Pennylane vs Puzzle API and MCP

Pennylane 82

Graded on the hosted lines. Atlassian Statuspage at status.pennylane.com with seven components, one of them the API on app.pennylane.com (20). The history feed, read on 1 November 2026, lists three incidents since 3 August, document uploads from mobile devices for about three hours on 27 August, slowdowns for 50 minutes on 14 September and instability with errors for 37 minutes on 25 September. Each hit one function or some requests, so all count as minor, and nothing has been posted since 25 September. The 20 July disruption, with seven minutes of unavailability, left the window (20). 25 requests per 5 seconds per token (15). 429 carries retry-after and every response carries rate limit headers. The error guide's safe-retry table says to retry 429, 500 and 503 and not 400 to 422, and warns that creation endpoints such as /customer_invoices and /ledger_entries don't enforce idempotency, so a repeated request can create duplicates. That is safe-retry guidance with no key, 12 of 15, as e2b and scalekit-agentkit. The customer terms commit to 99.9 per cent for app.pennylane.com with credits, while the API agreement supplies the API as is with no warranty, so half credit (5). v2 is described as the official stable version (10). 20+20+15+12+5+10 = 82.

Puzzle API and MCP 15

Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

Pennylane 76

Closed service. The API agreement of January 2024 and the customer terms of 16 December 2025 are public and name the entity and French law. The API agreement lets Pennylane change or revoke access without notice and takes an exclusive licence over integrations, and its registered office differs from the one in the customer terms (13). Privacy policy of 30 January 2026, a data processing agreement annexed to the terms, deletion 30 days after termination, EU hosting and a commitment not to train AI models on customer data. The privacy policy allows providers outside the EU while the sub-processor list shows none (24). The 2026 breaking changes had dated phases over 24 weeks and v1 had an end date, but no standing deprecation policy was found and the agreement reserves changes without notice (14). Sub-processor list with locations, dated 16 December 2025, with update notices 30 days ahead (20).

Puzzle API and MCP 49

Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.

Pennylane 85

Each reference page carries an OpenAPI 3.0.1 definition for its operation, readable through the Markdown twin. One downloadable file for the whole API was not located, and the MCP tool schemas need a signed-in session, so we did not read them (23). llms.txt indexes the guides and 185 reference pages (1 November 2026), and every page has a Markdown twin (10). Descriptions state purpose, the scopes required and side effects, such as a finalised invoice no longer being editable, and guides compare importing with creating an invoice (14). Typed parameters with minimum and maximum values and enums on the page read, though filter is a JSON array passed as a string (11). Examples in the definitions and an error guide covering nine status codes with fixes (12). Versioned as v2 with a dated changelog and RSS feed (15). Based on one reference page read in full.

Puzzle API and MCP 65

The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.

Pennylane 65

Newest changelog entry 29 October 2026 (30). Eight dated entries since 3 August, on 15 and 30 September, 14 October, 22 October (two), 27 October and 29 October (two) (20). Closed service with a dated changelog, an RSS feed, a public roadmap, support by chat or account manager for customers and Zendesk for partners, and a community forum we did not read (10). No official SDK was found, and a search of the official MCP registry for pennylane on 1 November 2026 returned no server (0). No package to assess. The docs are current, with changelog entries through 29 October 2026 (5). 30+20+10+0+5 = 65.

Puzzle API and MCP 53

The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.

Pennylane 66

The REST API is the main surface. Responses are sized with limit from 1 to 100, default 20, and filters, with no field selection found. The MCP server lists 31 tools, each data type switched on by its own scope (15). Cursor pagination, a filter parameter with operators and sort on list endpoints (20). Errors return error, message and details naming the field and rule, with a table of which codes to retry (17). No idempotency keys. The docs say creation endpoints do not enforce idempotency except supplier invoice imports, and a duplicate file returns 409. The MCP server is read only, and its annotations were not read (7). Sensible defaults, but no official SDK was found. The reference shows generated samples in six languages (7).

Puzzle API and MCP 56

MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.

Pennylane 68

OAuth 2.0 authorisation code with 24-hour access tokens and rotating refresh tokens for partners, company and firm tokens with chosen scopes, expiry and deletion, and OAuth 2.1 with PKCE on the MCP server. No documented option to send a token in a URL (30). Every resource has a :readonly scope, tokens can be read only and the MCP server cannot write. No confirmation step for irreversible calls such as finalising an invoice (16). The API returns invoice and supplier text written by other parties. The MCP docs warn that data goes to the AI vendor and that answers can be wrong, with no prompt-injection guidance (4). The token list shows last use, and changelog endpoints and the get_changelog tool list record changes over four weeks. No per-call log for the operator was found (6). ISO 27001 with a 2026 certificate published, an annual third-party penetration test in the customer terms, a security white paper and an incident response plan. No security.txt, bug bounty or disclosure policy was found (12).

Puzzle API and MCP 73

OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.