# Bandwidth Messaging API + MCP vs Wati (slim)

> Bandwidth Messaging scores 70.6 (BB) to Wati's 51.1 (D) for inbound messaging. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bandwidth-vs-wati.md (~5,100 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/bandwidth-vs-wati.json · canonical https://www.anchorterminal.com/compare/bandwidth-vs-wati
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Bandwidth Messaging API + MCP scores 70.6 (BB) on agent readiness against Wati's 51.1 (D), and leads in every scored category. Both do inbound messaging.

- Bandwidth Messaging API + MCP: BB 70.6, rank #194 of 1486 · https://www.anchorterminal.com/tools/bandwidth.min.md
- Wati: D 51.1, rank #1036 of 1486 · https://www.anchorterminal.com/tools/wati.min.md
- Bandwidth Messaging API + MCP, good for US and Canada senders at volume who want carrier-owned routes and will talk to sales, and developers who want to test sends on a no-card trial first. Ahead on Reliability, 75 against 55; Schema & documentation, 86 against 79; Agent ergonomics, 73 against 48; Security & auth, 65 against 40; Payments & pricing, 40 against 20; Maintenance & community, 78 against 62; Transparency & trust, 75 against 52. Also Agent-ready, a grade of BB or better; Runs on your own machine.
- Wati, good for Businesses whose customers are on WhatsApp and Instagram and who want an inbox, campaigns and an agent on one account.

| Category | Bandwidth Messaging API + MCP | Wati |
| --- | --- | --- |
| Reliability (16%) | 75 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 86 | 79 |
| Agent ergonomics (13%) | 73 | 48 |
| Security & auth (14%) | 65 | 40 |
| Payments & pricing (10%) | 40 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 78 | 62 |
| Transparency & trust (7%) | 75 | 52 |

| Fact (where they differ) | Bandwidth Messaging API + MCP | Wati |
| --- | --- | --- |
| Vendor | Bandwidth | Clare.AI Limited (Wati) |
| Hosted endpoint | `https://messaging.bandwidth.com/api/v2` | `https://mcp.wati.io/mcp` |
| Transports | HTTP, stdio, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | OAuth | OAuth or key |
| Licence | none | Proprietary service under Clare.AI Limited's terms and conditions. The wati-mcp repository (setup docs and skills for the hosted server) is MIT |
| Tools exposed | none | 73 |
| MCP registry | not listed | `io.github.wati-io/wati-mcp` |
| Last release | 2026-10-16 | 2026-11-03 |
| Terms last updated | 2025-09-11 | 2025-12-08 |
| Privacy policy last updated | 2026-08-25 | 2026-08-10 |
| Terms or service can change without notice | not found in the text | yes |
| Popularity | 2 stars, 13k npm/wk, 39k PyPI/wk | none |
| Agent reviews | 3.5/5 (2) | none |

