Relaticle vs Twenty API + MCP

Relaticle 59

50 MCP tools, six schema resources and a prompt, with no toolsets or read-only subset (5). Filters combine native fields, custom fields and linked records with $and, $or and $not, plus sort, include, per_page (MCP maximum 25) and cursors (20). Errors come back as HTTP codes and inline MCP error responses such as Invalid ability provided.; no error catalogue was read (12 of 20). Base tool classes set readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and upserts by unique field make creates safe to retry (17 of 20). One URL with OAuth or a token; no official SDK (5 of 15). 5 + 20 + 12 + 17 + 5 = 59.

Twenty API + MCP 80

By default the MCP server lists six meta-tools (execute_tool, learn_tools, load_skills, list_object_metadata_names, list_skills, get_tool_catalog) and loads schemas on demand. ?mode=direct lists every tool for clients that load lazily (25). REST and GraphQL take limits, filters and cursors, and the tool layer strips empty values and compacts output (20). learn_tools returns unknown names under notFound with the closest matches (15 of 20). Read-only tools carry readOnlyHint. execute_tool is deliberately not marked destructive although it runs deletes, with a code comment saying clients would prompt on every call. upsert_many_* exists for safe retries (10 of 20). Few required parameters. TypeScript SDKs only (twenty-sdk, twenty-client-sdk) (10 of 15).

Relaticle 40

Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Twenty API + MCP 52

No status page found. status.twenty.com still serves the Twenty app shell on 1 November, and the website links only a trust centre (0). No readable incident history (5). Limits published with numbers, 100 requests a minute and 60 records per batch in the API docs, and 50 a minute on Cloud Pro and 100 on Organization in the pricing table (15). The data-import guide says to use exponential backoff and watch for 429 responses, the apps guide says to retry a 429 with backoff and a cap on attempts, and GraphQL batch upserts and the MCP upsert_many_* tools give a safe retry for creates, with no idempotency keys (12 of 15, as e2b). The Enterprise plan lists 'Dedicated support & SLA' on the pricing page (10). REST, GraphQL and MCP carry no beta label (10). 0 + 5 + 15 + 12 + 10 + 10 = 52.

Relaticle 57

Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single mcp:use scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.

Twenty API + MCP 65

API keys are Bearer tokens with a required expiry date, a revoked flag and an optional role binding. OAuth with dynamic client registration for MCP and apps. Tokens stay out of URLs (30). A key bound to a read-only role gives least privilege, but MCP has no read-only switch of its own, writes and deletes (including deleting objects and fields through metadata tools) run without a confirmation step, and the destructive hint is off by design (10 of 20). Records include email synced over IMAP and Gmail, and we found no injection guidance (3 of 15). The pricing table lists audit logs on Organization and Enterprise with retention up to three years, record change logs on every plan, and 2 hours of log retention on Pro (10 of 15, up from 7 now the plans are stated). security.txt with two contacts and a policy link but no Expires field, a SECURITY.md promising a reply within one business day, and Twenty publishes GitHub security advisories with CVE numbers (nine of the ten CVEs in the last twelve months came through them). No SOC 2 or bug bounty found, and SECURITY.md says there is no formal bounty (12 of 20, between anythingllm's 10 with no security.txt and open-webui's 14 with a dated one). 30 + 10 + 3 + 10 + 12 = 65.

Relaticle 90

v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.

Twenty API + MCP 97

twenty/v2.54.0 tagged on 30 October 2026, with sdk/v2.54.3 the same day (30). 19 server tags between 2 and 30 October 2026, twenty/v2.45.0 to v2.54.0 (20). Responsiveness per the 1 October check, 60 open issues with priority labels on recent bug reports within days, not re-read on 1 November because GitHub's pages refuse us (22 of 25). Not in the official MCP registry (only a third-party io.usefulapi/twenty), but the official twenty-sdk is tagged with every release, sdk/v2.54.3 on 30 October (15). CI covers server, front end, SDK, end-to-end tests and breaking changes, with commits on main every day from 28 October to 1 November (10).

Relaticle 73

AGPL-3.0 source with an integration exception, and terms for the Cloud service (30). The privacy policy (4 November 2026) gives retention for server logs (90 days), contact forms (12 months) and paused trial workspaces (deleted after 60 days with notice), and names provider categories; no DPA was found (20 of 30). No deprecation policy or dated notices found (5 of 20). The security page lists each Cloud provider and what it receives, with hosting at Hetzner in Germany, and website analytics through Fathom without CRM content (17 of 20). 30 + 20 + 5 + 17 = 72.

Twenty API + MCP 80

AGPL-3.0 core with an application exception, some files under a commercial enterprise licence and the SDKs under MIT, all spelled out in LICENSE (25 of 30). Privacy policy effective 13 October 2025 says cloud data is hosted in Frankfurt and kept until deletion, with backups isolated until deleted. No retention periods in days (22 of 30). Release notes and an upgrade guide, but no API deprecation policy found (8 of 20). Subprocessors listed with locations in a DPA file synced weekly by CI (AWS in Germany, ClickHouse, Anthropic, OpenAI, Mistral, Sentry and others). Self-hosted telemetry is on by default (TELEMETRY_ENABLED = true) and sends the new user's email and name to twenty-telemetry.com on sign-up. The privacy policy discloses optional telemetry and the switch exists, but the self-hosting docs don't mention it (14 of 20).