Bandwidth Messaging API + MCP vs YCloud

Bandwidth Messaging API + MCP 65

OAuth 2.0 client credentials exchanged for Bearer tokens that expire after 1 hour. Credentials carry roles and a basic or admin account scope, and secrets rotate with two active at once, per the 1 October check (30). Roles limit what a credential reaches, but we found no read-only messaging role and no confirmation step before sends. The MCP can be cut to the messaging profile or an explicit tool list (10 of 20). Inbound messages are untrusted text. Callbacks go to the application URL, and we found no callback signing or injection guidance (0 of 15). Message records by API through listMessages (10 of 15). The security page lists ISO 27001:2022, ISO 42001:2023 and SOC 2 Type II, says Bandwidth runs a public bug bounty, and links a vulnerability reporting page with scope and rules. No reward terms were found on that page, no security.txt (404 on 2 November) and no advisories for bandwidth-sdk in OSV. Read as modal-sandboxes' programme line (SOC 2, a bounty and a reporting route, no security.txt) (15 of 20). 30 + 10 + 0 + 10 + 15 = 65.

YCloud 31

One API key in the X-API-Key header, never in the URL, rotated by creating a new key and revoking the old one; no scopes found (20 of 30). Trial accounts send only to pre-verified numbers; no read-only key or approval step (4 of 20). Inbound WhatsApp and SMS text arrives through webhooks, with no prompt-injection guidance (0 of 15). Every response carries a request ID; no operator request log was found in the docs (5 of 15). No certification is named on the pages read, the about page shows an unlabelled ISO image, and there is no security.txt or disclosure policy (2 of 20). 20 + 4 + 0 + 5 + 2 = 31.

Bandwidth Messaging API + MCP 75

Closed service with clear terms (communications services agreement). The MCP server repository still has no licence file (15). Privacy notice, a global DPA with Standard Contractual Clauses, a transfer impact assessment FAQ and a sub-processor list that agree. No retention periods found (20 of 30). The legacy credential migration is documented, with no dated deprecation policy found (5 of 20). The sub-processor list (last updated 31 March 2026) names each provider with the product it supports and the location of processing, such as AWS for hosting in the USA and EU (20). 15 + 20 + 5 + 20 = 60.

YCloud 53

Closed service with terms of 3 September 2026 that don't name the contracting entity; the about page names YCloud International Pte. Ltd. The Node SDK is MIT (12 of 30). The privacy policy (3 April 2026) gives no retention periods, mentions no DPA and says the primary servers are in Singapore (8 of 30). The terms promise reasonable notice of changes only to those who subscribe to it; v1 is kept as legacy (7 of 20). No sub-processor list; the data location is named (5 of 20). 12 + 8 + 7 + 5 = 32.

Bandwidth Messaging API + MCP 73

listMessages needs at least one filter and pages its results, with no field selection (15 of 25). Filters on to, from, message ID and date range (20). Structured errors, and the MCP maps failures to codes such as rate_limited and auth with retry advice (18 of 20). No idempotency key on sends. Excess messages queue rather than fail (5 of 20). Official SDKs in six languages. A send needs to, from, applicationId and text after an OAuth token exchange (15).

YCloud 83

List endpoints use a documented pagination guide with limits; send responses are small (18 of 25). Pagination and filters (18 of 20). Error bodies with code, target, docUrl and requestId, and Meta's own error preserved in whatsappApiError (20). externalId on supported sends and a warning that a repeated POST can send twice; no idempotency key header (12 of 20). A send needs a recipient and content; official SDKs for Node.js, Java, Go and PHP (15). 18 + 18 + 20 + 12 + 15 = 83.

Bandwidth Messaging API + MCP 40

No x402, MPP or L402 (0). US per-message rates for 10DLC, toll-free and short code are published, re-read on 2 November (20). Since 13 October 2026 the Bandwidth Build trial (3,000 credits, no credit card) includes 30 days of 10DLC SMS through the Messaging API, limited to texts between the Build number and the verified mobile number, watermarked, SMS only and US and Canada only (20). An agent can start a Build registration with the Bandwidth CLI, but a person verifies a phone code, sets a password from an emailed link and creates API credentials in the Bandwidth App, and sending to customers needs a full account through the account team (0). 0 + 20 + 20 + 0 = 40.

YCloud 35

No x402, MPP or L402 (0). Plan prices public, WhatsApp at Meta's rate with no markup and email at $0.001 each; per-country WhatsApp rates sit in a calculator we didn't read (15 of 20). The Free plan includes the messaging API with no card (20). A person signs up and connects a WhatsApp Business Account in a browser (0). 0 + 15 + 20 + 0 = 35.