{ "data": { "a": { "slug": "pamba", "name": "Pamba", "vendor": "Pamba", "vendorUrl": "https://pamba.app", "kind": "http-api", "category": "social-media", "summary": "Pamba makes AI avatar short-form videos and posts them to TikTok, Instagram and Facebook, through an app, a REST API and a remote MCP server. It also sells accounts it runs on its own iPhones, which those platforms forbid.", "url": "https://www.anchorterminal.com/tools/pamba", "markdownUrl": "https://www.anchorterminal.com/tools/pamba.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/pamba.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/pamba.json", "dns": "pamba.grade.anchorterminal.com", "license": "Closed service. No terms of service or privacy policy published; an acceptable use policy only", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.pamba.app/mcp", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.1 with PKCE and dynamic client registration on api.pamba.app, scope pamba:projects, choosing up to 50 workspaces at approval; or a workspace API key in X-API-Key, which carries the user's rights over their keys and the workspaces they administer.", "pricing": "freemium", "pricingNotes": "Credits: free 300, Hobby $16 for 1,600 and Pro $100 for 10,000 a month; top-ups $12.50 per 1,000. Managed TikTok or Instagram accounts $100 a month each. Fully managed from $7,500 a month. Per-model credit rates at GET /usage/pricing without auth. Read 11 November 2026.", "priceSummary": "$0.0125 / credit", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in Pamba's pricing, API or MCP pages, 11 November 2026. Billing is through Stripe.", "endpoints": [] }, "toolCount": 407, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-11" }, "docsUrl": "https://pamba.app/help/mcp-server", "llmsTxt": "https://pamba.app/llms.txt", "capabilities": [ "social.post", "social.schedule", "social.analytics", "social.comments", "social.media-upload", "video.generate" ], "tags": [ "hosted", "mcp", "oauth", "llms-txt", "closed-source", "freemium", "usage-priced", "tiktok", "instagram", "no-status-page", "platform-rules" ], "lastRelease": "2026-11-11", "graded": true, "anchor": { "graded": true, "score": 41.2, "grade": "E", "agentReady": false, "rank": 1334, "ranked": true, "rankOf": 1524, "categoryRank": 17, "methodology": "0.8", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 70, "payments": 53, "reliability": 45, "schema": 84, "security": 35, "transparency": 28 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-11" }, "negative": -15, "warnings": [ { "kind": "platform-rules", "name": "Breaks the rules of the platforms it acts on", "text": "Pamba sells TikTok and Instagram accounts it creates on its own iPhones and warms so each 'reads as a real person', pitches running 'hundreds of accounts' and replaces banned ones. TikTok's guidelines and Instagram's terms forbid that.", "deduct": -15, "since": "2026-11-11", "sources": [ "https://pamba.app/accounts", "https://pamba.app/help/account-warming", "https://www.tiktok.com/community-guidelines/en/integrity-authenticity/", "https://help.instagram.com/581066165581870" ] } ], "verdict": "Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.", "bestFor": "Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.", "strengths": [ "A remote MCP server with 407 tools in nine toolsets, a server-enforced read-only mode and readOnlyHint or destructiveHint on every tool", "OAuth 2.1 with PKCE and dynamic client registration, with protected-resource metadata on its own domain", "A tool reference generated from the server, and a dated API changelog that flags breaking changes", "Prices public without a login, including per-model credit rates from an unauthenticated route", "Publishes its own poor results: 42% of 6,678 videos it measured never reached 1,000 views" ], "weaknesses": [ "Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned", "No terms of service and no privacy policy (both 404), and no legal entity named", "Managed seats hold account logins, recovery emails and 2-step codes with no published data policy", "One OAuth scope covers everything, and an API key can manage the user's keys and delete workspaces", "No status page and no security contact" ], "agentNotes": [ "Tell your boss before using the accounts toolset: the managed accounts break TikTok's and Instagram's rules and can be banned", "Connect with ?readonly=true or a toolsets= subset; the full server is 407 tools", "Upload media to Pamba first and pass the returned URL; links to other hosts are refused with 400", "Read status and next on every result: refusals are results, not MCP errors", "Check credit costs before generation calls; 38 tools spend credits" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.8", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 41.2 } ], "editorialScores": { "ergonomics": 75, "maintenance": 70, "payments": 53, "reliability": 45, "schema": 84, "security": 35, "transparency": 18 }, "provenanceScore": 37, "checked": { "categories": { "ergonomics": "2026-11-11", "maintenance": "2026-11-11", "payments": "2026-11-11", "reliability": "2026-11-11", "schema": "2026-11-11", "security": "2026-11-11", "transparency": "2026-11-11" }, "last": "2026-11-11", "lastMoved": "2026-11-13", "oldest": "2026-11-11", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.pamba.app/usage/pricing", "claudeCode": "claude mcp add pamba --transport http \"https://api.pamba.app/mcp?readonly=true\"", "config": { "mcpServers": { "pamba": { "url": "https://api.pamba.app/mcp?readonly=true" } } } }, "letme": { "capability": "https://letme.dev/social.post", "tool": "https://letme.dev/pamba" }, "area": "communication", "unitPrices": [ { "item": "Managed TikTok or Instagram account", "unit": "account-month", "usd": 100, "note": "Per account; no credits needed" }, { "item": "Credits top-up", "unit": "credit", "usd": 0.0125, "note": "$12.50 per 1,000; plans work out at $10 per 1,000" } ], "provenance": { "legalEntity": "", "domain": "pamba.app", "domainRegistered": "2025-06-05", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://pamba.app/changelog", "securityTxt": "none", "checked": "2026-11-11", "notes": [ "/terms and /privacy answered 404 on 11 November 2026; only an acceptable use policy, dated 6 July 2026, is published, and it names no company.", "RDAP gives pamba.app a registration date of 5 June 2025 through Namecheap, with no