Relaticle vs SugarAI (SugarCRM)

Relaticle 90

v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.

SugarAI (SugarCRM) 12

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. The newest dated evidence of an API release is the 26.1 Developer Guide, whose REST pages are stamped 15 May 2026. A page stamp records no change, and no release note or dated API change was read, so no recency is credited (0). Three releases in the last 90 days were not established (0). The support site and its policy pages are current, with a support portal. The SugarClub community answered with a bot check on 9 October and was not read (7 of 25). No current SDKs in several languages. ventana, the JavaScript client, was last tagged 1.1.25 on 16 January 2026 (clone read 4 November), a partial held (5 of 15). No package was checked on a registry (0). 0 + 0 + 7 + 5 + 0 = 12.

Relaticle 86

OpenAPI 3.1 at /openapi.json and /openapi.yaml with 34 operations (25). llms.txt with a when-to-use and when-not section, and developer pages (10). The llms.txt and MCP docs say what the API is for and what it doesn't do (no email over REST, no meetings), while only 5 of 34 operations carry a description (14 of 20). 114 required lists and typed MCP inputs, but few enums (11 of 15). 661 examples and responses for 401, 402, 403, 404, 409, 422 and 429 (14 of 15). /v1 and frequent tagged releases, with no changelog page (relaticle.com/changelog is 404) (12 of 15). 25 + 10 + 14 + 11 + 14 + 12 = 86.

SugarAI (SugarCRM) 40

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. No OpenAPI file was found. A Postman collection was read on 9 October behind the viewer page at rest.apidocs.sugarcrm.com, with no download link recorded, so it isn't counted as a published contract. Each instance serves its own reference at /rest/v{version}/help and a /metadata endpoint, which we could not read without an instance (0). llms.txt on support.sugarai.com returned 404 and no Markdown docs were found (0). The 26.1 Developer Guide lists 350 endpoint pages. The five sampled carry an overview and a summary, and the filter page warns about unindexed filters, but none says when not to use an endpoint (11 of 20). Arguments are tabled with type and required flag. Record bodies are described only as <record field>, and filters are a free-form expression (7 of 15). Every sampled page has a request and response example, and a separate page lists 21 exception classes with HTTP codes and error labels. The examples carry dates from 2013 and 2014 (10 of 15). The API is versioned in the path, a table maps each Sugar release to its REST version, and each endpoint page has a change log. No dated API changelog was found (12 of 15). 0 + 0 + 11 + 7 + 10 + 12 = 40.

Relaticle 40

Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

SugarAI (SugarCRM) 61

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. Read with the hosted lines, for the SugarCloud REST API. Status page at status.cloud.sugarai.com on Better Stack with more than 100 components by region and cluster, and incident history (20). The RSS feed, read on 9 October, shows about 18 dated incidents between 15 July and 4 October 2026, most of them one to three minutes on a single cluster. The longest were 41 minutes on Sugar Cloud Premium DE 02 on 21 September and 39 minutes on US 02 on 16 July. On 24 July, 15 services including SugarIdentity global login and eight US clusters were down for about 11 minutes. No outage of an hour was found, and the wide one is why this sits below the minor band (14 of 30). The 24 July incident is now outside the 90 days from 6 August, and the window from 5 October is unread, so the line keeps its recorded value as a partial. The SugarCloud Policy Guide gives 20 requests a second as the level above which traffic may be blocked, and ends SELECT queries after 120 seconds. The limit is enforced at Sugar's discretion (12 of 15). No 429 or Retry-After behaviour is documented. Blocked traffic is lifted through a support case. Upsert by sync_key and a 409 edit_conflict error give some retry safety (5 of 15). No SLA was found in the Customer Terms of Service, which do not warrant uninterrupted service (0). The REST API is GA and versioned (10). 20 + 14 + 12 + 5 + 0 + 10 = 61.

Relaticle 30

No x402, MPP or L402 (0). Cloud prices are public per workspace with nothing per call (10). A 14-day Cloud Pro trial with no card, and self-hosting is free (20). A person signs up in a browser behind a Cloudflare check, or deploys a server (0). 0 + 10 + 20 + 0 = 30.

SugarAI (SugarCRM) 10

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. No x402, MPP or L402 (0). Plan prices are public for Sugar Sell, at $68, $98 and $155 a user a month billed annually, with Precision+ bundles quoted by sales and nothing per call (10). No free tier or self-serve trial was found. The site's buttons ask for a demo, and a 30-day Evaluation Agreement exists for evaluations Sugar arranges (0). A person buys through sales and an admin creates the user an agent logs in as (0).

Relaticle 59

50 MCP tools, six schema resources and a prompt, with no toolsets or read-only subset (5). Filters combine native fields, custom fields and linked records with $and, $or and $not, plus sort, include, per_page (MCP maximum 25) and cursors (20). Errors come back as HTTP codes and inline MCP error responses such as Invalid ability provided.; no error catalogue was read (12 of 20). Base tool classes set readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and upserts by unique field make creates safe to retry (17 of 20). One URL with OAuth or a token; no official SDK (5 of 15). 5 + 20 + 12 + 17 + 5 = 59.

SugarAI (SugarCRM) 69

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. List and filter calls take fields, view and max_num, with a default of 20 records (20 of 25). offset and next_offset pagination, 13 filter operators with $and and $or, order_by, q, and count endpoints (20). Errors return JSON with error and error_message, and the exceptions page maps 21 classes to HTTP codes including 409, 412, 413 and 422 (14 of 20). No idempotency keys. The /integrate endpoints upsert by sync_key, and updates can fail with 409 edit_conflict (10 of 20). Few required parameters. The only official client found is ventana, a JavaScript client on GitHub last pushed on 16 January 2026, so there are not SDKs in two languages (5 of 15). 20 + 20 + 14 + 10 + 5 = 69.

Relaticle 57

Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single mcp:use scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.

SugarAI (SugarCRM) 51

SugarAI's website Terms of Use bar any robot or automatic means from accessing Sugar websites, so Sugar pages are per the 9 October check, not re-read on 4 November. Tokens come from an OAuth 2.0 password grant that sends a user's username and plaintext password. The default client_id is sugar with an empty secret, the reference says there is no scope implementation, and an admin can obtain a token as any user through /oauth2/sudo/:user_name. Access tokens last 60 minutes and refresh tokens up to two weeks, both configurable in SugarIdentity (12 of 30). A token is limited by the user's roles and teams. No read-only token type or confirmation step for destructive calls was found (10 of 20). Records hold emails, notes and case text, and no prompt-injection guidance was found (3 of 15). SugarIdentity keeps an exportable audit log of logins, record audit endpoints exist (/:module/:record/audit), and access logs are available in SugarCloud Insights (10 of 15). security.txt is valid until 1 April 2027. The trust page lists SOC 2 Type II, ISO/IEC 27001:2022 and a CSA STAR listing, and the security FAQ states a bug bounty programme and patch targets of 14 days for critical flaws. The advisories page is closed to us by robots.txt and was not read (16 of 20). 12 + 10 + 3 + 10 + 16 = 51.