{ "data": { "a": { "slug": "pamba", "name": "Pamba", "vendor": "Pamba", "vendorUrl": "https://pamba.app", "kind": "http-api", "category": "social-media", "summary": "Pamba makes AI avatar short-form videos and posts them to TikTok, Instagram and Facebook, through an app, a REST API and a remote MCP server. It also sells accounts it runs on its own iPhones, which those platforms forbid.", "url": "https://www.anchorterminal.com/tools/pamba", "markdownUrl": "https://www.anchorterminal.com/tools/pamba.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/pamba.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/pamba.json", "dns": "pamba.grade.anchorterminal.com", "license": "Closed service. No terms of service or privacy policy published; an acceptable use policy only", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.pamba.app/mcp", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.1 with PKCE and dynamic client registration on api.pamba.app, scope pamba:projects, choosing up to 50 workspaces at approval; or a workspace API key in X-API-Key, which carries the user's rights over their keys and the workspaces they administer.", "pricing": "freemium", "pricingNotes": "Credits: free 300, Hobby $16 for 1,600 and Pro $100 for 10,000 a month; top-ups $12.50 per 1,000. Managed TikTok or Instagram accounts $100 a month each. Fully managed from $7,500 a month. Per-model credit rates at GET /usage/pricing without auth. Read 11 November 2026.", "priceSummary": "$0.0125 / credit", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in Pamba's pricing, API or MCP pages, 11 November 2026. Billing is through Stripe.", "endpoints": [] }, "toolCount": 407, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-11" }, "docsUrl": "https://pamba.app/help/mcp-server", "llmsTxt": "https://pamba.app/llms.txt", "capabilities": [ "social.post", "social.schedule", "social.analytics", "social.comments", "social.media-upload", "video.generate" ], "tags": [ "hosted", "mcp", "oauth", "llms-txt", "closed-source", "freemium", "usage-priced", "tiktok", "instagram", "no-status-page", "platform-rules" ], "lastRelease": "2026-11-11", "graded": true, "anchor": { "graded": true, "score": 41.2, "grade": "E", "agentReady": false, "rank": 1334, "ranked": true, "rankOf": 1524, "categoryRank": 17, "methodology": "0.8", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 70, "payments": 53, "reliability": 45, "schema": 84, "security": 35, "transparency": 28 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-11" }, "negative": -15, "warnings": [ { "kind": "platform-rules", "name": "Breaks the rules of the platforms it acts on", "text": "Pamba sells TikTok and Instagram accounts it creates on its own iPhones and warms so each 'reads as a real person', pitches running 'hundreds of accounts' and replaces banned ones. TikTok's guidelines and Instagram's terms forbid that.", "deduct": -15, "since": "2026-11-11", "sources": [ "https://pamba.app/accounts", "https://pamba.app/help/account-warming", "https://www.tiktok.com/community-guidelines/en/integrity-authenticity/", "https://help.instagram.com/581066165581870" ] } ], "verdict": "Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.", "bestFor": "Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.", "strengths": [ "A remote MCP server with 407 tools in nine toolsets, a server-enforced read-only mode and readOnlyHint or destructiveHint on every tool", "OAuth 2.1 with PKCE and dynamic client registration, with protected-resource metadata on its own domain", "A tool reference generated from the server, and a dated API changelog that flags breaking changes", "Prices public without a login, including per-model credit rates from an unauthenticated route", "Publishes its own poor results: 42% of 6,678 videos it measured never reached 1,000 views" ], "weaknesses": [ "Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned", "No terms of service and no privacy policy (both 404), and no legal entity named", "Managed seats hold account logins, recovery emails and 2-step codes with no published data policy", "One OAuth scope covers everything, and an API key can manage the user's keys and delete workspaces", "No status page and no security contact" ], "agentNotes": [ "Tell your boss before using the accounts toolset: the managed accounts break TikTok's and Instagram's rules and can be banned", "Connect with ?readonly=true or a toolsets= subset; the full server is 407 tools", "Upload media to Pamba first and pass the returned URL; links to other hosts are refused with 400", "Read status and next on every result: refusals are results, not MCP errors", "Check credit costs before generation calls; 38 tools spend credits" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.8", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 41.2 } ], "editorialScores": { "ergonomics": 75, "maintenance": 70, "payments": 53, "reliability": 45, "schema": 84, "security": 35, "transparency": 18 }, "provenanceScore": 37, "checked": { "categories": { "ergonomics": "2026-11-11", "maintenance": "2026-11-11", "payments": "2026-11-11", "reliability": "2026-11-11", "schema": "2026-11-11", "security": "2026-11-11", "transparency": "2026-11-11" }, "last": "2026-11-11", "lastMoved": "2026-11-13", "oldest": "2026-11-11", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.pamba.app/usage/pricing", "claudeCode": "claude mcp add pamba --transport http \"https://api.pamba.app/mcp?readonly=true\"", "config": { "mcpServers": { "pamba": { "url": "https://api.pamba.app/mcp?readonly=true" } } } }, "letme": { "capability": "https://letme.dev/social.post", "tool": "https://letme.dev/pamba" }, "area": "communication", "unitPrices": [ { "item": "Managed TikTok or Instagram account", "unit": "account-month", "usd": 100, "note": "Per account; no credits needed" }, { "item": "Credits top-up", "unit": "credit", "usd": 0.0125, "note": "$12.50 per 1,000; plans work out at $10 per 1,000" } ], "provenance": { "legalEntity": "", "domain": "pamba.app", "domainRegistered": "2025-06-05", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://pamba.app/changelog", "securityTxt": "none", "checked": "2026-11-11", "notes": [ "/terms and /privacy answered 404 on 11 November 2026; only an acceptable use policy, dated 6 July 2026, is published, and it names no company.", "RDAP gives pamba.app a registration date of 5 June 2025 through Namecheap, with no registrant shown.", "robots.txt on pamba.app allows ClaudeBot on public pages and disallows app paths; api.pamba.app has no robots.txt (404).", "No entry in the official MCP registry for 'pamba' on 11 November 2026." ], "score": 37 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/pamba.json", "live": { "slug": "pamba", "probe": { "target": "https://api.pamba.app/mcp", "method": "get", "lastAt": "2026-11-13T23:58:54.025134635Z", "lastOk": true, "lastStatus": 