46elks Voice API vs Vonage Voice API + MCP

46elks Voice API 12

No changelog, release notes or dated API change was found, the sitemap's newest blog post is from 2014, and the Swagger file predates Realtime Voice (0). No dated changes in the 90 days from 8 August (0). Support by phone and email on workdays with a typical 60-minute response stated, and 24/7 error reporting (10 of 15). No official SDK (0). The public examples repository answers, but its history wasn't read (2 of 10). 0+0+10+0+2 = 12.

Vonage Voice API + MCP 51

Vonage's SDKs bundle every Vonage API, so their releases count here only where they change voice code, as the Groq speech-to-text and Gemini embedding listings read their SDKs. vonage-java-sdk v9.15.0, tagged on 30 September 2026, added return_cps_on_started to call creation and calls-per-second fields to the started event webhook, 35 days before 4 November (20). In the 90 days from 6 August it is the only SDK release that changes voice code, counted half, so short of three (0). vonage-node-sdk v3.30.0 and v3.30.1, vonage-python-sdk v4.9.0 and v4.9.1, vonage-java-sdk v9.13.0, v9.13.1, v9.14.0 and v9.15.1, vonage-php-sdk-core 4.15.0 and vonage-ruby-sdk 7.36.0 change other APIs, shared client code or formatting. The Python voice package last changed on 20 July (1.5.1, in v4.8.2), and the Node voice package had only version bumps and a lint reformat. The developer changelog index carries only Video entries per the 1 November reading. Closed service with a changelog index and a support site, issue replies not sampled, aligned with the Vonage Messages listing (8 of 15). Official SDKs in six languages (15). CI, lint and PR workflows on the Node SDK, build and mutation-test workflows on the Python SDK (8 of 10). 20 + 0 + 8 + 15 + 8 = 51.

46elks Voice API 40

HTTP Basic credentials per account, with separate credentials per subaccount and no scopes found (18 of 30). Subaccounts separate traffic, with no read-only credential or confirmation for paid actions (6 of 20). Callers' speech, DTMF and SMS replies reach the agent as untrusted input. The docs show how to verify callback origin, with no prompt-injection guidance (5 of 15). Call, SMS and recording history through the API for 90 days (8 of 15). A registered Swedish telecom operator, but no security.txt (404), disclosure policy, bug bounty or certification was found (3 of 20). 18+6+5+8+3 = 40.

Vonage Voice API + MCP 73

Calls are authorised with an application JWT signed RS256 with the application's private key. Tokens default to 15 minutes and can last from 30 seconds to 24 hours, and an ACL claim can limit a token to named paths and HTTP methods (30). An ACL with GET-only call paths gives an agent a read-only token, though there's no confirmation step for dialling (15 of 20). Calls carry untrusted caller speech. Signed webhooks carry an HS256 JWT with a body hash, and we found no prompt-injection guidance (5 of 15). Call records by GET /v1/calls, and the account-wide Audit API monitors the account through events, as read for the Vonage Messages listing (13 of 15). Per the 2 October reading of www.vonage.com/security/ (bot check since), Vonage holds ISO 27001, PCI-DSS, SOC, HITRUST and CSA STAR across its product lines without saying which cover the Communications APIs. No security.txt, disclosure policy or bug bounty found. OSV lists no advisory for @vonage/server-sdk, vonage or the MCP package. The same page and reading give the Vonage Messages listing 10 (10 of 20). 30 + 15 + 5 + 13 + 10 = 73.

46elks Voice API 66

A Swagger 2.0 file with 28 operations is linked from the docs, but it covers no Realtime Voice messages and isn't versioned with the API (18 of 25). An llms.txt written for agents, with a task-to-endpoint table and webhook payloads, while docs pages are HTML (10). Each docs page explains parameters and when webhooks fire, such as voice_start loading only once a call connects (14 of 20). Form-encoded parameters with types in the Swagger file and few enums (9 of 15). Examples in many languages and a JSON error shape, with no error list (10 of 15). The /a1/ path, with no changelog found (5 of 15). 18+10+14+9+10+5 = 66.

Vonage Voice API + MCP 88

OpenAPI spec for the Voice API on developer.vonage.com, version 1.10.0 (25). llms.txt that tells agents to keep the api.nexmo.com and rest.nexmo.com hostnames (10). The NCCO reference explains each action, talk, input, record, connect, transfer, with notes on which to choose (14 of 20). Typed fields from the spec (12 of 15). Examples per action, a webhook reference and a shared API error catalogue in RFC 7807 form at developer.vonage.com/en/api-errors, though the Voice spec documents only a 201 for POST /v1/calls (12 of 15). Versioned /v1 path and a public changelog index (15). Per the 2 October check, not re-read on 4 November.

46elks Voice API 20

No x402, MPP or L402 (0). Per-minute prices by destination are public without login, also in kronor, with incoming calls free (20). No free credit; only SMS to the test number +46700000000 costs nothing, and accounts are prepaid or invoiced against a deposit (0). A person signs up in a browser and copies the credentials (0). 0+20+0+0 = 20.

Vonage Voice API + MCP 35

No x402, MPP or L402 (0). Per-minute rates are in a downloadable pricing sheet, and the pricing page returns 403 to automated readers (15 of 20). €2 of test credit without a card (20). A person signs up in a browser (0). Per the 2 October check, not re-read on 4 November.

46elks Voice API 62

Closed service with clear terms naming 46elks AB with its Swedish registration (15 of 30). The privacy policy gives concrete retention, 60 days of traffic data under Swedish law, 14 days of troubleshooting logs and a 90-day history for the customer, with EU storage, and a GDPR page and data protection page exist (24 of 30). No deprecation policy or dated notices found (0 of 20). Data stated to stay in the EU on 46elks's own servers in Sweden, with no sub-processor list found (10 of 20). 15+24+0+10 = 49.

Vonage Voice API + MCP 49

Closed service. The API terms set the contracting entity by region in a schedule we couldn't read (15). Per the 2 October check (www.vonage.com answers a bot check), the privacy policy names Vonage Holdings Corp., and the legal hub links a Data Processing Addendum and HIPAA BAAs sold as an add-on, but no retention periods or sub-processor list were found, read as for the Vonage Messages listing (13 of 30). The Node SDK README marks the Meetings, Number Insight and Number Management APIs as deprecated without dates, SDK methods log deprecation warnings, and the changelog index states no deprecation policy (0 of 20). No sub-processor list or data locations found (0). 15 + 13 + 0 + 0 = 28.

46elks Voice API 51

Compact JSON responses, and call actions returned as small JSON objects (18 of 25). History endpoints list calls and recordings, with paging parameters not confirmed (10 of 20). Errors carry error and detail (12 of 20). No idempotency key on POST /calls or number allocation (3 of 20). Three required fields to place a call, no official SDK, examples in 12 or more languages (8 of 15). 18+10+12+3+8 = 51.

Vonage Voice API + MCP 60

List calls takes page_size from 1 to 100 (default 10) and record_index, with no field selection (15 of 25). Filters on status, date_start, date_end and conversation_uuid, with ordering (20). A shared API error catalogue with codes an agent can look up (15 of 20). No idempotency key or safe-retry guidance found (0). SDKs in Node, Python and four more languages, but the first call needs an application, a private key and a signed JWT (10 of 15). Per the 2 October check, not re-read on 4 November.