for ticket creation, so Retry-After alone (10). No uptime SLA found. The SLA rows on the pricing page are ticket SLA policies (0). API v2 is GA and the MCP server went GA on 10 September 2026 (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

Freshdesk API + MCP 49

One API key per agent, sent as HTTP Basic on REST and as the raw Authorization value on MCP. It carries that agent's role, which is narrower than an account key but has no scopes, and the MCP security article confirms OAuth isn't supported (15). MCP inherits the key's permissions, and the write tools include createAgent, updateAgent and createTicketBulkUpdate, with no read-only mode or approval step (5). Tickets return customer-written text and we found no injection guidance (0). MCP actions show in the activity history like API and UI changes, and audit logs come with Enterprise (12). HackerOne disclosure programme, a security.txt with a contact but no Expires field, ISO and AICPA logos on the security page and a trust centre. security.txt, re-read on 4 November, also links an acknowledgements page and the HackerOne policy (17). 15 + 5 + 0 + 12 + 17 = 49.

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

Freshdesk API + MCP 50

No OpenAPI file, and the MCP tool schemas need an API key to read (0). No llms.txt (404 on developers.freshdesk.com on 4 November) (0). The API reference describes every endpoint, and the MCP article lists the 37 tool names with one-line descriptions (10). Attribute types and the numeric values for status, priority and source are documented (10). curl examples on each endpoint and 20 machine-readable error codes with field and message (15). The API is versioned (v2), and the reference carries a public changelog with month-dated entries from 2016 to November 2026, which the 1 October check missed (15). 0 + 0 + 10 + 10 + 15 + 15 = 50.