401, "lastMs": 248, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 299, "p95ms24h": 391, "samples24h": 239, "samples30d": 319, "days": [ { "date": "2026-11-12", "probes": 81, "ok": 81 }, { "date": "2026-11-13", "probes": 238, "ok": 238 } ], "since": "2026-11-12T16:06:25.231802453Z" }, "securityTxt": { "url": "https://pamba.app/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-13T16:15:01.559101993Z" }, "llmsTxt": { "url": "https://pamba.app/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-13T15:55:36.94769184Z" }, "pages": [ { "url": "https://pamba.app/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-13T18:26:24.542486652Z", "changedAt": "2026-11-13T18:26:24.542486652Z", "fingerprint": "a0b9ef3713fa" } ], "mcpTools": { "url": "https://api.pamba.app/mcp?readonly=true", "checkedAt": "2026-11-13T03:13:09.042103119Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-13T03:13:09.042103119Z" }, "updatedAt": "2026-11-13T23:58:54.025134635Z" }, "streak": { "days": 2, "from": "2026-11-12", "sinceWatching": true, "best": 2 } }, "answer": "X MCP scores 54.3 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing.", "b": { "slug": "x-mcp", "name": "X MCP", "vendor": "X Corp.", "vendorUrl": "https://docs.x.com/tools/mcp", "kind": "mcp", "category": "social-media", "summary": "X MCP is X Corp.'s hosted Model Context Protocol server for the X API at api.x.com/mcp. It lets a model search posts, look up users, manage bookmarks, read trends and news, and draft Articles.", "url": "https://www.anchorterminal.com/tools/x-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/x-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/x-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/x-mcp.json", "dns": "x-mcp.grade.anchorterminal.com", "repo": "https://github.com/xdevplatform/xurl", "license": "Proprietary hosted server under the X Developer Agreement. The xurl bridge on GitHub and npm is MIT", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://api.x.com/mcp", "packages": [ { "registry": "npm", "name": "@xdevplatform/xurl" } ], "auth": "mixed", "authNotes": "A person creates an app in the X Developer Portal, on the Pay-per-use package in Production. Reads work with the app-only Bearer token in an `Authorization` header sent straight to https://api.x.com/mcp. User-context tools (bookmarks, Articles, the current user) need OAuth 2.0 authorisation code with PKCE through the local `xurl mcp` bridge, which takes CLIENT_ID and CLIENT_SECRET, needs the redirect URI http://localhost:8080/callback registered, opens a browser once, then caches and refreshes tokens in ~/.xurl. No dynamic client registration. Self-serve, with no review step documented.", "pricing": "usage", "pricingNotes": "Pay-per-use credits bought in advance in the Developer Console, with no subscription and no free tier. Reads are charged per resource returned ($0.005 a post, $0.010 a user, $0.001 for the app owner's own data) and writes per request ($0.005 a bookmark, $0.010 a trends request). A one-time $20 credit needs a saved payment card. The MCP page doesn't say MCP calls are billed at these API rates, though it requires a Pay-per-use app (https://docs.x.com/x-api/getting-started/pricing.md).", "priceSummary": "$0.005 / call", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP page, the pricing page, the docs index or the OpenAPI spec (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1352, "npmWeekly": 6027, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.x.com/tools/mcp", "llmsTxt": "https://docs.x.com/llms.txt", "openapi": "https://api.x.com/2/openapi.json", "capabilities": [ "social.analytics" ], "tags": [ "official", "hosted", "mcp", "oauth", "usage-priced", "prepaid", "card-required", "openapi", "llms-txt", "closed-source", "cli", "go" ], "lastRelease": "2026-09-29", "graded": true, "anchor": { "graded": true, "score": 54.3, "grade": "C", "agentReady": false, "rank": 997, "ranked": true, "rankOf": 1524, "categoryRank": 8, "methodology": "0.8", "run": "2026-10-01", "scores": { "ergonomics": 45, "maintenance": 70, "payments": 30, "reliability": 72, "schema": 65, "security": 40, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-04" }, "negative": 0, "verdict": "First-party access to full-archive post search, user lookup, trends and news, with OAuth 2.0 PKCE scopes and per-resource prices published without a login. Every user must create a paid X developer app, the tool list isn't published, and the documented tools don't create posts.", "bestFor": "Research and monitoring on X by an agent whose owner already has, or will pay for, an X developer app, such as searching the archive, reading timelines and mentions, and filing bookmarks.", "strengths": [ "Hosted by X on api.x.com, with full-archive post search, user search and news search among the documented tools", "OAuth 2.0 with PKCE (S256 in the xurl bridge) and automatic token refresh, with the token sent in a header", "Per-resource prices are public, such as $0.005 a post read and $0.001 for reads of the app owner's own data", "The xurl bridge is MIT, with CI that builds, tests and lints on every push to main", "llms.txt, Markdown for every docs page and a public OpenAPI spec (version 2.173, 200 paths)" ], "weaknesses": [ "No dynamic client registration, so each user creates an X developer app on the Pay-per-use package in Production", "The tool list and tool schemas aren't published, and neither public repository carries them", "The documented tools don't create posts, replies, likes or follows. Writes cover bookmarks and Articles", "xurl 1.3.4 asks for a fixed set of 24 scopes, including tweet.write and dm.write, with no flag to narrow them", "No guidance on prompt injection, though every post returned is text written by strangers", "The platform changelog has no entry for the hosted server, which publishes no version history" ], "agentNotes": [ "Use the app-only Bearer header for read-only work. Bookmarks, Articles and any tool working in the user's name need the xurl bridge", "Set the client's startup timeout to 300 seconds or more, because the bridge holds the handshake until the first browser login ends", "On a headless host run `xurl auth oauth2 --headless` first, with CLIENT_ID and CLIENT_SECRET exported in that shell", "On `client-not-enrolled`, move the app to Pay-per-use and Production in the developer portal", "On 429, wait until the Unix time in `x-rate-limit-reset`. No Retry-After header is documented" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "C", "methodology": "0.8", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54.3 } ], "editorialScores": { "ergonomics": 45, "maintenance": 70, "payments": 30, "reliability": 72, "schema": 65, "security": 40, "transparency": 33 }, "provenanceScore": 85, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-13", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @xdevplatform/xurl", "config": { "mcpServers": { "xapi": { "args": [ "-y", "@xdevplatform/xurl", "mcp", "https://api.x.com/mcp" ], "command": "npx", "env": { "CLIENT_ID": "YOUR_X_APP_CLIENT_ID", "CLIENT_SECRET": "YOUR_X_APP_CLIENT_SECRET" } } } } }, "letme": { "capability": "https://letme.dev/social.analytics", "tool": "https://letme.dev/x-mcp" }, "sameCompany": [ "x-ads" ], "area": "communication", "unitPrices": [ { "item": "Post read", "unit": "record", "usd": 0.005, "note": "per post returned, deduplicated within a UTC day" }, { "item": "User read", "unit": "record", "usd": 0.01, "note": "per user returned" }, { "item": "Owned read (the app owner's own posts, bookmarks, followers)", "unit": "record", "usd": 0.001, "note": "when the authenticated user owns the app" }, { "item": "Bookmark write", "unit": "call", "usd": 0.005, "note": "per request" }, { "item": "Trends request", "unit": "call", "usd": 0.01, "note": "per request" } ], "provenance": { "legalEntity": "X Corp.", "domain": "x.com", "domainRegistered": "1993-04-02", "endpointOnVendorDomain": true, "terms": "https://docs.x.com/developer-terms/agreement", "privacy": "https://x.com/en/privacy", "statusPage": "https://developer.x.com/status", "changelog": "https://docs.x.com/changelog", "securityTxt": "unknown", "checked": "2026-11-04", "notes": [ "The Developer Agreement (last updated 27 April 2026, re-read on 4 November) names X Corp. as the contracting party, or X Internet Unlimited Company for a developer in the EU, EFTA or the United Kingdom.", "The privacy link is x.com/en/privacy. x.com's robots.txt disallows every path for unnamed agents, so the policy and X's general terms of service are closed to us and their 8 October readings are struck.", "x.com/.well-known/security.txt is closed to us by robots.txt, so its 8 October reading (expired 1 January 2024) is struck. docs.x.com and developer.x.com returned 404 for the file on 4 November, and api.x.com's robots.txt disallows every path for unnamed agents.", "https://developer.x.com/status needs JavaScript and showed our reader no status data on 8 October. The incident history is at https://docs.x.com/incidents.md.", "RDAP for x.com gives a registration date of 1993-04-02." ], "score": 85 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/x-mcp.json", "live": { "slug": "x-mcp", "probe": { "target": "https://api.x.com/mcp", "method": "mcp-initialize", "lastAt": "2026-11-13T23:59:09.343044745Z", "lastOk": true, "lastStatus": 401, "lastMs": 125, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 139, "p95ms24h": 205, "samples24h": 239, "samples30d": 7892, "days": [ { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 243, "ok": 243 }, { "date": "2026-11-08", "probes": 243, "ok": 243 }, { "date": "2026-11-09", "probes": 243, "ok": 243 }, { "date": "2026-11-10", "probes": 244, "ok": 244 }, { "date": "2026-11-11", "probes": 244, "ok": 244 }, { "date": "2026-11-12", "probes": 245, "ok": 245 }, { "date": "2026-11-13", "probes": 238, "ok": 238 } ], "since": "2026-10-08T00:00:00Z" }, "vendorStatus": { "page": "https://developer.x.com/status", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-13T23:55:49.657565621Z" }, "versions": [ { "registry": "github", "name": "xdevplatform/xurl", "version": "v1.3.4", "released": "2026-09-29", "seenAt": "2026-11-13T09:28:16.334822108Z" }, { "registry": "npm", "name": "@xdevplatform/xurl", "version": "1.3.4", "seenAt": "2026-11-13T09:28:15.543107059Z" } ], "githubStars": 1367, "npmWeekly": 4711, "securityTxt": { "url": "https://x.com/.well-known/security.txt", "state": "expired", "expires": "2024-01-01T06:00:00.000Z", "checkedAt": "2026-11-13T16:15:41.354354196Z" }, "llmsTxt": { "url": "https://docs.x.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-13T15:56:29.584011418Z" }, "domain": { "domain": "x.com", "registered": "1993-04-02", "source": "https://rdap.verisign.com/com/v1/domain/x.com", "checkedAt": "2026-11-08T14:51:33.858172428Z" }, "pages": [ { "url": "https://docs.x.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:19:48.52525792Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d1064f68558e" }, { "url": "https://docs.x.com/x-api/getting-started/pricing.md", "kind": "pricing", "status": 200, "checkedAt": "2026-11-13T18:18:55.108695247Z", "changedAt": "2026-10-31T06:11:50.27229026Z", "fingerprint": "7318d8cce7ac" }, { "url": "https://x.com/en/privacy", "kind": "privacy", "status": 0, "checkedAt": "2026-11-13T18:48:08.499533003Z", "changedAt": "0001-01-01T00:00:00Z", "blockedByRobots": true }, { "url": "https://docs.x.com/developer-terms/agreement", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:19:50.776391045Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "69ecb268f31a" } ], "mcpTools": { "url": "https://api.x.com/mcp", "checkedAt": "2026-11-13T03:15:58.737001834Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-08T21:34:02.68340277Z" }, "github": { "repo": "xdevplatform/xurl", "checkedAt": "2026-11-09T11:14:59.671174099Z", "stars": 1365, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-07T02:22:11Z", "openIssues": 12, "openPRs": 12, "issuesOpened90d": 7, "issuesClosed90d": 0, "prsMerged90d": 5, "ci": { "branch": "main", "runs": 43, "success": 43, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-07T02:30:17Z" }, "replies": { "sampled": 25, "unanswered": 12, "medianDays": 34.9 } }, "updatedAt": "2026-11-13T23:59:09.343044745Z" }, "streak": { "days": 37, "from": "2026-10-08", "sinceWatching": true, "best": 37 } }, "edges": [ { "by": 31, "category": "transparency", "leads": "x-mcp", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.", "b": "Editorial half only. The hosted server is closed, under a Developer Agreement last updated 27 April 2026, and the bridge is MIT per the xurl LICENSE read on 4 November (18 of 30, an earlier partial kept). The 8 October data-handling reading came from X's privacy policy and terms of service on x.com, whose robots.txt disallows every path for unnamed agents, so it is struck. The Developer Agreement (re-read on 4 November) links a controller-to-controller data protection addendum on gdpr.x.com, which wasn't read, and no retention statement or subprocessor list for developers was found in the pages still readable (0 of 30). The versioning page (re-read on 4 November) limits breaking changes to major versions, at most yearly, with migration guides, and says a deprecated version works for 'a defined period' without stating one. Dated notices exist but can be short, such as five days for the Account Activity replay endpoint in March 2026 and four days for the removal of follows, likes and quote posts from self-serve tiers in April 2026. Dated notices with no stated period take this run's settled 15 (15 of 20, from 14). The controller names came from the struck privacy policy, and no subprocessor or data location list was found (0 of 20). 