registrant shown.", "robots.txt on pamba.app allows ClaudeBot on public pages and disallows app paths; api.pamba.app has no robots.txt (404).", "No entry in the official MCP registry for 'pamba' on 11 November 2026." ], "score": 37 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/pamba.json", "live": { "slug": "pamba", "probe": { "target": "https://api.pamba.app/mcp", "method": "get", "lastAt": "2026-11-13T23:58:54.025134635Z", "lastOk": true, "lastStatus": 401, "lastMs": 248, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 299, "p95ms24h": 391, "samples24h": 239, "samples30d": 319, "days": [ { "date": "2026-11-12", "probes": 81, "ok": 81 }, { "date": "2026-11-13", "probes": 238, "ok": 238 } ], "since": "2026-11-12T16:06:25.231802453Z" }, "securityTxt": { "url": "https://pamba.app/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-13T16:15:01.559101993Z" }, "llmsTxt": { "url": "https://pamba.app/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-13T15:55:36.94769184Z" }, "pages": [ { "url": "https://pamba.app/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-13T18:26:24.542486652Z", "changedAt": "2026-11-13T18:26:24.542486652Z", "fingerprint": "a0b9ef3713fa" } ], "mcpTools": { "url": "https://api.pamba.app/mcp?readonly=true", "checkedAt": "2026-11-13T03:13:09.042103119Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-13T03:13:09.042103119Z" }, "updatedAt": "2026-11-13T23:58:54.025134635Z" }, "streak": { "days": 2, "from": "2026-11-12", "sinceWatching": true, "best": 2 } }, "answer": "Sprout Social API scores 56 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community.", "b": { "slug": "sprout-social", "name": "Sprout Social API", "vendor": "Sprout Social, Inc.", "vendorUrl": "https://sproutsocial.com", "kind": "http-api", "category": "social-media", "summary": "Sprout Social is a social media management suite. Its REST API reads profile and post analytics, inbox messages, listening topics and cases for connected profiles, and creates draft posts with media, on plans that include API access.", "url": "https://www.anchorterminal.com/tools/sprout-social", "markdownUrl": "https://www.anchorterminal.com/tools/sprout-social.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/sprout-social.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/sprout-social.json", "dns": "sprout-social.grade.anchorterminal.com", "license": "Proprietary service under the Sprout Social Developer Terms and Terms of Service", "transports": [ "http" ], "remoteUrl": "https://api.sproutsocial.com", "packages": [], "auth": "mixed", "authNotes": "Access needs a Sprout account on a plan with API access, a user holding the API Permissions permission, and acceptance of the API terms on the API page of Settings. That user then creates an OAuth client or an API token in the same page, with no review by Sprout described. OAuth 2.0 is the recommended route. A client ID and secret are exchanged at identity.sproutsocial.com for a short-lived JWT with the client credentials grant and `scope=organization_id`, or a user-based flow signs a Sprout user in. API tokens are named and can be invalidated. Either credential goes in the `Authorization: Bearer` header. No per-endpoint scopes are documented.", "pricing": "paid", "pricingNotes": "The Sprout API is listed on the Advanced plan at $399 per seat a month and on Enterprise (custom price). Standard is $199 and Professional $299 per seat a month, without the API. The page shows these prices beside an annual billing note. A 30-day trial needs no credit card. Whether the trial includes API access was not established, and there is no sandbox or per-call price (https://sproutsocial.com/pricing/, checked 2026-10-09).", "priceSummary": "$399 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the Developer Terms or the pricing page (checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://api.sproutsocial.com/docs/", "capabilities": [ "social.analytics", "social.comments", "social.media-upload" ], "tags": [ "hosted", "enterprise", "oauth", "closed-source", "status-page", "soc2", "iso27001", "analytics", "listening", "drafts-only" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 56, "grade": "C", "agentReady": false, "rank": 942, "ranked": true, "rankOf": 1524, "categoryRank": 5, "methodology": "0.8", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 38, "payments": 30, "reliability": 71, "schema": 51, "security": 61, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": 0, "verdict": "The API reads analytics, inbox messages, listening topics and cases across the main networks, with OAuth client credentials, field selection and a dated changelog. It creates draft posts only, so a person must publish them in Sprout. Access needs the Advanced plan at $399 per seat a month, and no OpenAPI file or SDK was found.", "bestFor": "Reporting agents that pull profile, post, inbox, listening and case data for a company that already pays for Sprout Social, and for drafting posts a person will approve.", "strengths": [ "OAuth 2.0 client credentials issue short-lived JWT access tokens, and named API tokens can be invalidated in settings", "Rate limits are published as 60 requests a minute and 250,000 a month", "Messages and post requests take a `fields` list and return only `guid` when it is omitted, with `limit` up to 100 and cursor paging", "The status page has a separate Sprout Social API component, and no incident in the 90 days to 9 October 2026 named it", "SOC 2 Type 2, ISO 27001 and ISO 27701 are listed on the trust centre, with a vulnerability disclosure programme on Bugcrowd" ], "weaknesses": [ "Posts can be created only as drafts (`is_draft: true`), so the API cannot publish or schedule a post without a person in Sprout", "API access is listed on the Advanced plan at $399 per seat a month and on Enterprise, with no per-call price", "No OpenAPI file, SDK or MCP server was found in the reviewed documentation", "No idempotency key on post creation, and no `Retry-After` header documented for 429 responses", "The Developer Terms of 9 May 2024 forbid monitoring the API's availability or performance for benchmarking, and combining the API with software Sprout Social has not authorised. Recorded as a fact with no deduction. It matters before any probe is run" ], "agentNotes": [ "Call `GET /v1/metadata/client` first for the customer ID, then `GET /v1/\u003ccustomer