Sprout Social API vs Xpoz MCP

Sprout Social API 71

Hosted lines, per the 9 October check, not re-read on 4 November (Sprout's website Terms of Use bar robots and automatic means, so its hosts and its own-domain status page were not requested). A public status page on Atlassian Statuspage with a separate Sprout Social API component and incident history (20). The history feed read on 9 October showed six incidents in its 90 days, traced to Meta, Reddit or Threads, to Sprout's Trellis assistant (one a 22-minute outage on 6 August) and to a two-hour platform performance incident on 20 July that now falls outside the window. None named the API component, so we read the record as minor incidents only (20). The stretch from 9 October to 4 November is unread and not credited. Rate limits are published as 60 requests a minute and 250,000 a month (15). 429 is documented with the advice to slow down, and the media upload section advises exponential back-off on 5xx, but no Retry-After header or idempotency key for post creation was found. The 6 is an in-between value, partly met, kept (6). No SLA was found in the Terms of Service or Developer Terms. The security page gives 99.9 per cent uptime as an internal target (0). The API is not labelled beta (10).

Xpoz MCP 20

No status page found (0). No history (5). Credit allowances, no rate limits found (5 of 15). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 0 + 0 + 10 = 20.

Sprout Social API 71

Closed service with published Developer Terms (9 May 2024), Terms of Service (9 May 2025) and website Terms of Use (30 June 2023) from Sprout Social, Inc. (15). Per the 9 October check, not re-read on 4 November. The privacy policy of 16 September 2026 covers the services and states the processor role, the Terms of Service allow account content to be removed within 30 days of termination, and the docs say uploaded media is kept for 24 hours. The policy gives no retention periods, and the DPA is a PDF we did not read (20). The changelog carries dated notices of removed metrics, most of them forced by Meta. The Developer Terms promise only reasonable efforts, when possible, to give notice that a version will stop being supported (8). Hosting is disclosed to the cloud region, all in the United States. The privacy policy lists service providers by category, and a named sub-processor list was not found on the pages read (12).

Xpoz MCP 29

Closed service; terms of use read without a legal entity (10 of 30). Data handling not read (5 of 30). No deprecation policy (0). Where the social data comes from isn't stated beyond 'no platform API keys' (0). 10 + 5 + 0 + 0 = 15.

Sprout Social API 61

Per the 9 October check, not re-read on 4 November. OAuth 2.0 client credentials issue short-lived JWT access tokens, a user-based flow is available, and API tokens are named and can be invalidated. The only scope documented is organization_id, so a credential is not limited to reading or to one endpoint group. Credentials travel in the Authorization header only (22). No read-only credential is documented. The API can write only draft posts and media, the app has approval workflows, and API access can be limited to IP ranges per the product security page (12). The messages and listening endpoints return text written by the public, and no guidance on untrusted content was found (2). The app has a customer-facing audit trail of over fifty events. Whether API calls appear in it was not established (8). Responsible Disclosure Policy with a Bugcrowd vulnerability disclosure programme, SOC 2 Type 2, ISO 27001, ISO 27701 and CSA STAR Level 1 on the trust centre. No security.txt and no paid bounty stated (17).

Xpoz MCP 37

One API key (20 of 30). 49 of 52 tools read-only (15 of 20). Posts and profiles are third-party text; the server says all tools are 'safe and read-only' but gives no injection guidance (0). No audit log (0). No security programme found (2 of 20). 20 + 15 + 0 + 0 + 2 = 37.

Sprout Social API 51

Per the 9 October check, not re-read on 4 November. No OpenAPI file or other machine-readable description was found in the docs (0). The site's llms.txt lists marketing articles and no API page, and the docs are one HTML page with no Markdown twin (2). Each endpoint group states its purpose and has a Limitations section, and the overview lists what the API does not include (14). Request keys are tabulated with example values, limits and a few enumerations such as media_type, but filters are strings in a small expression syntax such as created_time.in(...) (9). Every endpoint has an example request and response, and a status code table gives a corrective action for each code. The error body is one free-text string (11). Versioning is MAJOR.MINOR with version response headers, and the changelog is dated from November 2020 to 6 October 2026 (15).

Xpoz MCP 64

52 tools read from tools/list with JSON Schema inputs and 42 enums (25). No llms.txt read (0). Server instructions explain paging and field selection (16 of 20). Typed inputs with enums (15). Examples on the home page (5 of 15). Registry 1.4.1 from July, server 3.0.0; no changelog (3 of 15). 25 + 0 + 16 + 15 + 5 + 3 = 64.

Sprout Social API 38

Per the 9 October check, not re-read on 4 November. The newest changelog entry read is dated 6 October 2026, 29 days before 4 November (30). It is the only dated entry read in the 90 days from 6 August. The two before it are 15 June and 10 June, and entries after 9 October could not be read (0). No SDK, CLI or package of Sprout's own was found to add dated releases. A public changelog, a help centre and a community site are linked. The Developer Terms say they entitle the developer to no support for the API (8). No official SDK was found (0). No package to assess (0).

Xpoz MCP 25

Registry entry last updated 14 July 2026 and repository commit on 9 September; the live server reports 3.0.0 (10). No dated releases in 90 days (0). Issues not read (0). Official registry entry ai.xpoz/social-insights (15). Docker packaging only (0). 10 + 0 + 0 + 15 + 0 = 25. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Sprout Social API 20

Per the 9 October check, not re-read on 4 November. No x402 or other machine payment protocol (0). Plan prices are public and the API is listed on Advanced at $399 per seat a month, with no per-call price (10). A 30-day trial needs no credit card, but whether it includes API access was not established, so half marks (10). A person has to sign up, hold the API Permissions permission and accept the API terms in settings (0).

Xpoz MCP 30

No machine payment protocol (0). Plan prices public (10). Free 500 credits (20). A person signs in for a key (0). 0 + 10 + 20 + 0 = 30.