Refersion MCP vs X Ads API

Refersion MCP 46

The MCP tool definitions can be read only after signing in, which this run didn't do. Refersion says each tool maps to an endpoint of API v2026-08, whose OpenAPI 3.1 file is public at refersion.dev with 36 paths and 44 operations. That counts in part, since it's the API's contract and not the tools' (12 of 25). No llms.txt on refersion.com or refersion.dev (both 404) and no Markdown docs for agents (0 of 10). The OpenAPI descriptions run 240 to 1,221 characters and state behaviour and preconditions (an affiliate with unpaid conversions can't be deleted, topics replaces rather than merges), with little on when not to call, and the MCP descriptions weren't read (8 of 20). 315 required markers, but only 5 enums, and statuses such as PENDING or APPROVED are listed in prose rather than as enums (6 of 15). 615 examples and documented 401, 402, 403, 404, 422 and 429 responses in the API file, none readable for the MCP tools (10 of 15). A dated API version with a no-breaking-change commitment and dated product posts on the blog. The changelog site wasn't read (its robots.txt disallows agents) and the MCP server has no version of its own (10 of 15). Total 46.

X Ads API 64

No OpenAPI file covers the Ads API. The published file (version 2.170, 178 paths) describes api.x.com only. A Postman collection is linked and was not read (5 of 25). The docs have an llms.txt index for the Ads API and a Markdown twin for every page (10). Reference pages describe each endpoint and guides cover objectives, targeting, pacing and analytics, with little on when not to use an endpoint (14 of 20). Parameters are typed, with required and optional flags, defaults, ranges and 41 lists of possible values in the campaign management reference. Targeting values are looked up through separate endpoints (11 of 15). Each endpoint has an example request and response. The errors page lists about 77 error constants with HTTP codes and no explanation for each (11 of 15). Versions are in the URL path with a table of introduction and end-of-life dates, and a dated changelog with an RSS feed. Version 12 dates from 27 October 2022 and changes since then ship in place (13 of 15). Total 64.

Refersion MCP 50

Tool count and definition size couldn't be read. Refersion says each tool maps to an endpoint of an API with 44 operations, which points to more than 30 tools, so this takes the more-than-30 reading (5 of 25). The API has page and limit, a cursor on webhook endpoints, sorting and many range filters on affiliates and conversions; whether the tools pass all of them through wasn't seen (15 of 20). Documented 422 validation errors, 402 plan-limit messages such as 'Your plan does not include webhook access.', and a 429 body with retryAfter (14 of 20). Refersion says every tool is marked as reading, changing or deleting, so clients can confirm a delete, but the annotations weren't read and no idempotency keys exist (8 of 20). No API key or SDK is needed for the MCP server, and Refersion's examples are plain requests. Required inputs couldn't be read (8 of 15). Total 50.

X Ads API 62

Lists take count from 1 to 1,000 and filters by ID. No field selection on entity reads was found, and the campaign management reference is about 274 KB of Markdown. The MCP server lists 74 tools, which can be narrowed by scope (14 of 25). Cursor paging, sort_by, name search with q, with_deleted, with_draft, asynchronous analytics jobs and an Active Entities endpoint that says which entities changed (18 of 20). Errors carry a constant code, a message and often the parameter and details (15 of 20). No idempotency key was found. Batch endpoints take up to 40 items and succeed or fail as a group, PUT changes only the fields sent, and the sandbox host never serves ads. MCP tool annotations were not read (8 of 20). REST calls need an OAuth 1.0a signature on each request. The official Python and Ruby SDKs are at v11.0.0 from May 2022, one API version behind (7 of 15). Total 62.

Refersion MCP 58

OAuth on Refersion's own authorisation server with authorisation code and PKCE S256, refresh tokens, device code, a revocation endpoint and client ID metadata documents, and bearer tokens in the header only. The resource lists 20 scopes split by area and by read or write (30 of 30). Refersion says each scope can be unticked at consent, that user management, credentials, payout settings and billing stay off limits, that unverified clients are marked as such, and that connected assistants are listed in account settings and can be revoked. The consent screen wasn't seen, and payments:write and conversions:write reach money (15 of 20). Results include text written by affiliates and prospects (registration answers, promotion methods, prospect pitches), with no injection guidance found (3 of 15). Connected assistants are listed per account, and conversion status changes create an audit trail per the OpenAPI file, but no per-call log for the operator is documented (7 of 15). security.txt answers 403 on www.refersion.com and 404 on api and auth. The terms say vulnerabilities go to security@refersion.com. No bug bounty, SOC 2 or ISO 27001 found (3 of 20). Total 58.

X Ads API 48

REST calls use OAuth 1.0a with an app key and a user access token. The docs say these tokens do not expire, the user can revoke them, and app keys last until regenerated. The MCP server uses OAuth 2.0 with PKCE, scopes ads.read, ads.write and media.write, access tokens of about two hours and rotating refresh tokens. The manual token example in the MCP docs uses code_challenge_method=plain with a fixed verifier (24 of 30). Account-level roles include Campaign analyst and Organic analyst, the ads.read scope gives a read-only MCP session, MCP writes are created paused with separate activation tools, and the sandbox never serves. No confirmation step for a write was found (15 of 20). Lead exports, post text and audience names are third-party text, and no prompt-injection guidance was found in the Ads API or MCP pages (4 of 15). No audit log or change history endpoint was found. Deleted entities remain readable with with_deleted=true (2 of 15). x.com's robots.txt closes its security.txt to us, developer.x.com and docs.x.com return 404 for the file, and no certification or bounty statement was found in the pages read (3 of 20). Total 48.

Refersion MCP 12

No machine payment protocol (0 of 40). Plan prices are public without a login, Launch $39 and Growth $199 a month plus 3 or 2 per cent of affiliate-driven sales, but nothing says which plan includes the MCP server, and Scale is through sales (10 of 20). The free Marketplace Listing only publishes an offer, no trial is published, and API access is ticked for Growth only (0 of 20). A merchant signs up in a browser and approves the assistant at consent. Clients can identify themselves by a client ID metadata document with no manual registration, which earns 2 (2 of 20). Total 12.

X Ads API 20

No x402, MPP or L402 (0). No page read states a fee for Ads API access, and the X API pricing page does not mention the Ads API. Advertising prices were not read (10). The sandbox creates test accounts and funding instruments at no stated cost. Whether a developer account or an Ads app needs a payment card was not established (10). A person has to create a developer app, request Ads API access and consent in a browser (0). Total 20.

Refersion MCP 58

Read for a closed service. The server was announced on 26 October 2026, seven days before this check (30). Dated product posts on the blog within the 90 days from 4 August, among them API v2026-08 on 31 August, Branded Links on 21 September and the MCP server on 26 October (20). A help centre updated on 2 October 2026, the support address helpme@refersion.com and chat on Growth. changelog.refersion.com exists but wasn't read, and response times weren't checked (8 of 15). Not in the official MCP registry (0 of 15). No package to judge (0 of 10). Total 58.

X Ads API 63

The latest changelog entry labelled X Ads API is dated 17 September 2026, 22 days before the check (30). Four Ads API entries fall in the 90 days to 9 October 2026, on 13 August and 15, 16 and 17 September (20). Closed service with a dated changelog and RSS feed. The developer forum's robots.txt closes it to us, so replies there were not read (8 of 15). The two official SDKs, for Python and Ruby, were last tagged v11.0.0 on 27 May 2022 and target API version 11 (3 of 15). Both SDK repositories have CI workflows, with no commit since May 2022 (2 of 10). Total 63.