Relaticle vs Salesforce API + MCP

Relaticle 86

OpenAPI 3.1 at /openapi.json and /openapi.yaml with 34 operations (25). llms.txt with a when-to-use and when-not section, and developer pages (10). The llms.txt and MCP docs say what the API is for and what it doesn't do (no email over REST, no meetings), while only 5 of 34 operations carry a description (14 of 20). 114 required lists and typed MCP inputs, but few enums (11 of 15). 661 examples and responses for 401, 402, 403, 404, 409, 422 and 429 (14 of 15). /v1 and frequent tagged releases, with no changelog page (relaticle.com/changelog is 404) (12 of 15). 25 + 10 + 14 + 11 + 14 + 12 = 86.

Salesforce API + MCP 0

developer.salesforce.com answered robots.txt with an Akamai 403 on 4 November 2026, so the host is blocked and the 1 October readings from it are struck. The hosted MCP references, the API reference, llms.txt and the platform versioning notes were all read there. The release notes on help.salesforce.com load only by script, www.salesforce.com/llms.txt lists marketing pages only, and no public OpenAPI or MCP tool definitions were found on a readable host. Contract, llms.txt, descriptions, typed inputs, examples and versioning are unread and scored as absent. 0 + 0 + 0 + 0 + 0 + 0 = 0.

Relaticle 90

v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.

Salesforce API + MCP 4

No dated API or MCP change could be read on 4 November. developer.salesforce.com answered robots.txt with an Akamai 403 on 4 November 2026, so the host is blocked and the 1 October readings from it are struck. The release notes on help.salesforce.com load only by script. The April 2026 GA in the listing is now more than 180 days old in any case (0). No dated change in the 90 days from 6 August could be read (0). Support and help routes are linked from Salesforce's readable pages; the changelog can't be read (4 of 15). Not in the official MCP registry, which lists only third-party Salesforce servers on 4 November, and no official general-purpose REST SDK found (0). No packages to judge (0). 0 + 0 + 4 + 0 + 0 = 4.

Relaticle 59

50 MCP tools, six schema resources and a prompt, with no toolsets or read-only subset (5). Filters combine native fields, custom fields and linked records with $and, $or and $not, plus sort, include, per_page (MCP maximum 25) and cursors (20). Errors come back as HTTP codes and inline MCP error responses such as Invalid ability provided.; no error catalogue was read (12 of 20). Base tool classes set readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and upserts by unique field make creates safe to retry (17 of 20). One URL with OAuth or a token; no official SDK (5 of 15). 5 + 20 + 12 + 17 + 5 = 59.

Salesforce API + MCP 0

developer.salesforce.com answered robots.txt with an Akamai 403 on 4 November 2026, so the host is blocked and the 1 October readings from it are struck. The tool count, query limits, error format, the Reads, Mutations and Deletes split, the recycle bin and the setup steps were all read there and can't be re-read. No official general-purpose REST SDK was found on a readable host. Every line is unread and scored as absent. 0 + 0 + 0 + 0 + 0 = 0.

Relaticle 57

Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single mcp:use scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.

Salesforce API + MCP 40

developer.salesforce.com answered robots.txt with an Akamai 403 on 4 November 2026, so the host is blocked and the 1 October readings from it are struck. The OAuth 2.0 with PKCE and mcp_api scope reading came from there; no readable page states the API's credential model (0). Salesforce's security model page, read on 4 November, says access is limited at the object, field and record level through profiles, roles and permission sets; the per-risk MCP servers and delete confirmation are struck with the docs (10 of 20). Record text written by outsiders reaches the model. Salesforce's security site publishes prompt-injection advisories that turned on human confirmation for Agentforce actions (14 and 25 August 2025) and an LLM risk whitepaper, none for hosted MCP (4 of 15). The same page lists Setup Audit Trail, Login History and Field History Tracking built in, and Event Monitoring of 90+ event types in the paid Shield add-on (8 of 15). A responsible disclosure policy, an "independent bug bounty program" and SOC 2 Type II, ISO, PCI DSS L1 and FedRAMP claims on the security model page, and a public advisory archive and feed with CVEs (newest 2 October 2025). No security.txt found. Read above twilio-voice (disclosure, bounty, certifications, no advisories, 15) for the public advisories (18 of 20). 0 + 10 + 4 + 8 + 18 = 40.

Relaticle 73

AGPL-3.0 source with an integration exception, and terms for the Cloud service (30). The privacy policy (4 November 2026) gives retention for server logs (90 days), contact forms (12 months) and paused trial workspaces (deleted after 60 days with notice), and names provider categories; no DPA was found (20 of 30). No deprecation policy or dated notices found (5 of 20). The security page lists each Cloud provider and what it receives, with hosting at Hetzner in Germany, and website analytics through Fathom without CRM content (17 of 20). 30 + 20 + 5 + 17 = 72.

Salesforce API + MCP 67

Closed service with terms naming Salesforce, Inc. (15). Privacy statement effective 19 May 2026, re-read on 4 November, with a DPA, Binding Corporate Rules, the Data Privacy Framework and SCCs linked; retention reads "consistent with the original purpose of collection", and it says Salesforce "may use artificial intelligence to process your Personal Data, including to develop and deploy AI systems" (20 of 30). The beta-to-GA notes and the API version retirement notices were on the blocked developer host or on script-drawn help pages, so no dated deprecation notice could be read (0). Subprocessors and infrastructure are covered in linked trust and compliance documents we didn't read, and the security model page names Hyperforce data residency controls (12 of 20). 15 + 20 + 0 + 12 = 47.

Relaticle 40

Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Salesforce API + MCP 45

status.salesforce.com is a status site drawn by script, and trust.salesforce.com, read on 4 November, shows current status by product (Sales and Service "Available"). The status-page line is kept on that and the 1 October reading (20). The 1 October incident count came from api.status.salesforce.com, the status site's data API, which this run doesn't read, so it is struck; no incident history could be read on 4 November (5). developer.salesforce.com answered robots.txt with an Akamai 403 on 4 November 2026, so the host is blocked and the 1 October readings from it are struck. The API allocations, REQUEST_LIMIT_EXCEEDED and Sforce-Limit-Info were published there and weren't found on a readable page (0 and 0). Salesforce's security model page says "99.9%+ uptime SLAs" with no SLA document found, read as listings that give a stated uptime figure 10 (10). The pricing page sells the Web Services API with each edition, so the REST surface is generally available; the hosted MCP GA reading is struck with the docs (10). 20 + 5 + 0 + 0 + 10 + 10 = 45.