Fireflies.ai vs Zoom Realtime Media Streams (RTMS)

Fireflies.ai 30

No x402, MPP or L402 (0). Seat prices are public ($18, $29 and $39 a seat a month, less when billed annually), with nothing priced per call (10). The Free plan includes API access at 500 requests a day (20). A person signs up in a browser and copies a key or approves OAuth (0).

Zoom Realtime Media Streams (RTMS) 0

No x402, MPP or L402 (0). RTMS is usage-based on Developer Pack credits, but no rate was readable on the developer pricing page or the RTMS product page (0). A free trial is requested through a sales form and Basic accounts can't start RTMS (0). A person creates the app, buys credits and submits the app for review (0). 0+0+0+0 = 0.

Fireflies.ai 51

The MCP server uses OAuth with S256 PKCE, dynamic client registration and a revocation endpoint, but its scopes are only profile and email. The API takes one key per user with that user's full access, and rotation was not found in the docs (18). Access follows the user's role, and sharing or deleting needs the meeting owner or a team admin. No read-only mode and no confirmation step for writes such as sharing a transcript by email (8). Transcripts are untrusted speech and no injection guidance was found (0). An OCSF audit events query exists, in beta and on Enterprise only (9). SOC 2 Type II, GDPR, HIPAA and ISO 42001 claims, a Vanta trust centre and a HackerOne bounty by invitation, with no security.txt (16).

Zoom Realtime Media Streams (RTMS) 63

OAuth 2.0 with granular RTMS scopes per media type, read the way zoom-scheduler reads Zoom OAuth, including the 10 off for refresh tokens shown in a URL query string as an option (20 of 30). Least privilege is strong. Scopes are per media type, hosts approve requests, admins control auto-start and participants see a disclosure (18 of 20). Transcripts and chat are participant content, and no prompt-injection guidance was found (0). Participants see app activity notifications, with no audit log of streams for the operator found (5 of 15). Zoom's security.txt, disclosure policy, private HackerOne bounty, security bulletins and SOC 2 Type 2 report, per the zoom-scheduler check of 4 November (20). 20+18+0+5+20 = 63.

Fireflies.ai 80

The contract is a typed GraphQL schema read by introspection, which needs an API key. No public schema file or OpenAPI was found, and MCP input schemas need a sign-in, so 18 of 25. llms.txt, llms-full.txt and Markdown pages (10). The MCP reference states what each of 19 tools returns and excludes, with a comparison table and workflows (16). GraphQL inputs are typed with enums and length limits, while fireflies_search takes a query-grammar string (12). Every operation has curl, JavaScript, Python and Java examples and a list of its error codes (14). The changelog numbers 75 versions to 2.31.1 with no dates, and requests cannot pin a version (10).

Zoom Realtime Media Streams (RTMS) 71

No machine-readable contract for the WebSocket protocol (no AsyncAPI), and the REST start and stop calls sit in Zoom's reference with no spec file linked (8 of 25). llms.txt and a Markdown copy of each page (10). Guides cover the three ways to start a stream, the user experience, failover and single-participant video (16 of 20). Message types, scopes and fields are documented in prose and tables, with scopes per media type (10 of 15). Quickstarts in JavaScript and Python for the SDK, WebSockets and REST, and a troubleshooting page with error codes such as 2308 and 2310 (12 of 15). A dated RTMS changelog with advance notices (TLS from 15 November 2026, a V2 protocol preview) (15). 8+10+16+10+12+15 = 71.

Fireflies.ai 68

19 documented MCP tools (15), plus 5 for a compact toon default format and separate summary and transcript tools, and GraphQL field selection on the API (20). limit up to 50 with skip, date ranges, keyword scope, organiser and participant filters, and a cursor on audit events (18). Errors carry a code, status, help URLs and retryAfter (18). No idempotency keys, and MCP annotations could not be read without a sign-in. Webhook retry rules are documented (4). Few required parameters, but the only official SDK is Node, now 1.2.1 (October 2026) (8).

