Sprout Social API vs TwitterAPI.io MCP

Sprout Social API 71

Hosted lines, per the 9 October check, not re-read on 4 November (Sprout's website Terms of Use bar robots and automatic means, so its hosts and its own-domain status page were not requested). A public status page on Atlassian Statuspage with a separate Sprout Social API component and incident history (20). The history feed read on 9 October showed six incidents in its 90 days, traced to Meta, Reddit or Threads, to Sprout's Trellis assistant (one a 22-minute outage on 6 August) and to a two-hour platform performance incident on 20 July that now falls outside the window. None named the API component, so we read the record as minor incidents only (20). The stretch from 9 October to 4 November is unread and not credited. Rate limits are published as 60 requests a minute and 250,000 a month (15). 429 is documented with the advice to slow down, and the media upload section advises exponential back-off on 5xx, but no Retry-After header or idempotency key for post creation was found. The 6 is an in-between value, partly met, kept (6). No SLA was found in the Terms of Service or Developer Terms. The security page gives 99.9 per cent uptime as an internal target (0). The API is not labelled beta (10).

TwitterAPI.io MCP 40

No status page found (0). No incident history (5). Per-account QPS limits documented by tier (15). 'Hitting the ceiling returns an HTTP 429 (no Retry-After header is sent). Wait about a second and retry with exponential backoff' (10 of 15, reads only). No SLA; the terms disclaim uninterrupted service (0). Not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Sprout Social API 71

Closed service with published Developer Terms (9 May 2024), Terms of Service (9 May 2025) and website Terms of Use (30 June 2023) from Sprout Social, Inc. (15). Per the 9 October check, not re-read on 4 November. The privacy policy of 16 September 2026 covers the services and states the processor role, the Terms of Service allow account content to be removed within 30 days of termination, and the docs say uploaded media is kept for 24 hours. The policy gives no retention periods, and the DPA is a PDF we did not read (20). The changelog carries dated notices of removed metrics, most of them forced by Meta. The Developer Terms promise only reasonable efforts, when possible, to give notice that a version will stop being supported (8). Hosting is disclosed to the cloud region, all in the United States. The privacy policy lists service providers by category, and a named sub-processor list was not found on the pages read (12).

TwitterAPI.io MCP 41

The MCP package is MIT on npm; the service is closed under terms from September 2025 that don't name the company, which appears in the footer as Prism Digital, LLC of Newark, Delaware (15). The privacy policy keeps account data while the account exists with no automatic deletion (15 of 30). No deprecation policy (0). Subprocessors not listed in the pages read (5 of 20). 15 + 15 + 0 + 5 = 35.

Sprout Social API 61

Per the 9 October check, not re-read on 4 November. OAuth 2.0 client credentials issue short-lived JWT access tokens, a user-based flow is available, and API tokens are named and can be invalidated. The only scope documented is organization_id, so a credential is not limited to reading or to one endpoint group. Credentials travel in the Authorization header only (22). No read-only credential is documented. The API can write only draft posts and media, the app has approval workflows, and API access can be limited to IP ranges per the product security page (12). The messages and listening endpoints return text written by the public, and no guidance on untrusted content was found (2). The app has a customer-facing audit trail of over fifty events. Whether API calls appear in it was not established (8). Responsible Disclosure Policy with a Bugcrowd vulnerability disclosure programme, SOC 2 Type 2, ISO 27001, ISO 27701 and CSA STAR Level 1 on the trust centre. No security.txt and no paid bounty stated (17).

TwitterAPI.io MCP 37

OAuth or a single API key per account (20 of 30). All tools are reads (12 of 20). Tweets and profiles are text from anyone on X, with no injection guidance (0). No audit log (0). No security.txt or programme found (5 of 20). 20 + 12 + 0 + 0 + 5 = 37.

Sprout Social API 20

Per the 9 October check, not re-read on 4 November. No x402 or other machine payment protocol (0). Plan prices are public and the API is listed on Advanced at $399 per seat a month, with no per-call price (10). A 30-day trial needs no credit card, but whether it includes API access was not established, so half marks (10). A person has to sign up, hold the API Permissions permission and accept the API terms in settings (0).

TwitterAPI.io MCP 40

No machine payment protocol (0). Per-result prices public (20). Up to $1 in free credits, no card (20). A Google sign-in in a browser gets the key (0). 0 + 20 + 20 + 0 = 40.

Sprout Social API 59

Per the 9 October check, not re-read on 4 November. Messages and posts requests take a fields list and return only guid without it, and analytics requests name their metrics (20). Paging by page number or page_cursor, limit up to 100, filters and sort are documented, with a 10,000 result cap on numbered pages (18). The status code table tells the caller what to do for each code and every response carries X-Sprout-Request-ID, but there are no machine-readable error codes (11). No idempotency key was found. Post creation is draft-only, which limits the harm of a repeated call, and media parts are numbered so a part can be resent (5). No SDK was found, and every call needs a customer ID looked up first (5).

TwitterAPI.io MCP 78

12 compact tools, about 12 KB (15). Cursor-based paging on followers and search (18 of 20). 429 handling documented (10 of 20). All 12 annotated read-only (20). Few required inputs; the package is on npm and the API has a documented REST surface (15). 15 + 18 + 10 + 20 + 15 = 78.

Sprout Social API 51

Per the 9 October check, not re-read on 4 November. No OpenAPI file or other machine-readable description was found in the docs (0). The site's llms.txt lists marketing articles and no API page, and the docs are one HTML page with no Markdown twin (2). Each endpoint group states its purpose and has a Limitations section, and the overview lists what the API does not include (14). Request keys are tabulated with example values, limits and a few enumerations such as media_type, but filters are strings in a small expression syntax such as created_time.in(...) (9). Every endpoint has an example request and response, and a status code table gives a corrective action for each code. The error body is one free-text string (11). Versioning is MAJOR.MINOR with version response headers, and the changelog is dated from November 2020 to 6 October 2026 (15).

TwitterAPI.io MCP 62

12 tools read from tools/list with JSON Schema inputs (25). llms.txt (10). Short descriptions of what each returns (10 of 20). Typed inputs with two enums (10 of 15). Examples on the docs page, errors described only as 429 (7 of 15). No changelog found (404); registry version 1.0.1 (0). 25 + 10 + 10 + 10 + 7 + 0 = 62.