# Puzzle API and MCP vs Zoho Books (slim)

> Zoho Books scores 57.7 (C) to Puzzle's 46.2 (D) for accounting ledgers. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/puzzle-vs-zoho-books.md (~4,450 tokens) · this version ~2,680 tokens · JSON https://www.anchorterminal.com/compare/puzzle-vs-zoho-books.json · canonical https://www.anchorterminal.com/compare/puzzle-vs-zoho-books
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Zoho Books scores 57.7 (C) on agent readiness against Puzzle API and MCP's 46.2 (D), and leads in 4 of 7 scored categories. Puzzle API and MCP leads on agent ergonomics and security & auth. Both do accounting ledgers.

- Puzzle API and MCP: D 46.2, rank #1180 of 1510 · https://www.anchorterminal.com/tools/puzzle.min.md
- Zoho Books: C 57.7, rank #782 of 1510 · https://www.anchorterminal.com/tools/zoho-books.min.md
- Puzzle API and MCP, good for Startups already on Puzzle who want an assistant to answer finance questions and draft bookkeeping. xero, quickbooks-online and pennylane are the nearest listings; teams wanting a self-serve API should look there. Ahead on Agent ergonomics, 56 against 51; Security & auth, 73 against 68.
- Zoho Books, good for Small businesses already on Zoho that want an agent to raise invoices, record bills and payments, reconcile bank transactions and post journals with narrow scopes. Ahead on Reliability, 56 against 15; Schema & documentation, 71 against 65; Payments & pricing, 30 against 15; Transparency & trust, 75 against 49.

| Category | Puzzle API and MCP | Zoho Books |
| --- | --- | --- |
| Reliability (16%) | 15 | 56 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 65 | 71 |
| Agent ergonomics (13%) | 56 | 51 |
| Security & auth (14%) | 73 | 68 |
| Payments & pricing (10%) | 15 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 53 | 51 |
| Transparency & trust (7%) | 49 | 75 |

| Fact (where they differ) | Puzzle API and MCP | Zoho Books |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | Puzzle Financial Inc. | Zoho |
| Hosted endpoint | `https://app.puzzle.io/mcp` | `https://www.zohoapis.com/books/v3` |
| Transports | Streamable HTTP | HTTP |
| Pricing | Paid | Freemium |
| Licence | none | Proprietary service under Zoho's Terms of Service |
| Read-only variant documented | yes | no |
| MCP registry | `io.puzzle/puzzle` | not listed |
| Last release | 2026-10-05 | 2026-09-24 |
| Terms last updated | 2023-06-01 | 2022-03-02 |
| Privacy policy last updated | 2025-12-19 | 2025-12-22 |
| Customer content may train models | not found in the text | yes |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | not found in the text | yes |
| Arbitration or class-action waiver | yes | not found in the text |
| Agent reviews | none | 3.3/5 (4) |

Why the edge:
- Reliability, Zoho Books +41: Puzzle API and MCP 15 (Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.); Zoho Books 56 (Graded on the REST API v3, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which lists a Zoho Books component (20, kept as on the other Zoho listings while the host is blocked). On 3 November 2026 that host answered robots.txt with a 404 carrying StatusIQ's access-denied error page, read as a refusal, so nothing else was requested there and the 8 October incident reading is struck. No incident history for the last 90 days could be read (5). Limits are published with numbers, 100 requests a minute per organisation, 1,000 to 10,000 a day by plan and 5 or 10 concurrent calls (15). 429 is documented with codes 44, 45 and 1070, but no Retry-After header or backoff guidance was found. `X-Unique-Identifier-Key` with `X-Upsert` makes 15 update operations safe to repeat, and creates have no idempotency key (6 of 15). No SLA found (0). v3 is the current documented version (10). 20 + 5 + 15 + 6 + 0 + 10 = 56.)
- Transparency & trust, Zoho Books +26: Puzzle API and MCP 49 (Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.); Zoho Books 75 (Closed service under the Zoho Terms of Service, last updated 2 March 2022 (15 of 30). The privacy policy of 22 December 2025 says Zoho does not sell personal information, and that data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email (24 of 30). No API deprecation policy or dated retirement notice was found. The help centre notes a new API domain from 1 June 2024 without an end date for the old one (0). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names locations and their certifications (15 of 20).)
- Payments & pricing, Zoho Books +15: Puzzle API and MCP 15 (No x402, MPP or L402 (0). Plan prices are public, but there is no per-call price and the API has no published price (10). "Try for free" on every plan, with trial length and card requirement not stated on the pages read (5). A person signs up and authorises in a browser, and API credentials come by email (0). 0 + 10 + 5 + 0 = 15.); Zoho Books 30 (No x402, MPP or L402 (0). Plan prices are public, $15 to $240 an organisation a month billed yearly in the US edition. Calls have no unit price, and the API add-on that raises the daily limit has no public price (10). The Free plan includes 1,000 API requests a day per the plan comparison, and the signup steps on the pricing page ask for a company name, email address, phone number and password, with no card mentioned (20). A person signs up in a browser, registers an OAuth client in the developer console and approves scopes (0).)
- Schema & documentation, Zoho Books +6: Puzzle API and MCP 65 (The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.); Zoho Books 71 (The docs link a downloadable archive, `openapi-all.zip`, holding OpenAPI 3.0.0 files for 45 resources and 885 operations (25). No llms.txt at zoho.com or under the API docs. Every operation in the API docs has a Markdown twin, and the help centre has an llms.txt, with 324 pages on 3 November 2026 (8 of 10). Operation descriptions are short (median 47 characters), while parameter descriptions name the call that supplies each ID. Little on when not to use an operation (14 of 20). Required fields are marked, but only 26 enums appear across the 45 files, allowed values sit in prose and `filter_by` is a string grammar (8 of 15). Each operation has request and response examples. The files declare only 200 and 201 responses, and the errors page lists eight HTTP statuses and three sample codes with no error catalogue (8 of 15). The version is in the path. No dated API changelog was found, and the product What's New page is dated and carries some API items (8 of 15).)
- Agent ergonomics, Puzzle API and MCP +5: Puzzle API and MCP 56 (MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.); Zoho Books 51 (Graded on the REST API. Lists default to 200 records a page and `per_page` lowers that. No field selection parameter was found (10 of 25). `page`, `per_page` and `has_more_page` in `page_context`, with `filter_by`, `search_text`, `sort_column` and, on 17 operations, `last_modified_time` (18 of 20). Errors return a JSON `code` and `message`, documented thinly (10 of 20). Upsert by a unique custom field on 15 update operations, with no idempotency key on creates (8 of 20). No official SDK for the Books API was found, every call needs `organization_id`, access tokens last one hour and hosts differ by data centre (5 of 15).)
- Security & auth, Puzzle API and MCP +5: Puzzle API and MCP 73 (OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.); Zoho Books 68 (OAuth 2.0 with scopes per module and operation (81 scope strings in the OpenAPI files, such as `ZohoBooks.invoices.READ`), one-hour access tokens and refresh tokens the user can revoke (30). Less 10 because the documented token and refresh calls carry the client secret and refresh token in the URL query string, and the page tells readers to use the query string (20 of 30). READ scopes per module allow a read-only agent. No approval step for deletes through the API was found (13 of 20). Records hold text from customers and vendors and no prompt-injection guidance was found. The MCP help page asks users to get an admin's approval first and to add tools only when required (3 of 15). The API Usage dashboard lists recent calls by user, module, IP address and application, and plans include an activity log (12 of 15). security.txt valid to 30 June 2028, a bug bounty, SOC 2 Type 2 and ISO/IEC 27001 (20).)