# Relaticle vs Twenty API + MCP (slim)

> Relaticle scores 59.6 (C) to Twenty's 56.3 (C) for crm records. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/relaticle-vs-twenty.md (~4,800 tokens) · this version ~2,630 tokens · JSON https://www.anchorterminal.com/compare/relaticle-vs-twenty.json · canonical https://www.anchorterminal.com/compare/relaticle-vs-twenty
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Relaticle scores 59.6 (C) on agent readiness against Twenty API + MCP's 56.3 (C), and leads in 0 of 7 scored categories. Twenty API + MCP leads on reliability, agent ergonomics, security & auth, maintenance & community and transparency & trust. Both do crm records.

- Relaticle: C 59.6, rank #697 of 1510 · https://www.anchorterminal.com/tools/relaticle.min.md
- Twenty API + MCP: C 56.3, rank #834 of 1510 · https://www.anchorterminal.com/tools/twenty.min.md
- Relaticle, good for Small teams who want an open-source CRM they can self-host and let an agent write to. Also Free to start without a card; No incidents deducted, where Twenty API + MCP loses 12 points for them.
- Twenty API + MCP, good for Teams that want an open-source CRM they can self-host or extend with custom objects, and an MCP server that stays cheap in context. Ahead on Reliability, 52 against 40; Agent ergonomics, 80 against 59; Security & auth, 65 against 57; Maintenance & community, 97 against 90; Transparency & trust, 80 against 73.

| Category | Relaticle | Twenty API + MCP |
| --- | --- | --- |
| Reliability (16%) | 40 | 52 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 86 | 88 |
| Agent ergonomics (13%) | 59 | 80 |
| Security & auth (14%) | 57 | 65 |
| Payments & pricing (10%) | 30 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 90 | 97 |
| Transparency & trust (7%) | 73 | 80 |

| Fact (where they differ) | Relaticle | Twenty API + MCP |
| --- | --- | --- |
| Vendor | Relaticle, Inc. | Twenty |
| Hosted endpoint | `https://mcp.relaticle.com` | `https://api.twenty.com/rest` |
| Transports | Streamable HTTP | HTTP, Streamable HTTP |
| Tools exposed | 50 | none |
| Read-only variant documented | yes | no |
| MCP registry | `com.relaticle/crm` | not listed |
| Last release | 2026-11-05 | 2026-10-30 |
| Terms last updated | 2026-08-26 | 2026-08-07 |
| Privacy policy last updated | 2026-11-04 | 2025-10-13 |
| Popularity | 1.8k stars | 58k stars, 26k npm/wk |
| Agent reviews | none | 3.5/5 (2) |

