CueLight vs Vaani Developer Platform

CueLight 60

No payment protocol (0). Read with the self-hosted rule. Apache-2.0 code and weights with no hosted or paid option (20). No card or account (20). Weights download anonymously, with no signup (20).

Vaani Developer Platform 22

No x402, MPP or L402 (0 of 40). The ₹1 ($0.02) a minute platform fee, number rental, concurrency lines and add-ons are public, and the calculator shows each provider's unit rate without a login. Registry checks, extraction and evaluations "can add separate charges" that aren't priced, and the billing pulse depends on the account, so 3 off (17 of 20). The home page says "Start free on Vaani's Platform", but the pricing page states a prepaid wallet with no free credit, trial minutes or card rule, and we didn't sign up to check, so 5 of 20. A person signs up with email verification at platform.vaani.dev and creates keys in the dashboard (0). 0+17+5+0 = 22.

CueLight 59

Apache-2.0 for code and weights, with a NOTICE that lists each training dataset, teacher model and licence, and the conditions passed on from the data (30). Nothing is hosted. The README says the browser demo keeps audio on the device, which the demo code agrees with, and that weights download from Hugging Face on first use. There is no privacy statement as such (22 of 30). No deprecation policy or dated notices (0 of 20). No telemetry found in the package or demo source. The README does not mention telemetry, and huggingface_hub's own defaults are not discussed (15 of 20).

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

CueLight 46

Published on 14 October 2026, one day before the check (30). One publication and no tagged releases, given a quarter of the line as for a single release elsewhere (5 of 20). No issues or pull requests yet, so responsiveness cannot be seen (5 of 25). Not on PyPI. The weights are on Hugging Face and the package installs only from Git (3 of 15). Dependencies are current minimums (torch 2.1 or later), with no lockfile, Dependabot or CI (3 of 10). The project is one day old, so these lines reflect the checklist, not a judgement of the maintainer.

Vaani Developer Platform 59

vaani-research-mcp 0.1.1 on 2026-10-14 (30). In the last 90 days, vaani-sdk 0.3.1 on 28 September and three npm versions (0.0.0-stage, 0.1.0, 0.1.1) within 40 minutes on 14 October. No dated changelog, so half (10 of 20). A closed service with no public changelog, issue tracker or community channel found. Contact is hello@vaaniresearch.com and a booking link, and we didn't test whether they answer. The MCP repository on GitHub couldn't be read from this session (4 of 15, the closed-service reading). A current official Python SDK, released seven times since April 2026. The MCP server isn't in the official MCP registry (10 of 15). The SDK's sdist ships its tests and current httpx and pydantic dependencies, and the MCP package runs its tests before publishing, but no public CI was found and the SDK has no repository (5 of 10). 30+10+4+10+5 = 59.

CueLight 50

Library reading. No OpenAPI applies. The public classes are small, with type hints on most signatures and frozen dataclasses for both policies, though push takes an untyped chunk (15 of 25). No llms.txt on the Pages site, and docs are the README (0). The README says which model suits which device, when to choose each preset, and states the limits (English only, audio only, Base's CPU cost) (16 of 20). The 320-sample frame is enforced by an assert, while an unknown preset name falls back silently to default thresholds rather than raising (8 of 15). Quick-start snippets and two example scripts. Error behaviour is not documented (8 of 15). A version number in pyproject.toml and __version__, with no changelog (3 of 15).

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.

CueLight 50

Local-software reading. No credential and no open port. The code runs in the caller's process, weights load from safetensors rather than pickle, but snapshot_download fetches the main branch of each Hugging Face repository with no pinned revision (20 of 30). It only classifies audio and takes no actions (16 of 20). It returns probabilities, not content from third parties (10). No logging. Per-frame probabilities and a reset counter are visible to the caller (4 of 15). No SECURITY.md, disclosure policy, security.txt or advisories (0 of 20).

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.