ClickSend SMS API + MCP vs Kudosity

ClickSend SMS API + MCP 37

No public OpenAPI spec found. The MCP package bundles an OpenAPI 3.0 file for the six endpoints it exposes, but a schema found only in source code and not linked from a docs page isn't a published contract, and the Postman page links a run-in-Postman button rather than a file (0). llms.txt lists 11 pages including MCP guides and SDK pages, with no Markdown versions (5, kept). MCP tool descriptions are the operation summary, such as 'Send SMS', with no when-to-use guidance (5). Typed inputs generated from the spec (10). Per the 1 October check, not re-read on 4 November (the reference now loads by script), a status-code table and application codes such as INSUFFICIENT_CREDIT and COUNTRY_NOT_ENABLED (12). /v3 path, SDK migration guides and no public API changelog (5). 0+5+5+10+12+5 = 37.

Kudosity 86

OpenAPI 3.0.3 files for V2 (16 paths, 23 operations) and V1 are public on developers.kudosity.com, and the MCP tools have typed zod inputs (25). llms.txt per section and a Markdown twin of every page (10). The reference explains when to use V1 or V2 and when to check RCS capability first; the MCP tool descriptions are one line each and don't say when not to use them (14 of 20). Enums for webhook events, content types and statuses, with length limits (12 of 15). Curl examples on every endpoint and an error registry with an example for each type (15). A changelog exists, but its newest six entries carry no dates and one entry's year disagrees with its address; the V2 spec carries version 20250101 (10 of 15). 25 + 10 + 14 + 12 + 15 + 10 = 86.

ClickSend SMS API + MCP 65

Statuspage at status.clicksend.com with component history, read through its history.atom feed on 4 November (20). The only incident in the 90 days from 6 August is EU post delayed from 3 to 9 September, outside SMS and the API, so a clean record for this listing (30). No rate limit numbers published (0). Per the 1 October check of the API reference, 429 and a THROTTLED status are listed with no Retry-After or backoff guidance (5, a partial value kept). The reference now renders only by script and wasn't re-read on 4 November. No SLA found (0). REST API v3 is generally available (10). 20+30+0+5+0+10 = 65.

Kudosity 85

Read with the hosted lines. status.transmitsms.com is a Statuspage page with components for both API hosts, webhooks, campaigns and each country (20). Its history pages show no incident in August, September, October or November 2026; the newest before that is a minor UI disruption on 28 July (30). 15 calls a second per account, documented (15). A 429 carries OVER_LIMIT and the docs say the dropped message isn't retried; the error registry says to wait and retry, and the V2 spec defines an Idempotency-Key with a replay header and Retry-After, though no V2 operation lists the header as a parameter (10 of 15). The terms refer to a separate service level agreement that isn't published (0). SMS, MMS and WhatsApp on V2 are generally available; RCS is marked beta (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

ClickSend SMS API + MCP 20

No x402, MPP or L402 (0). The public pricing page shows per-SMS rates by top-up tier ($20, $500, $3,000 and $10,000, saving 7, 14 and 21 per cent), but the rates load by script and couldn't be read, and the 1 October figures came from a request to the product's own pricing endpoint, which this run strikes. So the readable pricing is tier-only (10). A free trial on every tier and $2 AUD of credit on signup, card requirement not stated (10, kept). A person signs up in a browser (0). 0+10+10+0 = 20.

Kudosity 32

No x402, MPP or L402 (0). SMS is priced per part without login, 8.0 cents AUD ex GST pay as you go; MMS, RCS and WhatsApp are on request (12 of 20). A 14-day developer trial whose form asks for no card (20). A person signs up in a browser and verifies by email (0). 0 + 12 + 20 + 0 = 32.

ClickSend SMS API + MCP 30

HTTP Basic auth with the account username and one API key, and subaccounts get their own keys. The MCP server still writes the full request options, the Basic Authorization header included, to stderr on every call (repository unchanged since 11 August 2026), and MCP hosts keep stderr in log files (10 of 30). No read-only mode or confirmation before sends. Subaccounts give some separation (5 of 20). Inbound replies and SMS history are untrusted text returned straight to the model, with no injection guidance (0 of 15). SMS history and statistics by API (8 of 15). The security page now loads and names only AWS's certifications. ClickSend's footer links Sinch's trust centre for ClickSend, which gives security@sinch.com to report a vulnerability and posts dated vulnerability notes. Its ISO 27001 and SOC 2 badges "may apply to specific products" and aren't stated for ClickSend, and no security.txt (404) or bug bounty was found, so a reporting route with no acknowledgement time (7). 10+5+0+8+7 = 30.

Kudosity 37

One account-wide API key on V2 and Basic auth with the key and a secret the user types in on V1, both in headers. No scopes, read-only keys or rotation steps were found (12 of 30). No least-privilege mode. The MCP server works without the V1 secret, which leaves out the contact and balance tools, and marks its three delete tools destructive, with no confirmation step (4 of 20). Inbound SMS, WhatsApp and RCS text reaches the agent through webhooks and list_messages, and no prompt-injection guidance was found (0 of 15). Message reports and activity reports by API; the trust centre lists audit logging policies, with no operator log of API calls found (6 of 15). ISO/IEC 27001:2022 and SOC 2 Type 2 stated on kudosity.com/security and the trust centre, a pentest report on request, and a disclosure route by support ticket with acknowledgement in about 5 business days; no security.txt or bug bounty (15 of 20). 12 + 4 + 0 + 6 + 15 = 37.

ClickSend SMS API + MCP 62

clicksend-client 6.0.2 tagged on 25 September 2026 (20, within 90 days, cause time). In the 90 days from 6 August, the Node SDK clicksend v6.0.0 (2 September), v6.0.1 (8 September) and v7.0.0 (11 September) from ClickSend/clicksend-nodejs-v2, Python 6.0.2, and the MCP package 2026.8.23 (20). The 1 October check counted two, missing the v2 SDK repositories. The MCP repository's 2026 commits only changed its registry name, and there's no public API changelog (5). Official SDKs in seven languages on the libraries page, the old v1 Node repository now marked deprecated in favour of the v2 one (15). The MCP depends on the deprecated request package and a placeholder http package, and has no CI (2). 20+20+5+15+2 = 62.

Kudosity 57

kudosity-mcp 0.5.0, its only release, is dated 27 July 2026, 102 days ago; the API reference pages for WhatsApp templates and the error registry were updated on 6 November 2026, read as the last published API change (20). The changelog's six newest entries carry no dates. Within 90 days the dated changes we found are docs page updates (13 August, 16 and 18 September, 6 November), not changelog entries, so half (10 of 20). Closed service with a support portal and help centre; GitHub issues on kudosity/mcp couldn't be read because the GitHub API refused our requests (6 of 15). com.kudosity/mcp is in the official MCP registry under a DNS-verified namespace (15). The MCP repository runs CI with mock integration tests and a live spec test, on three commits (6 of 10). 20 + 10 + 6 + 15 + 6 = 57.