18+0+15+0 = 33." }, "scores": { "a": 28, "b": 59 } }, { "by": 30, "category": "ergonomics", "leads": "pamba", "name": "Agent ergonomics", "reasons": { "a": "Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.", "b": "Per the 8 October check, not re-read on 4 November, apart from the xurl clone and the MCP page. The number of tools isn't published. One docs page lists six groups and another says XMCP exposes 200+ endpoints as tools, so context cost is not established (5 of 25). The API has `max_results`, `pagination_token`, field selection and expansions. Whether each MCP tool passes them through is unread (12 of 20). Errors are problem+json with a type URI, title and detail, and the xurl CHANGELOG (1.2.0) says the bridge turns transport and token failures into JSON-RPC errors keyed to the request (15 of 20). No idempotency keys, and no readOnlyHint or destructiveHint documented. The bridge refreshes the token and retries after a 401 (4 of 20). One npx line starts the bridge and the URL has a default, but each user first creates an app, registers a redirect URI and sets a 300-second startup timeout. Official XDKs exist for Python and TypeScript (9 of 15). 5+12+15+4+9 = 45." }, "scores": { "a": 75, "b": 45 } }, { "by": 27, "category": "reliability", "leads": "x-mcp", "name": "Reliability", "reasons": { "a": "Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists \"SLA guarantees\" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.", "b": "Read with the hosted lines, since the server runs at api.x.com and the bridge only relays. docs.x.com and developer.x.com are separate hosts with open robots.txt files. The incident history was re-read on 4 November, and the other lines are per the 8 October check, not re-read. A status page exists at developer.x.com/status but needs JavaScript and showed our reader nothing. The dated incident history at docs.x.com/incidents.md lists incidents by title, with no component view and no MCP entry (15 of 20, an earlier partial kept). On 4 November that history still has no incident dated after 1 July 2026, apart from a 'Missing entities.annotations' entry marked ongoing since 24 March 2026, so the earlier partial stays, as the x-ads listing holds it on the same page (25 of 30). API rate limits are published per endpoint, such as 300 per 15 minutes and 1 a second for full-archive search and 50 per 15 minutes for bookmark writes. The MCP page gives no numbers of its own and says only that writes are stricter than reads (12 of 15, an earlier partial kept). 429s come with `x-rate-limit-reset` and the docs advise waiting for it and backing off. No Retry-After and no idempotency keys or safe-retry guidance for writes were found, so backoff alone (10). No SLA found for Pay-per-use (0). The MCP page carries no beta or preview label (10). 15+25+12+10+0+10 = 72." }, "scores": { "a": 45, "b": 72 } }, { "by": 23, "category": "payments", "leads": "pamba", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.", "b": "Per the 8 October check, not re-read on 4 November. No x402, MPP or L402 (0). Per-resource and per-request prices are published without a login, such as $0.005 a post read, $0.010 a user read and $0.005 a bookmark write (20). No free tier. Credits are bought in advance, and the one-time $20 credit needs a saved payment card (0). A person signs in to the developer portal, creates an app and completes a browser login (0). 0+20+0+0 = 20. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30." }, "scores": { "a": 53, "b": 30 } }, { "by": 19, "category": "schema", "leads": "pamba", "name": "Schema \u0026 documentation", "reasons": { "a": "No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.", "b": "The MCP page, llms.txt and changelog were re-read on 4 November, and the rest is per the 8 October check. A public OpenAPI spec covers the API behind it, linked from llms.txt as the machine-readable contract and read at docs.x.com/openapi.json on 4 November (version 2.173, 200 paths, 257 operations). The 8 October copy at api.x.com is struck, since api.x.com's robots.txt disallows every path for unnamed agents. The MCP tool list and input schemas aren't published, and neither the xurl nor the xmcp repository carries the hosted server's tool definitions (18 of 25, an earlier partial kept). llms.txt, llms-full.txt, skill.md and Markdown for every page (10). The MCP page describes six groups of tools and names one tool, `article_publish`, with no per-tool guidance on when to use which (6 of 20). The API parameters are typed in the spec. Whether the MCP tools carry the same enums and constraints is unread (8 of 15). Client configs for five clients, a troubleshooting table of eight symptoms and a documented problem+json error format with eleven error types (12 of 15). The API is versioned in the path and has a dated changelog with an RSS feed, latest entry 29 October 2026 on 4 November, but the changelog has no entry for the hosted MCP server and the server publishes no version history (11 of 15). 18+10+6+8+12+11 = 65." }, "scores": { "a": 84, "b": 65 } }, { "by": 5, "category": "security", "leads": "x-mcp", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.", "b": "OAuth 2.0 authorisation code with PKCE, scopes and automatic token refresh, per the MCP page re-read on 4 November, and the xurl source sends `code_challenge_method` S256. Every documented configuration sends the token in an Authorization header. The 8 October reading of the OAuth metadata on api.x.com is struck, since api.x.com's robots.txt disallows every path for unnamed agents. Less 6 because xurl 1.3.4, still the newest release on 4 November, requests a fixed set of 24 scopes including tweet.write and dm.write with no flag to narrow them, and the bridge config holds the client secret in plain text (24 of 30). The app-only Bearer route is read-only per the docs. No confirmation step is documented for `article_publish` or for removing bookmarks, so approval rests with the MCP client (10 of 20). Posts, profiles and news text come from anyone on X, and the security section has no guidance on prompt injection (0 of 15). The Developer Console shows usage and spend live and /2/usage/tweets returns daily counts. No per-call log was found (6 of 15). The 8 October programme reading came from x.com's security.txt (expired, pointing to HackerOne), and x.com's robots.txt disallows every path for unnamed agents, so that reading is struck. The xurl repository has no SECURITY.md, OSV lists no advisory for xurl on 4 November, and no SOC 2 or ISO 27001 statement or disclosure page was found on docs.x.com. Struck evidence on a fixed line is 0 (0 of 20). 