Attendee vs MeetStream

Attendee 48

Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The OpenAPI 3.1.1 file at docs.attendee.dev/api-reference/openapi.json was read on 9 October in place of the rendered reference, but no docs page read then was recorded as linking it as a visible download, and the docs host is now paused, so it isn't counted as a published contract (0). The repository carries the spec as docs/openapi.yml (OpenAPI 3.0.3, 30 operations, last changed 28 October 2026), which no read page links for download either. llms.txt and a Markdown twin of each docs page (10). Most operations have a short description, and a few state when a call is allowed, such as delete_data only after a bot has ended (9). Enums, required fields and typed settings objects, with a free-form metadata object and no security scheme, since the key is declared as a header parameter (11). The only error responses are 400 and 404 with no schema, and 401 and 429 are absent, as the repository's docs/openapi.yml also shows on 4 November (8). The path is versioned as v1, info.version stays 1.0.0, and the site changelog has dated entries up to 24 March 2026 while repository tags continue to 30 October 2026 (10). 0 + 10 + 9 + 11 + 8 + 10 = 48.

MeetStream 83

No OpenAPI file was found linked from the docs or llms.txt. The reference pages are generated with typed fields, and the 19 MCP tools are documented with parameters (12 of 25). llms.txt per section, a Markdown copy of every page and a docs MCP server (10). Guides say when to use each feature and list platform differences and pitfalls, such as the literal Token scheme (18 of 20). Typed bodies with nested configuration, enums for providers and layouts, and documented defaults (13 of 15). Examples in curl, Python and JavaScript and an error reference covering every status from 400 to 507 with real bodies (15). /api/v1 paths and a dated changelog that flags breaking changes (15). 12+10+18+13+15+15 = 83.

Attendee 61

The recording is returned as a short-lived URL and transcripts and chat take updated_after, with no field selection or page size parameter (15). Cursor pagination on every list, with filters by state, meeting URL, join time and deduplication key (16). 400 responses are described only as Invalid input, while bot failures carry typed events and sub-types (8). deduplication_key on bots and calendars and an idempotency_key on webhook deliveries, with no idempotency header on the other POST calls (14). Two required fields to create a bot. No official SDK was found (8). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 15 + 16 + 8 + 14 + 8 = 61.

MeetStream 88

19 MCP tools (15), plus 2 because media come back as links rather than inline files (17 of 25). Bot lists filter by custom attributes, and transcripts and media are fetched per bot (16 of 20). Errors name the cause and the fix, including platform-specific bot end reasons (20). Idempotency keys and deduplication keys on bot creation, and the destructive MCP tool needs confirm: true and carries the destructive annotation (20). Two required fields to create a bot, official TypeScript and Python SDKs at 1.x and a CLI (15). 17+16+20+20+15 = 88.

Attendee 26

Graded on the hosted API with the hosted lines. No status page was found on the site, the docs or the README, and the footer's Status entry has no link (0). With no readable incident history the record takes the default (5). No rate limit is in the docs. The source sets defaults of 3,000 POST requests a minute per project and 2,500 concurrent bots, and the hosted values are not stated (5). No 429 response or Retry-After guidance is documented. deduplication_key makes bot and calendar creation safe to retry, and webhooks are retried 3 times (6). The terms supply the service as is with no uptime figure (0). The /api/v1 API has no beta label, though calendar integration is labelled Beta (10). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The rate-limit 5 and 429 6 are partials kept and flagged. 0 + 5 + 5 + 6 + 0 + 10 = 26.

MeetStream 45

Graded on the hosted REST API and MCP server with the hosted lines. No public status page was found, linked or at status.meetstream.ai (0), so no incident history could be read (5). Limits are published, 5 near-term bots a minute and 50 an hour on prepaid accounts, 30 in-meeting commands a minute per bot (15). 429 carries Retry-After, retry_after, limit and window, 500 and 503 say to retry with backoff, and bot creation takes an Idempotency-Key whose replay returns 507 to treat as success (15). No SLA found in the Terms or on the pricing page (0). Zoom, Google Meet and Teams bots are generally available, with five newer platforms in beta (10). 0+5+15+15+0+10 = 45.

Attendee 70

v1.89.2 was tagged on 30 October 2026, 5 days before the check (30). 88 version tags in the 90 days from 6 August to 4 November 2026, from v1.58.13 (7 August) to v1.89.2 (20). The repository merges outside contributors' pull requests and links a Slack community; reply times couldn't be read (12, per 9 October). No official SDK was found, and there is no MCP server to register (0). A CI workflow runs the test suites on each push and dependency updates are merged; the CI result couldn't be read (8). 30 + 20 + 12 + 0 + 8 = 70.

MeetStream 82

Changelog entries on 27 October 2026 (camera streaming and prepaid creation limits) (30). Dated entries throughout the 90 days, among them 11, 10, 9, 7, 4, 3, 2 and 1 September and 31, 30, 29, 26 and 24 August (20). A public changelog, support@meetstream.ai and Slack support, with no evidence read of reply times (10 of 15). In the official MCP registry as io.github.meetstream-ai/meetstream-mcp 0.3.0, and official SDKs 1.0.0 since 26 August 2026 (15). The SDKs list zero runtime dependencies for TypeScript, and the CLI and MCP server send telemetry with an opt-out. The repositories weren't cloned (7 of 10). 30+20+10+15+7 = 82.

Attendee 33

Project API keys sent in a header, stored as SHA-256 hashes, several per project and each can be disabled. No scopes, expiry or rotation tooling was found (20). No read-only key and no confirmation before delete_data, which the docs call irreversible. Dashboard users are admins or regular users limited to assigned projects (5). Transcripts and chat are participant-written, and no injection guidance was found (0). Bot events and a bot_logs.update webhook give per-bot visibility. No audit log of API calls is documented (5). No security.txt, SECURITY.md, disclosure address, bug bounty or certification was found. The source is public and dependency updates are automated (3). Per the 9 October check, re-read from the repository on 4 November. Commits of 11 and 15 September add dashboard permissions such as who may manage API keys; API keys still carry no scopes. OSV lists nothing for this project (its one hit, MAL-2022-6154, is an unrelated npm package named attendee). 20 + 5 + 0 + 5 + 3 = 33.

MeetStream 42

A key grants full access to its workspace's bots and data, and workspaces separate keys. MCP sign-in is OAuth, which mints a key per connection. No scopes or read-only keys found (15 of 30). delete_bot_data needs confirm: true and is marked destructive, and remove_bot keeps recordings, with no read-only mode (10 of 20). Transcripts, chat and audio come from meeting participants, and no prompt-injection guidance was found (0). A dashboard bot detail page and signed webhooks, with no audit log of API calls found (5 of 15). ISO 27001 certified (630036), SOC 2 Type 2 under audit, HIPAA with a BAA, a trust centre and HMAC-signed webhooks. No security.txt (404) or bug bounty found (12 of 20). 15+10+0+5+12 = 42.