ID\u003e/metadata/customer` for profile and group IDs. Every other path needs them", "Send `is_draft: true` on `POST /v1/\u003ccustomer ID\u003e/publishing/posts`. Tell the user the draft waits in the Sprout calendar for a person to publish", "Name the `fields` you want on messages and posts requests. Without the list only `guid` comes back", "Stay under 60 requests a minute and 250,000 a month, and back off on 429 on your own because no `Retry-After` is documented", "Check the response when a draft names several profiles. A profile that cannot take the attached media is dropped with no error" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.8", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56 } ], "editorialScores": { "ergonomics": 59, "maintenance": 38, "payments": 30, "reliability": 71, "schema": 51, "security": 61, "transparency": 55 }, "provenanceScore": 86, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-13", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.sproutsocial.com/v1/metadata/client -H \"Authorization: Bearer $TOKEN\" -H \"Accept: application/json\"" }, "letme": { "capability": "https://letme.dev/social.analytics", "tool": "https://letme.dev/sprout-social" }, "area": "communication", "unitPrices": [ { "item": "Advanced", "unit": "seat-month", "usd": 399, "note": "Cheapest plan that lists the Sprout API. Price shown beside an annual billing note" }, { "item": "Professional", "unit": "seat-month", "usd": 299, "note": "No API access listed" }, { "item": "Standard", "unit": "seat-month", "usd": 199, "note": "No API access listed" } ], "provenance": { "legalEntity": "Sprout Social, Inc.", "domain": "sproutsocial.com", "domainRegistered": "2009-09-22", "endpointOnVendorDomain": true, "terms": "https://sproutsocial.com/legal/api-terms-of-service/", "privacy": "https://sproutsocial.com/legal/privacy-policy/", "statusPage": "https://www.sproutsocialstatus.com/", "changelog": "https://api.sproutsocial.com/docs/changelog/", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "The Sprout Social Developer Terms (last updated 9 May 2024) are the agreement the API docs link, between the developer and Sprout Social, Inc. They sit on top of the Terms of Service (effective 9 May 2025, re-read on 4 November 2026) at https://sproutsocial.com/legal/terms/.", "The website Terms of Use (effective 30 June 2023, https://sproutsocial.com/legal/website-terms-of-use/) govern www.sproutsocial.com and each page linking to them, and bar using \"any robot, spider, or other automatic device, process, or means to access the Site for any purpose\". Read on 4 November 2026 as a ban on automated access, so the other pages were not re-read that day.", "The Terms of Service give the notice address as Sprout Social, Inc., 131 S. Dearborn Suite 700, Chicago, Illinois 60603.", "The privacy policy (last updated 16 September 2026) says it applies to the websites and services, app.sproutsocial.com among them, and that Sprout Social is a data processor for customer data.", "https://sproutsocial.com/.well-known/security.txt answered 404. Reports go through the Bugcrowd programme named in the Responsible Disclosure Policy.", "The API answers at api.sproutsocial.com and tokens come from identity.sproutsocial.com.", "RDAP for sproutsocial.com gives a registration date of 2009-09-22 and GoDaddy Corporate Domains, LLC as registrar." ], "score": 86 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/sprout-social.json", "live": { "slug": "sprout-social", "probe": { "target": "https://api.sproutsocial.com", "method": "get", "lastAt": "2026-11-13T23:59:02.626826401Z", "lastOk": true, "lastStatus": 404, "lastMs": 247, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 273, "p95ms24h": 347, "samples24h": 239, "samples30d": 7892, "days": [ { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 243, "ok": 243 }, { "date": "2026-11-08", "probes": 243, "ok": 243 }, { "date": "2026-11-09", "probes": 243, "ok": 243 }, { "date": "2026-11-10", "probes": 244, "ok": 244 }, { "date": "2026-11-11", "probes": 244, "ok": 244 }, { "date": "2026-11-12", "probes": 245, "ok": 245 }, { "date": "2026-11-13", "probes": 238, "ok": 238 } ], "since": "2026-10-09T00:00:00Z" }, "vendorStatus": { "page": "https://www.sproutsocialstatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-13T23:55:34.535759448Z" }, "securityTxt": { "url": "https://sproutsocial.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-13T16:16:39.161013908Z" }, "domain": { "domain": "sproutsocial.com", "registered": "2009-09-22", "source": "https://rdap.verisign.com/com/v1/domain/sproutsocial.com", "checkedAt": "2026-11-08T15:06:07.695668304Z" }, "pages": [ { "url": "https://api.sproutsocial.com/docs/changelog/", "kind": "changelog", "status": 304, "checkedAt": "2026-11-13T18:09:15.894437044Z", "changedAt": "2026-10-31T06:04:22.731741078Z", "fingerprint": "3a407acdff7c" }, { "url": "https://sproutsocial.com/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-13T18:31:24.391679886Z", "changedAt": "2026-10-29T05:16:21.700997532Z", "fingerprint": "48222d72f8b6" }, { "url": "https://sproutsocial.com/legal/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-13T18:31:22.744557666Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "c3bb94f08774" }, { "url": "https://sproutsocial.com/legal/api-terms-of-service/", "kind": "terms", "status": 200, "checkedAt": "2026-11-13T18:31:20.151567787Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "51915d0f6e67" } ], "updatedAt": "2026-11-13T23:59:02.626826401Z" }, "streak": { "days": 36, "from": "2026-10-09", "sinceWatching": true, "best": 36 } }, "edges": [ { "by": 43, "category": "transparency", "leads": "sprout-social", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.", "b": "Closed service with published Developer Terms (9 May 2024), Terms of Service (9 May 2025) and website Terms of Use (30 June 2023) from Sprout Social, Inc. (15). Per the 9 October check, not re-read on 4 November. The privacy policy of 16 September 2026 covers the services and states the processor role, the Terms of Service allow account content to be removed within 30 days of termination, and the docs say uploaded media is kept for 24 hours. The policy gives no retention periods, and the DPA is a PDF we did not read (20). The changelog carries dated notices of removed metrics, most of them forced by Meta. The Developer Terms promise only reasonable