24+10+0+6+0 = 40." }, "scores": { "a": 35, "b": 40 } } ], "facts": [ { "a": "HTTP API", "b": "MCP server", "name": "Kind" }, { "a": "Pamba", "b": "X Corp.", "name": "Vendor" }, { "a": "https://api.pamba.app/mcp", "b": "https://api.x.com/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "Streamable HTTP, stdio", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Pay per use", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Closed service. No terms of service or privacy policy published; an acceptable use policy only", "b": "Proprietary hosted server under the X Developer Agreement. The xurl bridge on GitHub and npm is MIT", "name": "Licence" }, { "a": "407", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-11", "b": "2026-09-29", "name": "Last release" }, { "a": "no document linked", "b": "2026-04-27", "name": "Terms last updated" }, { "a": "no document linked", "b": "couldn't be read", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "1.4k stars, 6k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "X MCP scores 54.3 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, Pamba or X MCP?" }, { "answer": "Pamba uses an OAuth sign-in. X MCP takes an API key or an OAuth sign-in.", "question": "Do Pamba and X MCP need an API key?" }, { "answer": "Yes. Pamba has a hosted endpoint at https://api.pamba.app/mcp and X MCP at https://api.x.com/mcp.", "question": "Can an agent call Pamba and X MCP without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 84 against 65", "Agent ergonomics, 75 against 45", "Payments \u0026 pricing, 53 against 30" ], "also": null, "goodFor": "Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.", "slug": "pamba", "watchFor": "Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned" }, { "aheadOn": [ "Reliability, 72 against 45", "Security \u0026 auth, 40 against 35", "Transparency \u0026 trust, 59 against 28" ], "also": [ "Runs on your own machine", "No incidents deducted, where Pamba loses 15 points for them" ], "goodFor": "Research and monitoring on X by an agent whose owner already has, or will pay for, an X developer app, such as searching the archive, reading timelines and mentions, and filing bookmarks.", "slug": "x-mcp", "watchFor": "No dynamic client registration, so each user creates an X developer app on the Pay-per-use package in Production" } ], "history": { "pamba": [ { "causes": [ "method" ], "date": "2026-11-13", "delta": 2.3, "from": 38.9, "fromGrade": "E", "to": 41.2, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-11-13", "delta": -5, "from": 43.9, "fromGrade": "E", "to": 38.9, "toGrade": "E" } ], "x-mcp": [ { "causes": [ "method" ], "date": "2026-11-13", "delta": 1.2, "from": 53.1, "fromGrade": "D", "to": 54.3, "toGrade": "C" }, { "causes": [ "evidence" ], "date": "2026-11-04", "delta": -2.3, "from": 55.4, "fromGrade": "C", "to": 53.1, "toGrade": "D" } ] }, "job": { "capability": "social.analytics", "name": "Social analytics" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ayrshare-vs-pamba.json", "title": "Ayrshare API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/ayrshare-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/blotato-vs-pamba.json", "title": "Blotato vs Pamba", "url": "https://www.anchorterminal.com/compare/blotato-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/buffer-vs-pamba.json", "title": "Buffer API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/buffer-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/bundle-social-vs-pamba.json", "title": "bundle.social vs Pamba", "url": "https://www.anchorterminal.com/compare/bundle-social-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/late-vs-pamba.json", "title": "Zernio (formerly Late) API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/late-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/metricool-vs-pamba.json", "title": "Metricool API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/metricool-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-pamba.json", "title": "Mixpost API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/mixpost-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/oneup-vs-pamba.json", "title": "OneUp API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/oneup-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-post-bridge.json", "title": "Pamba vs Post Bridge API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-post-bridge" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-postiz.json", "title": "Pamba vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-publer.json", "title": "Pamba vs Publer API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-publer" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-repostit.json", "title": "Pamba vs Repostit", "url": "https://www.anchorterminal.com/compare/pamba-vs-repostit" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-typefully.json", "title": "Pamba vs Typefully", "url": "https://www.anchorterminal.com/compare/pamba-vs-typefully" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-upload-post.json", "title": "Pamba vs Upload-Post API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-upload-post" }, { "json": "https://www.anchorterminal.com/compare/ayrshare-vs-x-mcp.json", "title": "Ayrshare API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/ayrshare-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/blotato-vs-x-mcp.json", "title": "Blotato vs X MCP", "url": "https://www.anchorterminal.com/compare/blotato-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/buffer-vs-x-mcp.json", "title": "Buffer API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/buffer-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/bundle-social-vs-x-mcp.json", "title": "bundle.social vs X MCP", "url": "https://www.anchorterminal.com/compare/bundle-social-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/late-vs-x-mcp.json", "title": "Zernio (formerly Late) API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/late-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/metricool-vs-x-mcp.json", "title": "Metricool API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/metricool-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-x-mcp.json", "title": "Mixpost API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/oneup-vs-x-mcp.json", "title": "OneUp API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/oneup-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social.json", "title": "Pamba vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp.json", "title": "Pamba vs TwitterAPI.io MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp.json", "title": "Pamba vs Xpoz MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp" }, { "json": "https://www.anchorterminal.com/compare/post-bridge-vs-x-mcp.json", "title": "Post Bridge API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/post-bridge-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-x-mcp.json", "title": "Postiz