Amazon Nova 2 Sonic vs Pipecat

Amazon Nova 2 Sonic 10

No x402, MPP or L402 (0). The Nova and Bedrock pricing pages carry a speech-to-speech table drawn by script, so the per-token prices weren't read and this line scores absent, which is our reader's limit and not the vendor's (0). New accounts get up to $200 in Free Tier credits, and the Free Tier FAQ says most new customers need no payment method, read as half on the other AWS listings (10). A person signs up for an AWS account in a browser (0). Total 10.

Pipecat 60

No x402, MPP or L402 (0). Read with the self-hosted rule, with the pricing line scored on Pipecat Cloud, the paid option. Its per-minute prices by agent size, transport, telephony and recording are published without a login, re-read on 1 November ($0.01 an active minute for agent-1x, $0.018 a minute for Daily PSTN) (20). The BSD-2-Clause package installs with no card. Pipecat Cloud needs billing credentials or a trial code before sessions start (20, on the package). The framework runs with no account, on the developer's own provider keys (20). 0 + 20 + 20 + 20 = 60.

Amazon Nova 2 Sonic 50

Read as a model. The newest dated change is the May 2026 refresh, completed on 28 May, 162 days before this check (10). No Sonic release note or document history entry in the 90 days from 8 August. The pre-alpha Python SDK shipped 0.9.0, 0.10.0, 0.11.0 and 0.12.0 in the window, counted half (10 of 20). Release notes, document history, re:Post and AWS Support (10 of 15). The JavaScript Bedrock runtime client is current at 3.1163.0, while the Python route is pre-alpha (10 of 15). The SDKs ship on AWS's release train; CI not read (10). Total 50.

Pipecat 85

pipecat-ai 1.15.0, dated 28 October 2026 in the changelog and tagged that day, 4 days before the check (30). Nine releases in the 90 days to 1 November, 1.8.0 on 26 August to 1.15.0 (20). Issue and pull-request reply times couldn't be read, since GitHub's pages answer 403, and the 17 October figures came from a third-party copy of GitHub data, now struck. The clone shows 151 pull requests from outside forks merged in the 90 days to 1 November, fixes that cite the issues they close, and a needs-repro workflow that labels issues (13 of 25, was 15). The Python framework and the JavaScript client (@pipecat-ai/client-js 1.16.0, tagged 28 October) are current, with client SDKs in six languages (15). CI, coverage, a licence check, a uv lockfile and trusted publishing to PyPI are configured. Dependabot was added on 23 October, for the pinned GitHub Actions only, and a passing main wasn't confirmed (7 of 10). 30 + 20 + 13 + 15 + 7 = 85.

Amazon Nova 2 Sonic 95

Hosted reading. AWS Health Dashboard with per-service, per-Region history (20). The dashboard history file (newest event 30 October 2026) lists no Bedrock event in the 90 days from 8 August, and the 3 September us-west-2 event names STS, Connect and IAM Identity Center, not Bedrock. The public dashboard records broad events only, so 25 of 30, as amazon-nova-embeddings was read. Quotas published, 20 concurrent requests per Region, not adjustable (15). The stream API lists ThrottlingException (429), ServiceUnavailableException (503), ModelTimeoutException (408) and ModelStreamErrorException (424), Bedrock's troubleshooting guide advises backoff with jitter, and the 8-minute connection limit comes with a session-continuation sample (15). Bedrock's SLA of 99.9 per cent a month per Region for model APIs, as read for amazon-nova-embeddings on 1 November (10). Generally available since 2 December 2025 (10). 20 + 25 + 15 + 15 + 10 + 10 = 95.

Pipecat 68

Local-software reading of the framework. pipecat-ai installs from PyPI with Python 3.11 or later declared (1.15.0's pyproject), and a compatibility workflow builds it on 3.11 to 3.14 (20). A public tests workflow runs pytest (406 Python files under tests/ in 1.15.0), on pushes to main and on pull requests, with coverage and licence-check jobs, but GitHub's Actions pages weren't readable on 17 October or 1 November, so a green main is not confirmed (15 of 25). The issue tracker couldn't be read, since GitHub's pages answer 403. The 17 October reading of open issues came from a third-party copy of GitHub data, which we no longer use, so it is struck. The clone shows 3,539 commits in the 90 days to 1 November, fixes that cite the issues they close (#6162 on 15 October, #6256 on 20 October, #6410 from an outside contributor on 28 October) and 151 merged pull requests from outside forks, so 8 of 25 on that evidence alone (was 12). Keep a Changelog with dates, semver stated and breaking changes flagged with a warning sign, but minor releases keep carrying them, 16 flagged in 1.8.0, 4 in 1.9.0, 4 in 1.10.0, 6 in 1.13.0, 1 in 1.14.0 and 5 in 1.15.0 (10 of 15). 1.15.0, classed Production/Stable (15). 20 + 15 + 8 + 10 + 15 = 68.

