ClickSend SMS API + MCP vs Prelude

ClickSend SMS API + MCP 37

No public OpenAPI spec found. The MCP package bundles an OpenAPI 3.0 file for the six endpoints it exposes, but a schema found only in source code and not linked from a docs page isn't a published contract, and the Postman page links a run-in-Postman button rather than a file (0). llms.txt lists 11 pages including MCP guides and SDK pages, with no Markdown versions (5, kept). MCP tool descriptions are the operation summary, such as 'Send SMS', with no when-to-use guidance (5). Typed inputs generated from the spec (10). Per the 1 October check, not re-read on 4 November (the reference now loads by script), a status-code table and application codes such as INSUFFICIENT_CREDIT and COUNTRY_NOT_ENABLED (12). /v3 path, SDK migration guides and no public API changelog (5). 0+5+5+10+12+5 = 37.

Prelude 93

OpenAPI for the 27 SDK endpoints is public at the URL in the SDK repository's .stats.yml, and every reference page embeds its endpoint's OpenAPI (25). llms.txt and Markdown pages (10). Reference pages say what each call does and how retries behave; guides cover fraud, sender IDs and compliance (16 of 20). Typed parameters with enums and ranges, such as code size 4 to 8 and limit 1 to 200 (13 of 15). Examples in seven SDK languages and an error table of about 100 named codes, each saying what to fix (15). Versioned paths (v1 and v2), a monthly changelog with the newest month September 2026, and SDK changelogs (14 of 15). 25 + 10 + 16 + 13 + 15 + 14 = 93.

ClickSend SMS API + MCP 30

HTTP Basic auth with the account username and one API key, and subaccounts get their own keys. The MCP server still writes the full request options, the Basic Authorization header included, to stderr on every call (repository unchanged since 11 August 2026), and MCP hosts keep stderr in log files (10 of 30). No read-only mode or confirmation before sends. Subaccounts give some separation (5 of 20). Inbound replies and SMS history are untrusted text returned straight to the model, with no injection guidance (0 of 15). SMS history and statistics by API (8 of 15). The security page now loads and names only AWS's certifications. ClickSend's footer links Sinch's trust centre for ClickSend, which gives security@sinch.com to report a vulnerability and posts dated vulnerability notes. Its ISO 27001 and SOC 2 badges "may apply to specific products" and aren't stated for ClickSend, and no security.txt (404) or bug bounty was found, so a reporting route with no acknowledgement time (7). 10+5+0+8+7 = 30.

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

ClickSend SMS API + MCP 64

Closed service with terms from ClickSend Pty Ltd. The MCP server is MIT (15). The privacy policy still says it was last updated in September 2023 and names no retention periods. The sub-processor page now loads and says message data held by AWS is deleted after 120 days. The DPA terms are a linked PDF we can't read (15 of 30). No deprecation policy found; the v1 SDKs are marked deprecated with no date, and the legacy HTTP v2 and SMPP APIs are still documented (0). The sub-processor list names each provider with the data, purpose and hosting location (AWS in Australia, Datadog in North America, Sinch entities by country) and promises an update at least 10 days before a new one, as Sinch's list is read (20). 15+15+0+20 = 50.

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.

ClickSend SMS API + MCP 62

clicksend-client 6.0.2 tagged on 25 September 2026 (20, within 90 days, cause time). In the 90 days from 6 August, the Node SDK clicksend v6.0.0 (2 September), v6.0.1 (8 September) and v7.0.0 (11 September) from ClickSend/clicksend-nodejs-v2, Python 6.0.2, and the MCP package 2026.8.23 (20). The 1 October check counted two, missing the v2 SDK repositories. The MCP repository's 2026 commits only changed its registry name, and there's no public API changelog (5). Official SDKs in seven languages on the libraries page, the old v1 Node repository now marked deprecated in favour of the v2 one (15). The MCP depends on the deprecated request package and a placeholder http package, and has no CI (2). 20+20+5+15+2 = 62.

Prelude 83

@prelude.so/sdk 0.16.0 published to npm on 16 October 2026, 21 days ago, carrying API updates (30). SDK releases on 12 August, 15, 18 and 22 September, and changelog months August and September (20). Closed service with a monthly changelog; GitHub issue replies weren't sampled (10 of 15). Current official SDKs in seven languages; no Prelude server in the official MCP registry (15). The SDK repository runs CI and publish workflows (8 of 10). 30 + 20 + 10 + 15 + 8 = 83.

ClickSend SMS API + MCP 70

6 MCP tools, with inputs generated from the spec (20 of 25). Pages with page and limit (15 to 100) and a next_page_url, and SMS history filters by date, which the MCP parses from natural language (20). HTTP and application error codes, though the MCP returns them as plain text (15 of 20). No idempotency key on sends and no tool annotations (0 of 20). SDKs in ten languages, and a send needs only a recipient and a body (15).

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

ClickSend SMS API + MCP 20

No x402, MPP or L402 (0). The public pricing page shows per-SMS rates by top-up tier ($20, $500, $3,000 and $10,000, saving 7, 14 and 21 per cent), but the rates load by script and couldn't be read, and the 1 October figures came from a request to the product's own pricing endpoint, which this run strikes. So the readable pricing is tier-only (10). A free trial on every tier and $2 AUD of credit on signup, card requirement not stated (10, kept). A person signs up in a browser (0). 0+10+10+0 = 20.

Prelude 30

No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.