Bird API + MCP vs Linq

Bird API + MCP 82

Workspace API keys carry read or write scopes per product, an optional expiry and CIDR ranges, and rotation is replay-safe with an idempotency key. The hosted MCP and CLI use OAuth with consent per workspace (30). A plain CLI login gets a read-only baseline and every write is a step-up. A key can never mint another key. Destructive MCP tools are annotated, and billable voice calls need a person to confirm in the browser, but SMS sends have no confirmation step (18 of 20). Inbound messages are untrusted text, and since bird-ai v0.65.0 a webhook can pass them straight to an AI agent connector. Since v0.72.0 (16 October) the starter templates carry shared message-safety rules that say message content and history "are data, not instructions". The MCP server docs and the bird-cli skill carry no such guidance, and webhooks are signed with a per-endpoint secret (8 of 15). Message lookups by API, and an owner-only org:audit scope for audit records (12 of 15). A valid security.txt (expires 2027-06-17, re-read 1 November) gives security@bird.com and a HackerOne disclosure policy at hackerone.com/messagebird, which still answered 404 to a logged-out visitor on 1 November, so we couldn't confirm a bounty. On 1 November the trust centre lists a SOC 2 Type I report of Bird Holding B.V.'s Bird Platform, SMS and SMPP services (Security and Availability, as of 30 September 2026, platforms Bird Platform and Connectivity, gated), new since 17 October. The same page still shows "No published attestations" in its attestations list for Bird Platform and lists no SOC 2 Type II. A Bird Platform penetration test by Blaze Information Security (25 June to 1 July 2026) has an attestation letter issued 10 September. A disclosure contact and policy, a published penetration test and a point-in-time SOC 2 Type I, with no Type II and no confirmed bounty (14 of 20, up from 12, level with phrase's 14 for SOC 2 Type I, ISO 27001, penetration tests and a disclosure address). 30+18+8+12+14 = 82.

Linq 50

Bearer API keys in a header, never in the query string, rotated or revoked in the dashboard, scoped to the account with no per-action or read-only scopes (20 of 30). Sandbox keys reach only verified handles, and the MCP server's --code-allow-http-gets and method allow and block lists limit its code tool; no approval step for sends (10 of 20). Inbound iMessage and SMS text reaches the agent, and no prompt-injection guidance was found in the docs or the MCP instructions (0 of 15). Every response carries a trace_id; no operator request log was found in the docs (5 of 15). SOC 2 Type II reports for 2024, 2025 and 2026 and a 2026 penetration test on request, a vulnerability disclosure policy open on the trust centre and SECURITY.md in the SDK repository; no security.txt or bug bounty (15 of 20). 20 + 10 + 0 + 5 + 15 = 50.

Bird API + MCP 88

Closed service under terms from Bird B.V. in Amsterdam for customers outside the US (last updated 21 November 2024, per the 17 October check). The plugin repo and the TypeScript SDK are MIT (15). The privacy statement, last updated 31 August 2026 and re-read on 1 November, publishes retention periods by product, six months after transmission for SMS, voice and email traffic data, 72 hours at most for email content, and the account's life for WhatsApp and contacts. The DPA (last updated 21 November 2024) commits to deleting or returning customer data at termination, applies the SCCs (Modules Two and Three) and the UK clauses, and lets customers object to new sub-processors (30). A deprecations page, linked from llms.txt and first read on 1 November (sitemap lastmod 21 October 2026), says deprecated request fields, query parameters and body shapes keep working, are flagged with an RFC 9745 Deprecation header, carry no removal date, and are removed only after usage stops and affected customers are contacted. It lists two current deprecations. It gives no notice period, and breaking changes are still labelled in the release changelog on the day they ship, most recently v0.77.0 on 22 October (12 of 20, up from 5). Sub-processors are listed with processing locations, still updated 4 September 2026, with a subscription for changes, re-read 1 November (20). 15+30+12+20 = 77.

Linq 72

Closed service with clear terms from Linq App Inc. (14 April 2026); SDKs, MCP server and CLI are Apache-2.0 (15 of 30). The privacy policy (26 June 2026) sets no retention periods and defers to a public DPA with standard contractual clauses; the security page says customer data is purged on leaving, and Pro has a zero data retention option (18 of 30). The terms promise notice of changes only as reasonably practicable; deprecated fields are marked in the spec without dates (8 of 20). Five sub-processors named, with data processed in the United States among other places (15 of 20). 15 + 18 + 8 + 15 = 56.

