SandBase vs Zapier MCP (agent actions)

SandBase 48

The editorial half. The catalogue service, routing, billing, API, MCP server, Agents runtime and sandboxes are closed; the CLI, bridge, skill, catalogue, examples and SDKs are Apache-2.0. The terms (14 October 2026) name AXIOMCLOUD PTE. LTD. under Singapore law and cover agents, scraping APIs, provider licences and billing, with no registration number or address on any page read. Paid, Nevermined and Monid earned 17 for closed platforms with open SDKs (17 of 30). The privacy policy (30 October 2026) names the company, lists the customer content it handles and says the information an operation needs goes to the selected provider. It states no retention periods ('We do not claim a universal retention duration'), says only that it 'does not grant SandBase an unrestricted right' to use private content, and asserts no transfer mechanism. It agrees with the terms but leaves retention and training open. OpenRouter earned 15 where the policies settled storage, and Monid 5 where they were silent on run data (12 of 30). No deprecation policy or dated notices. The terms promise notice of material changes and say that beta parts of the service 'may change, have quotas or be discontinued', and the pricing page promises notice before sandbox pricing changes (3 of 20). The policy names Cloudflare, Google and GitHub sign-in, Stripe, Airwallex, Google Analytics 4 and PostHog (United States), but not the hosting provider, other data locations or the model and data providers. Monid earned 6 and Nevermined 14 (9 of 20). 17+12+3+9 = 41. The provenance half is computed from the provenance block.

Zapier MCP (agent actions) 78

Closed service under Zapier's terms (effective 9 April 2026) (15). Data stored in AWS us-east-1, configurable retention only on Enterprise, only Enterprise is opted out of AI training by default, and the terms let Zapier train on de-identified Derived Data unless a customer opts out (18). AI Actions and NLA retired with a pointer to MCP, the SDK attaches deprecation notices to tool results and has stated stability tiers (16). The subprocessor list names each subprocessor with its processing and location, and its 27 October 2026 revision takes effect on 10 November (20). 15+18+16+20 = 69.

SandBase 76

A public OpenAPI 3.1 file at www.sandbase.ai/openapi.json (SandBase API 1.0.0, server https://api.sandbase.ai), linked from llms.txt, covers the OpenAI, Anthropic and Gemini compatible routes, /v1/run, the data API passthrough, uploads, assets, models, account, webhooks, Agents and Sessions. Our reader stopped at about 110,000 characters, before components, so the security schemes and error schemas weren't read, and the hosted MCP tool list wasn't read; the bridge's built-in definitions give JSON Schema for all seven tools. Missing routes and unread MCP tools took 22 for Monid and Nevermined (22 of 25). llms.txt, llms-full.txt, Markdown docs and a 'For AI agents' section (10). The skill says when to use SandBase and when not to (the user's own tools and built-in search first), and the bridge's descriptions say 'Always inspect before running', but each tool description is one line and the live server's text is unread. Monid took 15 with its MCP text unread (15 of 20). The bridge schemas have required fields, additionalProperties: false and an enum on discover's type, but limit has no bounds and sandbase_run takes arguments as a free object typed only through inspect. Monid's untyped run body took 11 (11 of 15). Examples in curl and SDKs throughout, and an errors guide with a status table and recommended actions, but no list of named codes, and core platform errors can be a flat {"error": "..."} string. Monid earned 14 with a 19-value code field (11 of 15). Path versioning under /v1 and dated CLI tags, but no changelog for the API, the MCP server or the platform. Paid earned 7 for versioning with no API changelog (7 of 15). 22+10+15+11+11+7 = 76.

Zapier MCP (agent actions) 54

MCP tools carry JSON Schema by protocol, but the 16 meta-tools are server-side and action schemas are generated per app, and reading them needs a signed-in session. Unread, they count as absent, as typeform's OAuth-gated MCP schemas did (0). llms.txt with .md pages for every MCP doc (10). The docs say when to use the read and write execution tools, while action schemas are terse (12). Action input typing not visible to us (7). Troubleshooting guides cover MCP errors, with few worked examples of calls (10). Registry versions, the SDK changelog and a dated product changelog at zapier.com/changelog with a Zapier MCP category (entries on 14 September, 28 September and 19 October 2026) (15). 0+10+12+7+10+15 = 54.

