ElevenLabs Agents API + MCP vs Vaani Developer Platform

ElevenLabs Agents API + MCP 75

Read as a hosted service. Status page at status.elevenlabs.io (incident.io) with an ElevenAgents component group (Conversations, Telephony, Integrations, Other Agents APIs, Quality, RAG, UI) and dated component history (20). Re-read on 1 November from the history page, which dates each component's impact, as the ElevenLabs text-to-speech and voice cloning listings were read; the incidents feed was re-posted on 21 October and leaves older incidents out. In the 90 days from 3 August, ten incidents touched Agents components, all partial or under an hour. The longest, from 08:50 UTC on 13 October, a database behind the Agents platform in the US stalled, and the write-up says roughly 45 per cent of US calls failed and 7 per cent of API requests returned errors until 14:18 UTC, on seven Agents components marked partial outage. That is a share of requests in one region, read as partial, as hubspot-mcp's "many customers in North America" was and as the ElevenLabs text-to-speech and voice cloning listings read this incident, not every user in a region as in google-drive-api's regional major. The others are Inbound Twilio calls on 18 August (under 1 per cent), EU batch calling delays on 27 August, EU conversation history on 10 September, some calls failing to start on 18 and 19 September (1 hour 25 minutes), the EU platform unresponsive from 13:40 to 14:18 UTC on 28 September (38 minutes, one region), a usage datastore fault from 15:56 to 19:36 UTC on 29 September that caused latency and some failed requests on Agents conversations, STT and Creative products (partial outage), EU SIP calls with static IPs from 9:53 to 12:06 UTC on 6 October (one region, one call path) and SIP conversations from 14:21 to 15:15 UTC on 8 October. Minor only (20 of 30, was 5). Concurrency per plan is published, from 4 calls on Free to 40 on Business with burst to three times the cap (15). The errors page returns 429 with rate_limit_exceeded, concurrent_limit_exceeded or system_busy and tells callers to back off exponentially. No Retry-After header and no idempotency keys found (10 of 15). No SLA found for a self-serve tier, and Enterprise lists custom terms around SLAs (0). Agents is generally available (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.

Vaani Developer Platform 28

Graded on the hosted REST API at api.vaanivoice.ai. No status page. status.vaani.dev and status.vaanivoice.ai don't resolve, and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits are published. The docs give 2 concurrent calls on pay as you go and a per-organisation campaign concurrency cap, so partial credit (5). The SDK raises RateLimitError on 429 and the MCP client retries once after 600 ms, but no Retry-After, backoff guidance or idempotency key for call creation is documented (3). The pricing table lists a 99.50 per cent uptime SLA on both plans, but no SLA document or service credits were found and the terms supply the service "as-is" with no warranties, so half (5). The API is version 2.0.0 and isn't labelled beta (10). 0+5+5+3+5+10 = 28.

ElevenLabs Agents API + MCP 83

The hosted MCP server signs in with OAuth and asks for scoped access to agents and speech. API keys can be limited to endpoint groups, given a credit limit, owned by a service account, rotated, and are disabled if found on GitHub (30). Scoped keys and signed URLs for private agents keep the main key off clients (17 of 20). Agents pass caller speech to an LLM. The guardrails docs, generally available since 19 October 2026, describe a Manipulation guardrail that detects prompt injection in user turns and can end the conversation, included at no extra cost, and the MCP security page recommends Always Ask approval for tool calls. It is a setting the builder turns on, not a default we could confirm (12 of 15, was 5). Audit logs cover over 100 endpoints through GET /v1/workspace/audit-logs, but only on Enterprise, and every conversation keeps a transcript (12 of 15). security.txt valid to 6 October 2027 (re-read on 1 November) and HIPAA BAAs are available with zero retention mode. We didn't re-check certifications or a bug bounty (12 of 20). 30 + 17 + 12 + 12 + 12 = 83.

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.