efforts, when possible, to give notice that a version will stop being supported (8). Hosting is disclosed to the cloud region, all in the United States. The privacy policy lists service providers by category, and a named sub-processor list was not found on the pages read (12)." }, "scores": { "a": 28, "b": 71 } }, { "by": 33, "category": "schema", "leads": "pamba", "name": "Schema \u0026 documentation", "reasons": { "a": "No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.", "b": "Per the 9 October check, not re-read on 4 November. No OpenAPI file or other machine-readable description was found in the docs (0). The site's llms.txt lists marketing articles and no API page, and the docs are one HTML page with no Markdown twin (2). Each endpoint group states its purpose and has a Limitations section, and the overview lists what the API does not include (14). Request keys are tabulated with example values, limits and a few enumerations such as `media_type`, but filters are strings in a small expression syntax such as `created_time.in(...)` (9). Every endpoint has an example request and response, and a status code table gives a corrective action for each code. The error body is one free-text string (11). Versioning is MAJOR.MINOR with version response headers, and the changelog is dated from November 2020 to 6 October 2026 (15)." }, "scores": { "a": 84, "b": 51 } }, { "by": 32, "category": "maintenance", "leads": "pamba", "name": "Maintenance \u0026 community", "reasons": { "a": "Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.", "b": "Per the 9 October check, not re-read on 4 November. The newest changelog entry read is dated 6 October 2026, 29 days before 4 November (30). It is the only dated entry read in the 90 days from 6 August. The two before it are 15 June and 10 June, and entries after 9 October could not be read (0). No SDK, CLI or package of Sprout's own was found to add dated releases. A public changelog, a help centre and a community site are linked. The Developer Terms say they entitle the developer to no support for the API (8). No official SDK was found (0). No package to assess (0)." }, "scores": { "a": 70, "b": 38 } }, { "by": 26, "category": "reliability", "leads": "sprout-social", "name": "Reliability", "reasons": { "a": "Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists \"SLA guarantees\" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.", "b": "Hosted lines, per the 9 October check, not re-read on 4 November (Sprout's website Terms of Use bar robots and automatic means, so its hosts and its own-domain status page were not requested). A public status page on Atlassian Statuspage with a separate Sprout Social API component and incident history (20). The history feed read on 9 October showed six incidents in its 90 days, traced to Meta, Reddit or Threads, to Sprout's Trellis assistant (one a 22-minute outage on 6 August) and to a two-hour platform performance incident on 20 July that now falls outside the window. None named the API component, so we read the record as minor incidents only (20). The stretch from 9 October to 4 November is unread and not credited. Rate limits are published as 60 requests a minute and 250,000 a month (15). 429 is documented with the advice to slow down, and the media upload section advises exponential back-off on 5xx, but no `Retry-After` header or idempotency key for post creation was found. The 6 is an in-between value, partly met, kept (6). No SLA was found in the Terms of Service or Developer Terms. The security page gives 99.9 per cent uptime as an internal target (0). The API is not labelled beta (10)." }, "scores": { "a": 45, "b": 71 } }, { "by": 26, "category": "security", "leads": "sprout-social", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.", "b": "Per the 9 October check, not re-read on 4 November. OAuth 2.0 client credentials issue short-lived JWT access tokens, a user-based flow is available, and API tokens are named and can be invalidated. The only scope documented is `organization_id`, so a credential is not limited to reading or to one endpoint group. Credentials travel in the Authorization header only (22). No read-only credential is documented. The API can write only draft posts and media, the app has approval workflows, and API access can be limited to IP ranges per the product security page (12). The messages and listening endpoints return text written by the public, and no guidance on untrusted content was found (2). The app has a customer-facing audit trail of over fifty events. Whether API calls appear in it was not established (8). Responsible Disclosure Policy with a Bugcrowd vulnerability disclosure programme, SOC 2 Type 2, ISO 27001, ISO 27701 and CSA STAR Level 1 on the trust centre. No security.txt and no paid bounty stated (17)." }, "scores": { "a": 35, "b": 61 } }, { "by": 23, "category": "payments", "leads": "pamba", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.", "b": "Per the 9 October check, not re-read on 4 November. No x402 or other machine payment protocol (0). Plan prices are public and the API is listed on Advanced at $399 per seat a month, with no per-call price (10). A 30-day trial needs no credit card, but whether it includes API access was not established, so half marks (10). A person has to sign up, hold the API Permissions permission and accept the API terms in settings (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30." }, "scores": { "a": 53, "b": 30 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Pamba", "b": "Sprout Social, Inc.", "name": "Vendor" }, { "a": "https://api.pamba.app/mcp", "b": "https://api.sproutsocial.com", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Closed service. No terms of service or privacy policy published; an acceptable use policy only", "b": "Proprietary service under the Sprout Social Developer Terms and Terms of Service", "name": "Licence" }, { "a": "407", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-11-11", "b": "2026-10-06", "name": "Last release" }, { "a": "no document linked", "b": "2024-05-09", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-09-16", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" } ], "faq": [ { "answer": "Sprout Social API scores 56 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community.", "question": "Which is better for AI agents, Pamba or Sprout Social