Invoice Ninja API vs Puzzle API and MCP

Invoice Ninja API 83

v5.13.49 on 18 October 2026 (30). 20 tagged releases on v5-stable since 6 August, from v5.13.30 to v5.13.49 (20). Pull requests merge within days on v5-stable. We couldn't see issue reply times from git (15). Official PHP SDK, v2.0.0 tagged on 2 November 2026 after v1.4.0 in January 2025. No MCP server (8). PHPUnit CI runs the test suite across PHP 8.2 to 8.5 on every push to v5-stable and v5-develop, plus Dependabot (10). 30 + 20 + 15 + 8 + 10 = 83.

Puzzle API and MCP 53

The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.

Invoice Ninja API 41

Oh Dear status page watching invoiceninja.com and invoicing.co, with no component for the API itself; it now links an incident history page (15). The history page lists one event, invoiceninja.com down for one minute on 29 October 2026, and doesn't say how far back it reaches, so the 90-day record isn't established and the line keeps 5. The docs give no numbers. The source sets 1,000 requests a minute per IP and per token on the hosted service, 20 a minute on report exports and no limit when self-hosted, counted at half as on 1 October (8). 429 appears only as a row in the error table, with no backoff or retry guidance (3, the 1 October partial). No SLA, and the terms say Invoice Ninja "strives to ensure maximum uptime" (0). GA (10). 15 + 5 + 8 + 3 + 0 + 10 = 41.

Puzzle API and MCP 15

Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

Invoice Ninja API 53

API tokens per user, created and revoked under Settings, Account Management, Integrations, in a header and never a URL. No per-token scopes (20). No read-only token. Invoices stay drafts unless the call asks otherwise (5). Returns client and product text that other people wrote, and stored XSS advisories came through invoice line items, product notes and the terms field, with no injection guidance for API consumers (3). Activity log and an activities report export (10). SECURITY.md with a disclosure email, advisories published on GitHub, and a SOC 2 page (Security, Availability, Confidentiality and Processing Integrity, report under NDA on request) with a PCI-DSS claim. The page names neither the SOC 2 type nor the auditor. No security.txt or bug bounty (15, as brex). 20 + 5 + 3 + 10 + 15 = 53.

Puzzle API and MCP 73

OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.

Invoice Ninja API 35

No x402, MPP or L402 (0). Hosted plan prices are public, Pro $14 a month, Enterprise $18 to $300, Premium Business from $280 a year (10). Hosted Free (5 clients, no card) has no REST API, but self-hosting is free with every feature, which we counted at three quarters (15). The public demo at demo.invoiceninja.com takes the token TOKEN with no signup, though it's a shared demo, not your own company (10). 0 + 10 + 15 + 10 = 35.

Puzzle API and MCP 15

No x402, MPP or L402 (0). Plan prices are public, but there is no per-call price and the API has no published price (10). "Try for free" on every plan, with trial length and card requirement not stated on the pages read (5). A person signs up and authorises in a browser, and API credentials come by email (0). 0 + 10 + 5 + 0 = 15.

Invoice Ninja API 63

Source-available under the Elastic License 2.0, which is clear but isn't an OSI licence, so we scored between closed and open (20). The privacy policy on invoiceninja.com names eight vendors (OVH Cloud added) and a DPA, and now states one retention period (free accounts inactive for three months are deleted), and the terms (version 1.0.2, effective 1 February 2026) name Florida law. No full retention schedule or registered address, so 15 plus 3 (18). No deprecation policy found, only release notes (3). Self-hosted error reporting is opt-in by checkbox and disclosed. Vendors named without data locations (16). 20 + 18 + 3 + 16 = 57.

Puzzle API and MCP 49

Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.