ElevenLabs Agents API + MCP 78

Closed service with clear terms and MIT SDKs (18 of 30). Conversation data is kept 2 years by default, set per agent in days, with per-agent zero retention mode and audio saving that can be turned off, and the statements agree (22 of 30). Dated changelog entries, but we didn't find a deprecation policy for the agents product (10 of 20). EU, India and Singapore residency endpoints are documented. We didn't check the subprocessor list this run (15 of 20).

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

ElevenLabs Agents API + MCP 92

Public OpenAPI at api.elevenlabs.io/openapi.json (25). llms.txt with Markdown copies of each page (10). The docs explain each agent setting with guidance on when to use it, such as turn timeout and soft-timeout fillers (16 of 20). The OpenAPI types every field, but conversation_config is a large nested object (12 of 15). The errors page lists codes, types and fixes, and every error carries a request_id (14 of 15). Weekly dated changelog entries and a versioned API (15).

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.

ElevenLabs Agents API + MCP 85

Changelog entry on 26 October 2026, and @elevenlabs/client 1.32.1 and @elevenlabs/react 1.20.2 tagged on 29 October (30). Weekly entries, with 108 tags in the agents packages repository since 3 August (20). Weekly changelog and incident write-ups on the status page, support we didn't test (12 of 15 for a closed service). Python and JavaScript SDKs with over a million weekly downloads each per the 1 October check, plus mobile SDKs (15). MIT SDKs on GitHub (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Vaani Developer Platform 59

vaani-research-mcp 0.1.1 on 2026-10-14 (30). In the last 90 days, vaani-sdk 0.3.1 on 28 September and three npm versions (0.0.0-stage, 0.1.0, 0.1.1) within 40 minutes on 14 October. No dated changelog, so half (10 of 20). A closed service with no public changelog, issue tracker or community channel found. Contact is hello@vaaniresearch.com and a booking link, and we didn't test whether they answer. The MCP repository on GitHub couldn't be read from this session (4 of 15, the closed-service reading). A current official Python SDK, released seven times since April 2026. The MCP server isn't in the official MCP registry (10 of 15). The SDK's sdist ships its tests and current httpx and pydantic dependencies, and the MCP package runs its tests before publishing, but no public CI was found and the SDK has no repository (5 of 10). 30+10+4+10+5 = 59.

ElevenLabs Agents API + MCP 77

We couldn't count the hosted MCP server's tools, since the docs list about ten capabilities without a tool list, so we scored context cost on the API, where list endpoints take page sizes and cursors (18 of 25). Conversation lists page and filter (18 of 20). Typed error codes with suggested fixes (18 of 20). MCP clients can set each tool to ask first and the docs warn that deleting an agent is destructive, but we found no idempotency keys (8 of 20). Few required fields to create an agent and official SDKs for Python, JavaScript, React, Swift, Kotlin and Flutter (15).

Vaani Developer Platform 64

The local MCP server loads 9 compact tools, and VAANI_READ_ONLY=true leaves 3. Transcripts are cut at 20,000 characters by default with a note. The REST API has no field selection or summaries, so 3 off (22 of 25). Call history pages by page and page_size up to 200 with no filters. The MCP agent filter runs client-side on one page. Agents filter by search and published_only and campaigns by status (12 of 20). Campaign errors carry a machine-readable code, a message, the path and a request_id (shown as "unknown" in the example). Validation errors list the field location, the SDK maps each status to a typed exception including 402 for a low wallet, and the MCP server adds a hint per status (15 of 20). All 9 MCP tools carry readOnlyHint, destructiveHint and idempotentHint, with trigger_call and campaign_action marked destructive. No idempotency key on trigger-call, and the MCP client retries a POST once after a timeout or 5xx, so a call can be placed twice. The webhook docs say to deduplicate by event id (8 of 20). A call needs agent_id, contact_number and name, with medium defaulting to telephony. One official SDK, Python, sync and async. The npm package is an MCP server, not an SDK (7 of 15). 22+12+15+8+7 = 64.