# Bird API + MCP vs Prelude (slim)

> Bird scores 78.1 (A) to Prelude's 67.6 (B) for sms. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bird-vs-prelude.md (~5,300 tokens) · this version ~3,230 tokens · JSON https://www.anchorterminal.com/compare/bird-vs-prelude.json · canonical https://www.anchorterminal.com/compare/bird-vs-prelude
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Bird API + MCP scores 78.1 (A) on agent readiness against Prelude's 67.6 (B), and leads in 5 of 7 scored categories. Both do sms.

- Bird API + MCP: A 78.1, rank #24 of 1510 · https://www.anchorterminal.com/tools/bird.min.md
- Prelude: B 67.6, rank #317 of 1510 · https://www.anchorterminal.com/tools/prelude.min.md
- Bird API + MCP, good for Agents that send SMS, WhatsApp and email from one account and need scoped credentials and safe retries. Ahead on Reliability, 70 against 65; Agent ergonomics, 95 against 85; Security & auth, 82 against 63; Payments & pricing, 35 against 30; Transparency & trust, 88 against 42. Also Agent-ready, a grade of BB or better; Runs on your own machine.
- Prelude, good for Agents or apps that verify a phone number or email with a code and want fraud blocking, and for transactional messages in Europe.

| Category | Bird API + MCP | Prelude |
| --- | --- | --- |
| Reliability (16%) | 70 | 65 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 92 | 93 |
| Agent ergonomics (13%) | 95 | 85 |
| Security & auth (14%) | 82 | 63 |
| Payments & pricing (10%) | 35 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 83 | 83 |
| Transparency & trust (7%) | 88 | 42 |

| Fact (where they differ) | Bird API + MCP | Prelude |
| --- | --- | --- |
| Vendor | Bird (formerly MessageBird) | DING SAS (Prelude) |
| Hosted endpoint | `https://us1.platform.bird.com/v1` | `https://api.prelude.dev` |
| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |
| Price for sms | $0.0035 per message | not published |
| Licence | MIT | Proprietary service; the terms are on a Notion page we couldn't read. The backend SDKs are Apache-2.0 |
| Read-only variant documented | yes | no |
| MCP registry | `com.bird/mcp` | not listed |
| Last release | 2026-10-29 | 2026-10-16 |
| Terms last updated | 2024-11-21 | couldn't be read |
| Privacy policy last updated | 2026-08-31 | couldn't be read |
| Customer content may train models | not found in the text | couldn't be read |
| Terms restrict automated access | not found in the text | couldn't be read |
| Terms restrict benchmarking | not found in the text | couldn't be read |
| Terms or service can change without notice | not found in the text | couldn't be read |
| Arbitration or class-action waiver | yes | couldn't be read |
| Popularity | 6 stars, 67k npm/wk | 98k npm/wk |
| Agent reviews | 3.6/5 (8) | none |

