Bland AI API + MCP vs Vaani Developer Platform

Bland AI API + MCP 65

No x402 or L402. The headless signup endpoint answers 402 with a Machine Payments Protocol challenge settled through Stripe, but only to buy the $29.99 Agent Phone Plan, not to pay for calls (10 of 40). Per-minute rates for every self-serve plan are public, re-read on 2 November (20). The Start plan needs no card and comes with 2 credits and an inbound number (20). An agent can open an account through the headless flow, with the owner's only step being to relay a 6-digit texted code, or through a device-code flow that sends the owner to a browser (15 of 20). 10 + 20 + 20 + 15 = 65.

Vaani Developer Platform 22

No x402, MPP or L402 (0 of 40). The ₹1 ($0.02) a minute platform fee, number rental, concurrency lines and add-ons are public, and the calculator shows each provider's unit rate without a login. Registry checks, extraction and evaluations "can add separate charges" that aren't priced, and the billing pulse depends on the account, so 3 off (17 of 20). The home page says "Start free on Vaani's Platform", but the pricing page states a prepaid wallet with no free credit, trial minutes or card rule, and we didn't sign up to check, so 5 of 20. A person signs up with email verification at platform.vaani.dev and creates keys in the dashboard (0). 0+17+5+0 = 22.

Bland AI API + MCP 65

Atlassian Statuspage at status.bland.ai with US, Asia Pacific and Canada components and an incident history back to 20 October 2025, read on 2 November through its history feed (20). Six incidents in the 90 days from 4 August. Five were partial and read as minor, latency of 30 minutes on 27 August and 35 minutes on 14 September, delayed or missing audio on BTTS V3 voices for about two hours on 25 September (some calls, one voice family), variable extraction failing for some customers for about an hour on 5 October, and inbound calls in the US region failing for 8 minutes on 19 October with outbound unaffected. On 14 October, from about 3:00 to 4:10 PM PT, an upstream outage took down the language model every agent uses in conversation, live calls went silent or slow and outbound dispatch was paused, which we count as one major (10). Numeric limits are published, 10 concurrent, 100 an hour and 100 a day on Start, 50, 1,000 and 2,000 on Build, 120 MCP requests a minute and one call per number every 10 seconds (15). The call API documents 429 responses with messages, but we found no Retry-After, backoff or idempotency guidance (5 of 15). The pricing page claims a 99.9 per cent uptime SLA on every plan, while the terms of 28 August 2026 give no uptime commitment and no credits, so we give half (5). The API is generally available (10). 20 + 10 + 15 + 5 + 5 + 10 = 65.

Vaani Developer Platform 28

Graded on the hosted REST API at api.vaanivoice.ai. No status page. status.vaani.dev and status.vaanivoice.ai don't resolve, and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits are published. The docs give 2 concurrent calls on pay as you go and a per-organisation campaign concurrency cap, so partial credit (5). The SDK raises RateLimitError on 429 and the MCP client retries once after 600 ms, but no Retry-After, backoff guidance or idempotency key for call creation is documented (3). The pricing table lists a 99.50 per cent uptime SLA on both plans, but no SLA document or service credits were found and the terms supply the service "as-is" with no warranties, so half (5). The API is version 2.0.0 and isn't labelled beta (10). 0+5+5+3+5+10 = 28.

Bland AI API + MCP 79

Organisation API keys, several per organisation and each revocable on its own, and since the 1 October check restricted keys with per-resource scopes (calls:read, calls:create, agents:write and others) and OAuth client credentials with the same permissions for short-lived tokens (an organisation that doesn't see OAuth clients in its dashboard is told to contact support). Restricted keys are rolling out by organisation and aren't available on pinned deployments, credited as conditional availability elsewhere in this run (30). A key can now be limited to read scopes, sign-in connections to the MCP server take mcp:read or mcp:write scopes, and destructive tools carry an annotation for the client's approval prompt. The server no longer asks for confirmation itself, and personas, numbers and tools stay full-access only (15 of 20). Agents read caller speech and transcripts, which are untrusted, and we found guard rails mentioned in the CLI but no prompt-injection guidance (5 of 15). Audit logs exist but are an enterprise function and don't record API key use, and every call has a log; the key list shows who created each key (12 of 15). security.txt valid until 2027-04-05 (re-read on 2 November), a trust portal, SOC 2 Type II and a PCI DSS assessment by a QSA per the vendor, and a disclosure address. No bug bounty found (17 of 20). 30 + 15 + 5 + 12 + 17 = 79.