Amazon Nova 2 Sonic 75

The Bedrock service model types InvokeModelWithBidirectionalStream, but the Sonic events inside it (session, prompt, content, tool and usage events) are JSON payloads documented only in the guide, with no schema file (12 of 25). llms.txt and Markdown copies of the Nova 2 guide (10). Guides on the event lifecycle, barge-in, turn-taking, async tools and chat history say when and how to use each (16 of 20). Event fields are documented as JSON examples and tables, not typed schemas (10 of 15). Sample repositories in several languages and the API's exceptions with HTTP codes (12 of 15). Release notes and document history, with in-place model refreshes and a versioned model ID (15). Total 75.

Pipecat 92

Framework reading. Typed Python (py.typed) with an API reference page per service, transport, frame type and utility (25). llms.txt, Markdown copies of each page and llms-full.txt (4.7 MB on 1 November) (10). Guides say when to reach for Flows, multiple LLM agents or a single pipeline, and the error-handling page says which failures are worth retrying. The OpenTelemetry reference now gives PipelineWorker defaults of enable_tracing False and enable_turn_tracking True, matching the 1.15.0 source, so the mismatch the 17 October check found is gone (16 of 20, was 14). Pydantic Settings classes per service, a provider-neutral FunctionSchema, and an ErrorCategory enum (12 of 15). Example folders from function calling and MCP to telephony, and documented error categories and Pipecat Cloud error codes (14 of 15). Dated changelog with pull-request links, towncrier fragments and a migration guide to 1.0 (15). 25 + 10 + 16 + 12 + 14 + 15 = 92.

Amazon Nova 2 Sonic 77

SigV4 with IAM roles and temporary credentials scoped per model ARN, as the Sonic quickstart signs (30). Tools run in the client, so side effects are the developer's to approve, and IAM can restrict which models a role invokes, with no approval step in the API (12 of 20). The model listens to callers and acts on tool results, and no prompt-injection guidance was found in the Sonic guide (5 of 15). CloudTrail logs Bedrock API calls, read as amazon-nova-embeddings was (12 of 15). VDP on HackerOne, Bedrock in SOC scope and a valid security.txt on aws.amazon.com, with no paid bounty, as on the other AWS listings (18 of 20). Total 77.

Pipecat 67

Framework reading, as for the frameworks category. We found no telemetry in the source, and tracing is off by default and needs an exporter the developer supplies. The two credential flaws the 17 October check found on 1.12.0 are fixed in released versions. 1.13.0 (18 October) makes the services for OpenAI-compatible providers raise an error when given no key instead of falling back to OPENAI_API_KEY, and masks API keys, tokens and signed URLs in error messages, and 1.14.0 (23 October) closes a gap in that masking (30 of 30, was 20). No tool-approval or confirmation primitive. tools_filter allowlists MCP tools and tools_arguments pins values the model cannot change (8 of 20). A caller's speech and MCP tool results go to the model, and we found no prompt-injection guidance in the docs, re-searched in llms-full.txt on 1 November (3 of 15). OpenTelemetry spans per service and tool call, with FunctionCallObserver and LLMLogObserver for per-call visibility (15). SECURITY.md routes reports to an email address at Daily, and GitHub advisories are published with CVEs and fixed versions, four since April 2026 (OSV, re-read on 1 November, lists no new one). The OPENAI_API_KEY fix shipped without an advisory. No security.txt or bug bounty. Daily states SOC 2 Type 2, which isn't scored for a framework (11 of 20). 30 + 8 + 3 + 15 + 11 = 67.

Amazon Nova 2 Sonic 64

Scored as an API. Responses carry transcripts of both sides and usage events, chat history is capped at 200 KB and can be injected once per session (15 of 25). Output controls are voice, turn-taking sensitivity and text or audio input (12 of 20). Typed exceptions with HTTP codes, while errors inside the event stream are less documented (15 of 20). Asynchronous tool calls let the model keep talking, and AWS samples show how to resume after the 8-minute limit, with nothing on repeating tool side effects after a reconnect (12 of 20). A session needs a sequence of start events before audio. The JavaScript SDK is current, but the Python SDK the quickstart uses is pre-alpha and needs Python 3.12 (10 of 15). Total 64.

Pipecat 72

Framework reading. MCPClient registers an MCP server's tools with the LLM, with tools_filter to allow only named tools and tools_arguments to fix values and hide them from the schema. The repository's streamable HTTP MCP example is about 130 lines of code, most of it the voice pipeline rather than the tool wiring (20 of 25). tools_output_filters trims tool results, and context summarisation and Flows context strategies limit what the model sees (15 of 20). Errors carry a category that marks permanent failures, services expose is_usable, ProcessorUnusablePolicy decides whether a bot ends, and MCP failures return to the model as text (17 of 20). Function calls cancel on interruption by default, with per-tool timeouts and opt-in asynchronous or model-cancellable calls, but there is no idempotency guidance for tools with side effects (10 of 20). A bot needs a transport, speech-to-text, LLM, text-to-speech, VAD and context aggregators wired by hand, which pipecat init scaffolds. Server code is Python only, with client SDKs in six languages (10 of 15).