Bandwidth Messaging API + MCP vs Linq

Bandwidth Messaging API + MCP 73

listMessages needs at least one filter and pages its results, with no field selection (15 of 25). Filters on to, from, message ID and date range (20). Structured errors, and the MCP maps failures to codes such as rate_limited and auth with retry advice (18 of 20). No idempotency key on sends. Excess messages queue rather than fail (5 of 20). Official SDKs in six languages. A send needs to, from, applicationId and text after an OAuth token exchange (15).

Linq 90

The MCP server has two tools, code execution against the SDK and docs search, so its definitions cost little context (25). Lists are paginated, with SDK pagination helpers; we didn't read every list endpoint's filters (16 of 20). Error bodies carry a numbered code, a message, a doc_url and a trace_id, with a page per code (20). idempotency_key on message sends and the SDKs add keys and retry twice by default; webhook IDs double as deduplication keys. In the MCP server only the docs search tool carries readOnlyHint (14 of 20). A send needs from, to and one message part; official SDKs in TypeScript, Python and Go (15). 25 + 16 + 20 + 14 + 15 = 90.

Bandwidth Messaging API + MCP 65

OAuth 2.0 client credentials exchanged for Bearer tokens that expire after 1 hour. Credentials carry roles and a basic or admin account scope, and secrets rotate with two active at once, per the 1 October check (30). Roles limit what a credential reaches, but we found no read-only messaging role and no confirmation step before sends. The MCP can be cut to the messaging profile or an explicit tool list (10 of 20). Inbound messages are untrusted text. Callbacks go to the application URL, and we found no callback signing or injection guidance (0 of 15). Message records by API through listMessages (10 of 15). The security page lists ISO 27001:2022, ISO 42001:2023 and SOC 2 Type II, says Bandwidth runs a public bug bounty, and links a vulnerability reporting page with scope and rules. No reward terms were found on that page, no security.txt (404 on 2 November) and no advisories for bandwidth-sdk in OSV. Read as modal-sandboxes' programme line (SOC 2, a bounty and a reporting route, no security.txt) (15 of 20). 30 + 10 + 0 + 10 + 15 = 65.

Linq 50

Bearer API keys in a header, never in the query string, rotated or revoked in the dashboard, scoped to the account with no per-action or read-only scopes (20 of 30). Sandbox keys reach only verified handles, and the MCP server's --code-allow-http-gets and method allow and block lists limit its code tool; no approval step for sends (10 of 20). Inbound iMessage and SMS text reaches the agent, and no prompt-injection guidance was found in the docs or the MCP instructions (0 of 15). Every response carries a trace_id; no operator request log was found in the docs (5 of 15). SOC 2 Type II reports for 2024, 2025 and 2026 and a 2026 penetration test on request, a vulnerability disclosure policy open on the trust centre and SECURITY.md in the SDK repository; no security.txt or bug bounty (15 of 20). 20 + 10 + 0 + 5 + 15 = 50.

Bandwidth Messaging API + MCP 75

Statuspage at status.bandwidth.com with datacentre, market and messaging components (20). Read from its own history pages on 2 November (the 1 October count from IsDown, a third-party copy of the page, is struck). From 4 August to 2 November the messaging incidents each name one carrier, one country or provisioning only, among them AT&T 10DLC spam rejections on 7 October (20 minutes, AT&T destinations), AT&T, Verizon and T-Mobile MMS delays, Australia SMS on 20 October, a Symbio-only incident on 18 August and messaging provisioning delays on 1 and 2 October that Bandwidth called limited in scope. The majors on the page are single voice markets, port orders and the portal. Partial incidents read as minor, so minor only (20). Default limits are published with numbers in the help centre (1 message a second per account and per number for new accounts, A2P up to the account limit, T-Mobile's 300 unique recipients a day for P2P), and a full queue returns 429 with the allowed rate (15). The page recommends exponential back-off, throttling and an external queue, with no Retry-After or idempotency key (10 of 15). No SLA found (0). The Messaging API is generally available. The MCP server is beta (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.

Linq 83

Read with the hosted lines. status.linqapp.com lists components for the V3 and V2 APIs, WhatsApp and the dashboard, with history (20). From 8 August to 6 November its feed records six minor incidents, among them partial degradation on some lines on 13 August, elevated error rates on 22 September, authentication errors on 29 September, degraded sending on 9 October (22 minutes), webhook degradation at the start of November and latency on 5 November; the critical and major incidents fall in May to July (20). Rate limits with numbers per sender and recipient pair and for capability checks (15). 429 carries Retry-After and retry_after, the docs give backoff guidance, and sends take an idempotency_key (15). llms.txt states 99.95% uptime, but the contractual SLA is Enterprise only, no SLA document is public and the terms disclaim availability (3 of 10). Partner API v3 is generally available (10). 20 + 20 + 15 + 15 + 3 + 10 = 83.

Bandwidth Messaging API + MCP 86

OpenAPI spec at dev.bandwidth.com/spec/messaging.yml (25). llms.txt linking Markdown versions of the docs, re-read on 2 November (10). Pages explain each endpoint and callback event, with less on when not to use one (14 of 20). Typed request bodies from the spec (13 of 15). Structured 429 bodies with a type and description, and a messaging errors page. We didn't recheck the full messaging error list (12 of 15). Versioned /api/v2 path and dated release notes (12 of 15). Total 86.

Linq 93

OpenAPI 3.1 file for the Partner API and another for WhatsApp, both public (25). llms.txt, llms-full.txt and Markdown for every page (10). Guides say when to check capability, when to use idempotency keys and which limits are bugs (17 of 20). 93 enums in the spec and typed parts for messages (14 of 15). Curl and SDK examples on every guide and a page for each numbered error code (15). Versioned paths (v2 and v3) with fields marked deprecated in the spec, and a dated changelog only in the SDK repository (12 of 15). 25 + 10 + 17 + 14 + 15 + 12 = 93.

Bandwidth Messaging API + MCP 78

Dated release notes, the latest on 16 October 2026 (30). Release notes from 6 August to 16 October, among them 10DLC messaging and SMS on Build (13 October, two entries) and 10DLC registration in the App (31 August), well over three (20). Closed service with release notes and account management. The MCP repository's last commit is still 21 July 2026 and v0.3.0 (11 June) its newest tag (8 of 15). Official SDKs in six languages, node-sdk v8.3.1 and python-sdk v23.3.1 on 13 October 2026 (15). SDKs are generated from the spec, CI not checked (5 of 10). 30 + 20 + 8 + 15 + 5 = 78.

Linq 83

@linqapp/sdk and @linqapp/sdk-mcp 0.80.0 on 5 November 2026 (30). Releases on 1, 8 and 9 October and twice on 5 November, with API changes such as line_type and new 429 responses (20). Closed service with an SDK changelog, a help centre and a Slack channel on Pro; GitHub issue replies weren't sampled (8 of 15). io.github.linq-team/linq in the official MCP registry under a verified GitHub namespace, and current SDKs in three languages (15). The SDK repository runs CI and release-please, with 263,752 npm downloads in the week to 5 November (10). 30 + 20 + 8 + 15 + 10 = 83.