Amazon Nova 2 Sonic vs Vapi API + MCP

Amazon Nova 2 Sonic 50

Read as a model. The newest dated change is the May 2026 refresh, completed on 28 May, 162 days before this check (10). No Sonic release note or document history entry in the 90 days from 8 August. The pre-alpha Python SDK shipped 0.9.0, 0.10.0, 0.11.0 and 0.12.0 in the window, counted half (10 of 20). Release notes, document history, re:Post and AWS Support (10 of 15). The JavaScript Bedrock runtime client is current at 3.1163.0, while the Python route is pre-alpha (10 of 15). The SDKs ship on AWS's release train; CI not read (10). Total 50.

Vapi API + MCP 88

The changelog's newest entry is the week of 26 October 2026, and @vapi-ai/web 3.1.0 was tagged on 30 October (30). Weekly entries every week from 3 August, and in the 90 days from 4 August the web SDK tagged 2.6.2, 2.6.3, 2.7.0, 2.7.1, 3.0.0, 3.0.1 and 3.1.0, the Python SDK 3.0.0 (12 October), the TypeScript SDK 2.0.1 and the MCP server 0.0.10 and 0.0.11 (20). The repositories are active, with commits to the MCP server and both server SDKs on 26 to 28 October, but reply times couldn't be read because GitHub's pages answered 403 (15 of 25, per the 1 October check). Server SDKs, web SDK and MCP server on npm and PyPI (15). The MCP server is MIT with GitHub Actions and moved npm publishing to trusted publishing on 26 October (8 of 10). 30 + 20 + 15 + 15 + 8 = 88.

Amazon Nova 2 Sonic 95

Hosted reading. AWS Health Dashboard with per-service, per-Region history (20). The dashboard history file (newest event 30 October 2026) lists no Bedrock event in the 90 days from 8 August, and the 3 September us-west-2 event names STS, Connect and IAM Identity Center, not Bedrock. The public dashboard records broad events only, so 25 of 30, as amazon-nova-embeddings was read. Quotas published, 20 concurrent requests per Region, not adjustable (15). The stream API lists ThrottlingException (429), ServiceUnavailableException (503), ModelTimeoutException (408) and ModelStreamErrorException (424), Bedrock's troubleshooting guide advises backoff with jitter, and the 8-minute connection limit comes with a session-continuation sample (15). Bedrock's SLA of 99.9 per cent a month per Region for model APIs, as read for amazon-nova-embeddings on 1 November (10). Generally available since 2 December 2025 (10). 20 + 25 + 15 + 15 + 10 + 10 = 95.

Vapi API + MCP 70

status.vapi.ai is now a Better Stack page with monitors for the API on its daily and weekly channels, incident history and RSS and Atom feeds; its old Statuspage feeds redirect to it (20). In the 90 days from 4 August the feed lists twelve incidents. Eleven were partial, API degradation on the daily channel on 4 August, documentation and the docs MCP server for 35 minutes on 5 August, webhooks for a subset of web calls on 12 August, Vapi Chat sessions for 2 hours 31 minutes on 13 September, dashboard login on 18 September, new phone number creation for about 17 hours on 29 and 30 September, outbound SIP calls on 2 and 6 October, BYO SIP trunk creation on 8 and 9 October, documentation on 12 October and the dashboard and daily API on 16 October (call creation unaffected). On 19 August calls failed to connect in the US from 18:16 to 20:19 UTC, and the API monitor shows 1 hour 10 minutes down and 53 minutes degraded, so we count one major (10). The 1 October check dated that incident to 12 August. Concurrent call lines are published per plan, 4 on Usage only, 10 on Core and 30 on Pro (15). A full account queues the call and subscriptionLimits.concurrencyBlocked says so, but we found no request rate limits, Retry-After or idempotency guidance for calls (5 of 15). The Pro package carries a 99 per cent uptime SLA and Premier 99.9 per cent, re-read on 2 November (10). The API is generally available (10). 20 + 10 + 15 + 5 + 10 + 10 = 70.

