Metricool API + MCP vs Pamba

Metricool API + MCP 6

No dated API or MCP change found. mcp-metricool on PyPI was at 1.1.9 from 7 October 2025 per the 2 October check; pypi.org didn't resolve from our network on 10 November (0). No releases or dated changelog entries since 12 August (0). No public API changelog. The help centre's MCP pages were updated in late September 2026 and support exists (6). No official SDKs or registry entry (0). metricool/mcp-metricool, the repository the help centre names, still asks for credentials to clone on 10 November (0). The terms page footer links a Product Updates page, not read because the terms bar automated extraction. Total 6.

Pamba 70

Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.

Metricool API + MCP 23

The listing names an OpenAPI 3.0 file at app.metricool.com/api/swagger.json (553 paths per the 30 September check). It sits under the REST API's own base path and the docs page is a viewer drawn by script over it, so the 30 September reading is struck (0 of 25), and the typed-input credit that rested on it goes with it (0 of 15). llms.txt on the help centre, per the 2 October check (10). The help centre explains what the MCP can and can't do, and the hosted tools' definitions need an OAuth session (8). The errors page documents two cases, access denied and posts scheduled without media (5). No API or MCP changelog. The only changelog in the help centre's llms.txt is the Looker Studio connector's (0). Help centre pages per the 2 October check, not re-read on 10 November because Metricool's terms bar automated extraction. Total 23.

Pamba 84

No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.

Metricool API + MCP 66

Closed service with published terms from METRICOOL SOFTWARE, S.L. of Madrid (NIF B87527115), updated 3 November 2026 (15). Per the 1 and 2 October checks, the privacy policy says all data sits on EU servers, gives statutory retention periods of 4 to 6 years and folds a DPA into the service terms, and a signed DPA is available on request, with deletion or return of data when the contract ends (22). No deprecation policy or dated API notices found. The terms promise 15 days' notice of price rises only (0). Section 16.2.6 of the terms names two sub-processors, Amazon Web Services EMEA SARL for hosting and STR Sistemas y Desarrollos en Internet, S.L. for server administration, promises 30 days' written notice of changes to the list, and allows processing outside the EEA only with the customer's prior written approval (20). Total 57.

Pamba 28

Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.

Metricool API + MCP 39

Per the 2 October check, not re-read on 10 November. The help centre's MCP basics page lists six hosted tools, four that read (metrics, analytics, best time, scheduled posts) and two that write (create and update a scheduled post). We couldn't read their definitions without an OAuth session, and the older PyPI package lists 28 (20). Analytics take date ranges. We didn't verify pagination or field selection (8). Two documented error cases, no codes an agent can act on (5). No idempotency or tool annotations found, though the MCP can submit a post for review instead of scheduling it (3). No SDKs, and three values per REST call (3). Total 39.

Pamba 75

Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.

Metricool API + MCP 15

status.metricool.com and its metricool.statuspage.io copy refused our reader in robots.txt on 1 and 2 October 2026, so the 30 September reading of the page is struck (0 of 20), and Metricool's terms now bar automated extraction, so the host wasn't requested on 10 November. No incident history we could read (5). No request rate limits published. The terms, updated 3 November 2026, say Metricool may monitor and rate-limit usage without giving numbers, and set 500 API calls a month per brand as "Standard Use" for the Integration and White Label plans, a billing threshold rather than a request limit (0). No 429 or retry guidance found (0). No SLA, and the terms promise only best efforts at round-the-clock access (0). The API and MCP aren't labelled beta, per the 2 October check, not re-read on 10 November (10). Total 15.

Pamba 45

Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists "SLA guarantees" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Metricool API + MCP 48

Per the 1 and 2 October checks, not re-read on 10 November. REST takes one account token in the X-Mc-Auth header, not the query string, plus userId and blogId. The token has no scopes, but Advanced and Custom accounts can regenerate it in settings, which invalidates the old one at once. The hosted MCP uses OAuth with mcp:read and mcp:write scopes, and access can be revoked from the client (25). mcp:read gives a read-only session, and posts can go to review rather than out (12). Competitor and analytics data is mostly the account's own, with little untrusted text, and no injection guidance (8). No audit log found (0). The privacy policy names a DPO. No security.txt, disclosure route or certification found, and the terms' data processing section refers to Article 32 GDPR measures in a DPA annex, not a certification (3). Total 48.

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.