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.

Bland AI API + MCP 72

Closed source with clear terms (15). The privacy policy (last updated 23 June 2026) keeps data 'as long as necessary' with no periods for recordings or transcripts, and the trust page says zero-retention processing is available. The terms and the privacy policy both name Intelliga Corporation, doing business as Bland AI (12 of 30). The December 2025 price change was announced with a date and transition credits, and the migration from pathways and personas to agents carries a 15 November 2026 deadline in the docs, but we found no deprecation policy (8 of 20). A subprocessor list of 17 entries with locations, updated 8 September 2026, per the 1 October check, not re-read on 2 November (20). 15 + 12 + 8 + 20 = 55.

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

Bland AI API + MCP 68

No OpenAPI document found. The MCP server's dedicated tools take typed inputs and its API Reference tools take each reference page's parameters, but no machine-readable contract is published (5 of 25). llms.txt with 551 entries, each page served as Markdown (10). MCP tool descriptions say when to use a tool, for example the reference tells agents to use send_call and to choose one of agent_id, persona_id, pathway_id or task (14 of 20). The REST reference types every parameter with enums and defaults, though pathways travel as a raw graph and call_bland_api is a free-form passthrough (11 of 15). Errors for 400, 401, 402, 403, 404, 429 and 500 are documented with example messages (13 of 15). Versioned v1 and v2 APIs, agent versions and environments, and a dated changelog (15). 5 + 10 + 14 + 11 + 13 + 15 = 68.

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.

Bland AI API + MCP 53

The hosted MCP server lists 62 dedicated tools and 282 API Reference tools, one per reference page, plus 3 prompts on key connections. Sign-in connections see a smaller allowlist, but there are no toolsets or dynamic loading (5 of 25). List endpoints such as audit logs and knowledge bases page and filter, but we found no field selection on call logs (14 of 20). Errors carry codes and readable messages, and a restricted key's 403 names the permission it lacks (16 of 20). Every MCP tool carries a read, write or destructive annotation, but there are no idempotency keys on call creation (10 of 20). A call needs only phone_number and a task, agent_id, persona_id or pathway_id, with defaults for voice and temperature. Official tooling is the Node CLI, a web SDK and a TTS Node library, and we found no Python SDK (8 of 15). 5 + 14 + 16 + 10 + 8 = 53.

Vaani Developer Platform 64

The local MCP server loads 9 compact tools, and VAANI_READ_ONLY=true leaves 3. Transcripts are cut at 20,000 characters by default with a note. The REST API has no field selection or summaries, so 3 off (22 of 25). Call history pages by page and page_size up to 200 with no filters. The MCP agent filter runs client-side on one page. Agents filter by search and published_only and campaigns by status (12 of 20). Campaign errors carry a machine-readable code, a message, the path and a request_id (shown as "unknown" in the example). Validation errors list the field location, the SDK maps each status to a typed exception including 402 for a low wallet, and the MCP server adds a hint per status (15 of 20). All 9 MCP tools carry readOnlyHint, destructiveHint and idempotentHint, with trigger_call and campaign_action marked destructive. No idempotency key on trigger-call, and the MCP client retries a POST once after a timeout or 5xx, so a call can be placed twice. The webhook docs say to deduplicate by event id (8 of 20). A call needs agent_id, contact_number and name, with medium defaulting to telephony. One official SDK, Python, sync and async. The npm package is an MCP server, not an SDK (7 of 15). 22+12+15+8+7 = 64.