Zoom Realtime Media Streams (RTMS) 59

Streaming reading of the checklist. Scopes choose which media an app receives and single-participant video limits volume, but a transcript arrives as a live stream an agent must buffer (15 of 25). Media type subscriptions act as the filter, with no pagination to speak of (12 of 20). Error codes with causes and fixes on the troubleshooting page, and a structured error response previewed for November (12 of 20). Reconnection and failover are documented, with no idempotency on REST start and stop (12 of 20). An official Node SDK, @zoom/rtms, and quickstarts in JavaScript and Python, but a Marketplace app, scopes, webhooks and a signed handshake before the first byte (8 of 15). 15+12+12+12+8 = 59.

Fireflies.ai 60

Graded on the hosted GraphQL API and MCP server. status.fireflies.ai answered on 8 October with a Freshservice status page (20, per the 8 October check). On 3 November 2026 its robots.txt disallows every path, so nothing else was requested, and the page drew its components and 90-day record only in a browser even then, so no part of the window has been read (5). Limits are published with numbers, Free 30 a minute and 500 a day, Pro 60 a minute and 5,000 a day, Business and Enterprise 60 a minute per paid seat pooled across the team, plus per-mutation limits (15). Since changelog 2.28.0 a 429 carries Retry-After in seconds with X-RateLimit-* headers, and the limits page says to wait that long before retrying. No idempotency keys or safe-retry guidance for writes were found (10). No SLA found in the terms or on the pricing page (0). The API and MCP server carry no beta label, though the Realtime API, audit events and two MCP tools do (10). 20 + 5 + 15 + 10 + 0 + 10 = 60.

Zoom Realtime Media Streams (RTMS) 67

Graded on the hosted RTMS service with the hosted lines. www.zoomstatus.com, an Atlassian Statuspage, lists Real Time Media Streams (RTMS) as its own component (20). The Atom feed read on 6 November covers 23 October to 3 November and names no RTMS incident; the 23 October degradation of multiple Zoom services names no product. The window from 8 August to 22 October is drawn by script and robots.txt closes /api/, so, as for zoom-scheduler, the line is 10. Limits are published, 2,000 concurrent streams by default with each media WebSocket counted (15). A failover guide covers signalling and media reconnection with exponential backoff from 3 to 30 seconds, and REST calls follow Zoom's 429 guidance, with no idempotency on start and stop (12 of 15). No SLA found for RTMS (0). RTMS for Meetings carries no beta label (10). 20+10+15+12+0+10 = 67.

Fireflies.ai 80

Version 1.2.1 of the official Node SDK (changelog dated 9 October, tag on 12 October 2026) covers the rest of the public GraphQL API and retries 429s, and the changelog gained 2.28.0 to 2.31.1 between the 8 October check and 3 November, with the page's sitemap date 2 November 2026 (30). Dated changes in the 90 days from 5 August: MCP registry versions on 20 August and 14 September, SDK 1.2.1, and five API versions (2.28.0 to 2.31.1) that appeared within those 26 days. 2.27.1 records a July change retroactively and isn't counted (20). A public changelog, a support address and a Developer Programme, with no public issue tracker for the API (8). Listed in the official MCP registry as ai.fireflies/fireflies (15). The SDK now has a build-and-test CI workflow and axios 1.17.0. Its pass state on GitHub couldn't be read (7). 30 + 20 + 8 + 15 + 7 = 80.

Zoom Realtime Media Streams (RTMS) 73

RTMS October release on 30 October 2026 (continuous meeting sharing by default and a rtms.request_status webhook) (30). Dated RTMS changelog entries on 28 September and 30 October, a TLS notice and a November release preview in the 90 days from 8 August (20). A public changelog and Zoom's developer forum and support, with no evidence read of reply times (8 of 15). The official @zoom/rtms SDK is at 1.1.0 from 16 April 2026, behind the protocol changes since (10 of 15). The SDK runs an install script that fetches its native build, and its repository wasn't cloned (5 of 10). 30+20+8+10+5 = 73.