API?" }, { "answer": "Pamba uses an OAuth sign-in. Sprout Social API takes an API key or an OAuth sign-in.", "question": "Do Pamba and Sprout Social API need an API key?" }, { "answer": "Yes. Pamba has a hosted endpoint at https://api.pamba.app/mcp and Sprout Social API at https://api.sproutsocial.com.", "question": "Can an agent call Pamba and Sprout Social API without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 84 against 51", "Agent ergonomics, 75 against 59", "Payments \u0026 pricing, 53 against 30", "Maintenance \u0026 community, 70 against 38" ], "also": null, "goodFor": "Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.", "slug": "pamba", "watchFor": "Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned" }, { "aheadOn": [ "Reliability, 71 against 45", "Security \u0026 auth, 61 against 35", "Transparency \u0026 trust, 71 against 28" ], "also": [ "No incidents deducted, where Pamba loses 15 points for them" ], "goodFor": "Reporting agents that pull profile, post, inbox, listening and case data for a company that already pays for Sprout Social, and for drafting posts a person will approve.", "slug": "sprout-social", "watchFor": "Posts can be created only as drafts (`is_draft: true`), so the API cannot publish or schedule a post without a person in Sprout" } ], "history": { "pamba": [ { "causes": [ "method" ], "date": "2026-11-13", "delta": 2.3, "from": 38.9, "fromGrade": "E", "to": 41.2, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-11-13", "delta": -5, "from": 43.9, "fromGrade": "E", "to": 38.9, "toGrade": "E" } ], "sprout-social": [ { "causes": [ "method" ], "date": "2026-11-13", "delta": 1.2, "from": 54.8, "fromGrade": "C", "to": 56, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 54.7, "fromGrade": "C", "to": 54.8, "toGrade": "C" } ] }, "job": { "capability": "social.analytics", "name": "Social analytics" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ayrshare-vs-pamba.json", "title": "Ayrshare API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/ayrshare-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/blotato-vs-pamba.json", "title": "Blotato vs Pamba", "url": "https://www.anchorterminal.com/compare/blotato-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/buffer-vs-pamba.json", "title": "Buffer API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/buffer-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/bundle-social-vs-pamba.json", "title": "bundle.social vs Pamba", "url": "https://www.anchorterminal.com/compare/bundle-social-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/late-vs-pamba.json", "title": "Zernio (formerly Late) API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/late-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/metricool-vs-pamba.json", "title": "Metricool API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/metricool-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-pamba.json", "title": "Mixpost API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/mixpost-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/oneup-vs-pamba.json", "title": "OneUp API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/oneup-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-post-bridge.json", "title": "Pamba vs Post Bridge API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-post-bridge" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-postiz.json", "title": "Pamba vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-publer.json", "title": "Pamba vs Publer API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-publer" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-repostit.json", "title": "Pamba vs Repostit", "url": "https://www.anchorterminal.com/compare/pamba-vs-repostit" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-typefully.json", "title": "Pamba vs Typefully", "url": "https://www.anchorterminal.com/compare/pamba-vs-typefully" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-upload-post.json", "title": "Pamba vs Upload-Post API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-upload-post" }, { "json": "https://www.anchorterminal.com/compare/ayrshare-vs-sprout-social.json", "title": "Ayrshare API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/ayrshare-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/blotato-vs-sprout-social.json", "title": "Blotato vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/blotato-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/buffer-vs-sprout-social.json", "title": "Buffer API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/buffer-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/bundle-social-vs-sprout-social.json", "title": "bundle.social vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/bundle-social-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/late-vs-sprout-social.json", "title": "Zernio (formerly Late) API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/late-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/metricool-vs-sprout-social.json", "title": "Metricool API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/metricool-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-sprout-social.json", "title": "Mixpost API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/mixpost-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/oneup-vs-sprout-social.json", "title": "OneUp API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/oneup-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp.json", "title": "Pamba vs TwitterAPI.io MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp.json", "title": "Pamba vs X MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp.json", "title": "Pamba vs Xpoz MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp" }, { "json": "https://www.anchorterminal.com/compare/post-bridge-vs-sprout-social.json", "title": "Post Bridge API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/post-bridge-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-sprout-social.json", "title": "Postiz API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/postiz-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/publer-vs-sprout-social.json", "title": "Publer API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/publer-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/socialcannon-vs-sprout-social.json", "title": "SocialCannon vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/socialcannon-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/sprout-social-vs-twitterapi-io-mcp.json", "title": "Sprout Social API vs TwitterAPI.io MCP", "url": "https://www.anchorterminal.com/compare/sprout-social-vs-twitterapi-io-mcp" }, { "json": "https://www.anchorterminal.com/compare/sprout-social-vs-upload-post.json", "title": "Sprout Social API vs Upload-Post API + MCP", "url": "https://www.anchorterminal.com/compare/sprout-social-vs-upload-post" }, { "json": "https://www.anchorterminal.com/compare/sprout-social-vs-x-mcp.json", "title": "Sprout Social API vs X MCP", "url": "https://www.anchorterminal.com/compare/sprout-social-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/sprout-social-vs-xpoz-mcp.json", "title": "Sprout Social API vs Xpoz MCP", "url": "https://www.anchorterminal.com/compare/sprout-social-vs-xpoz-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-socialcannon.json", "title": "Pamba vs SocialCannon", "url": "https://www.anchorterminal.com/compare/pamba-vs-socialcannon" } ], "panel": null, "scores": [ { "by": 26, "edge": "sprout-social", "key": "reliability", "name": "Reliability", "pamba": 45, "sprout-social": 71, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 33, "edge": "pamba", "key": "schema", "name": "Schema \u0026 documentation", "pamba": 84, "sprout-social": 51, "weight": 13 }, { "by": 16, "edge": "pamba", "key": "ergonomics", "name": "Agent ergonomics", "pamba": 75, "sprout-social": 59, "weight": 13 }, { "by": 26, "edge": "sprout-social", "key": "security", "name": "Security \u0026 auth", "pamba": 35, "sprout-social": 61, "weight": 14 }, { "by": 23, "edge": "pamba", "key": "payments", "name": "Payments \u0026 pricing", "pamba": 53, "sprout-social": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 32, "edge": "pamba", "key": "maintenance", "name": "Maintenance \u0026 community", "pamba": 70, "sprout-social": 38, "weight": 7 }, { "by": 43, "edge": "sprout-social", "key": "transparency", "name": "Transparency \u0026 trust", "pamba": 28, "sprout-social": 71, "weight": 7 } ], "summary": "Sprout Social API scores 56 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community. Both do social analytics.", "tasks": null, "tutorials": [ { "title": "Inventory reporting profiles with Sprout Social", "tool": "sprout-social", "url": "https://www.anchorterminal.com/tutorials/sprout-social/" } ], "verdicts": { "pamba": "Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.", "sprout-social": "The API reads analytics, inbox messages, listening topics and cases across the main networks, with OAuth client credentials, field selection and a dated changelog. It creates draft posts only, so a person must publish them in Sprout. Access needs the Advanced plan at $399 per seat a month, and no OpenAPI file or SDK was found." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social", "json": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social.min.md" }, "markdown": "Sprout Social API scores 56 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community. Both do social analytics.\n\n- Pamba: grade E, 41.2/100, rank #1334 of 1524. Markdown https://www.anchorterminal.com/tools/pamba.md · JSON https://www.anchorterminal.com/api/v1/tools/pamba.json\n- Sprout Social API: grade C, 56/100, rank #942 of 1524. Markdown https://www.anchorterminal.com/tools/sprout-social.md · JSON https://www.anchorterminal.com/api/v1/tools/sprout-social.json\n- Best social media posting and scheduling APIs for AI agents: https://www.anchorterminal.com/best/social-media/index.md\n- All 182 social comparisons: https://www.anchorterminal.com/compare/social-media/index.md\n\n## Which one, for what\n\n### Pamba (E)\n\nGood for: Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.\n\nAhead on:\n- Schema \u0026 documentation, 84 against 51\n- Agent ergonomics, 75 against 59\n- Payments \u0026 pricing, 53 against 30\n- Maintenance \u0026 community, 70 against 38\n\nWatch for: Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned\n\n### Sprout Social API (C)\n\nGood for: Reporting agents that pull profile, post, inbox, listening and case data for a company that already pays for Sprout Social, and for drafting posts a person will approve.\n\nAhead on:\n- Reliability, 71 against 45\n- Security \u0026 auth, 61 against 35\n- Transparency \u0026 trust, 71 against 28\n\nAlso in its favour:\n- No incidents deducted, where Pamba loses 15 points for them\n\nWatch for: Posts can be created only as drafts (`is_draft: true`), so the API cannot publish or schedule a post without a person in Sprout\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Sprout Social API +43\n\n- Pamba (28): Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.\n- Sprout Social API (71): Closed service with published Developer Terms (9 May 2024), Terms of Service (9 May 2025) and website Terms of Use (30 June 2023) from Sprout Social, Inc. (15). Per the 9 October check, not re-read on 4 November. The privacy policy of 16 September 2026 covers the services and states the processor role, the Terms of Service allow account content to be removed within 30 days of termination, and the docs say uploaded media is kept for 24 hours. The policy gives no retention periods, and the DPA is a PDF we did not read (20). The changelog carries dated notices of removed metrics, most of them forced by Meta. The Developer Terms promise only reasonable efforts, when possible, to give notice that a version will stop being supported (8). Hosting is disclosed to the cloud region, all in the United States. The privacy policy lists service providers by category, and a named sub-processor list was not found on the pages read (12).\n\n### Schema \u0026 documentation: Pamba +33\n\n- Pamba (84): No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.\n- Sprout Social API (51): Per the 9 October check, not re-read on 4 November. No OpenAPI file or other machine-readable description was found in the docs (0). The site's llms.txt lists marketing articles and no API page, and the docs are one HTML page with no Markdown twin (2). Each endpoint group states its purpose and has a Limitations section, and the overview lists what the API does not include (14). Request keys are tabulated with example values, limits and a few enumerations such as `media_type`, but filters are strings in a small expression syntax such as `created_time.in(...)