Amazon Nova 2 Sonic 10

No x402, MPP or L402 (0). The Nova and Bedrock pricing pages carry a speech-to-speech table drawn by script, so the per-token prices weren't read and this line scores absent, which is our reader's limit and not the vendor's (0). New accounts get up to $200 in Free Tier credits, and the Free Tier FAQ says most new customers need no payment method, read as half on the other AWS listings (10). A person signs up for an AWS account in a browser (0). Total 10.

Vapi API + MCP 35

No x402, MPP or L402 (0 of 40). The $0.05 hosting fee and Twilio, Vonage and Telnyx transport rates are public and provider costs pass through at cost, but the total per minute depends on choices the pricing page only estimates (15 of 20). $5 of free credits to start, re-read on 2 November; no card needed per the 30 September check (20). Access starts with a human signup (0). 0 + 15 + 20 + 0 = 35.

Amazon Nova 2 Sonic 77

SigV4 with IAM roles and temporary credentials scoped per model ARN, as the Sonic quickstart signs (30). Tools run in the client, so side effects are the developer's to approve, and IAM can restrict which models a role invokes, with no approval step in the API (12 of 20). The model listens to callers and acts on tool results, and no prompt-injection guidance was found in the Sonic guide (5 of 15). CloudTrail logs Bedrock API calls, read as amazon-nova-embeddings was (12 of 15). VDP on HackerOne, Bedrock in SOC scope and a valid security.txt on aws.amazon.com, with no paid bounty, as on the other AWS listings (18 of 20). Total 77.

Vapi API + MCP 61

Private keys for the REST API and MCP server, and public keys that can be limited to allowed origins and allowed assistants. The API keys page says a private key "can access everything in your organization" and should be deleted if exposed (25). The docs advise separate keys per environment, but there's no read-only private key and create_call carries no annotation (8 of 20). Assistants listen to callers. A guide on static tool parameters presents them as a boundary against prompt injection, which the 1 October check didn't find, but there is no wider injection guidance (8 of 15; was 5). Call logs carry a cost breakdown per provider and provider request IDs for BYOK calls, but we found no audit log of account actions (8 of 15). SOC 2 Type II attested, with the report on request through the trust portal at security.vapi.ai, and HIPAA, GDPR and PCI pages. vapi.ai/.well-known/security.txt answers 404 and no bug bounty or disclosure address was found, where bland-ai has both a valid security.txt and a disclosure address (17). The June 2026 npm incident was written up in public (12 of 20). 25 + 8 + 8 + 8 + 12 = 61.

Amazon Nova 2 Sonic 75

The Bedrock service model types InvokeModelWithBidirectionalStream, but the Sonic events inside it (session, prompt, content, tool and usage events) are JSON payloads documented only in the guide, with no schema file (12 of 25). llms.txt and Markdown copies of the Nova 2 guide (10). Guides on the event lifecycle, barge-in, turn-taking, async tools and chat history say when and how to use each (16 of 20). Event fields are documented as JSON examples and tables, not typed schemas (10 of 15). Sample repositories in several languages and the API's exceptions with HTTP codes (12 of 15). Release notes and document history, with in-place model refreshes and a versioned model ID (15). Total 75.

Vapi API + MCP 89

OpenAPI 3.1.0 at docs.vapi.ai/openapi/api-reference.json with 145 operations on 76 paths, linked from llms.txt. api.vapi.ai's robots.txt now disallows /api*, so the api.vapi.ai/api-json path the 1 October check read wasn't requested (25). llms.txt with Markdown copies of every page and a docs MCP server (10). Guides explain when to use squads, tools and fallback plans (15 of 20). The OpenAPI types every field, though assistant configuration is a large nested object (12 of 15). Examples throughout and a call-errors guide that explains ended reasons, with less on REST error bodies (12 of 15). A weekly changelog, now at docs.vapi.ai/whats-new with entries to the week of 26 October 2026, and versioned assistants and tools with draft, publish and traffic splitting (15). 25 + 10 + 15 + 12 + 12 + 15 = 89.