Puzzle API and MCP vs Rutter Accounting API

Puzzle API and MCP 15

Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

Rutter Accounting API 70

Statuspage at status.rutterapi.com with components for Rutter APIs, Dashboard, Link, Data Fetching System, Sandbox, Webhook Delivery and Documentation (20). Since 6 August one major, high latency and error rates on calls to the API from 20:21 UTC on 3 September, stable from 21:18 and resolved at 21:10 on 4 September, which the page labels critical. The rest were partial. Slow responses with elevated 5xx rates from 17:25 to 20:43 on 14 September, labelled minor, name no fuller scope than elevated rates. NetSuite bundle installs failed on 12 August (Rutter Link), 500s hit some requests on 1 September, and QuickBooks Online syncs were delayed by Intuit's outage on 1 and 2 September. Database maintenance on 25 and 29 September was announced ahead with a window, so it counts as maintenance. Nothing posted since 29 September. One major (10). 500 requests per 10 seconds per paid organisation, 100 for free, test and sandbox (15). 429 for Rutter's own limit with advice to allow time between requests, 452 when the platform throttles with async writes retried by Rutter using exponential backoff, and an Idempotency-Key header on async writes (409 on a mismatched reuse). No Retry-After mentioned (15). The pricing page states a guaranteed 99.9 per cent monthly uptime, but no SLA document was found (0). GA (10).

Puzzle API and MCP 73

OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.

Rutter Accounting API 31

client_id and client_secret by HTTP Basic auth, one pair for the whole organisation, plus a per-connection access_token that the docs only ever pass as a query parameter, so it lands in URLs and logs. The checklist takes 10 off for a secret that can travel in a URL query string, as for the Google API listings, though the token is useless without the client secret (10). No read-only credentials or scopes found (3). Returns ledger and commerce data with third-party text and no injection guidance. Each call reaches only the connection its access_token names, which limits what an injected prompt can reach (5). Integration management and observability tools on the paid plan, which we couldn't inspect (8). A Vanta trust centre mentions encryption at rest and in transit and access logging, but we couldn't see certifications, a disclosure policy or a bug bounty, and security.txt answers 404 on www.rutter.com and docs.rutter.com on 4 November. The pricing page says the disaster recovery plan is tested to meet SOC 2 Type II and ISO 27001 standards, with no report or disclosure route (5).

Puzzle API and MCP 65

The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.

Rutter Accounting API 79

OpenAPI spec per API version at docs.rutter.com/rest/<version>/spec, which the listing had as missing (25). llms.txt returns 404 and there are no Markdown docs (0). Reference pages per endpoint with platform coverage tables, though they don't say when to prefer one route (14). Typed request and response models, and POST input validation rules exposed per platform for expenses and bills (12). Errors carry error_type, error_code, error_message and error_metadata, with 450, 451, 452 and 550 marking a platform's own 400, 401, 429 and 500 (13). Dated versions in the X-Rutter-Version header, an upgrade guide listing breaking changes per version and a weekly changelog (15).

Puzzle API and MCP 56

MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.

Rutter Accounting API 67

Cursor pagination on lists. We found no field selection or summary options (12). next_cursor paging, with no other list filters checked (14). Structured errors that separate Rutter's failures from the platform's, so an agent can tell a bad request from a throttled ledger (18). Idempotency-Key on writes, and response_mode prefer_sync returns within 30 seconds or falls back to a 202 with an async_response (18). No official SDK, a required version header, and the connection token as a query parameter on every call (5).

Puzzle API and MCP 53

The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.

Rutter Accounting API 62

Changelog entry on 29 October 2026 (30). 12 dated entries since 6 August, weekly coverage updates from 6 August to 29 October (20). Closed service with a weekly changelog, a help centre and 24/7 support on the paid plan (12). No official SDKs and no MCP server found in the docs or a search (0). No packages to judge (0).

Puzzle API and MCP 15

No x402, MPP or L402 (0). Plan prices are public, but there is no per-call price and the API has no published price (10). "Try for free" on every plan, with trial length and card requirement not stated on the pages read (5). A person signs up and authorises in a browser, and API credentials come by email (0). 0 + 10 + 5 + 0 = 15.

Rutter Accounting API 20

No x402, MPP or L402 (0). Production is "Get a custom quote" (0). Starter is free for 30 days with sandbox data and QuickBooks, Xero, FreshBooks and Zoho Books, no card (20). Browser signup (0).