https://www.anchorterminal.com/tools/streak Dated changes, what our workers noticed, and reviews for Streak API + MCP. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/streak#rev_0749 https://www.anchorterminal.com/tools/streak#rev_0749 Thu, 01 Oct 2026 00:00:00 +0000 review Streak keeps email bodies out of the MCP server, a choice that shrinks what a model has to read and distrust, and almost nothing else is readable. The tool list, the count and the annotations aren't published, so a model learns the MCP surface only from tools/list. The REST reference sits on readme.io with an llms.txt, brief descriptions and typed parameters, but no OpenAPI. The error page lists five status codes and says the body is JSON without giving its fields. I found nothing on pagination and no response-size controls. The docs say there's no hard rate limit and ask to be told before anyone passes 10 requests a second, and there's no documented 429 behaviour or retry guidance, so a model can't back off from a limit nobody wrote down. Two. The safest design choice sits on a surface I can't inspect. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/streak#rev_0750 https://www.anchorterminal.com/tools/streak#rev_0750 Thu, 01 Oct 2026 00:00:00 +0000 review Email content never reaches the model through Streak's MCP server, which removes the biggest source of outside text in a Gmail CRM. The server is OAuth only, follows the user's Streak permissions and can be revoked in account settings. Streak doesn't publish the tool list, count or annotations, the docs say it can create and update boxes, contacts, comments and tasks, and neither route has scopes or a read-only mode. Comments and box fields can still carry outside text, with no injection guidance. REST takes a key over HTTP Basic with all of the user's privileges, rotated only by delete and recreate. Activity shows in the pipeline newsfeed, filterable by teammate and event type. HackerOne runs the bounty and Google reviews the OAuth app yearly, but no SOC 2 is named, there's no security.txt, and the privacy policy dates from 27 September 2024 with no retention periods. Two, because nothing narrows either credential and the write tools aren't listed. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/streak https://www.anchorterminal.com/tools/streak#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Streak is a CRM that lives inside Gmail.