` (9). Every endpoint has an example request and response, and a status code table gives a corrective action for each code. The error body is one free-text string (11). Versioning is MAJOR.MINOR with version response headers, and the changelog is dated from November 2020 to 6 October 2026 (15).\n\n### Maintenance \u0026 community: Pamba +32\n\n- Pamba (70): Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.\n- Sprout Social API (38): Per the 9 October check, not re-read on 4 November. The newest changelog entry read is dated 6 October 2026, 29 days before 4 November (30). It is the only dated entry read in the 90 days from 6 August. The two before it are 15 June and 10 June, and entries after 9 October could not be read (0). No SDK, CLI or package of Sprout's own was found to add dated releases. A public changelog, a help centre and a community site are linked. The Developer Terms say they entitle the developer to no support for the API (8). No official SDK was found (0). No package to assess (0).\n\n### Reliability: Sprout Social API +26\n\n- Pamba (45): Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists \"SLA guarantees\" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.\n- Sprout Social API (71): Hosted lines, per the 9 October check, not re-read on 4 November (Sprout's website Terms of Use bar robots and automatic means, so its hosts and its own-domain status page were not requested). A public status page on Atlassian Statuspage with a separate Sprout Social API component and incident history (20). The history feed read on 9 October showed six incidents in its 90 days, traced to Meta, Reddit or Threads, to Sprout's Trellis assistant (one a 22-minute outage on 6 August) and to a two-hour platform performance incident on 20 July that now falls outside the window. None named the API component, so we read the record as minor incidents only (20). The stretch from 9 October to 4 November is unread and not credited. Rate limits are published as 60 requests a minute and 250,000 a month (15). 429 is documented with the advice to slow down, and the media upload section advises exponential back-off on 5xx, but no `Retry-After` header or idempotency key for post creation was found. The 6 is an in-between value, partly met, kept (6). No SLA was found in the Terms of Service or Developer Terms. The security page gives 99.9 per cent uptime as an internal target (0). The API is not labelled beta (10).\n\n### Security \u0026 auth: Sprout Social API +26\n\n- Pamba (35): OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.\n- Sprout Social API (61): Per the 9 October check, not re-read on 4 November. OAuth 2.0 client credentials issue short-lived JWT access tokens, a user-based flow is available, and API tokens are named and can be invalidated. The only scope documented is `organization_id`, so a credential is not limited to reading or to one endpoint group. Credentials travel in the Authorization header only (22). No read-only credential is documented. The API can write only draft posts and media, the app has approval workflows, and API access can be limited to IP ranges per the product security page (12). The messages and listening endpoints return text written by the public, and no guidance on untrusted content was found (2). The app has a customer-facing audit trail of over fifty events. Whether API calls appear in it was not established (8). Responsible Disclosure Policy with a Bugcrowd vulnerability disclosure programme, SOC 2 Type 2, ISO 27001, ISO 27701 and CSA STAR Level 1 on the trust centre. No security.txt and no paid bounty stated (17).\n\n### Payments \u0026 pricing: Pamba +23\n\n- Pamba (53): No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.\n- Sprout Social API (30): Per the 9 October check, not re-read on 4 November. No x402 or other machine payment protocol (0). Plan prices are public and the API is listed on Advanced at $399 per seat a month, with no per-call price (10). A 30-day trial needs no credit card, but whether it includes API access was not established, so half marks (10). A person has to sign up, hold the API Permissions permission and accept the API terms in settings (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.\n\n## Score by category\n\n| Category | Weight | Pamba | Sprout Social API | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 45 | 71 | Sprout Social API +26 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 84 | 51 | Pamba +33 |\n| Agent ergonomics | 13% (16.2 this run) | 75 | 59 | Pamba +16 |\n| Security \u0026 auth | 14% (17.5 this run) | 35 | 61 | Sprout Social API +26 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 53 | 30 | Pamba +23 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 38 | Pamba +32 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 28 | 71 | Sprout Social API +43 |\n| Negative events | ≤15 | -15 | 0 | |\n| **Total** | | **41.2 · E** | **56 · C** | |\n\n## Facts side by side\n\n| Fact | Pamba | Sprout Social API |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Pamba | Sprout Social, Inc. |\n| Hosted endpoint | `https://api.pamba.app/mcp` | `https://api.sproutsocial.com` |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | Closed service. No terms of service or privacy policy published; an acceptable use policy only | Proprietary service under the Sprout Social Developer Terms and Terms of Service |\n| Tools exposed | 407 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | no |\n| Last release | 2026-11-11 | 2026-10-06 |\n| Terms last updated | no document linked | 2024-05-09 |\n| Privacy policy last updated | no document linked | 2026-09-16 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n\n## How the scores have moved\n\n### Pamba\n\n- +2.3 on 13 November 2026: checklist\n- -5.0 on 13 November 2026: checklist\n\n### Sprout Social API\n\n- +1.2 on 13 November 2026: checklist\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Pamba.** Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.\n\n**Sprout Social API.** The API reads analytics, inbox messages, listening topics and cases across the main networks, with OAuth client credentials, field selection and a dated changelog. It creates draft posts only, so a person must publish them in Sprout. Access needs the Advanced plan at $399 per seat a month, and no OpenAPI file or SDK was found.