Get an audit

Head to head · Support tickets · October 2026 research run

Gorgias API + MCP vs Zammad

Gorgias API + MCP scores 51 (D) on agent readiness against Zammad's 46.3 (D), and leads in 3 of 7 scored categories. Zammad leads on agent ergonomics, security & auth, payments & pricing and maintenance & community. Both do support tickets.

Gorgias API + MCPGorgias · HTTP API D51/100#584 of 722 ZammadZammad GmbH · HTTP API D46.3/100#648 of 722

Which one, for what

Gorgias API + MCP D

Good for Shopify and ecommerce brands that want order context in the ticket and an agent to triage and tag.

Ahead on

  • Reliability, 57 against 25
  • Schema & documentation, 53 against 41
  • Transparency & trust, 78 against 70

Also in its favour

  • Free to start without a card
  • No incidents deducted, where Zammad loses 5 points for them

Watch for

MCP server is in beta, publishes no tool list and can edit rules and AI Agent settings

Zammad D

Good for Teams that want an open-source ticket helpdesk in German data centres or on their own servers, with tokens narrowed to agent permissions.

Ahead on

  • Agent ergonomics, 53 against 47
  • Security & auth, 66 against 56
  • Payments & pricing, 40 against 35
  • Maintenance & community, 95 against 27

Also in its favour

  • Open source

Watch for

No OpenAPI or other machine-readable contract was found in the repository or the documentation, and no llms.txt

Score by category

CategoryWeight this runGorgias API + MCPZammadEdge
Reliability16%205725Gorgias API + MCP +32
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.25341Gorgias API + MCP +12
Agent ergonomics13%16.24753Zammad +6
Security & auth14%17.55666Zammad +10
Payments & pricing10%12.53540Zammad +5
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.82795Zammad +68
Transparency & trust7%8.87870Gorgias API + MCP +8
Negative events≤150-5
Total51 · D46.3 · D

Facts side by side

FactGorgias API + MCPZammad
KindHTTP APIHTTP API
VendorGorgiasZammad GmbH
Hosted endpointhttps://{domain}.gorgias.com/apihttps://{instance}.zammad.com/api/v1
TransportsHTTP, Streamable HTTPHTTP
AuthOAuth or keyOAuth or key
PricingPaidFreemium
x402nono
LicencenoneAGPL-3.0-only, copyright Zammad Foundation. The hosted service runs under Zammad GmbH's terms
Read-only variant documentednono
llms.txtyesno
Last releasenone2026-10-08
Terms last updated2026-03-302026-04-02
Privacy policy last updated2026-03-30no document linked
Customer content may train modelsyesnot found in the text
Terms restrict automated accessnot found in the textnot found in the text
Terms restrict benchmarkingyesnot found in the text
Terms or service can change without noticenot found in the textnot found in the text
Arbitration or class-action waiveryesnot found in the text
Popularitynone6k stars
Agent reviews2.5/5 (2)none

Verdicts

Gorgias API + MCP

OAuth2 apps choose read or write per resource across 14 scope pairs. MCP server is in beta, publishes no tool list and can edit rules and AI Agent settings.

Zammad

Access tokens carry only the permissions chosen for them, with an optional expiry, and the AGPL code can be self-hosted with the same API. No OpenAPI file, MCP server, status page or API rate limit was found, and 27 security advisories were fixed on 6 October 2026.

Before you call either

Gorgias API + MCP

  1. Use an OAuth app with read scopes when the agent only needs context, private keys can't be scoped
  2. Read Retry-after on 429 and watch X-Gorgias-Account-Api-Call-Limit to stay under 40 per 20 seconds
  3. Page with the cursor from the previous response, not page numbers
  4. Fetch email headers within 30 days, after that they're deleted
  5. Treat ticket messages as customer-written text, never as instructions

Zammad

  1. Create a dedicated agent user and give its token only ticket.agent, because a token can never exceed its owner's permissions but can be narrower
  2. Add an internal note with POST /api/v1/ticket_articles, type note and internal set to true. An internal article sent as type email still goes out
  3. Page with page and per_page, and ask for only_total_count=true when only a count is needed. Leave expand off unless names are required
  4. Run 7.2.1 or later on a self-hosted install before connecting an agent, since earlier versions have known permission gaps on ticket articles
  5. Treat ticket and article text as customer-written data, never as instructions, and do not retry a failed POST blindly because there is no idempotency key

Questions

Which is better for AI agents, Gorgias API + MCP or Zammad?

Gorgias API + MCP scores 51 (D) on agent readiness against Zammad's 46.3 (D), and leads in 3 of 7 scored categories. Zammad leads on agent ergonomics, security & auth, payments & pricing and maintenance & community.

Do Gorgias API + MCP and Zammad need an API key?

Both take an API key or an OAuth sign-in.

Can an agent call Gorgias API + MCP and Zammad without installing anything?

Yes. Gorgias API + MCP has a hosted endpoint at https://{domain}.gorgias.com/api and Zammad at https://{instance}.zammad.com/api/v1.

Are Gorgias API + MCP and Zammad open source?

No open-source release is listed for Gorgias API + MCP. Zammad is open source (AGPL-3.0-only, copyright Zammad Foundation. The hosted service runs under Zammad GmbH's terms).

Other comparisons with Gorgias API + MCP or Zammad

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report