Pamba vs X MCP

Pamba 28

Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.

X MCP 59

Editorial half only. The hosted server is closed, under a Developer Agreement last updated 27 April 2026, and the bridge is MIT per the xurl LICENSE read on 4 November (18 of 30, an earlier partial kept). The 8 October data-handling reading came from X's privacy policy and terms of service on x.com, whose robots.txt disallows every path for unnamed agents, so it is struck. The Developer Agreement (re-read on 4 November) links a controller-to-controller data protection addendum on gdpr.x.com, which wasn't read, and no retention statement or subprocessor list for developers was found in the pages still readable (0 of 30). The versioning page (re-read on 4 November) limits breaking changes to major versions, at most yearly, with migration guides, and says a deprecated version works for 'a defined period' without stating one. Dated notices exist but can be short, such as five days for the Account Activity replay endpoint in March 2026 and four days for the removal of follows, likes and quote posts from self-serve tiers in April 2026. Dated notices with no stated period take this run's settled 15 (15 of 20, from 14). The controller names came from the struck privacy policy, and no subprocessor or data location list was found (0 of 20). 18+0+15+0 = 33.

Pamba 75

Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.

X MCP 45

Per the 8 October check, not re-read on 4 November, apart from the xurl clone and the MCP page. The number of tools isn't published. One docs page lists six groups and another says XMCP exposes 200+ endpoints as tools, so context cost is not established (5 of 25). The API has max_results, pagination_token, field selection and expansions. Whether each MCP tool passes them through is unread (12 of 20). Errors are problem+json with a type URI, title and detail, and the xurl CHANGELOG (1.2.0) says the bridge turns transport and token failures into JSON-RPC errors keyed to the request (15 of 20). No idempotency keys, and no readOnlyHint or destructiveHint documented. The bridge refreshes the token and retries after a 401 (4 of 20). One npx line starts the bridge and the URL has a default, but each user first creates an app, registers a redirect URI and sets a 300-second startup timeout. Official XDKs exist for Python and TypeScript (9 of 15). 5+12+15+4+9 = 45.

Pamba 45

Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists "SLA guarantees" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

X MCP 72

Read with the hosted lines, since the server runs at api.x.com and the bridge only relays. docs.x.com and developer.x.com are separate hosts with open robots.txt files. The incident history was re-read on 4 November, and the other lines are per the 8 October check, not re-read. A status page exists at developer.x.com/status but needs JavaScript and showed our reader nothing. The dated incident history at docs.x.com/incidents.md lists incidents by title, with no component view and no MCP entry (15 of 20, an earlier partial kept). On 4 November that history still has no incident dated after 1 July 2026, apart from a 'Missing entities.annotations' entry marked ongoing since 24 March 2026, so the earlier partial stays, as the x-ads listing holds it on the same page (25 of 30). API rate limits are published per endpoint, such as 300 per 15 minutes and 1 a second for full-archive search and 50 per 15 minutes for bookmark writes. The MCP page gives no numbers of its own and says only that writes are stricter than reads (12 of 15, an earlier partial kept). 429s come with x-rate-limit-reset and the docs advise waiting for it and backing off. No Retry-After and no idempotency keys or safe-retry guidance for writes were found, so backoff alone (10). No SLA found for Pay-per-use (0). The MCP page carries no beta or preview label (10). 15+25+12+10+0+10 = 72.

Pamba 53

No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

X MCP 30

Per the 8 October check, not re-read on 4 November. No x402, MPP or L402 (0). Per-resource and per-request prices are published without a login, such as $0.005 a post read, $0.010 a user read and $0.005 a bookmark write (20). No free tier. Credits are bought in advance, and the one-time $20 credit needs a saved payment card (0). A person signs in to the developer portal, creates an app and completes a browser login (0). 0+20+0+0 = 20. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.

Pamba 84

No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.

X MCP 65

The MCP page, llms.txt and changelog were re-read on 4 November, and the rest is per the 8 October check. A public OpenAPI spec covers the API behind it, linked from llms.txt as the machine-readable contract and read at docs.x.com/openapi.json on 4 November (version 2.173, 200 paths, 257 operations). The 8 October copy at api.x.com is struck, since api.x.com's robots.txt disallows every path for unnamed agents. The MCP tool list and input schemas aren't published, and neither the xurl nor the xmcp repository carries the hosted server's tool definitions (18 of 25, an earlier partial kept). llms.txt, llms-full.txt, skill.md and Markdown for every page (10). The MCP page describes six groups of tools and names one tool, article_publish, with no per-tool guidance on when to use which (6 of 20). The API parameters are typed in the spec. Whether the MCP tools carry the same enums and constraints is unread (8 of 15). Client configs for five clients, a troubleshooting table of eight symptoms and a documented problem+json error format with eleven error types (12 of 15). The API is versioned in the path and has a dated changelog with an RSS feed, latest entry 29 October 2026 on 4 November, but the changelog has no entry for the hosted MCP server and the server publishes no version history (11 of 15). 18+10+6+8+12+11 = 65.

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.

X MCP 40

OAuth 2.0 authorisation code with PKCE, scopes and automatic token refresh, per the MCP page re-read on 4 November, and the xurl source sends code_challenge_method S256. Every documented configuration sends the token in an Authorization header. The 8 October reading of the OAuth metadata on api.x.com is struck, since api.x.com's robots.txt disallows every path for unnamed agents. Less 6 because xurl 1.3.4, still the newest release on 4 November, requests a fixed set of 24 scopes including tweet.write and dm.write with no flag to narrow them, and the bridge config holds the client secret in plain text (24 of 30). The app-only Bearer route is read-only per the docs. No confirmation step is documented for article_publish or for removing bookmarks, so approval rests with the MCP client (10 of 20). Posts, profiles and news text come from anyone on X, and the security section has no guidance on prompt injection (0 of 15). The Developer Console shows usage and spend live and /2/usage/tweets returns daily counts. No per-call log was found (6 of 15). The 8 October programme reading came from x.com's security.txt (expired, pointing to HackerOne), and x.com's robots.txt disallows every path for unnamed agents, so that reading is struck. The xurl repository has no SECURITY.md, OSV lists no advisory for xurl on 4 November, and no SOC 2 or ISO 27001 statement or disclosure page was found on docs.x.com. Struck evidence on a fixed line is 0 (0 of 20). 24+10+0+6+0 = 40.