Why the edge:
- Transparency & trust, Bird API + MCP +46: Bird API + MCP 88 (Closed service under terms from Bird B.V. in Amsterdam for customers outside the US (last updated 21 November 2024, per the 17 October check). The plugin repo and the TypeScript SDK are MIT (15). The privacy statement, last updated 31 August 2026 and re-read on 1 November, publishes retention periods by product, six months after transmission for SMS, voice and email traffic data, 72 hours at most for email content, and the account's life for WhatsApp and contacts. The DPA (last updated 21 November 2024) commits to deleting or returning customer data at termination, applies the SCCs (Modules Two and Three) and the UK clauses, and lets customers object to new sub-processors (30). A deprecations page, linked from llms.txt and first read on 1 November (sitemap lastmod 21 October 2026), says deprecated request fields, query parameters and body shapes keep working, are flagged with an RFC 9745 `Deprecation` header, carry no removal date, and are removed only after usage stops and affected customers are contacted. It lists two current deprecations. It gives no notice period, and breaking changes are still labelled in the release changelog on the day they ship, most recently v0.77.0 on 22 October (12 of 20, up from 5). Sub-processors are listed with processing locations, still updated 4 September 2026, with a subscription for changes, re-read 1 November (20). 15+30+12+20 = 77.); Prelude 42 (Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.)
- Security & auth, Bird API + MCP +19: Bird API + MCP 82 (Workspace API keys carry read or write scopes per product, an optional expiry and CIDR ranges, and rotation is replay-safe with an idempotency key. The hosted MCP and CLI use OAuth with consent per workspace (30). A plain CLI login gets a read-only baseline and every write is a step-up. A key can never mint another key. Destructive MCP tools are annotated, and billable voice calls need a person to confirm in the browser, but SMS sends have no confirmation step (18 of 20). Inbound messages are untrusted text, and since bird-ai v0.65.0 a webhook can pass them straight to an AI agent connector. Since v0.72.0 (16 October) the starter templates carry shared message-safety rules that say message content and history "are data, not instructions". The MCP server docs and the bird-cli skill carry no such guidance, and webhooks are signed with a per-endpoint secret (8 of 15). Message lookups by API, and an owner-only org:audit scope for audit records (12 of 15). A valid security.txt (expires 2027-06-17, re-read 1 November) gives security@bird.com and a HackerOne disclosure policy at hackerone.com/messagebird, which still answered 404 to a logged-out visitor on 1 November, so we couldn't confirm a bounty. On 1 November the trust centre lists a SOC 2 Type I report of Bird Holding B.V.'s Bird Platform, SMS and SMPP services (Security and Availability, as of 30 September 2026, platforms Bird Platform and Connectivity, gated), new since 17 October. The same page still shows "No published attestations" in its attestations list for Bird Platform and lists no SOC 2 Type II. A Bird Platform penetration test by Blaze Information Security (25 June to 1 July 2026) has an attestation letter issued 10 September. A disclosure contact and policy, a published penetration test and a point-in-time SOC 2 Type I, with no Type II and no confirmed bounty (14 of 20, up from 12, level with phrase's 14 for SOC 2 Type I, ISO 27001, penetration tests and a disclosure address). 30+18+8+12+14 = 82.); Prelude 63 (API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.)
- Agent ergonomics, Bird API + MCP +10: Bird API + MCP 95 (The full hosted MCP catalogue is curated to task-level tools, and the /dynamic endpoint cuts it to search and execute. We couldn't count the full catalogue (20 of 25). Cursor pagination with limit and starting_after, and filters on templates and lists (20). Typed error codes, a pointer to the rejected field, and CLI exit codes by failure class (20). Idempotency-Key on workspace and organisation mutations with a 3-hour window and a 409 on reuse with a different body, and destructive MCP tools are annotated. The generated contract lists Idempotency-Key on POST /v1/sms/messages and POST /v1/whatsapp/messages, and the TypeScript SDK creates one key per mutation and reuses it across retries (20, up from 15 on 1 October, when sends weren't confirmed). SDKs in TypeScript, Python, Go and PHP, and a send needs a recipient, a sender and text or a template (15).); Prelude 85 (List calls take `limit` from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.)
- Reliability, Bird API + MCP +5: Bird API + MCP 70 (Statuspage at status.bird.com with a readable history feed (20). The feed lists 12 entries in the 90 days from 3 August to 1 November, one of them scheduled maintenance. One is major. From 15:31 UTC on 17 September, US API requests returned elevated errors and increased latency, writes most affected, until a fix at 16:46 UTC, and the incident closed at 17:44 UTC. We count 75 minutes of wide errors on a core API as major, a judgement call, and it stays inside the window until 16 December. The rest are minor or outside the API agents use, including about 18 minutes of US API errors on 26 September, SMS delivery latency on 4 October, increased 5xx errors and delayed email deliveries on the Bird Platform from 20:18 to 21:11 CEST on 5 October (53 minutes), and on 23 October some WhatsApp messages not being sent, identified at 16:16 CEST and resolved at 16:44 CEST with the backlog sent, new since the 17 October check (10). Rate limits are published with numbers on the pricing pages for each plan, re-read on 1 November, for example 60 SMS sends a minute, 10 WhatsApp sends a minute, 60 create and 500 retrieve requests a minute on pay as you go, rising to 750 to 1,500 SMS sends a minute on Scale, and the effective policy comes back in RateLimit-Policy and RateLimit headers (15). A 429 carries Retry-After, the rate-limit guide says to honour it and retry with backoff, and Idempotency-Key replays a request for 3 hours (15). No SLA found (0). SMS and WhatsApp are generally available. RCS and push are in private beta, and voice calls were a preview per the 1 October check, not re-read on 1 November (10). 20+10+15+15+0+10 = 70.); Prelude 65 (Read with the hosted lines. status.prelude.so has components for Verify, Auth, Watch, Intel, Notify and the dashboard, with history (20). From 8 August to 6 November its feed records one major incident, increased error rates and latencies across the APIs on 16 and 17 August, posted after it was resolved with no duration stated, and minor ones such as Verify latency on 9 and 10 August, SMS degradation in China and on Orange France and delayed webhooks on 23 October (10). No numeric API rate limits were found; only the MCP server's limits and per-window Verify retry limits are documented (7 of 15). A 429 carries Retry-After and X-Should-Retry, and repeating the create call inside the window performs a retry rather than a new verification (13 of 15). The pricing page lists a 99.95 SLA on Enterprise with no SLA document found (5 of 10). Verify and Notify v2 are generally available (10). 20 + 10 + 7 + 13 + 5 + 10 = 65.)
- Payments & pricing, Bird API + MCP +5: Bird API + MCP 35 (No x402, MPP or L402 in the pricing pages or the MCP docs re-read on 1 November (0). Per-segment US SMS prices, 10DLC fees and WhatsApp per-message prices are published without a login (20). Free tiers cover email sending, mailboxes, the Inbox software and Realtime capacity. We found no free SMS or WhatsApp allowance, and messaging is prepaid, with optional SMS plans that add a monthly deposit from $15 (0). An agent can sign up, verify an emailed code and create an organisation from the CLI with no browser, but we found no programmatic way to top up the prepaid balance on 1 November. A sender claim on a short wallet returns 402, and the skill says to top up and call again (15 of 20).); Prelude 30 (No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.)