FreeScout vs Intercom API + MCP

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

Intercom API + MCP 94

OpenAPI 3.0.1 per API version in a public repo, 259 operations in 2.17 (12 October 2026) and 287 in Preview, plus Postman collections (25). llms.txt (10). All 259 operations in 2.17 have descriptions, and the MCP guide explains each of its 14 tools and the permissions it needs (16). 346 enums and typed schemas in 2.17 (14). 3,330 examples, 401 on 253 operations and 404 on 180, but 429 on only two (14). Dated API versions (2.17 on 12 October 2026), a written definition of a breaking change and a rule that breaking changes ship only in a new version (15).

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

Intercom API + MCP 74

Private apps get a revocable access token, public apps use OAuth with per-permission grants such as read conversations or write articles, and the MCP server takes browser OAuth with a consent screen or the same Bearer token (25). The MCP server can write only internal notes and help centre articles, so it can't reply to, assign or close a conversation, and since October 2026 its calls are limited to the teammate's own permissions and seat, refused with 403 action_forbidden. The Fin Operator tools carry readOnlyHint and destructiveHint, with apply_proposals marked destructive so clients confirm it. No confirmation step for notes or articles (16). Conversations are customer-written and we found no injection guidance for the MCP server (0). An admin activity log API at /admins/activity_logs (13). SOC 2 Type II, ISO 27001, 27018, 27701 and 42001, HIPAA, a Bugcrowd programme and a security.txt valid to 15 March 2029 (20).

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.

Intercom API + MCP 80

Closed service with published terms (15). Privacy policy effective 21 October 2026 keeps data only as long as necessary, with a DPA and a sub-processor list. The security page says Fin trains only on your own knowledge and deletes data within 30 days, which the privacy policy doesn't repeat (20). Versioned API with breaking changes only in new versions, but no stated support period for old versions, and the unversioned changes page carries breaking changes that apply to every version (12). Sub-processors published, hosting in the US, EU and Australia (18).

FreeScout 0

Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.

Intercom API + MCP 30

No x402, MPP or L402 (0). Seat prices public ($29, $85 and $132 a seat a month billed yearly, with Essential at $19 for new customers) and Fin at $0.99 an outcome, nothing per API call (10). A 14-day cardless trial and free development workspaces for building and testing (20). A person signs up and creates an app or signs in through OAuth (0).

FreeScout 50

Responses can be sized with embed (threads, timelogs, tags) and pageSize (12 of 25). Page and pageSize paging, with conversation filters by mailbox, folder, status, state, type, assignee, customer email and phone (16 of 20). Errors return a status code, an errorCode and a list of messages, with each code explained (14 of 20). The docs say a timed-out call is safe to retry; no idempotency keys for creates (3 of 20). No official SDK; few required parameters on most calls (5 of 15). 12 + 16 + 14 + 3 + 5 = 50.

Intercom API + MCP 74

14 MCP tools, 12 of them read-only, with universal search and fetch tools that cover several resources (17). Cursor pagination with starting_after, per_page and a search query language for conversations and contacts (20). Documented error objects with codes (17). No idempotency key on REST writes, and we couldn't read MCP tool annotations (5). Official SDKs for Node, Python, Java, PHP and Ruby (15).

FreeScout 73

Read with the local-software lines, because FreeScout runs only on the operator's server; there is no first-party hosted service. Installs from official releases with a web installer and updater, with PHP and MySQL or PostgreSQL requirements stated (20). Public CI in test.yml, test-pgsql.yml and phpcs.yml with feature tests; pass status not read (18 of 25). Open crash and regression issues were not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). Patch releases v1.8.238 to v1.8.249 with notes on GitHub, and module versions tied to a required core version (10 of 15). Past 1.0 (15). 20 + 18 + 10 + 10 + 15 = 73.

Intercom API + MCP 88

incident.io status page at finstatus.com with separate US, EU and AU hosting pages, each with components including REST API and Webhooks (20). The regional history and feeds were readable on 1 November 2026. Since 3 August the US page lists eight incidents, on Fin, the Inbox, the Messenger and integrations, none on the REST API component, among them Inbox search degraded from 13:35 to 15:53 UTC on 3 August and a Shopify integration partial outage on 19 August. The AU page lists "Fin failures in Australia region" from 14:13 to 14:36 UTC on 3 September (23 minutes), a full outage of the Messenger, Inbox and Fin and a partial outage of every other component, the REST API and Webhooks among them. One region and under an hour, so partial and minor, as this run reads regional incidents. Minor only (20). 10,000 calls a minute per app and 25,000 per workspace, spread over 10-second windows (15). 429 with X-RateLimit-Limit, -Remaining and -Reset, Retry-After on search rate limits since September, plus advice to use randomised exponential backoff. No idempotency keys for replies or notes (13). The security page cites a 99.8 per cent uptime SLA (10). The REST API is GA and the MCP page carries no beta label (10).