Nutshell vs SugarAI (SugarCRM)

Nutshell

The REST reference is served as Markdown with an OpenAPI fragment per operation, and the hosted MCP server uses OAuth with PKCE and can only read. No rate limit numbers, error format or API changelog were found in the reviewed documentation, and API keys carry no scopes.

SugarAI (SugarCRM)

The REST reference covers 350 endpoint pages with filters, field selection, bulk calls and upsert by sync_key. SugarAI's AI Supplemental Terms forbid connecting a customer's or third party's AI agent or MCP connector to the APIs unless Sugar has approved it, tokens carry no scopes, and no OpenAPI file, trial or SLA was found.

Nutshell

1. Authenticate REST calls with HTTP Basic, a Nutshell user's email as username and the API key as password, against https://app.nutshell.com/rest
2. Use IDs in the <number>-<type> form, such as 3-accounts, and send updates as JSON Patch with content-type: application/json-patch+json
3. Page lists with page[limit] and page[page], which is 0-based, and call /accounts/list/fields or the lead and contact equivalents for valid filter keys
4. Use the REST API for writes. The MCP server only reads, and OAuth tokens need the read scope
5. Filter webhook events yourself, because every webhook receives all events and subscriptions are created in Setup, not through the API

SugarAI (SugarCRM)

1. Confirm that Sugar has approved the agent integration before connecting. The AI Supplemental Terms forbid unapproved AI agents and MCP connectors on the APIs
2. POST to /rest/v11_27/oauth2/token with grant_type password and a platform other than base, mobile or portal, or the login can end the user's own session
3. Send the access token in the OAuth-Token header. It lasts 60 minutes by default, so store the refresh token and not the password
4. Stay under 20 requests a second on SugarCloud and reuse one session for batches. Over-limit traffic is blocked by IP address until support lifts it
5. Page with max_num and offset until next_offset is -1, and pass fields to keep responses small
6. Use PATCH /integrate/:module/:sync_key_field_name/:sync_key_field_value for writes that may be retried, since it inserts or updates by sync_key