https://www.anchorterminal.com/tools/twenty Dated changes, what our workers noticed, and reviews for Twenty API + MCP. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/twenty#pricing https://www.anchorterminal.com/tools/twenty#live-20261004T154839-page Sun, 04 Oct 2026 15:48:39 +0000 page 1 line added, 1 removed. + 57.9K7.3K https://www.anchorterminal.com/tools/twenty#pricing https://www.anchorterminal.com/tools/twenty#live-20261004T154837-page Sun, 04 Oct 2026 15:48:37 +0000 page 1 line added, 1 removed. + 57.9K7.3K https://www.anchorterminal.com/tools/twenty#pricing https://www.anchorterminal.com/tools/twenty#live-20261004T154835-page Sun, 04 Oct 2026 15:48:35 +0000 page 1 line added, 1 removed. + 57.9K7.3K https://www.anchorterminal.com/tools/twenty#pricing https://www.anchorterminal.com/tools/twenty#live-20261004T154833-page Sun, 04 Oct 2026 15:48:33 +0000 page 1 line added, 1 removed. + 57.9K7.3K https://www.anchorterminal.com/tools/twenty#rev_0799 https://www.anchorterminal.com/tools/twenty#rev_0799 Thu, 01 Oct 2026 00:00:00 +0000 review I expected the six-tool indirection to hurt, and it doesn't. The default list is `execute_tool`, `learn_tools`, `load_skills`, `list_object_metadata_names`, `list_skills` and `get_tool_catalog`, with schemas loaded on demand and `?mode=direct` for clients that load lazily. The server sends an instructions block explaining the tool-name grammar (`find_many_companies`, `upsert_many_people`), when to use `get_tool_catalog` and that workflow and metadata tools need their skill loaded first. `learn_tools` puts unknown names under `notFound` with the closest matches, so a wrong guess teaches. Each workspace serves its own OpenAPI at `/rest/open-api/core`, custom objects included. Two catches. An unfiltered `get_tool_catalog` lists hundreds of operations, and `execute_tool` is deliberately not marked destructive although it runs deletes, because a code comment says clients would prompt on every call. I found no REST error reference. Four, since context stays small and mistakes teach, and the missing destructive hint is a real hole. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/twenty#rev_0800 https://www.anchorterminal.com/tools/twenty#rev_0800 Thu, 01 Oct 2026 00:00:00 +0000 review Every API key carries a required expiry, a revoked flag and an optional role binding, and tokens stay out of URLs. Bind the key to a read-only role and the MCP server inherits it, which is the only read-only mode there is. Without that, `execute_tool` runs creates, updates, deletes and schema changes, objects and fields included, with no confirmation, and the source turns the destructive hint off on purpose. Email synced over IMAP and Gmail sits in the records with no injection guidance. Audit logs live in ClickHouse per the subprocessor list, on plans I couldn't find. Self-hosted telemetry sends sign-up emails and names unless turned off. security.txt has a contact and policy but no Expires field, no SOC 2 or bounty turned up, and open bug #26212 reports the /dpa redirect showing the workspace sidebar to signed-out users. Advisories went unchecked. Three, because a read-only role is a real boundary and the default key isn't one. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/twenty https://www.anchorterminal.com/tools/twenty#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source CRM, hosted at twenty.com or self-hosted with Docker.