API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/postiz-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/publer-vs-x-mcp.json", "title": "Publer API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/publer-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/socialcannon-vs-x-mcp.json", "title": "SocialCannon vs X MCP", "url": "https://www.anchorterminal.com/compare/socialcannon-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/sprout-social-vs-x-mcp.json", "title": "Sprout Social API vs X MCP", "url": "https://www.anchorterminal.com/compare/sprout-social-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/twitterapi-io-mcp-vs-x-mcp.json", "title": "TwitterAPI.io MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/twitterapi-io-mcp-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/upload-post-vs-x-mcp.json", "title": "Upload-Post API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/upload-post-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/x-mcp-vs-xpoz-mcp.json", "title": "X MCP vs Xpoz MCP", "url": "https://www.anchorterminal.com/compare/x-mcp-vs-xpoz-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-socialcannon.json", "title": "Pamba vs SocialCannon", "url": "https://www.anchorterminal.com/compare/pamba-vs-socialcannon" } ], "panel": null, "scores": [ { "by": 27, "edge": "x-mcp", "key": "reliability", "name": "Reliability", "pamba": 45, "weight": 16, "x-mcp": 72 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 19, "edge": "pamba", "key": "schema", "name": "Schema \u0026 documentation", "pamba": 84, "weight": 13, "x-mcp": 65 }, { "by": 30, "edge": "pamba", "key": "ergonomics", "name": "Agent ergonomics", "pamba": 75, "weight": 13, "x-mcp": 45 }, { "by": 5, "edge": "x-mcp", "key": "security", "name": "Security \u0026 auth", "pamba": 35, "weight": 14, "x-mcp": 40 }, { "by": 23, "edge": "pamba", "key": "payments", "name": "Payments \u0026 pricing", "pamba": 53, "weight": 10, "x-mcp": 30 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 0, "edge": "", "key": "maintenance", "name": "Maintenance \u0026 community", "pamba": 70, "weight": 7, "x-mcp": 70 }, { "by": 31, "edge": "x-mcp", "key": "transparency", "name": "Transparency \u0026 trust", "pamba": 28, "weight": 7, "x-mcp": 59 } ], "summary": "X MCP scores 54.3 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing. Both do social analytics.", "tasks": null, "tutorials": [ { "title": "Research product mentions with X MCP", "tool": "x-mcp", "url": "https://www.anchorterminal.com/tutorials/x-mcp/" } ], "verdicts": { "pamba": "Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.", "x-mcp": "First-party access to full-archive post search, user lookup, trends and news, with OAuth 2.0 PKCE scopes and per-resource prices published without a login. Every user must create a paid X developer app, the tool list isn't published, and the documented tools don't create posts." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp", "json": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp.min.md" }, "markdown": "X MCP scores 54.3 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing. Both do social analytics.\n\n- Pamba: grade E, 41.2/100, rank #1334 of 1524. Markdown https://www.anchorterminal.com/tools/pamba.md · JSON https://www.anchorterminal.com/api/v1/tools/pamba.json\n- X MCP: grade C, 54.3/100, rank #997 of 1524. Markdown https://www.anchorterminal.com/tools/x-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/x-mcp.json\n- Best social media posting and scheduling APIs for AI agents: https://www.anchorterminal.com/best/social-media/index.md\n- All 182 social comparisons: https://www.anchorterminal.com/compare/social-media/index.md\n\n## Which one, for what\n\n### Pamba (E)\n\nGood for: Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.\n\nAhead on:\n- Schema \u0026 documentation, 84 against 65\n- Agent ergonomics, 75 against 45\n- Payments \u0026 pricing, 53 against 30\n\nWatch for: Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned\n\n### X MCP (C)\n\nGood for: Research and monitoring on X by an agent whose owner already has, or will pay for, an X developer app, such as searching the archive, reading timelines and mentions, and filing bookmarks.\n\nAhead on:\n- Reliability, 72 against 45\n- Security \u0026 auth, 40 against 35\n- Transparency \u0026 trust, 59 against 28\n\nAlso in its favour:\n- Runs on your own machine\n- No incidents deducted, where Pamba loses 15 points for them\n\nWatch for: No dynamic client registration, so each user creates an X developer app on the Pay-per-use package in Production\n\n\n## Why the edge\n\n### Transparency \u0026 trust: X MCP +31\n\n- Pamba (28): Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.\n- X MCP (59): Editorial half only. The hosted server is closed, under a Developer Agreement last updated 27 April 2026, and the bridge is MIT per the xurl LICENSE read on 4 November (18 of 30, an earlier partial kept). The 8 October data-handling reading came from X's privacy policy and terms of service on x.com, whose robots.txt disallows every path for unnamed agents, so it is struck. The Developer Agreement (re-read on 4 November) links a controller-to-controller data protection addendum on gdpr.x.com, which wasn't read, and no retention statement or subprocessor list for developers was found in the pages still readable (0 of 30). The versioning page (re-read on 4 November) limits breaking changes to major versions, at most yearly, with migration guides, and says a deprecated version works for 'a defined period' without stating one. Dated notices exist but can be short, such as five days for the Account Activity replay endpoint in March 2026 and four days for the removal of follows, likes and quote posts from self-serve tiers in April 2026. Dated notices with no stated period take this run's settled 15 (15 of 20, from 14). The controller names came from the struck privacy policy, and no subprocessor or data location list was found (0 of 20). 18+0+15+0 = 33.\n\n### Agent ergonomics: Pamba +30\n\n- Pamba (75): Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.\n- X MCP (45): Per the 8 October check, not re-read on 4 November, apart from the xurl clone and the MCP page. The number of tools isn't published. One docs page lists six groups and another says XMCP exposes 200+ endpoints as tools, so context cost is not established (5 of 25). The API has `max_results`, `pagination_token`, field selection and expansions. Whether each MCP tool passes them through is unread (12 of 20). Errors are problem+json with a type URI, title and detail, and the xurl CHANGELOG (1.2.0) says the bridge turns transport and token failures into JSON-RPC errors keyed to the request (15 of 20). No idempotency keys, and no readOnlyHint or destructiveHint documented. The bridge refreshes the token and retries after a 401 (4 of 20). One npx line starts the bridge and the URL has a default, but each user first creates an app, registers a redirect URI and sets a 300-second startup timeout. Official XDKs exist for Python and TypeScript (9 of 15). 