Bandwidth Voice API + MCP vs didlogic Voice API

Bandwidth Voice API + MCP 73

Statuspage at status.bandwidth.com with datacentre, market and calling components (20). Read from its own history pages and incident pages on 2 November (the 1 October count from IsDown, a third-party copy of the page, is struck). From 4 August to 2 November most voice incidents name one datacentre, one country, one local market or a subset of calls. They include LAX outbound calls through that datacentre (10 to 12 August), a subset of JFK voice traffic (14 August), a subset of inbound calls from the Lumen network (7 October), a subset of US toll-free outbound calls (15 to 20 October), France, Japan and single rate centres. Partial incidents read as minor. On 1 September, from 12:15 to 13:29 EDT (74 minutes), outbound calls received an unexpected 404 and failed to connect. The incident page names one affected component, Outbound Calling (SIP) - United States, with inbound and non-US calling unaffected, so it is one direction in one country and read as partial, as hubspot-mcp's regional incident ("many customers in North America") and the toll-free incident here (bland-ai's 14 October outage, which hit every call inbound and outbound, is the major comparison). The 22 October US Voice Traffic major says some customers saw reduced inbound traffic for a carrier's off-network condition, so partial. Minor incidents only (20). Defaults published, 5 calls a second and 100 active sessions, with an outbound queue of 5 minutes of CPS (1,500 calls at 5 CPS), re-read on 2 November (15). 429 is documented with two distinct messages for rate and concurrency, with no Retry-After or backoff guidance (8 of 15). No SLA found (0). The Voice API is generally available. The MCP server is beta (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.

didlogic Voice API 26

Graded on the hosted API and MCP server with the hosted lines. The footer's network status page carries no components or incidents, and no other status page was found (0). No readable incident history (5). Rate limits are given only for recording lookups (one a second, one lookup a minute) (5 of 15). Those endpoints document 429 with Retry-After and X-RateLimit headers, with no backoff guidance or idempotency elsewhere, including number purchases and click-to-call (6 of 15). The site claims 99.999 per cent voice uptime, but no SLA was found in the Terms (0). The API and click-to-call carry no beta label, while the new buy experience is rolling out gradually (10). 0+5+5+6+0+10 = 26.

Bandwidth Voice API + MCP 78

Dated release notes, the newest voice entry on 16 October 2026 (Salesforce Contact Center BYOC voice in EMEA), and node-sdk v8.3.1 and python-sdk v23.3.1 on 13 October 2026 (30). Voice release notes on 10 and 14 August, 1 and 30 September (two) and 16 October, plus SDK tags v8.1.5, v8.2.0, v8.3.0 and v8.3.1 in the window (20). Closed service with release notes and account management. The MCP repository's last commit is still 21 July 2026, v0.3.0 its newest tag (8 of 15). Official SDKs in six languages, current (15). SDKs are generated from the spec, CI not checked (5 of 10). 30 + 20 + 8 + 15 + 5 = 78.

didlogic Voice API 38

Release notes dated by month, the newest September 2026 (click-to-call API and WebSocket calls), about 37 to 67 days before this check (20). Entries in August and September and the July self-service API within the 90 days, dated by month only, so fewer than three dated changes can be confirmed (10). Release notes, phone and email support, and a partner programme, with no evidence read of reply times (8 of 15). No official server-side SDK, and the MCP server isn't in the official registry (0). No package to assess (0). 20+10+8+0+0 = 38.

Bandwidth Voice API + MCP 70

OAuth 2.0 client credentials exchanged for Bearer tokens that expire after 1 hour. Each credential has roles that set its permissions and a basic or admin account scope, client secrets rotate with up to two active at once, and credentials can be deactivated or deleted, per the 1 October check (30). Roles and basic scope limit what an agent's credential can reach, though we found no read-only voice role and no confirmation step before dialling (10 of 20). Calls carry untrusted caller speech. We found no callback signing or prompt-injection guidance (0 of 15). Voice Insights shows debug logs per call, including API request history and webhook delivery attempts, since 10 August 2026 (15). The security page, read on 2 November, lists ISO 42001:2023, ISO 27001:2022 and SOC 2 Type II, says Bandwidth runs a public bug bounty, and links a vulnerability reporting page with scope and rules. No reward terms were found on that page, no security.txt (404 on 2 November) and no advisories for bandwidth-sdk in OSV. Read as the Bandwidth messaging listing and modal-sandboxes (SOC 2, a bounty and a reporting route, no security.txt) (15 of 20). 30 + 10 + 0 + 15 + 15 = 70.

didlogic Voice API 46

Revocable bearer keys created in the portal, each with full account access by the vendor's own warning. MCP OAuth mints a separate key per sign-in (18 of 30). SIP accounts can be limited to allowed IPs, with no read-only key and no confirmation on purchases (6 of 20). Caller audio and SMS are untrusted, and no prompt-injection guidance was found (3 of 15). Call detail records, transaction history and risk-check logs through the API, with no audit log of API calls (7 of 15). ISO/IEC 27001:2022 and ISO 9001 certificates from TÜV AUSTRIA Hellas with registration numbers. No security.txt or bug bounty found (12 of 20). 18+6+3+7+12 = 46.

Bandwidth Voice API + MCP 75

Closed service with clear terms (communications services agreement). The MCP server repository still has no licence file (15). Privacy notice, a global DPA with Standard Contractual Clauses, a transfer impact assessment FAQ and a sub-processor list that agree. No retention periods found (20 of 30). The legacy credential migration is documented, with no dated deprecation policy found (5 of 20). The sub-processor list (last updated 31 March 2026) names each provider with the product it supports and the location of processing, including AWS for Programmable Voice call recording, Amazon Polly for text to speech and Amazon Transcribe for call transcription, all USA and EU (20). 15 + 20 + 5 + 20 = 60.

didlogic Voice API 58

Closed service with long, clear terms naming DID Logic PTE. LTD. in Singapore (15 of 30). The privacy policy commits to data minimisation and says call content isn't monitored except for requested recording, but gives no retention periods (12 of 30). No deprecation policy, though the docs explain backward-compatible identifier changes (5 of 20). Twelve points of presence are claimed, with no sub-processor list or data locations found (5 of 20). 15+12+5+5 = 37.

Bandwidth Voice API + MCP 65

Call and recording lists take page sizes. No field selection (15 of 25). Filtering on call lists exists but we didn't confirm the full set this run (15 of 20). Errors page with codes and messages, and 429 bodies say which limit was hit (15 of 20). No idempotency key on call creation. Excess calls queue rather than fail, which makes a retry less often needed (5 of 20). Official SDKs in Node, Python and four more languages. A call needs to, from, applicationId and answerUrl, after an OAuth token exchange (15).

didlogic Voice API 57

Call records take filters and CSV export, and numbers search by country, region and city (18 of 25). Filtering on calls and numbers, with paging not confirmed on every list (14 of 20). One error envelope with field messages and 404 for unknown ids (14 of 20). No idempotency key on purchases or click-to-call. MCP annotations weren't readable without a sign-in (3 of 20). Few required fields, no official SDK beyond the browser Voice SDK (8 of 15). 18+14+14+3+8 = 57.