Granola vs MeetGeek

Granola 60

The newest API changelog entry is v1.6.0, labelled October 2026 with no day. Our 8 October check found v1.5.0 as the newest entry, so v1.6.0 was posted after 8 October, and the docs sitemap dates the changelog and the new Search notes page 27 October and the List Spaces page 9 October, all within 30 days (30). Entries in the last 90 days are v1.4.0 (August, 28 of whose 31 days fall after 4 August; the Get Transcript page it added carries a sitemap date of 11 August), v1.5.0 (September) and v1.6.0 (October) (20). A public changelog, a support address, incidents each closed with a note, and published security reports. No public issue tracker (10 of 15). No entry from Granola in the official MCP registry, where the one match is a third party's server, and no official SDK (0). No packages to assess (0). 30 + 20 + 10 + 0 + 0 = 60.

MeetGeek 10

No API changelog or dated API release was found. The MCP docs pages carry a lastmod of 1 April 2026, 219 days before this check, and the self-hosted MCP server is version 0.1.0 (0). No dated releases in the 90 days from 8 August (0). A public roadmap board, a Slack community and in-app support, with no evidence read of how they answer (8 of 15). No official SDK and no entry in the official MCP registry (0). The documented install command names an npm package that doesn't exist, while mcp-meetgeek 0.1.0 was published from a personal account on 5 September 2025 (2 of 10). 0+0+8+0+2 = 10.

Granola 70

API keys go in a Bearer header, carry Personal notes, Public notes or both, and can be edited and revoked. Workspace keys do not expire. Audit and legal hold keys do one job each, capped at five active keys. The MCP server uses OAuth with S256 PKCE, dynamic client registration and one scope, mcp, or enterprise-managed authorisation (25 of 30). The notes API cannot edit or delete notes, Enterprise admins can limit scopes and switch off transcripts for MCP, and webhook payloads carry no note content. A notes key can still register a webhook to any public HTTPS URL (16 of 20). Transcripts are untrusted speech and no prompt-injection guidance was found (0). The Audit API records each API key use and MCP tool call for a year, on Enterprise only (12 of 15). SOC 2 Type II, a valid security.txt, a disclosure policy with safe harbour and paid rewards, and published post-mortems. No formal bug bounty (17 of 20).

MeetGeek 38

Plain bearer API keys per region with no scopes or rotation guidance found. The cloud MCP uses an OAuth sign-in through auth.meetgeek.ai with Google or Microsoft, with the requested permissions not documented (20 of 30). No read-only key. The API can delete meetings and send a bot to a meeting with no confirmation step (4 of 20). Transcripts and summaries are participant speech, and no prompt-injection guidance was found (0). No audit log of API or MCP use found (0 of 15). Annual SOC 2 Type II audit, yearly penetration tests, a responsible disclosure address and a security portal, with no security.txt (404) or bug bounty (14 of 20). 20+4+0+0+14 = 38.

Granola 82

A public OpenAPI 3.1.0 document covers 19 operations across notes, search, transcripts, folders, spaces, audit, webhooks and legal holds (25). llms.txt and a Markdown copy of every page (10). Parameter and scope descriptions state behaviour and limits. The nine MCP tools have one line each in the docs and their input schemas are not published (14 of 20). IDs carry patterns, scopes and events are enums and page sizes have bounds (13 of 15). The document carries about 180 example values and the guides show curl requests with responses. Error responses are a status code and a one-line description with no body schema, though codes such as TRANSCRIPT_TOO_LARGE and VALIDATION_ERROR are named in prose (9 of 15). The path is versioned v1 and a changelog runs from v1.0.0 in February 2026 to v1.6.0 in October 2026, labelled by month, while the OpenAPI document still says version 1.0.0 (11 of 15).

MeetGeek 70

Public OpenAPI 3.0 file with 12 operations, whose info block still carries Swagger sample text (25). llms.txt and Markdown pages (10). Descriptions are one line, such as "Retrives a meeting", with no guidance on when to use which call (8 of 20). Few parameters, typed, with limit and cursor on lists (10 of 15). Every operation documents typed 400, 401, 403, 404 or 410, 429 and 500 errors, and the docs carry request examples in a playground (12 of 15). Paths under /v1, with no changelog found (5 of 15). 25+10+8+10+12+5 = 70.

Granola 71

The MCP server has nine tools per the docs, and the definitions themselves need a sign-in to read. On REST the transcript is returned only with include=transcript, and large ones move to a paged endpoint (21 of 25). Cursor pagination with page_size up to 30 for notes and 100 for transcript items, filters for created and updated dates, folder and space, and since v1.6.0 POST /v1/notes/search over titles and shared summaries with participant, folder, space, meeting date and update time filters (20). Errors return a JSON body with an error name and message, and a few codes are documented, with no error catalogue or schema (11 of 20). The notes endpoints are read-only and webhook deliveries can be deduplicated by event_id. No idempotency key on webhook or legal hold creation, and MCP annotations could not be read (11 of 20). Few required parameters. No official SDK was found (8 of 15). 21 + 20 + 11 + 11 + 8 = 71.

MeetGeek 59

The cloud MCP server has 8 compact tools, and the transcript is paged with limit up to 500 segments (23 of 25). Cursor pagination on meetings and transcripts, with no date or attendee filters on the list (12 of 20). Typed error bodies per status code (14 of 20). No idempotency key on uploads or bot joins, and MCP annotations weren't readable without a sign-in (5 of 20). Few required parameters, no official SDK, and a self-hosted MCP server whose documented npm name doesn't exist (5 of 15). 23+12+14+5+5 = 59.

Granola 76

Closed service with published Platform Terms and User Terms, both dated 19 December 2025, which count related APIs as part of the Services (15 of 30). The privacy policy (effective 8 September 2026), the DPA (17 July 2026) and the help centre agree that data sits on AWS in the United States, audio is deleted after transcription, third parties may not train on customer data and Granola trains on de-identified data unless the user opts out. Notes and transcripts are kept indefinitely unless a retention period is set (24 of 30). No deprecation policy was found. The Audit API page says existing fields will not change without a new API version (5 of 20). Storage location is disclosed and the security page names Deepgram, AssemblyAI, OpenAI and Anthropic. The full sub-processor list is on a trust centre we could not read, with ten days' notice of changes per the DPA (14 of 20).

MeetGeek 67

Closed service with clear terms of 12 August 2026 naming the contracting entity for each instance (15 of 30). The Terms and the Privacy Policy (9 September 2026) agree that customer content isn't used to train models without a written opt-in, give retention per data type with deletion windows (30 days, then 35 days from backups), and refer to a DPA (26 of 30). No deprecation policy, though the Terms promise notice by email or in the app before changes take effect (5 of 20). EU and US instances with data in the chosen region, and a sub-processor list linked from the security page, not read (15 of 20). 15+26+5+15 = 61.

Granola 25

No x402, MPP or L402 (0). Plan prices are public, $0, $14 and $35 a user a month, with nothing priced per call (10). The free Basic plan includes MCP for personal notes from the last 30 days with some tools withheld, while the REST API and webhooks need a paid plan or a time-limited trial (15 of 20). A person installs the app, signs in with Google or Microsoft and creates a key or approves OAuth (0).

MeetGeek 30

No x402, MPP or L402 (0). Plan prices are public but inconsistent, $15.99 and $27 a user a month on the plan cards and $9.99 and $17 in the page's calculator, with nothing priced per call (10). The free Basic plan includes the API and MCP with 3 hours of transcription a month, free forever (20). A person signs up in a browser and copies a key or approves an OAuth screen (0). 0+10+20+0 = 30.