SandBase 81

Read on the MCP tools, with the HTTP API where a line covers it. Seven tools (sandbase_discover, sandbase_inspect, sandbase_run, sandbase_run_get, sandbase_runs, sandbase_account, sandbase_run_cancel) with one-line descriptions, from the bridge's built-in copy and the skill, which agree; the live tools/list wasn't read. Ten or fewer compact tools (25). sandbase_discover filters by query, type and vendor with a limit, sandbase_run_get pages a run's output by cursor and limit, sandbase_runs by limit and offset, account history by page up to 100, and Agents lists by cursor. Other output sizing depends on each provider's parameters, and the skill sends large results to the CLI's -o file. Monid took 18 with more filters and no paging of run output (18 of 20). Bridge errors are isError results naming the cause and the next step (sign in again, top up, raise the key's spending limit, wait 10 to 30 seconds), and a 402 separates a key's spending limit from an empty balance. The API's platform errors are a bare string with no code or retryable flag (16 of 20). Idempotency keys on Agents writes, session events, cancel and Agent Service runs (sandbase_run_cancel requires one, and the CLI generates one for service runs), and the bridge refuses to resend a run once it may have reached the server, but POST /v1/run and sandbase_run take no key and no tool carries readOnlyHint or destructiveHint. Smithery earned 10 with idempotent upserts and safe client retries (10 of 20). A run needs only a tool name and arguments. SDKs for Python, TypeScript and Go sit in sandbaseai/sandbase at 0.1.0, installed from GitHub and on no package registry, and the OpenAI, Anthropic and E2B SDKs work by changing the base URL. Monid took 8 with the CLI alone (12 of 15). 25+18+16+10+12 = 81.

Zapier MCP (agent actions) 67

16 fixed meta-tools in agentic mode, which discover, enable and run actions at runtime, or managed mode with only pre-selected actions. Early-access workflow tools and a write_code_action tool rolling out add more when enabled (25). The SDK pages list results with cursors, but we found no output-size controls on MCP action results (12). Errors come from the app behind each action, and troubleshooting guides cover the common MCP failures (12). Reads and writes run through separate tools, but we found no annotations or idempotency guidance for MCP calls, and a batch of five rows is five separate calls (10). The SDK is TypeScript only and in beta (8). 25+12+12+10+8 = 67.

SandBase 45

Standard keys (sk- and 64 hex characters) act for one organisation with no user-selectable scopes, can carry an expiry and a spending limit, are shown once and are revoked permanently in the console. CLI Login keys from the browser approval (device secret plus PKCE S256) are scoped to mcp:invoke and answer 403 insufficient_scope outside it. No OAuth for the MCP server and no API for managing keys. Above plain revocable keys, below OpenRouter's 25 with OAuth PKCE and a management API (22). The OpenAPI file's generateContent operation 'also accepts x-goog-api-key and the key query parameter for Google SDK compatibility', noting headers are safer, and all four Gemini operations list a GoogleQueryApiKey scheme, read on 8 November 2026. A secret in a URL query string is a documented option, so 10 off (12 of 30). Per-key spending limits and expiry, the organisation's funding boundary and a monthly limit on auto top-up bound spend, and an agent can't lift a key's limit by topping up. No read-only key, per-period budget, per-run cap, allowlist of tools or providers or approval step before a paid run. Monid earned 16 with per-period budgets, a per-run cap and read-only scopes, which SandBase lacks (12 of 20). Runs return scraped pages and social posts from third parties, and neither the skill nor the docs read say to treat them as untrusted. Monid took 3 with none (3 of 15). Request history lists each request's status and cost, sandbase_runs and account history return runs with cost, GET /v1/tasks/{task_id}/cost gives a task's cost, and billing records export as CSV. No key-level audit (created by, last used) was found. Monid earned 13 with key usage records (12 of 15). security.txt answered a client error. SECURITY.md in sandbaseai/sandbase names the SDKs, examples, catalogue and API as in scope for GitHub private vulnerability reporting with acknowledgement within 3 business days, and the CLI repository has its own. No bug bounty or certification found. Paid earned 6 for a reporting address without security.txt (6 of 20). 12+12+3+12+6 = 45.