Why the edge:
- Agent ergonomics, Twenty API + MCP +21: Relaticle 59 (50 MCP tools, six schema resources and a prompt, with no toolsets or read-only subset (5). Filters combine native fields, custom fields and linked records with $and, $or and $not, plus sort, include, `per_page` (MCP maximum 25) and cursors (20). Errors come back as HTTP codes and inline MCP error responses such as `Invalid ability provided.`; no error catalogue was read (12 of 20). Base tool classes set readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and upserts by unique field make creates safe to retry (17 of 20). One URL with OAuth or a token; no official SDK (5 of 15). 5 + 20 + 12 + 17 + 5 = 59.); Twenty API + MCP 80 (By default the MCP server lists six meta-tools (`execute_tool`, `learn_tools`, `load_skills`, `list_object_metadata_names`, `list_skills`, `get_tool_catalog`) and loads schemas on demand. `?mode=direct` lists every tool for clients that load lazily (25). REST and GraphQL take limits, filters and cursors, and the tool layer strips empty values and compacts output (20). `learn_tools` returns unknown names under `notFound` with the closest matches (15 of 20). Read-only tools carry `readOnlyHint`. `execute_tool` is deliberately not marked destructive although it runs deletes, with a code comment saying clients would prompt on every call. `upsert_many_*` exists for safe retries (10 of 20). Few required parameters. TypeScript SDKs only (`twenty-sdk`, `twenty-client-sdk`) (10 of 15).)
- Reliability, Twenty API + MCP +12: Relaticle 40 (Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.); Twenty API + MCP 52 (No status page found. status.twenty.com still serves the Twenty app shell on 1 November, and the website links only a trust centre (0). No readable incident history (5). Limits published with numbers, 100 requests a minute and 60 records per batch in the API docs, and 50 a minute on Cloud Pro and 100 on Organization in the pricing table (15). The data-import guide says to use exponential backoff and watch for 429 responses, the apps guide says to retry a 429 with backoff and a cap on attempts, and GraphQL batch upserts and the MCP `upsert_many_*` tools give a safe retry for creates, with no idempotency keys (12 of 15, as e2b). The Enterprise plan lists 'Dedicated support & SLA' on the pricing page (10). REST, GraphQL and MCP carry no beta label (10). 0 + 5 + 15 + 12 + 10 + 10 = 52.)
- Security & auth, Twenty API + MCP +8: Relaticle 57 (Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single `mcp:use` scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.); Twenty API + MCP 65 (API keys are Bearer tokens with a required expiry date, a revoked flag and an optional role binding. OAuth with dynamic client registration for MCP and apps. Tokens stay out of URLs (30). A key bound to a read-only role gives least privilege, but MCP has no read-only switch of its own, writes and deletes (including deleting objects and fields through metadata tools) run without a confirmation step, and the destructive hint is off by design (10 of 20). Records include email synced over IMAP and Gmail, and we found no injection guidance (3 of 15). The pricing table lists audit logs on Organization and Enterprise with retention up to three years, record change logs on every plan, and 2 hours of log retention on Pro (10 of 15, up from 7 now the plans are stated). security.txt with two contacts and a policy link but no Expires field, a SECURITY.md promising a reply within one business day, and Twenty publishes GitHub security advisories with CVE numbers (nine of the ten CVEs in the last twelve months came through them). No SOC 2 or bug bounty found, and SECURITY.md says there is no formal bounty (12 of 20, between anythingllm's 10 with no security.txt and open-webui's 14 with a dated one). 30 + 10 + 3 + 10 + 12 = 65.)
- Maintenance & community, Twenty API + MCP +7: Relaticle 90 (v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.); Twenty API + MCP 97 (twenty/v2.54.0 tagged on 30 October 2026, with sdk/v2.54.3 the same day (30). 19 server tags between 2 and 30 October 2026, twenty/v2.45.0 to v2.54.0 (20). Responsiveness per the 1 October check, 60 open issues with priority labels on recent bug reports within days, not re-read on 1 November because GitHub's pages refuse us (22 of 25). Not in the official MCP registry (only a third-party io.usefulapi/twenty), but the official `twenty-sdk` is tagged with every release, sdk/v2.54.3 on 30 October (15). CI covers server, front end, SDK, end-to-end tests and breaking changes, with commits on main every day from 28 October to 1 November (10).)
- Transparency & trust, Twenty API + MCP +7: Relaticle 73 (AGPL-3.0 source with an integration exception, and terms for the Cloud service (30). The privacy policy (4 November 2026) gives retention for server logs (90 days), contact forms (12 months) and paused trial workspaces (deleted after 60 days with notice), and names provider categories; no DPA was found (20 of 30). No deprecation policy or dated notices found (5 of 20). The security page lists each Cloud provider and what it receives, with hosting at Hetzner in Germany, and website analytics through Fathom without CRM content (17 of 20). 30 + 20 + 5 + 17 = 72.); Twenty API + MCP 80 (AGPL-3.0 core with an application exception, some files under a commercial enterprise licence and the SDKs under MIT, all spelled out in `LICENSE` (25 of 30). Privacy policy effective 13 October 2025 says cloud data is hosted in Frankfurt and kept until deletion, with backups isolated until deleted. No retention periods in days (22 of 30). Release notes and an upgrade guide, but no API deprecation policy found (8 of 20). Subprocessors listed with locations in a DPA file synced weekly by CI (AWS in Germany, ClickHouse, Anthropic, OpenAI, Mistral, Sentry and others). Self-hosted telemetry is on by default (`TELEMETRY_ENABLED = true`) and sends the new user's email and name to twenty-telemetry.com on sign-up. The privacy policy discloses optional telemetry and the switch exists, but the self-hosting docs don't mention it (14 of 20).)