Zernio (formerly Late) API + MCP vs Pamba

Zernio (formerly Late) API + MCP 71

Closed API under published terms (last updated 9 October 2026), with the Node SDK under Apache-2.0 (15). The privacy policy, updated 26 October 2026, deletes data within 30 days of account deletion, keeps other data as long as needed, says content reached through the MCP or API isn't used to train models, and links a subprocessor list. A public DPA (19 October 2026, replacing a version dated 2 July 2026) is part of the terms with no signature needed, names ZERNIO SOFTWARE SL as processor, and deletes customer personal data within 10 business days of the end of the service, with backups within 30 days and logs within 90. The privacy policy also sets token lifetimes and deletion on disconnect for Google and Microsoft data. The statements agree, though general account data is kept as long as needed (26). No deprecation policy in practice. The changelog says a breaking change ships only as a new path version, yet breaking changes ship inside v1 on the day they're marked, and old getlate.dev URLs still redirect (6). The subprocessor list (9 October 2026) names 25 providers with purpose, data and transfer safeguard, and gives 14 days' notice of changes. Core hosting and the database are in London, and 18 entries say the location is provider-managed and not pinned to one region (15). 15+26+6+15 = 62.

Pamba 28

Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.

Zernio (formerly Late) API + MCP 80

Better Stack page at zernio-status.com with components for the API, each network, schedulers, webhooks, inbox and analytics, read through its RSS feed (20). From 3 August to 1 November 2026 the feed lists many incidents, each partial by its own text. The longest touching the API, on 8 October from 14:44 to 15:52 UTC, had some customers see the dashboard and API slow or time out. On 19 October post creation failed for 21 minutes, and on 26 October many API requests failed for about 20 minutes. Reddit has been unavailable since 19 October because Reddit blocked third-party apps, and other items hit one network, the inbox or webhooks. No full outage of everything and nothing over an hour that wasn't partial, so minor only (20). Limits published by tier, 60, 600 or 1,200 requests a minute, a per-second analytics window and per-network posting caps (15). 429 carries Retry-After and X-RateLimit headers, and an Idempotency-Key covers posts and other writes (15). The terms state no SLA (0). GA (10). 20+20+15+15+0+10 = 80.

Pamba 45

Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists "SLA guarantees" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Zernio (formerly Late) API + MCP 65

API keys as Bearer tokens, restricted keys created through POST /v1/api-keys with any of ten resource groups switched off or limited to chosen profiles, and OAuth 2.1 with dynamic client registration on the MCP with eight scopes such as posts:read and analytics:read (30). Read-only keys and scopes are possible, members can be limited to profiles, and tools are annotated, but we found no approval guidance for publishing (14). The inbox, comments and DM tools return text from strangers and we found no prompt-injection guidance (0). A unified activity log endpoint (GET /v1/logs) covers publishing, connections, webhooks and messaging, webhook delivery logs are listed, X-Request-Id is on every response, and the security overview describes an append-only audit log of team-management actions for the owner. API calls aren't attributed to a key in a log we found (11). The DPA and pricing page say the SOC 2 Type II report and GDPR paperwork are available on request through the trust centre at trust.zernio.com. No security.txt (404 on 1 November) and no disclosure route, and the privacy contact is a named person's email (10). 30+14+0+11+10 = 65.

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.

Zernio (formerly Late) API + MCP 87

@zernio/node v0.2.1420 and zernio-sdk v1.4.1476 tagged on 1 November 2026 in their repositories, and changelog entries the same day (30). Hundreds of releases and 241 changelog entries dated 1 October or later (20). Public changelog and support. The SDK repositories are generated, so issue replies weren't a useful signal (12). Official registry entry com.zernio/zernio under its own domain, version 1.0.0 published 25 May 2026, still the latest on 1 November (15). The Node SDK runs ci, generate and publish workflows and regenerates from the OpenAPI spec several times a day (10). 30+20+12+15+10 = 87.

Pamba 70

Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.

Zernio (formerly Late) API + MCP 88

The tools page lists 20 core tools and says tools/list returns about 50 everyday ones, with search_tools and call_tool loading the long tail on demand (5 plus 10). Page and cursor pagination on list endpoints (20). ErrorResponse codes such as idempotency_conflict, and the MCP returns the list of accounts when account_id is ambiguous (18). Idempotency-Key with 24-hour keys and an Idempotent-Replayed header, plus readOnlyHint, destructiveHint and openWorldHint on tools (20). The SDKs page lists official clients in eight languages, including Node and Python (15). 15+20+18+20+15 = 88.

Pamba 75

Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.

Zernio (formerly Late) API + MCP 60

No x402 or other machine payment (0). Per-unit prices published without login, per connected account a month, X calls passed through at X's rates and SMS per message (20). Two accounts free with no card (20). A person signs up in a browser for the first key. Keys can then be minted by API, which doesn't remove the human step (0). 0+20+20+0 = 40. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 40 is 60.

Pamba 53

No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.