Pamba vs SocialCannon

Pamba 70

Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.

SocialCannon 0

No changelog, release notes or dated API change found on socialcannon.app (recency 0, 90-day line 0). The docs name an npm MCP package, @socialcannon/mcp 1.0.2, and an OpenClaw skill at version 1.14.0, but no first-hand dated release record was readable (0). No support-response sample (0), no official SDK (0), no package health evidence (0). 0 + 0 + 0 + 0 + 0 = 0.

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.

SocialCannon 62

Scoped client credentials exchanged for one-hour JWTs, secret regeneration revokes the old one (25, kept as the earlier partial). Separate read, write and delete scopes (20). Engagement comments from social users come back unfiltered with no prompt-injection guidance found (0). Post and engagement state visible to the operator (10). security.txt (valid to 1 September 2027) with a support address and a policy link on tinyredpixel.dev, whose robots.txt refuses us, so no acknowledgement time read (7). 25 + 20 + 0 + 10 + 7 = 62.

Pamba 28

Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.

SocialCannon 53

Closed service with terms naming Tiny Red Pixel Ltd, company number 17224220, updated 28 October 2026 (15). Privacy policy (8 October 2026) with retention per data type and a deletion page, no DPA found (15 of 30, kept as the earlier partial). No deprecation policy or dated notice (0). Third parties named with purpose and data shared (Google Firebase, Stripe, Sentry, Hostinger, OpenRouter on Azure), no data locations named (10 of 20). 15 + 15 + 0 + 10 = 40.

Pamba 84

No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.

SocialCannon 65

No OpenAPI or similar contract found (0); the platform capabilities JSON is a data file, not a contract. llms.txt index and Markdown copies of the API reference, the error reference and guides (10). Endpoint purposes and platform constraints (20), parameter descriptions and validation rules (15), request and response examples with an error reference of 83 codes and their safe next action (15), versioned v1 routes with no dated changelog (5, kept as the earlier partial). 0 + 10 + 20 + 15 + 15 + 5 = 65.

Pamba 75

Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.

SocialCannon 85

Cursor pagination and compact response envelopes (20), status, platform and account filters (20), error codes with details.retryable and details.action remedies (20). Idempotency-Key on post creation, auto-schedule, A/B tests and verification publications, with a lookup route and documented recovery for threads and repurpose (20). Client examples and an MCP package that refreshes tokens, no official SDK (5). 20 + 20 + 20 + 20 + 5 = 85.

Pamba 53

No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

SocialCannon 45

No machine payment protocol found (0). Public monthly plans of $15, $49 and $150 (10). Free plan with no card required (20). Account signup and an owner OAuth flow for each social account are required (0). 0 + 10 + 20 + 0 = 30. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 30 is 45.