FreeScout vs Missive API + MCP

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.

Missive API + MCP 77

Closed service under Terms and Conditions last updated 15 April 2024, which name Heliom inc. and Quebec law (15). The privacy policy of 27 March 2026 says staff do not read user data without consent or a security need (per the 8 October check), the terms keep data retrievable for 30 days after termination, and a DPA is available on request. No general retention periods are given. The security page now names AWS and Crunchy Bridge, in line with the sub-processor list, where on 8 October it named Heroku. The line keeps its earlier partial value (20). No deprecation policy was found, and the terms let Missive modify or terminate API access with or without notice (4). The GDPR page, last updated 15 July 2025, lists 13 sub-processors with locations and an RSS feed, and the security FAQ says all servers run in AWS us-east-1, per the 8 October check (18).

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

Missive API + MCP 61

The REST API takes a personal access token with no scopes that reaches every account the user can open, sent only in the Authorization header. The MCP server uses OAuth with PKCE, automatic client registration, the resource parameter, eight permissions and 30-day access that the user can revoke. Scored between the two (22). MCP read permissions are separate from write ones and drafting from sending, but the docs say MCP writes run immediately with no server-side confirmation, and admins cannot restrict apps or permissions (12). The MCP docs tell users to make the client ask before running tools and to check the redirect URL. No prompt-injection guidance was found for message content (4). A connected-apps list shows scopes, last IP and last use, API posts leave a visible trace, and the feature list claims an audit trail of every action. No per-call API log was found (7). security.txt is valid until 13 July 2027, there is a disclosure programme with discretionary rewards, and Missive states SOC 2 Type II with the report on request. No public advisories page was found (16).

FreeScout 0

Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.

Missive API + MCP 30

No x402, MPP or L402 (0). Plan prices are public at $14, $24 and $36 a user a month billed yearly, or $18, $30 and $45 monthly, with nothing priced per call (10). A 30-day trial of the Productive plan needs no card, and the changelog of 24 September 2026 says the MCP server can be enabled on a trial (20). A person signs up in a browser, and the MCP authorisation flow cannot create an account (0).

FreeScout 70

Core v1.8.249 tagged on 31 October 2026 (30). Twelve tags from 30 August to 31 October (20). Issue responsiveness was not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). No official SDK, and no MCP server from the project (0). CI with tests on MySQL and PostgreSQL, and a Laravel dependency advisory taken on 31 October (10). 30 + 20 + 10 + 0 + 10 = 70.

Missive API + MCP 50

Graded on the REST API and MCP server, so changelog entries about app functions the API doesn't serve are not counted. The newest entry naming the API or the MCP server is version 11.36.0 on 24 September 2026, which made the MCP server available on trial, 41 days before this check. Versions 11.37.0 (8 October), 11.37.1 (20 October) and 11.38.0 (23 October) cover app functions only (20). Four dated entries since 6 August name API or MCP server changes, on 14 August (add_default_signature on drafts), 28 August (MCP server out of beta), 10 September (signature variables in drafts made through the API and MCP server) and 24 September (20). Support is by email, there is a public feedback board and the changelog names API fixes, with no public issue tracker (10). No official SDK was found (0). There is no package to assess (0).

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

Missive API + MCP 52

No OpenAPI or other machine-readable contract was found in the developer docs, and the MCP tool definitions were not read because mcp.missiveapp.com disallows every path in robots.txt (0). The docs publish llms.txt and a Markdown twin of every page (10). The endpoints reference covers 44 method and path forms and says when to use posts, drafts or the silent conversation update (14). Parameters are in tables with types, defaults, maximums and required marks, not in a schema (8). Request and response examples are plentiful, but errors are limited to a few 400 and 404 cases with no error format (8). The path is versioned /v1 and the dated changelog names API changes, though the WhatsApp identifier change marked breaking in the docs has no changelog entry we found (12).

FreeScout 73

Read with the local-software lines, because FreeScout runs only on the operator's server; there is no first-party hosted service. Installs from official releases with a web installer and updater, with PHP and MySQL or PostgreSQL requirements stated (20). Public CI in test.yml, test-pgsql.yml and phpcs.yml with feature tests; pass status not read (18 of 25). Open crash and regression issues were not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). Patch releases v1.8.238 to v1.8.249 with notes on GitHub, and module versions tied to a required core version (10 of 15). Past 1.0 (15). 20 + 18 + 10 + 10 + 15 = 73.

Missive API + MCP 60

Graded as a hosted service. status.missiveapp.com is a PagerDuty status page with eight components, one of them REST API, per the 8 October check, not re-read on 4 November because its robots.txt request answers with the status app's HTML page (20). The incident history was not read on either date (5). REST limits are 5 concurrent requests, 300 a minute and 900 per 15 minutes, and MCP limits are 60 a minute and 600 an hour per user (15). A 429 carries Retry-After and three X-RateLimit headers and the docs give pacing guidance, but no idempotency key or safe-retry guidance for draft and message writes was found (10). No SLA is published. The security FAQ lists uptime figures for 2020 to 2023 only, per the 8 October check (0). The REST API is generally available and the MCP server left beta on 28 August 2026 (10).