Relaticle vs Salesflare

Relaticle 90

v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.

Salesflare 5

No API changelog or release notes found. The 9 October recency credit rested on the spec file's Last-Modified header (8 October), and on 4 November the same header read 4 November 2026 with the operation count unchanged, so it is a deployment stamp that records no change and sets no recency (20 to 0). No dated changelog entries (0). Support by chat and email per the help centre, untested, and no public issue tracker for the API (5 of 25). No official SDK. No official MCP registry entry was read (0). No packages to judge (0). Total 5.

Relaticle 86

OpenAPI 3.1 at /openapi.json and /openapi.yaml with 34 operations (25). llms.txt with a when-to-use and when-not section, and developer pages (10). The llms.txt and MCP docs say what the API is for and what it doesn't do (no email over REST, no meetings), while only 5 of 34 operations carry a description (14 of 20). 114 required lists and typed MCP inputs, but few enums (11 of 15). 661 examples and responses for 401, 402, 403, 404, 409, 422 and 429 (14 of 15). /v1 and frequent tagged releases, with no changelog page (relaticle.com/changelog is 404) (12 of 15). 25 + 10 + 14 + 11 + 14 + 12 = 86.

Salesflare 57

Public Swagger 2.0 file with 71 operations, linked as a download from the API introduction ("You can download it here") and from llms.txt, re-read on 4 November (25). llms.txt on the main site and help centre, with a Markdown twin for every page. The API reference itself is a Redoc page drawn from the spec (10). 17 of 71 operations have a description, and most repeat the summary (5 of 20). Enums, formats, minimums and required fields are widespread, but custom fields travel as a string, alternatives use a non-standard x-alternatives key, and the help centre says phone number arrays are not well described (10 of 15). No examples. 47 operations document only a default response, and errors appear only as a table of five status codes (4 of 15). The spec is version 1.0.0 with no changelog. Old fields are marked deprecated in their descriptions (3 of 15). Total 57.

Relaticle 40

Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Salesflare 18

Read with the hosted lines. Salesflare links a status page at status.salesflare.com, but on 4 November its robots.txt answered an empty 406, which this run reads as a refusal (as pipedrive's), so the 9 October readings of its components and history are struck and the line has no readable component history (20 to 0). No part of the window from 6 August could be read (30 to 5). No rate limit numbers found (0). The API introduction, re-read on 4 November, lists 429 with no Retry-After or backoff guidance, and there are no idempotency keys. update_if_exists on account creation and force=false on contact creation allow a safe retry of two writes (3 of 15, partial kept). No SLA found, and the terms promise reasonable endeavours without a figure (0). The REST API carries no beta label (10). 0+5+0+3+0+10 = 18.

Relaticle 73

AGPL-3.0 source with an integration exception, and terms for the Cloud service (30). The privacy policy (4 November 2026) gives retention for server logs (90 days), contact forms (12 months) and paused trial workspaces (deleted after 60 days with notice), and names provider categories; no DPA was found (20 of 30). No deprecation policy or dated notices found (5 of 20). The security page lists each Cloud provider and what it receives, with hosting at Hetzner in Germany, and website analytics through Fathom without CRM content (17 of 20). 30 + 20 + 5 + 17 = 72.

Salesflare 58

Closed service with terms, re-read on 4 November and still undated, that name Salesflare BVBA in Antwerp and Belgian law (15). The terms promise daily backups and processing only on the customer's instructions, and the help centre places data on Google Cloud in St. Ghislain, Belgium. The DPA is supplied on request, the privacy policy could not be read, and no retention period after termination was found (12 of 30). Spec fields are marked deprecated with their replacements, with no dates or policy (5 of 20). Hosting provider and location are disclosed. No subprocessor list was found (8 of 20). Total 40.

Relaticle 57

Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single mcp:use scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.

Salesflare 44

REST uses API keys sent as a Bearer header, created in Settings with no documented scopes, expiry or rotation. The MCP server uses OAuth authorisation code with PKCE (S256) and dynamic client registration, and its metadata lists only openid and offline_access, so tokens are not scoped by resource (22 of 30). Viewer, team member, manager and admin roles with data scopes exist on the Pro plan, but whether an API key inherits its creator's role is not documented. The MCP guide tells users to start with read-only requests and review writes (8 of 20). Account feeds return email and message content, with no injection guidance found (3 of 15). No audit log found (0). A disclosure programme with bounties generally of $20 to $80 and reports to security@salesflare.com (re-read on 4 November), CASA Tier 2 verification revalidated yearly and testing by an independent lab per the help centre. No SOC 2 or ISO 27001 of its own and no security.txt (11 of 20). Total 44.

Relaticle 59

50 MCP tools, six schema resources and a prompt, with no toolsets or read-only subset (5). Filters combine native fields, custom fields and linked records with $and, $or and $not, plus sort, include, per_page (MCP maximum 25) and cursors (20). Errors come back as HTTP codes and inline MCP error responses such as Invalid ability provided.; no error catalogue was read (12 of 20). Base tool classes set readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and upserts by unique field make creates safe to retry (17 of 20). One URL with OAuth or a token; no official SDK (5 of 15). 5 + 20 + 12 + 17 + 5 = 59.

Salesflare 49

Graded on the REST API. The MCP tool definitions sit behind OAuth and were not read. Lists take limit and offset, and details=false on accounts and opportunities trims the response, with no field selection (14 of 25). search, order_by, typed field filters and a q rule builder on every main list, with no documented maximum page size or total count (16 of 20). The docs list five status codes without causes and 47 operations type their response only as default; the 9 October reading of an error body came from an unauthenticated request to the API, which is struck. The status-code table still partly meets the line, so the earlier partial is kept (8 of 20, partial kept). No idempotency keys. update_if_exists and force=false cover account and contact creation only (5 of 20). Few required fields, and no official SDK was found among the vendor's 47 public repositories (6 of 15). 14+16+8+5+6 = 49.