Zapier MCP (agent actions) 58

OAuth for listed clients, otherwise a long-lived connection token tied to one server, revoked by regenerating it. The docs document ?token= in the URL as a working option while preferring the header, so we deduct 10 (12). Account-level app and action restrictions apply, managed mode limits the agent to chosen actions, admins can switch MCP off per workspace and set task quotas, but there's no approval step for writes (15). Actions return email, CRM and document content with no prompt-injection guidance; the security page says only that users can't bring in third-party tools (3). User-level activity logs for every tool call in the History tab, which superadmins can review for any user, and MCP events in the account audit log (15). SOC 2 Type II and SOC 3, an invitation-only HackerOne bounty with a responsible-disclosure policy and no stated acknowledgement time, no ISO 27001 and no security.txt (zapier.com/.well-known/security.txt answers 404) (13). 12+15+3+15+13 = 58.

SandBase 68

Read for a hosted service with an open CLI and SDKs. sandbaseai/cli tagged v0.3.9 on 7 November 2026, npm @sandbaseai/cli 0.3.8 was published on 25 October, and the catalogue repository refreshed on 8 November (30). Tags v0.1.14 to v0.1.17 on 15 and 19 August, v0.3.0 to v0.3.6 on 11 and 12 October, v0.3.8 on 24 October and v0.3.9 on 7 November (20). The platform is closed and GitHub's API refused the graders, so issue queues are unread and the 0 to 15 scale for closed services applies. No public changelog for the API or MCP server, support by GitHub Discussions, issue forms and Discord (untested), and every merged pull request came from a sandbaseai branch, with commits from two people under three account names. Paid earned 5 with a support channel and no changelog, and Monid 6 with merged outside pull requests (5 of 15). The official MCP registry couldn't be read (the fetch needed an approval that didn't come), so presence there scores absent although server.json declares io.github.sandbaseai/cli. Official SDKs in Python, TypeScript and Go exist only in the GitHub repository at 0.1.0, a week old, and the TypeScript README says to copy the file until the npm package is published (5 of 15). CI runs lint, tests, a build and a package audit that rejects lifecycle scripts, with a lockfile and three runtime dependencies, and npm publishing is configured with provenance. CI results weren't read (8 of 10). 30+20+5+5+8 = 68.

Zapier MCP (agent actions) 81

Zapier's product changelog dates its latest Zapier MCP entry 19 October 2026 (multi-client servers) (30). Three dated Zapier MCP entries in the 90 days from 6 August (14 September, 28 September, 19 October) (20). Closed service with dated changelogs, support and a send_feedback tool in the server, and no public issue tracker (10). Registered as com.zapier/mcp 1.0.1 in the official MCP registry (15). The SDK, now at 0.117.0 on its changelog, is still in beta, and its npm dates couldn't be read on 4 November (6). 30+20+10+15+6 = 81.

SandBase 40

No x402, MPP or L402 on the home page, pricing, billing, llms.txt or the OpenAPI paths; the balance is funded through Stripe or Airwallex checkout (0). Prices per million tokens, per image, per seconds of video or per call on public pages without a login, such as anthropic/claude-sonnet-5.5 at $1.70 in and $8.50 out per million tokens, and inspect returns each price before a run (20). Every organisation gets 100 free calls a day on eligible data APIs, which a zero-balance organisation can still use per the skill, and Start is $0. No card requirement was found on the pricing page or the billing guide, which asks for a saved card only for auto top-up. Nevermined earned 20 for a free plan with no card requirement found (20). A person approves a browser sign-in, through the CLI's flow or the console, before any key exists, and no keyless or programmatic route was found (0). 0+20+20+0 = 40.

Zapier MCP (agent actions) 30

No x402, MPP or L402 (0). Each successful call costs two tasks and plan prices are public, so the per-call cost can be worked out but depends on the plan. That is public plan-only pricing (10). Free plan with 100 tasks a month and no card, and MCP is available to every account type (20). A person signs up in a browser and connects apps. MCP Embed lets a product create servers for its users, which still needs a human sign-in (0). 0+10+20+0 = 30.