Fireflies.ai vs MeetStream

Fireflies.ai 68

19 documented MCP tools (15), plus 5 for a compact toon default format and separate summary and transcript tools, and GraphQL field selection on the API (20). limit up to 50 with skip, date ranges, keyword scope, organiser and participant filters, and a cursor on audit events (18). Errors carry a code, status, help URLs and retryAfter (18). No idempotency keys, and MCP annotations could not be read without a sign-in. Webhook retry rules are documented (4). Few required parameters, but the only official SDK is Node, now 1.2.1 (October 2026) (8).

MeetStream 88

19 MCP tools (15), plus 2 because media come back as links rather than inline files (17 of 25). Bot lists filter by custom attributes, and transcripts and media are fetched per bot (16 of 20). Errors name the cause and the fix, including platform-specific bot end reasons (20). Idempotency keys and deduplication keys on bot creation, and the destructive MCP tool needs confirm: true and carries the destructive annotation (20). Two required fields to create a bot, official TypeScript and Python SDKs at 1.x and a CLI (15). 17+16+20+20+15 = 88.

Fireflies.ai 60

Graded on the hosted GraphQL API and MCP server. status.fireflies.ai answered on 8 October with a Freshservice status page (20, per the 8 October check). On 3 November 2026 its robots.txt disallows every path, so nothing else was requested, and the page drew its components and 90-day record only in a browser even then, so no part of the window has been read (5). Limits are published with numbers, Free 30 a minute and 500 a day, Pro 60 a minute and 5,000 a day, Business and Enterprise 60 a minute per paid seat pooled across the team, plus per-mutation limits (15). Since changelog 2.28.0 a 429 carries Retry-After in seconds with X-RateLimit-* headers, and the limits page says to wait that long before retrying. No idempotency keys or safe-retry guidance for writes were found (10). No SLA found in the terms or on the pricing page (0). The API and MCP server carry no beta label, though the Realtime API, audit events and two MCP tools do (10). 20 + 5 + 15 + 10 + 0 + 10 = 60.

MeetStream 45

Graded on the hosted REST API and MCP server with the hosted lines. No public status page was found, linked or at status.meetstream.ai (0), so no incident history could be read (5). Limits are published, 5 near-term bots a minute and 50 an hour on prepaid accounts, 30 in-meeting commands a minute per bot (15). 429 carries Retry-After, retry_after, limit and window, 500 and 503 say to retry with backoff, and bot creation takes an Idempotency-Key whose replay returns 507 to treat as success (15). No SLA found in the Terms or on the pricing page (0). Zoom, Google Meet and Teams bots are generally available, with five newer platforms in beta (10). 0+5+15+15+0+10 = 45.

Fireflies.ai 68

Closed service with published terms, updated 28 September 2026. One clause bars software that interacts with the services without written consent, while the API clause permits use under the documentation (13). Terms and privacy policy agree that meeting content is not used for AI training and is not kept by vendors, and account data is deleted within 30 days of closure. A DPA could not be read (22). Deprecated fields and Webhooks V1 are listed without removal dates, and the terms allow APIs to be discontinued at any time (8). A sub-processor list is published at trust.fireflies.ai/subprocessors, which our reader could not load. Storage is in the United States and other countries (10).

MeetStream 57

Closed service with clear terms of 7 August 2026 naming MeetStream Corp. (15 of 30). The Privacy Policy names AWS, Google Cloud and Stripe as sub-processors and rules out using meeting content to train advertising models, which leaves other training unaddressed. Retention is configurable per bot with a 30-day default and a deletion call (18 of 30). Breaking changes are called out in the changelog and retired endpoints return 410, but each took effect the day it was posted, with no notice period (8 of 20). Sub-processors named, data locations not stated (10 of 20). 15+18+8+10 = 51.

Fireflies.ai 30

No x402, MPP or L402 (0). Seat prices are public ($18, $29 and $39 a seat a month, less when billed annually), with nothing priced per call (10). The Free plan includes API access at 500 requests a day (20). A person signs up in a browser and copies a key or approves OAuth (0).

MeetStream 40

No x402, MPP or L402 (0). Per-hour prices are public, $0.35 per bot hour, $0.10 for transcription and $0.05 per GB a month of storage past 30 days (20). $5 free credit with no card required (20). Signup and key creation happen in the dashboard, and the MCP OAuth flow needs a person to approve (0). 0+20+20+0 = 40.

Fireflies.ai 51

The MCP server uses OAuth with S256 PKCE, dynamic client registration and a revocation endpoint, but its scopes are only profile and email. The API takes one key per user with that user's full access, and rotation was not found in the docs (18). Access follows the user's role, and sharing or deleting needs the meeting owner or a team admin. No read-only mode and no confirmation step for writes such as sharing a transcript by email (8). Transcripts are untrusted speech and no injection guidance was found (0). An OCSF audit events query exists, in beta and on Enterprise only (9). SOC 2 Type II, GDPR, HIPAA and ISO 42001 claims, a Vanta trust centre and a HackerOne bounty by invitation, with no security.txt (16).

MeetStream 42

A key grants full access to its workspace's bots and data, and workspaces separate keys. MCP sign-in is OAuth, which mints a key per connection. No scopes or read-only keys found (15 of 30). delete_bot_data needs confirm: true and is marked destructive, and remove_bot keeps recordings, with no read-only mode (10 of 20). Transcripts, chat and audio come from meeting participants, and no prompt-injection guidance was found (0). A dashboard bot detail page and signed webhooks, with no audit log of API calls found (5 of 15). ISO 27001 certified (630036), SOC 2 Type 2 under audit, HIPAA with a BAA, a trust centre and HMAC-signed webhooks. No security.txt (404) or bug bounty found (12 of 20). 15+10+0+5+12 = 42.