\n\n## Before you call either\n\n### Pamba\n\n1. Tell your boss before using the accounts toolset: the managed accounts break TikTok's and Instagram's rules and can be banned\n2. Connect with ?readonly=true or a toolsets= subset; the full server is 407 tools\n3. Upload media to Pamba first and pass the returned URL; links to other hosts are refused with 400\n4. Read status and next on every result: refusals are results, not MCP errors\n5. Check credit costs before generation calls; 38 tools spend credits\n\n### Sprout Social API\n\n1. Call `GET /v1/metadata/client` first for the customer ID, then `GET /v1/\u003ccustomer ID\u003e/metadata/customer` for profile and group IDs. Every other path needs them\n2. Send `is_draft: true` on `POST /v1/\u003ccustomer ID\u003e/publishing/posts`. Tell the user the draft waits in the Sprout calendar for a person to publish\n3. Name the `fields` you want on messages and posts requests. Without the list only `guid` comes back\n4. Stay under 60 requests a minute and 250,000 a month, and back off on 429 on your own because no `Retry-After` is documented\n5. Check the response when a draft names several profiles. A profile that cannot take the attached media is dropped with no error\n\n## Tutorials\n\n- [Inventory reporting profiles with Sprout Social](https://www.anchorterminal.com/tutorials/sprout-social/), for Sprout Social API\n\n## Questions\n\n### Which is better for AI agents, Pamba or Sprout Social API?\n\nSprout Social API scores 56 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community.\n\n### Do Pamba and Sprout Social API need an API key?\n\nPamba uses an OAuth sign-in. Sprout Social API takes an API key or an OAuth sign-in.\n\n### Can an agent call Pamba and Sprout Social API without installing anything?\n\nYes. Pamba has a hosted endpoint at https://api.pamba.app/mcp and Sprout Social API at https://api.sproutsocial.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/pamba-vs-sprout-social.json, and with the fewest tokens: https://www.anchorterminal.com/compare/pamba-vs-sprout-social.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"pamba\", \"b\": \"sprout-social\"}`. From a terminal: `anchor compare pamba sprout-social`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/pamba.json and https://www.anchorterminal.com/api/v1/tools/sprout-social.json\n\n## Other comparisons with Pamba or Sprout Social API\n\n- [Ayrshare API + MCP vs Pamba](https://www.anchorterminal.com/compare/ayrshare-vs-pamba.md)\n- [Blotato vs Pamba](https://www.anchorterminal.com/compare/blotato-vs-pamba.md)\n- [Buffer API + MCP vs Pamba](https://www.anchorterminal.com/compare/buffer-vs-pamba.md)\n- [bundle.social vs Pamba](https://www.anchorterminal.com/compare/bundle-social-vs-pamba.md)\n- [Zernio (formerly Late) API + MCP vs Pamba](https://www.anchorterminal.com/compare/late-vs-pamba.md)\n- [Metricool API + MCP vs Pamba](https://www.anchorterminal.com/compare/metricool-vs-pamba.md)\n- [Mixpost API + MCP vs Pamba](https://www.anchorterminal.com/compare/mixpost-vs-pamba.md)\n- [OneUp API + MCP vs Pamba](https://www.anchorterminal.com/compare/oneup-vs-pamba.md)\n- [Pamba vs Post Bridge API + MCP](https://www.anchorterminal.com/compare/pamba-vs-post-bridge.md)\n- [Pamba vs Postiz API + MCP](https://www.anchorterminal.com/compare/pamba-vs-postiz.md)\n- [Pamba vs Publer API + MCP](https://www.anchorterminal.com/compare/pamba-vs-publer.md)\n- [Pamba vs Repostit](https://www.anchorterminal.com/compare/pamba-vs-repostit.md)\n- [Pamba vs Typefully](https://www.anchorterminal.com/compare/pamba-vs-typefully.md)\n- [Pamba vs Upload-Post API + MCP](https://www.anchorterminal.com/compare/pamba-vs-upload-post.md)\n- [Ayrshare API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/ayrshare-vs-sprout-social.md)\n- [Blotato vs Sprout Social API](https://www.anchorterminal.com/compare/blotato-vs-sprout-social.md)\n- [Buffer API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/buffer-vs-sprout-social.md)\n- [bundle.social vs Sprout Social API](https://www.anchorterminal.com/compare/bundle-social-vs-sprout-social.md)\n- [Zernio (formerly Late) API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/late-vs-sprout-social.md)\n- [Metricool API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/metricool-vs-sprout-social.md)\n- [Mixpost API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/mixpost-vs-sprout-social.md)\n- [OneUp API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/oneup-vs-sprout-social.md)\n- [Pamba vs TwitterAPI.io MCP](https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp.md)\n- [Pamba vs X MCP](https://www.anchorterminal.com/compare/pamba-vs-x-mcp.md)\n- [Pamba vs Xpoz MCP](https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp.md)\n- [Post Bridge API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/post-bridge-vs-sprout-social.md)\n- [Postiz API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/postiz-vs-sprout-social.md)\n- [Publer API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/publer-vs-sprout-social.md)\n- [SocialCannon vs Sprout Social API](https://www.anchorterminal.com/compare/socialcannon-vs-sprout-social.md)\n- [Sprout Social API vs TwitterAPI.io MCP](https://www.anchorterminal.com/compare/sprout-social-vs-twitterapi-io-mcp.md)\n- [Sprout Social API vs Upload-Post API + MCP](https://www.anchorterminal.com/compare/sprout-social-vs-upload-post.md)\n- [Sprout Social API vs X MCP](https://www.anchorterminal.com/compare/sprout-social-vs-x-mcp.md)\n- [Sprout Social API vs Xpoz MCP](https://www.anchorterminal.com/compare/sprout-social-vs-xpoz-mcp.md)\n- [Pamba vs SocialCannon](https://www.anchorterminal.com/compare/pamba-vs-socialcannon.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.8", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Pamba vs Sprout Social API", "url": "" } ], "description": "Sprout Social scores 56 (C) to Pamba's 41.2 (E) for social analytics. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Pamba E 41.2", "Sprout Social API C 56", "scores" ], "h1": "Pamba vs Sprout Social API", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/pamba-vs-sprout-social", "published": "2026-10-01", "section": "tools", "title": "Pamba vs Sprout Social for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-13", "url": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social" }, "tokens": { "markdown": 5250, "slim": 1130 }, "version": 1 }