Pamba vs Post Bridge API + MCP

Pamba 70

Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.

Post Bridge API + MCP 31

Recency from postbridge-cli 1.1.4, published to npm on 9 September 2026 per the 1 October reading of the npm registry (not re-read), 56 days before this check (20; 30 on 1 October). The repository bumps the CLI to 1.1.5 (4 October), 1.1.6 (19 October), 1.1.7 (25 October) and 1.1.8 (31 October) in commits with no tag and no changelog entry, which this run doesn't count as releases, so fewer than three confirmed releases or dated changelog entries fall in the 90 days from 6 August (0; 20 on 1 October, which also counted the MCP registry's versions). llms.txt says support is answered by the founder within a few hours. The repository has never had a pull request and there's no public changelog (8). The 1 October registry line rested on the official MCP registry's JSON API, which this run doesn't use, and the vendor publishes no official SDK (0; 15 on 1 October). The CLI has no dependencies and the repository runs no CI (3). 20 + 0 + 8 + 0 + 3 = 31.

Pamba 53

No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

Post Bridge API + MCP 23

No x402 or other machine payment (0). Plan prices are public with $1 a month per account above 99, and no per-call price (10). The pricing FAQ, re-read on 4 November, still says free users get 5 posts a month, but the plan table shows only paid plans and doesn't say free users get the API. The 7-day trial reads $0.00 due today with no statement on cards, so part credit (5). A person signs up in a browser, or approves OAuth in a client (0). 0 + 10 + 5 + 0 = 15. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 15 is 23.

Pamba 28

Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.

Post Bridge API + MCP 45

The CLI, skills and plugin are MIT. The hosted service runs under terms that name only Post Bridge with Canadian governing law, no company type or registration, and a 24-hour refund window that the pricing FAQ gives as 7 days. The terms' Last Updated line showed the day of each check, 1 October and 4 November 2026 (10). The privacy policy, updated 5 October 2026, sets retention per data type, deletes personal data within 30 days of account deletion and names Supabase, Cloudflare, Stripe, Trigger.dev, Mailgun, Unkey and Vercel, with no DPA and no data locations (20). No deprecation policy. The terms promise email notice of changes (3). Subprocessors named, locations not (12). 10 + 20 + 3 + 12 = 45.

Pamba 75

Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.

Post Bridge API + MCP 60

16 compact MCP tools with no toolsets (15). Offset and limit with a next URL, and posts filter by platform and status (20). Errors are plain strings with no codes, though list_post_results gives per-platform outcomes and the skill maps common failure causes (12). No idempotency key and no annotations we could see. is_draft holds a post, and delete_post only touches scheduled or draft posts (6). A zero-dependency Node CLI and no SDKs. Omitting scheduled_at publishes at once (7). 15 + 20 + 12 + 6 + 7 = 60.

Pamba 84

No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.

Post Bridge API + MCP 72

The API reference page at api.post-bridge.com/reference carries the OpenAPI 3.0.0 document in its own HTML (info.version 1.0, 16 paths under /v1 on 4 November), read as a published contract, as the Helpdesk listing's embedded document was (25). llms.txt and llms-full.txt (10). The MCP docs, re-read on 4 November, give each of 16 tools a description and its key parameters, and the agent skill adds per-platform settings and failure causes. We didn't read the hosted tools' own descriptions (12). Platform and status enums and typed DTOs in the document (12). Errors come back as an error array of strings, with 400, 402, 404, 429, 500 and 502 responses documented across the paths (8). Paths sit under /v1 with info.version 1.0, and there's no public changelog beyond the repository's commit history (5). 25 + 10 + 12 + 12 + 8 + 5 = 72.

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.

Post Bridge API + MCP 44

The hosted MCP does OAuth 2.0 with PKCE (S256), automatic client registration and six scopes, among them posts:read, analytics:read, accounts:read and media:read, per the 1 October reading of its published OAuth metadata. It also takes a pb_live_ key as a Bearer header, and the MCP docs, re-read on 4 November, document ?key=pb_live_... for clients without header support and a Grok route with the key in the URL, so less 10 (20). Read-only scopes are possible and is_draft holds posts for review. The skill tells the agent to confirm local file and cron actions with the user (12). Tools return the operator's own posts and analytics, with no inbox or comments (10). list_post_results shows per-platform outcomes, no audit log (2). www.post-bridge.com/.well-known/security.txt returns 404, and no disclosure route or certification was found, only support@post-bridge.com (0). 20 + 12 + 10 + 2 + 0 = 44.