Mixpost API + MCP vs Pamba

Mixpost API + MCP 15

No x402 (0). Pro is $299 once and Enterprise $1,199 once, and Cloud's Momentum plan with the API and MCP is $49 a month, all public, with no per-call price (10). Lite is free but has no API or MCP, Pro has a 14-day money-back guarantee, and Cloud's 7-day trial needs a card (0). A person has to buy a licence or sign up for Cloud in a browser (0). 0 + 10 + 0 + 0 = 10. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 10 is 15.

Pamba 53

No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

Mixpost API + MCP 43

31 MCP tools since v7.3.0 added list-mentions on 30 October 2026, with no toolsets (5). A workspace role decides which tools a token may use, but the docs say a Viewer calling a members-only tool gets an error, not a shorter tool list, so nothing comes back (5 of 25). Some list endpoints paginate and some don't, per the API docs (12). Laravel-style JSON errors with field messages and 422 for validation, and MCP inputs with unknown option keys rejected with an error naming the accepted keys (15). No idempotency keys, and the read, write and destructive labels live in the docs rather than as MCP annotations. unschedule-post and restore-post give safe ways back (6). No official SDKs, only an n8n community node (5). 5 + 12 + 15 + 6 + 5 = 43.

Pamba 75

Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.

Mixpost API + MCP 70

Scored on the checklist for software you run yourself, since Pro installs into your own Laravel app and its uptime is whatever your server gives it. Mixpost Cloud has no public status page we could find. Installs from Inovector's Composer repository with PHP 8.2 or later stated, per the 1 October check (20). Lite runs a public test workflow on PHP 8.2 and 8.3, and Pro's CI isn't public; kept at the earlier partial value (10). The Lite repository's issues were read on 1 October (27 open, no maintainer replies visible) and couldn't be re-read on 4 November, and Pro's tracker is private (10). Release notes per version, with v7.0.0 flagged as breaking and no breaking change found in the 7.1 to 7.3 notes (15). Past 1.0, at Pro v7.3.1 (15). 20 + 10 + 10 + 15 + 15 = 70.

Pamba 45

Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists "SLA guarantees" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Mixpost API + MCP 51

The API and MCP live in Pro and Enterprise, which are proprietary with clear licence terms and a perpetual fallback licence. Lite is MIT (15). Privacy policy from INOVECTOR DIGITAL S.R.L. of Moldova names Hetzner, DigitalOcean, PayPal and Sentry, but has no date, no DPA and vague retention (12). v7.0.0 is flagged breaking and the MIXPOST_CORE_PATH default change is documented, with no formal deprecation policy (8). Cloud subprocessors and countries named. We found no statement on whether self-hosted installs report anything back (10), per the 1 October check. 15 + 12 + 8 + 10 = 45.

Pamba 28

Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.

Mixpost API + MCP 57

Personal keys as Bearer headers that expire after 7, 30, 60 or 90 days, a year, a custom date or never, and since Pro v7.1.0 (15 October 2026) can be renamed, re-dated and rotated, but have no scopes and carry the full authority of the user who made them. Each instance is also an OAuth 2.1 server with PKCE (S256 only), refresh tokens that rotate on every use, revocation and two scopes, api and mcp, which choose the surface but not what the token may do (25 of 30). A key or OAuth token from a Viewer-role user can only read, and a workspace that requires post approval puts posts scheduled through MCP into needs-approval. Deletes aren't gated (15 of 20). Tools return the operator's own posts and analytics, little untrusted text (10). Connected apps can be reviewed and disconnected; no audit log found (0). The Lite repository's SECURITY.md asks for reports by email, with no acknowledgement time, which this run reads as 7. The path traversal (24 February 2026) and XSS (17 June 2026) reports on the Lite repository have no fix; the XSS is CVE-2026-57958, a Medium assigned by VulnCheck (7 of 20). 25 + 15 + 10 + 0 + 7 = 57.

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.

Mixpost API + MCP 76

OpenAPI 3.1.0 linked from the API docs as a download, version 1.0.0 with 75 operations and 33 enums on 4 November (25). No llms.txt found (404 at the standard path) (0). The MCP tools page groups 31 tools and labels each read, write or destructive (12). Inputs typed in the spec (12). A dedicated errors page, consistent JSON error shapes, and 422 with errors.limit for plan limits (12). Public release notes for every Pro version (15). 25 + 0 + 12 + 12 + 12 + 15 = 76.

Pamba 84

No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.