Bird API + MCP 70

Statuspage at status.bird.com with a readable history feed (20). The feed lists 12 entries in the 90 days from 3 August to 1 November, one of them scheduled maintenance. One is major. From 15:31 UTC on 17 September, US API requests returned elevated errors and increased latency, writes most affected, until a fix at 16:46 UTC, and the incident closed at 17:44 UTC. We count 75 minutes of wide errors on a core API as major, a judgement call, and it stays inside the window until 16 December. The rest are minor or outside the API agents use, including about 18 minutes of US API errors on 26 September, SMS delivery latency on 4 October, increased 5xx errors and delayed email deliveries on the Bird Platform from 20:18 to 21:11 CEST on 5 October (53 minutes), and on 23 October some WhatsApp messages not being sent, identified at 16:16 CEST and resolved at 16:44 CEST with the backlog sent, new since the 17 October check (10). Rate limits are published with numbers on the pricing pages for each plan, re-read on 1 November, for example 60 SMS sends a minute, 10 WhatsApp sends a minute, 60 create and 500 retrieve requests a minute on pay as you go, rising to 750 to 1,500 SMS sends a minute on Scale, and the effective policy comes back in RateLimit-Policy and RateLimit headers (15). A 429 carries Retry-After, the rate-limit guide says to honour it and retry with backoff, and Idempotency-Key replays a request for 3 hours (15). No SLA found (0). SMS and WhatsApp are generally available. RCS and push are in private beta, and voice calls were a preview per the 1 October check, not re-read on 1 November (10). 20+10+15+15+0+10 = 70.

Linq 83

Read with the hosted lines. status.linqapp.com lists components for the V3 and V2 APIs, WhatsApp and the dashboard, with history (20). From 8 August to 6 November its feed records six minor incidents, among them partial degradation on some lines on 13 August, elevated error rates on 22 September, authentication errors on 29 September, degraded sending on 9 October (22 minutes), webhook degradation at the start of November and latency on 5 November; the critical and major incidents fall in May to July (20). Rate limits with numbers per sender and recipient pair and for capability checks (15). 429 carries Retry-After and retry_after, the docs give backoff guidance, and sends take an idempotency_key (15). llms.txt states 99.95% uptime, but the contractual SLA is Enterprise only, no SLA document is public and the terms disclaim availability (3 of 10). Partner API v3 is generally available (10). 20 + 20 + 15 + 15 + 3 + 10 = 83.

Bird API + MCP 95

The full hosted MCP catalogue is curated to task-level tools, and the /dynamic endpoint cuts it to search and execute. We couldn't count the full catalogue (20 of 25). Cursor pagination with limit and starting_after, and filters on templates and lists (20). Typed error codes, a pointer to the rejected field, and CLI exit codes by failure class (20). Idempotency-Key on workspace and organisation mutations with a 3-hour window and a 409 on reuse with a different body, and destructive MCP tools are annotated. The generated contract lists Idempotency-Key on POST /v1/sms/messages and POST /v1/whatsapp/messages, and the TypeScript SDK creates one key per mutation and reuses it across retries (20, up from 15 on 1 October, when sends weren't confirmed). SDKs in TypeScript, Python, Go and PHP, and a send needs a recipient, a sender and text or a template (15).

Linq 90

The MCP server has two tools, code execution against the SDK and docs search, so its definitions cost little context (25). Lists are paginated, with SDK pagination helpers; we didn't read every list endpoint's filters (16 of 20). Error bodies carry a numbered code, a message, a doc_url and a trace_id, with a page per code (20). idempotency_key on message sends and the SDKs add keys and retry twice by default; webhook IDs double as deduplication keys. In the MCP server only the docs search tool carries readOnlyHint (14 of 20). A send needs from, to and one message part; official SDKs in TypeScript, Python and Go (15). 25 + 16 + 20 + 14 + 15 = 90.

Bird API + MCP 35

No x402, MPP or L402 in the pricing pages or the MCP docs re-read on 1 November (0). Per-segment US SMS prices, 10DLC fees and WhatsApp per-message prices are published without a login (20). Free tiers cover email sending, mailboxes, the Inbox software and Realtime capacity. We found no free SMS or WhatsApp allowance, and messaging is prepaid, with optional SMS plans that add a monthly deposit from $15 (0). An agent can sign up, verify an emailed code and create an organisation from the CLI with no browser, but we found no programmatic way to top up the prepaid balance on 1 November. A sender claim on a short wallet returns 402, and the skill says to top up and call again (15 of 20).

Linq 40

No x402, MPP or L402 (0). Public plan prices only, Hobby $0 and Pro from $260 a month, with no per-message fee (10 of 20). Hobby is free with no card, and the Pro trial needs no card (20). linq signup creates an account, an API key and a number from a terminal, but a person has to read back the emailed code, so half (10 of 20). 0 + 10 + 20 + 10 = 40.