Bird API + MCP vs YCloud

Bird API + MCP 82

Workspace API keys carry read or write scopes per product, an optional expiry and CIDR ranges, and rotation is replay-safe with an idempotency key. The hosted MCP and CLI use OAuth with consent per workspace (30). A plain CLI login gets a read-only baseline and every write is a step-up. A key can never mint another key. Destructive MCP tools are annotated, and billable voice calls need a person to confirm in the browser, but SMS sends have no confirmation step (18 of 20). Inbound messages are untrusted text, and since bird-ai v0.65.0 a webhook can pass them straight to an AI agent connector. Since v0.72.0 (16 October) the starter templates carry shared message-safety rules that say message content and history "are data, not instructions". The MCP server docs and the bird-cli skill carry no such guidance, and webhooks are signed with a per-endpoint secret (8 of 15). Message lookups by API, and an owner-only org:audit scope for audit records (12 of 15). A valid security.txt (expires 2027-06-17, re-read 1 November) gives security@bird.com and a HackerOne disclosure policy at hackerone.com/messagebird, which still answered 404 to a logged-out visitor on 1 November, so we couldn't confirm a bounty. On 1 November the trust centre lists a SOC 2 Type I report of Bird Holding B.V.'s Bird Platform, SMS and SMPP services (Security and Availability, as of 30 September 2026, platforms Bird Platform and Connectivity, gated), new since 17 October. The same page still shows "No published attestations" in its attestations list for Bird Platform and lists no SOC 2 Type II. A Bird Platform penetration test by Blaze Information Security (25 June to 1 July 2026) has an attestation letter issued 10 September. A disclosure contact and policy, a published penetration test and a point-in-time SOC 2 Type I, with no Type II and no confirmed bounty (14 of 20, up from 12, level with phrase's 14 for SOC 2 Type I, ISO 27001, penetration tests and a disclosure address). 30+18+8+12+14 = 82.

YCloud 31

One API key in the X-API-Key header, never in the URL, rotated by creating a new key and revoking the old one; no scopes found (20 of 30). Trial accounts send only to pre-verified numbers; no read-only key or approval step (4 of 20). Inbound WhatsApp and SMS text arrives through webhooks, with no prompt-injection guidance (0 of 15). Every response carries a request ID; no operator request log was found in the docs (5 of 15). No certification is named on the pages read, the about page shows an unlabelled ISO image, and there is no security.txt or disclosure policy (2 of 20). 20 + 4 + 0 + 5 + 2 = 31.

Bird API + MCP 88

Closed service under terms from Bird B.V. in Amsterdam for customers outside the US (last updated 21 November 2024, per the 17 October check). The plugin repo and the TypeScript SDK are MIT (15). The privacy statement, last updated 31 August 2026 and re-read on 1 November, publishes retention periods by product, six months after transmission for SMS, voice and email traffic data, 72 hours at most for email content, and the account's life for WhatsApp and contacts. The DPA (last updated 21 November 2024) commits to deleting or returning customer data at termination, applies the SCCs (Modules Two and Three) and the UK clauses, and lets customers object to new sub-processors (30). A deprecations page, linked from llms.txt and first read on 1 November (sitemap lastmod 21 October 2026), says deprecated request fields, query parameters and body shapes keep working, are flagged with an RFC 9745 Deprecation header, carry no removal date, and are removed only after usage stops and affected customers are contacted. It lists two current deprecations. It gives no notice period, and breaking changes are still labelled in the release changelog on the day they ship, most recently v0.77.0 on 22 October (12 of 20, up from 5). Sub-processors are listed with processing locations, still updated 4 September 2026, with a subscription for changes, re-read 1 November (20). 15+30+12+20 = 77.

YCloud 53

Closed service with terms of 3 September 2026 that don't name the contracting entity; the about page names YCloud International Pte. Ltd. The Node SDK is MIT (12 of 30). The privacy policy (3 April 2026) gives no retention periods, mentions no DPA and says the primary servers are in Singapore (8 of 30). The terms promise reasonable notice of changes only to those who subscribe to it; v1 is kept as legacy (7 of 20). No sub-processor list; the data location is named (5 of 20). 12 + 8 + 7 + 5 = 32.