5+12+15+4+9 = 45.\n\n### Reliability: X MCP +27\n\n- Pamba (45): Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists \"SLA guarantees\" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.\n- X MCP (72): Read with the hosted lines, since the server runs at api.x.com and the bridge only relays. docs.x.com and developer.x.com are separate hosts with open robots.txt files. The incident history was re-read on 4 November, and the other lines are per the 8 October check, not re-read. A status page exists at developer.x.com/status but needs JavaScript and showed our reader nothing. The dated incident history at docs.x.com/incidents.md lists incidents by title, with no component view and no MCP entry (15 of 20, an earlier partial kept). On 4 November that history still has no incident dated after 1 July 2026, apart from a 'Missing entities.annotations' entry marked ongoing since 24 March 2026, so the earlier partial stays, as the x-ads listing holds it on the same page (25 of 30). API rate limits are published per endpoint, such as 300 per 15 minutes and 1 a second for full-archive search and 50 per 15 minutes for bookmark writes. The MCP page gives no numbers of its own and says only that writes are stricter than reads (12 of 15, an earlier partial kept). 429s come with `x-rate-limit-reset` and the docs advise waiting for it and backing off. No Retry-After and no idempotency keys or safe-retry guidance for writes were found, so backoff alone (10). No SLA found for Pay-per-use (0). The MCP page carries no beta or preview label (10). 15+25+12+10+0+10 = 72.\n\n### Payments \u0026 pricing: Pamba +23\n\n- Pamba (53): No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.\n- X MCP (30): Per the 8 October check, not re-read on 4 November. No x402, MPP or L402 (0). Per-resource and per-request prices are published without a login, such as $0.005 a post read, $0.010 a user read and $0.005 a bookmark write (20). No free tier. Credits are bought in advance, and the one-time $20 credit needs a saved payment card (0). A person signs in to the developer portal, creates an app and completes a browser login (0). 0+20+0+0 = 20. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.\n\n### Schema \u0026 documentation: Pamba +19\n\n- Pamba (84): No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.\n- X MCP (65): The MCP page, llms.txt and changelog were re-read on 4 November, and the rest is per the 8 October check. A public OpenAPI spec covers the API behind it, linked from llms.txt as the machine-readable contract and read at docs.x.com/openapi.json on 4 November (version 2.173, 200 paths, 257 operations). The 8 October copy at api.x.com is struck, since api.x.com's robots.txt disallows every path for unnamed agents. The MCP tool list and input schemas aren't published, and neither the xurl nor the xmcp repository carries the hosted server's tool definitions (18 of 25, an earlier partial kept). llms.txt, llms-full.txt, skill.md and Markdown for every page (10). The MCP page describes six groups of tools and names one tool, `article_publish`, with no per-tool guidance on when to use which (6 of 20). The API parameters are typed in the spec. Whether the MCP tools carry the same enums and constraints is unread (8 of 15). Client configs for five clients, a troubleshooting table of eight symptoms and a documented problem+json error format with eleven error types (12 of 15). The API is versioned in the path and has a dated changelog with an RSS feed, latest entry 29 October 2026 on 4 November, but the changelog has no entry for the hosted MCP server and the server publishes no version history (11 of 15). 18+10+6+8+12+11 = 65.\n\n### Security \u0026 auth: X MCP +5\n\n- Pamba (35): OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.\n- X MCP (40): OAuth 2.0 authorisation code with PKCE, scopes and automatic token refresh, per the MCP page re-read on 4 November, and the xurl source sends `code_challenge_method` S256. Every documented configuration sends the token in an Authorization header. The 8 October reading of the OAuth metadata on api.x.com is struck, since api.x.com's robots.txt disallows every path for unnamed agents. Less 6 because xurl 1.3.4, still the newest release on 4 November, requests a fixed set of 24 scopes including tweet.write and dm.write with no flag to narrow them, and the bridge config holds the client secret in plain text (24 of 30). The app-only Bearer route is read-only per the docs. No confirmation step is documented for `article_publish` or for removing bookmarks, so approval rests with the MCP client (10 of 20). Posts, profiles and news text come from anyone on X, and the security section has no guidance on prompt injection (0 of 15). The Developer Console shows usage and spend live and /2/usage/tweets returns daily counts. No per-call log was found (6 of 15). The 8 October programme reading came from x.com's security.txt (expired, pointing to HackerOne), and x.com's robots.txt disallows every path for unnamed agents, so that reading is struck. The xurl repository has no SECURITY.md, OSV lists no advisory for xurl on 4 November, and no SOC 2 or ISO 27001 statement or disclosure page was found on docs.x.com. Struck evidence on a fixed line is 0 (0 of 20). 24+10+0+6+0 = 40.\n\n## Score by category\n\n| Category | Weight | Pamba | X MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 45 | 72 | X MCP +27 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 84 | 65 | Pamba +19 |\n| Agent ergonomics | 13% (16.2 this run) | 75 | 45 | Pamba +30 |\n| Security \u0026 auth | 14% (17.5 this run) | 35 | 40 | X MCP +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 53 | 30 | Pamba +23 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 70 | even |\n| Transparency \u0026 trust | 7% (8.8 this run) | 28 | 59 | X MCP +31 |\n| Negative events | ≤15 | -15 | 0 | |\n| **Total** | | **41.2 · E** | **54.3 · C** | |\n\n## Facts side by side\n\n| Fact | Pamba | X MCP |\n| --- | --- | --- |\n| Kind | HTTP API | MCP server |\n| Vendor | Pamba | X Corp. |\n| Hosted endpoint | `https://api.pamba.app/mcp` | `https://api.x.com/mcp` |\n| Transports | HTTP, Streamable HTTP | Streamable HTTP, stdio |\n| Auth | OAuth | OAuth or key |\n| Pricing | Freemium | Pay per use |\n| x402 | no | no |\n| Licence | Closed service. No terms of service or privacy policy published; an acceptable use policy only | Proprietary hosted server under the X Developer Agreement. The xurl bridge on GitHub and npm is MIT |\n| Tools exposed | 407 | none |\n| Read-only variant documented | yes | yes |\n| llms.txt | yes | yes |\n| Last release | 2026-11-11 | 2026-09-29 |\n| Terms last updated | no document linked | 2026-04-27 |\n| Privacy policy last updated | no document linked | couldn't be read |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | none | 1.4k stars, 6k npm/wk |\n\n## How the scores have moved\n\n### Pamba\n\n- +2.3 on 13 November 2026: checklist\n- -5.0 on 13 November 2026: checklist\n\n### X MCP\n\n- +1.2 on 13 November 2026 (D to C): checklist\n- -2.3 on 4 November 2026 (C to D): new evidence\n\n## Verdicts\n\n**Pamba.** Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.\n\n**X MCP.** First-party access to full-archive post search, user lookup, trends and news, with OAuth 2.0 PKCE scopes and per-resource prices published without a login. Every user must create a paid X developer app, the tool list isn't published, and the documented tools don't create posts.\n\n## Before you call either\n\n### Pamba\n\n1. Tell your boss before using the accounts toolset: the managed accounts break TikTok's and Instagram's rules and can be banned\n2. Connect with ?readonly=true or a toolsets= subset; the full server is 407 tools\n3. Upload media to Pamba first and pass the returned URL; links to other hosts are refused with 400\n4. Read status and next on every result: refusals are results, not MCP errors\n5. Check credit costs before generation calls; 38 tools spend credits\n\n### X MCP\n\n1. Use the app-only Bearer header for read-only work. Bookmarks, Articles and any tool working in the user's name need the xurl bridge\n2. Set the client's startup timeout to 300 seconds or more, because the bridge holds the handshake until the first browser login ends\n3. On a headless host run `xurl auth oauth2 --headless` first, with CLIENT_ID and CLIENT_SECRET exported in that shell\n4. On `client-not-enrolled`, move the app to Pay-per-use and Production in the developer portal\n5. On 429, wait until the Unix time in `x-rate-limit-reset`. No Retry-After header is documented\n\n## Tutorials\n\n- [Research product mentions with X MCP](https://www.anchorterminal.com/tutorials/x-mcp/), for X MCP\n\n## Questions\n\n### Which is better for AI agents, Pamba or X MCP?\n\nX MCP scores 54.3 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing.\n\n### Do Pamba and X MCP need an API key?\n\nPamba uses an OAuth sign-in. X MCP takes an API key or an OAuth sign-in.\n\n### Can an agent call Pamba and X MCP without installing anything?\n\nYes. Pamba has a hosted endpoint at https://api.pamba.app/mcp and X MCP at https://api.x.com/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/pamba-vs-x-mcp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/pamba-vs-x-mcp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"pamba\", \"b\": \"x-mcp\"}`. From a terminal: `anchor compare pamba x-mcp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/pamba.json and https://www.anchorterminal.com/api/v1/tools/x-mcp.json\n\n## Other comparisons with Pamba or X MCP\n\n- [Ayrshare API + MCP vs Pamba](https://www.anchorterminal.com/compare/ayrshare-vs-pamba.md)\n- [Blotato vs Pamba](https://www.anchorterminal.com/compare/blotato-vs-pamba.md)\n- [Buffer API + MCP vs Pamba](https://www.anchorterminal.com/compare/buffer-vs-pamba.md)\n- [bundle.social vs Pamba](https://www.anchorterminal.com/compare/bundle-social-vs-pamba.md)\n- [Zernio (formerly Late) API + MCP vs Pamba](https://www.anchorterminal.com/compare/late-vs-pamba.md)\n- [Metricool API + MCP vs Pamba](https://www.anchorterminal.com/compare/metricool-vs-pamba.md)\n- [Mixpost API + MCP vs Pamba](https://www.anchorterminal.com/compare/mixpost-vs-pamba.md)\n- [OneUp API + MCP vs Pamba](https://www.anchorterminal.com/compare/oneup-vs-pamba.md)\n- [Pamba vs Post Bridge API + MCP](https://www.anchorterminal.com/compare/pamba-vs-post-bridge.md)\n- [Pamba vs Postiz API + MCP](https://www.anchorterminal.com/compare/pamba-vs-postiz.md)\n- [Pamba vs Publer API + MCP](https://www.anchorterminal.com/compare/pamba-vs-publer.md)\n- [Pamba vs Repostit](https://www.anchorterminal.com/compare/pamba-vs-repostit.md)\n- [Pamba vs Typefully](https://www.anchorterminal.com/compare/pamba-vs-typefully.md)\n- [Pamba vs Upload-Post API + MCP](https://www.anchorterminal.com/compare/pamba-vs-upload-post.md)\n- [Ayrshare API + MCP vs X MCP](https://www.anchorterminal.com/compare/ayrshare-vs-x-mcp.md)\n- [Blotato vs X MCP](https://www.anchorterminal.com/compare/blotato-vs-x-mcp.md)\n- [Buffer API + MCP vs X MCP](https://www.anchorterminal.com/compare/buffer-vs-x-mcp.md)\n- [bundle.social vs X MCP](https://www.anchorterminal.com/compare/bundle-social-vs-x-mcp.md)\n- [Zernio (formerly Late) API + MCP vs X MCP](https://www.anchorterminal.com/compare/late-vs-x-mcp.md)\n- [Metricool API + MCP vs X MCP](https://www.anchorterminal.com/compare/metricool-vs-x-mcp.md)\n- [Mixpost API + MCP vs X MCP](https://www.anchorterminal.com/compare/mixpost-vs-x-mcp.md)\n- [OneUp API + MCP vs X MCP](https://www.anchorterminal.com/compare/oneup-vs-x-mcp.md)\n- [Pamba vs Sprout Social API](https://www.anchorterminal.com/compare/pamba-vs-sprout-social.md)\n- [Pamba vs TwitterAPI.io MCP](https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp.md)\n- [Pamba vs Xpoz MCP](https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp.md)\n- [Post Bridge API + MCP vs X MCP](https://www.anchorterminal.com/compare/post-bridge-vs-x-mcp.md)\n- [Postiz API + MCP vs X MCP](https://www.anchorterminal.com/compare/postiz-vs-x-mcp.md)\n- [Publer API + MCP vs X MCP](https://www.anchorterminal.com/compare/publer-vs-x-mcp.md)\n- [SocialCannon vs X MCP](https://www.anchorterminal.com/compare/socialcannon-vs-x-mcp.md)\n- [Sprout Social API vs X MCP](https://www.anchorterminal.com/compare/sprout-social-vs-x-mcp.md)\n- [TwitterAPI.io MCP vs X MCP](https://www.anchorterminal.com/compare/twitterapi-io-mcp-vs-x-mcp.md)\n- [Upload-Post API + MCP vs X MCP](https://www.anchorterminal.com/compare/upload-post-vs-x-mcp.md)\n- [X MCP vs Xpoz MCP](https://www.anchorterminal.com/compare/x-mcp-vs-xpoz-mcp.md)\n- [Pamba vs SocialCannon](https://www.anchorterminal.com/compare/pamba-vs-socialcannon.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.8", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Pamba vs X MCP", "url": "" } ], "description": "X MCP scores 54.3 (C) to Pamba's 41.2 (E) for social analytics. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Pamba E 41.2", "X MCP C 54.3", "scores" ], "h1": "Pamba vs X MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/pamba-vs-x-mcp", "published": "2026-10-01", "section": "tools", "title": "Pamba vs X MCP for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-13", "url": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp" }, "tokens": { "markdown": 5550, "slim": 1080 }, "version": 1 }