Refersion MCP vs Snapchat Ads API

Refersion MCP 72

Read with the hosted lines, for the remote server at api.refersion.com/mcp. status.refersion.com is an Atlassian Statuspage with components for the dashboards, click and conversion tracking, REST API and GraphQL API, though none for the MCP server (20). The last 90 days hold one incident, on 1 September 2026, when the marketing website didn't load for about two hours while tracking and the app stayed up. The one before was a cloud-provider degradation on 20 October 2025 (20 of 30). API v2026-08 publishes 300 reads, 60 writes and 30 webhook-endpoint requests a minute per account. The tools map to that API per Refersion, but no limit is stated for the MCP server itself (12 of 15). 429 responses carry Retry-After with the wait in the body, and a few operations are documented as idempotent, but there are no idempotency keys for writes such as manual credits (10 of 15). No SLA found (0 of 10). The server isn't labelled beta or preview on the product page or the launch post (10). Total 72.

Snapchat Ads API 34

Read with the hosted lines, grading the public REST API. No status page is linked from the reviewed documentation, and status.snapchat.com did not connect from our network (0). With no readable incident history, the record scores the brief's 5 (5). Rate limits are published as an average of 20 requests a second per app and 10 per access token (15). 429 is documented with advice to lower the request rate, and the docs say to refresh and retry on a 401 for an expired token. No Retry-After header, backoff schedule or idempotency key was found (4 of 15). No SLA was found (0). The API is v1 and generally available. Reach and Frequency buying is marked beta (10). Total 34.

Refersion MCP 46

The MCP tool definitions can be read only after signing in, which this run didn't do. Refersion says each tool maps to an endpoint of API v2026-08, whose OpenAPI 3.1 file is public at refersion.dev with 36 paths and 44 operations. That counts in part, since it's the API's contract and not the tools' (12 of 25). No llms.txt on refersion.com or refersion.dev (both 404) and no Markdown docs for agents (0 of 10). The OpenAPI descriptions run 240 to 1,221 characters and state behaviour and preconditions (an affiliate with unpaid conversions can't be deleted, topics replaces rather than merges), with little on when not to call, and the MCP descriptions weren't read (8 of 20). 315 required markers, but only 5 enums, and statuses such as PENDING or APPROVED are listed in prose rather than as enums (6 of 15). 615 examples and documented 401, 402, 403, 404, 422 and 429 responses in the API file, none readable for the MCP tools (10 of 15). A dated API version with a no-breaking-change commitment and dated product posts on the blog. The changelog site wasn't read (its robots.txt disallows agents) and the MCP server has no version of its own (10 of 15). Total 46.

Snapchat Ads API 56

No OpenAPI specification or other machine-readable contract was found (0). llms.txt indexes every Marketing API page and each has a Markdown twin (10). Reference pages describe each entity and endpoint, with a quick start and guides for ad formats, though little on when not to use an endpoint (13 of 20). Attribute tables mark required fields and list allowed values, while targeting travels as nested JSON described by example (11 of 15). Each endpoint has a curl request and a JSON response. The errors page is a table of HTTP codes with placeholder text, and E codes are explained only for PATCH, large stats responses and two FAQ cases (9 of 15). One version, v1, with a dated change log back to 2017 and an announcements page. Changes ship in place (13 of 15). Total 56.

Refersion MCP 12

No machine payment protocol (0 of 40). Plan prices are public without a login, Launch $39 and Growth $199 a month plus 3 or 2 per cent of affiliate-driven sales, but nothing says which plan includes the MCP server, and Scale is through sales (10 of 20). The free Marketplace Listing only publishes an offer, no trial is published, and API access is ticked for Growth only (0 of 20). A merchant signs up in a browser and approves the assistant at consent. Clients can identify themselves by a client ID metadata document with no manual registration, which earns 2 (2 of 20). Total 12.

Snapchat Ads API 20

No x402, MPP or L402 (0). No fee for API access was found and no page states a price for the API. Ad pricing is public, with a $5 daily minimum (10). OAuth app setup has no stated cost and test ad accounts never serve live ads. The quick start lists a funding source among the prerequisites and the help centre article on access could not be read, so no-card access is not established (10). A person has to create the OAuth app in Business Manager and consent in a browser (0). Total 20.

Refersion MCP 50

Tool count and definition size couldn't be read. Refersion says each tool maps to an endpoint of an API with 44 operations, which points to more than 30 tools, so this takes the more-than-30 reading (5 of 25). The API has page and limit, a cursor on webhook endpoints, sorting and many range filters on affiliates and conversions; whether the tools pass all of them through wasn't seen (15 of 20). Documented 422 validation errors, 402 plan-limit messages such as 'Your plan does not include webhook access.', and a 429 body with retryAfter (14 of 20). Refersion says every tool is marked as reading, changing or deleting, so clients can confirm a delete, but the annotations weren't read and no idempotency keys exist (8 of 20). No API key or SDK is needed for the MCP server, and Refersion's examples are plain requests. Required inputs couldn't be read (8 of 15). Total 50.

Snapchat Ads API 57

Stats requests take fields, omit_empty and limit, and no field selection was found on entity reads. The measurement page is about 300 KB of Markdown. The MCP server's tool list is not published (15 of 25). Cursor paging with limit from 50 to 1,000, sort on four entities, breakdowns and asynchronous reports (18 of 20). Errors carry error_code, debug_message, display_message and a status for each entity in a bulk call, with no full code list, and E3003 means either no permission or no such entity (13 of 20). No idempotency key was found. Test ad accounts, PAUSED status, eligibility and estimate endpoints and sub_request_warnings lower the cost of a wrong write, while PUT resets omitted attributes to defaults (6 of 20). No Ads API SDK was found. Calls need one bearer header and bulk bodies are plain JSON (5 of 15). Total 57.

Refersion MCP 58

OAuth on Refersion's own authorisation server with authorisation code and PKCE S256, refresh tokens, device code, a revocation endpoint and client ID metadata documents, and bearer tokens in the header only. The resource lists 20 scopes split by area and by read or write (30 of 30). Refersion says each scope can be unticked at consent, that user management, credentials, payout settings and billing stay off limits, that unverified clients are marked as such, and that connected assistants are listed in account settings and can be revoked. The consent screen wasn't seen, and payments:write and conversions:write reach money (15 of 20). Results include text written by affiliates and prospects (registration answers, promotion methods, prospect pitches), with no injection guidance found (3 of 15). Connected assistants are listed per account, and conversion status changes create an audit trail per the OpenAPI file, but no per-call log for the operator is documented (7 of 15). security.txt answers 403 on www.refersion.com and 404 on api and auth. The terms say vulnerabilities go to security@refersion.com. No bug bounty, SOC 2 or ISO 27001 found (3 of 20). Total 58.

Snapchat Ads API 65

OAuth 2.0 authorisation code grant with 60-minute access tokens, a client secret shown once and revocation by the member. The snapchat-marketing-api scope covers reads and writes, and refresh tokens do not expire. The MCP server has its own snapads.read scope. No documented option puts a token in a URL (22 of 30). Calls follow the member's roles, the reports role is read-only, the MCP server is read-only and needs an admin's approval for each agent, and test ad accounts never serve. No confirmation step for a write or delete was found (14 of 20). The MCP page warns that agents may act on instructions hidden in tool outputs and gives no mitigation. Lead form responses and creator content are third-party text (7 of 15). Change logs return user, app and before and after values for five entity types (12 of 15). security.txt points to a HackerOne programme and the DPA promises breach notice within 72 hours. No SOC 2 or ISO 27001 statement was found in the pages read (10 of 20). Total 65.