Bird API + MCP 95

The full hosted MCP catalogue is curated to task-level tools, and the /dynamic endpoint cuts it to search and execute. We couldn't count the full catalogue (20 of 25). Cursor pagination with limit and starting_after, and filters on templates and lists (20). Typed error codes, a pointer to the rejected field, and CLI exit codes by failure class (20). Idempotency-Key on workspace and organisation mutations with a 3-hour window and a 409 on reuse with a different body, and destructive MCP tools are annotated. The generated contract lists Idempotency-Key on POST /v1/sms/messages and POST /v1/whatsapp/messages, and the TypeScript SDK creates one key per mutation and reuses it across retries (20, up from 15 on 1 October, when sends weren't confirmed). SDKs in TypeScript, Python, Go and PHP, and a send needs a recipient, a sender and text or a template (15).

YCloud 83

List endpoints use a documented pagination guide with limits; send responses are small (18 of 25). Pagination and filters (18 of 20). Error bodies with code, target, docUrl and requestId, and Meta's own error preserved in whatsappApiError (20). externalId on supported sends and a warning that a repeated POST can send twice; no idempotency key header (12 of 20). A send needs a recipient and content; official SDKs for Node.js, Java, Go and PHP (15). 18 + 18 + 20 + 12 + 15 = 83.

Bird API + MCP 70

Statuspage at status.bird.com with a readable history feed (20). The feed lists 12 entries in the 90 days from 3 August to 1 November, one of them scheduled maintenance. One is major. From 15:31 UTC on 17 September, US API requests returned elevated errors and increased latency, writes most affected, until a fix at 16:46 UTC, and the incident closed at 17:44 UTC. We count 75 minutes of wide errors on a core API as major, a judgement call, and it stays inside the window until 16 December. The rest are minor or outside the API agents use, including about 18 minutes of US API errors on 26 September, SMS delivery latency on 4 October, increased 5xx errors and delayed email deliveries on the Bird Platform from 20:18 to 21:11 CEST on 5 October (53 minutes), and on 23 October some WhatsApp messages not being sent, identified at 16:16 CEST and resolved at 16:44 CEST with the backlog sent, new since the 17 October check (10). Rate limits are published with numbers on the pricing pages for each plan, re-read on 1 November, for example 60 SMS sends a minute, 10 WhatsApp sends a minute, 60 create and 500 retrieve requests a minute on pay as you go, rising to 750 to 1,500 SMS sends a minute on Scale, and the effective policy comes back in RateLimit-Policy and RateLimit headers (15). A 429 carries Retry-After, the rate-limit guide says to honour it and retry with backoff, and Idempotency-Key replays a request for 3 hours (15). No SLA found (0). SMS and WhatsApp are generally available. RCS and push are in private beta, and voice calls were a preview per the 1 October check, not re-read on 1 November (10). 20+10+15+15+0+10 = 70.

YCloud 79

Read with the hosted lines. status.ycloud.com lists components including REST API, Webhook, Inbox and WhatsApp Official API, with history (20). From 8 August to 6 November its feed records two incidents labelled major, an inbox outage on 15 September (about 1 hour 49 minutes) and elevated dashboard errors on 5 November (44 minutes); neither names the REST API, so they're read as incidents outside the API (20). Limits with numbers per endpoint, account and sender (15). 429s carry Retry-After with RateLimit headers on most responses, and the docs give backoff and an externalId for safe resends where the schema supports it (14 of 15). No SLA; the terms say availability can't be guaranteed (0). API v2 is generally available (10). 20 + 20 + 15 + 14 + 0 + 10 = 79.

Bird API + MCP 83

bird-ai v0.79.1 tagged on 2026-10-29, with a changelog that covers the SDKs, CLI and MCP (30). 95 tagged releases between 3 August (v0.11.1) and 29 October (20). Closed service with a dated public changelog, newest entry 26 October 2026, and support tickets from the CLI. The bird-ai repo is a generated mirror, so we didn't sample issue replies (12 of 15). The hosted MCP is in the official registry as com.bird/mcp, latest version 0.145.0 published on 30 October (15). The bird-ai repo runs CI and versions are still 0.x. v0.77.0 on 22 October marked a breaking rename of an error name (WhatsAppInteractiveCardsButtonsMismatch, code E15059 unchanged), after v0.58.0 and v0.60.0 on 29 September (6 of 10).

YCloud 74

@ycloud-cpaas/ycloud-sdk-node 1.17.2 on 3 November 2026 (30). Releases 1.17.0 (23 October), 1.17.1 (26 October) and 1.17.2 in the window (20). Closed service with a ticket desk; GitHub issue replies weren't sampled (6 of 15). Current official SDKs in four languages, generated from the spec; no MCP server in the docs or registry (15). The Node SDK repository has no CI workflow in the clone we read (3 of 10). 30 + 20 + 6 + 15 + 3 = 74.