FreeScout vs Gorgias API + MCP

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.

Gorgias API + MCP 80

Closed service with published terms, the Master Subscription Agreement and website terms both last revised 30 March 2026 (15). Per the 1 October check, the privacy notice (revised 30 March 2026) keeps data while you hold an account, with a DPA and a sub-processor list. The changelog adds email retention (headers deleted and bodies archived 30 days after each email, from 8 September 2026). No AI training statement found (18 of 30). Dated changelog notices of deprecations and removals, such as the TLS 1.2 update with a scheduled date, and no stated notice period, which this benchmark scores 15 (15). Sub-processor list published, hosting on Google Cloud, transfers to the US under standard contractual clauses (15 of 20). 15 + 18 + 15 + 15 = 63.

FreeScout 70

Core v1.8.249 tagged on 31 October 2026 (30). Twelve tags from 30 August to 31 October (20). Issue responsiveness was not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). No official SDK, and no MCP server from the project (0). CI with tests on MySQL and PostgreSQL, and a Laravel dependency advisory taken on 31 October (10). 30 + 20 + 10 + 0 + 10 = 70.

Gorgias API + MCP 27

The newest developer changelog entry, posted on 1 July 2026, changed the API on 8 September 2026, when email headers began to be removed and original bodies archived 30 days after each email. That dated API change is 57 days old (20). No changelog entries in the 90 days from 6 August (0). The MCP server lost its beta label and gained a tool list dated October 2026, with no dated entry. Changelog and support, no public issue tracker (7 of 15). No official SDKs (0). No package to assess (0). 20 + 0 + 7 + 0 + 0 = 27.

FreeScout 0

Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.

Gorgias API + MCP 35

Per the 30 September check, not re-read on 4 November 2026. No x402, MPP or L402 (0). Prices are per ticket, from $10 a month for 50 tickets with overage of $0.40 a ticket on Starter and $36 to $40 per 100 above it, and AI Agent per automated interaction. Per-unit, though not per API call (15). Free trial without a card on most plans (20). A person signs up and makes a key or signs in through OAuth (0). 0 + 15 + 20 + 0 = 35.

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

Gorgias API + MCP 56

Private API keys go over Basic auth with the user's email and have no scopes. OAuth2 apps choose read or write per resource, and the MCP server signs in by OAuth and acts with your Gorgias role (22 of 30). The MCP tools page gives each tool a minimum role and labels those that send to customers, go live, change real data or can't be undone. New rules and actions are created off, guidance and articles are saved as drafts, and macros are archived rather than deleted. Approval of each call is left to the AI client, and there is no read-only mode, though an OAuth app can be limited to read scopes (10 of 20). Ticket messages are customer-written and we found no injection guidance (0). Audit log events kept for 12 months, per the changelog (10 of 15). SOC 2 Type II and HIPAA reports on request and a valid security.txt per the 1 October check, and a vulnerability disclosure policy (last revised 30 March 2026) that acknowledges reports within 5 business days. The bug bounty was paused on 1 October (14 of 20). No 2025 or 2026 record in the CVE list names Gorgias. 22 + 10 + 0 + 10 + 14 = 56.

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

Gorgias API + MCP 53

No public OpenAPI file found (0). llms.txt indexes the developer docs, and any page gives Markdown with .md appended (10). Reference pages describe each object and endpoint (12 of 20). Typed fields on the object pages (10 of 15). An errors page and request examples in the reference (11 of 15). A dated developer changelog marks deprecations and removals, with no API versioning (10 of 15). The MCP tools page names each tool and what it does, without input schemas. 0 + 10 + 12 + 10 + 11 + 10 = 53.