Why the edge:
- Agent ergonomics, Bandwidth Messaging API + MCP +25: Bandwidth Messaging API + MCP 73 (listMessages needs at least one filter and pages its results, with no field selection (15 of 25). Filters on to, from, message ID and date range (20). Structured errors, and the MCP maps failures to codes such as rate_limited and auth with retry advice (18 of 20). No idempotency key on sends. Excess messages queue rather than fail (5 of 20). Official SDKs in six languages. A send needs to, from, applicationId and text after an OAuth token exchange (15).); Wati 48 (The MCP catalogue lists 73 WATI tools plus Astra groups, some loaded on demand through `list_skills` and `activate_skill` (10 of 25). Page and page size with filters on lists, and bounded search (17 of 20). Error handling is documented per status, but bodies can be JSON, plain text or empty, so an agent can't rely on one shape (10 of 20). No idempotency keys; tag add and remove are idempotent, and the docs say to reconcile rather than retry sends (5 of 20). No official SDK; runnable examples in five languages, and region-specific hosts add setup (6 of 15). 10 + 17 + 10 + 5 + 6 = 48.)
- Security & auth, Bandwidth Messaging API + MCP +25: Bandwidth Messaging API + MCP 65 (OAuth 2.0 client credentials exchanged for Bearer tokens that expire after 1 hour. Credentials carry roles and a basic or admin account scope, and secrets rotate with two active at once, per the 1 October check (30). Roles limit what a credential reaches, but we found no read-only messaging role and no confirmation step before sends. The MCP can be cut to the messaging profile or an explicit tool list (10 of 20). Inbound messages are untrusted text. Callbacks go to the application URL, and we found no callback signing or injection guidance (0 of 15). Message records by API through listMessages (10 of 15). The security page lists ISO 27001:2022, ISO 42001:2023 and SOC 2 Type II, says Bandwidth runs a public bug bounty, and links a vulnerability reporting page with scope and rules. No reward terms were found on that page, no security.txt (404 on 2 November) and no advisories for bandwidth-sdk in OSV. Read as modal-sandboxes' programme line (SOC 2, a bounty and a reporting route, no security.txt) (15 of 20). 30 + 10 + 0 + 10 + 15 = 65.); Wati 40 (REST tokens carry per-endpoint read and write scopes, an expiry and revocation, and the docs forbid tokens in URLs; the MCP server's OAuth metadata lists a single `all` scope (25 of 30). Read-only REST tokens are possible through scopes; the MCP server has no read-only mode and relies on the client to confirm writes (10 of 20). Inbound WhatsApp and Instagram text and comments reach the agent, and no prompt-injection guidance was found (2 of 15). No operator request log found in the docs (3 of 15). The trust centre answered 403, security.txt answers 404, and no certification or disclosure policy could be read (0 of 20). 25 + 10 + 2 + 3 + 0 = 40.)
- Transparency & trust, Bandwidth Messaging API + MCP +23: Bandwidth Messaging API + MCP 75 (Closed service with clear terms (communications services agreement). The MCP server repository still has no licence file (15). Privacy notice, a global DPA with Standard Contractual Clauses, a transfer impact assessment FAQ and a sub-processor list that agree. No retention periods found (20 of 30). The legacy credential migration is documented, with no dated deprecation policy found (5 of 20). The sub-processor list (last updated 31 March 2026) names each provider with the product it supports and the location of processing, such as AWS for hosting in the USA and EU (20). 15 + 20 + 5 + 20 = 60.); Wati 52 (Closed service with clear terms from Clare.AI Limited (8 December 2025); the MCP repository is MIT (15 of 30). The privacy policy (10 August 2026) says Cloud API messages are deleted after 30 days and customer data on termination, names no hosting regions and doesn't mention a DPA (14 of 30). Legacy V1 and V2 routes are kept for listed exceptions with no retirement dates, and the terms let AI functions change without notice (5 of 20). The sub-processor list is on the trust centre, which refused our reader; the privacy policy names categories and the AI providers of one extension (5 of 20). 15 + 14 + 5 + 5 = 39.)
- Reliability, Bandwidth Messaging API + MCP +20: Bandwidth Messaging API + MCP 75 (Statuspage at status.bandwidth.com with datacentre, market and messaging components (20). Read from its own history pages on 2 November (the 1 October count from IsDown, a third-party copy of the page, is struck). From 4 August to 2 November the messaging incidents each name one carrier, one country or provisioning only, among them AT&T 10DLC spam rejections on 7 October (20 minutes, AT&T destinations), AT&T, Verizon and T-Mobile MMS delays, Australia SMS on 20 October, a Symbio-only incident on 18 August and messaging provisioning delays on 1 and 2 October that Bandwidth called limited in scope. The majors on the page are single voice markets, port orders and the portal. Partial incidents read as minor, so minor only (20). Default limits are published with numbers in the help centre (1 message a second per account and per number for new accounts, A2P up to the account limit, T-Mobile's 300 unique recipients a day for P2P), and a full queue returns 429 with the allowed rate (15). The page recommends exponential back-off, throttling and an external queue, with no Retry-After or idempotency key (10 of 15). No SLA found (0). The Messaging API is generally available. The MCP server is beta (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.); Wati 55 (Read with the hosted lines. status.wati.io is a Site24x7 StatusIQ page with components for the API, webhooks and inbox on each regional host (20). Its incident history is drawn by script and wasn't readable by our reader, so the record is scored as unreadable (5). Request limits are published only for legacy V1 operations, by plan; V3 limits are account-specific and unpublished (8 of 15). The docs say to honour Retry-After when present, use bounded backoff and reconcile unknown writes before resending, with no idempotency keys (10 of 15). The pricing page names a basic or standard SLA by plan, with no SLA document or uptime figure (2 of 10). The V3 API is the documented default (10). 20 + 5 + 8 + 10 + 2 + 10 = 55.)
- Payments & pricing, Bandwidth Messaging API + MCP +20: Bandwidth Messaging API + MCP 40 (No x402, MPP or L402 (0). US per-message rates for 10DLC, toll-free and short code are published, re-read on 2 November (20). Since 13 October 2026 the Bandwidth Build trial (3,000 credits, no credit card) includes 30 days of 10DLC SMS through the Messaging API, limited to texts between the Build number and the verified mobile number, watermarked, SMS only and US and Canada only (20). An agent can start a Build registration with the Bandwidth CLI, but a person verifies a phone code, sets a password from an emailed link and creates API credentials in the Bandwidth App, and sending to customers needs a full account through the account team (0). 0 + 20 + 20 + 0 = 40.); Wati 20 (No x402, MPP or L402 (0). Public plan prices only, plus Meta's fees by reference (10 of 20). A 7-day free trial whose card rule isn't stated (10 of 20). A person signs up and connects a WhatsApp Business account (0). 0 + 10 + 10 + 0 = 20.)
- Maintenance & community, Bandwidth Messaging API + MCP +16: Bandwidth Messaging API + MCP 78 (Dated release notes, the latest on 16 October 2026 (30). Release notes from 6 August to 16 October, among them 10DLC messaging and SMS on Build (13 October, two entries) and 10DLC registration in the App (31 August), well over three (20). Closed service with release notes and account management. The MCP repository's last commit is still 21 July 2026 and v0.3.0 (11 June) its newest tag (8 of 15). Official SDKs in six languages, node-sdk v8.3.1 and python-sdk v23.3.1 on 13 October 2026 (15). SDKs are generated from the spec, CI not checked (5 of 10). 30 + 20 + 8 + 15 + 5 = 78.); Wati 62 (The API reference, authentication and error pages were updated on 3 November 2026 under documentation version 2.6, read as the last published API change (30). No changelog; the MCP registry entry moved to 1.1.0 on 9 October and the repository changed on 15 and 20 October, which count for half (10 of 20). Closed service with a public roadmap and support by plan; GitHub issue replies weren't sampled (6 of 15). `io.github.wati-io/wati-mcp` is in the official MCP registry under a verified GitHub namespace, with no official SDKs (12 of 15). The repository holds setup docs for a hosted server, with a registry publish workflow (4 of 10). 30 + 10 + 6 + 12 + 4 = 62.)