FreeScout vs LiveAgent

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.

LiveAgent 68

Closed service under published terms that cover the API. The terms carry no date, can change without notice, and name Quality Unit, s. r. o. under Delaware law while the site footer names Quality Unit, LLC (13). The privacy policy deletes account data within 30 days of termination with a cold backup kept 30 days more, and the GDPR page gives the same periods. Since 29 October the GDPR page and the sub-processor list agree that accounts are hosted on AWS in the region chosen at signup, and both say AI providers are chosen and connected by the customer under its own terms. The DPA templates are DOCX downloads we didn't read (25). API changes are announced in help centre articles tied to a version, such as the ticket limit from 5.51. No deprecation policy or notice period was found (7, kept). The sub-processor list of 29 October 2026 names a location and a transfer safeguard for every entry, with a dated change log and written notice before a new one (20).

FreeScout 0

Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.

LiveAgent 30

No x402, MPP or L402 (0). Plan prices are public per agent per month, with nothing per API call (10). A 30-day trial with no card (20). A person signs up in a browser, and the terms say accounts registered by bots or automated methods are not permitted (0).

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

LiveAgent 52

API v3 keys are created by an admin with per-key permissions, plans allow 1, 5, 10 or unlimited keys, and a key is replaced by regenerating it. MCP uses OAuth 2.1 with PKCE or bearer tokens that expire after two years and are revoked one by one (28). Less 10 because the legacy v1 API documents its key as a URL or form parameter (18). Read-only permissions exist per key and MCP calls run under the agent's role, but a personal MCP token gets every tool the role allows and no confirmation step for writes was found. submit_answer_suggestion leaves a draft for review (13). Tickets hold customer-written text and no prompt-injection guidance was found (0). An audit log on the Business and Enterprise plans, and MCP actions recorded in ticket history under the agent's name (11). A bug bounty of $100 a verified vulnerability with reports by email and no stated acknowledgement time, fixes tagged [Security] in the changelog, and no security.txt. The sub-processor page says LiveAgent holds no SOC 2 or ISO 27001 yet and a SOC 2 Type II audit is under way (10).

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

LiveAgent 48

The v3 Swagger definition and the v4 OpenAPI document are loaded by the Swagger UI script on the docs pages, with no visible download link, so this run doesn't read them and the 9 October reading is struck (0). www.liveagent.com/llms.txt now answers, indexing the site's product pages and linking the API documentation (10). The Python client Quality Unit generates for v3 lists its operations with one-line summaries, and the MCP tools reference is fuller, with when-to-use notes on each tool (9, kept). The client's models carry 165 enumerated values and ticket creation names its required fields, but _filters is a JSON string and status codes are single letters (9, kept). The v1 reference and the MCP reference carry examples and return fields, and the MCP reference documents its error objects (7). Versions sit in the path (v1, v3, v4), and a public changelog lists dated builds with API fixes, without a separate API changelog (13).