fone.me vs GPT-Live

fone.me 23

Closed service. Terms of service exist at /terms but draw by script, so their content, governing law and the company they name are unchecked; no company, address or country of incorporation appears on any page read, llms.txt says San Francisco, and the MCP repository has no licence (5 of 30). Data handling was read only from guide pages, which say only the owner sees their calls and messages, calls are transcribed and callers told so, and private categories are withheld. The privacy policy and data-deletion page draw by script, so no retention period, recording statement, DPA or AI-training statement was read (8 of 30). No deprecation policy or dated notices (0). No subprocessors, telephony, model or hosting providers or data locations are named on any page read; the demo agent card's icon is served from Cloudinary (0 of 20). 5+8+0+0 = 13.

GPT-Live 90

Closed service. The Python SDK is Apache-2.0, and the OpenAPI file and the Live Console sample are MIT. The services agreement is scored as the OpenAI API listing scores it, per that listing's check, since openai.com answered our reader with 403 (15 of 30, was 10, the reading every other OpenAI listing carries). The data controls page, re-read on 1 November, says /v1/live/sessions data is not used for training, abuse logs are kept up to 30 days, recordings are stored for 30 days only when store is true and storage is enabled, and Zero Data Retention treats store as false. It also says there is no public endpoint to delete a stored session. Those are stated conditions, not statements that disagree. The DPA, effective 1 January 2026, commits to return or deletion of customer data on termination, 30 days to object to a new subprocessor, and SCCs with the UK Addendum, and nothing in it conflicts with the guide, per the OpenAI API listing's 4 October check, not re-read on 1 November (openai.com answered 403). The same reading as the other OpenAI listings (30 of 30, was 18). The deprecations page states at least six months' notice for generally available models and lists dated shutdowns (20 of 20). The data-controls guide lists /v1/live/sessions for storage and processing in the United States and Europe only, narrower than most OpenAI endpoints, and the subprocessor list, updated 9 July 2026, names third-party subprocessors and OpenAI affiliates with processing countries and a notice form, per the OpenAI API listing's 4 October check. Locations and subprocessors are disclosed, which is what the line scores (20 of 20, was 10). 15 + 30 + 20 + 20 = 85.

fone.me 23

Closed service. The newest dated change to the agent surface found is the MCP repository github.com/spearisa/fone-me-mcp, created 5 October 2026 with server.json version 1.0.0, 31 days ago (20). The comparison page marked 'Checked October 28, 2026' and the profile lastmods in the sitemap are content, not releases. No changelog, release notes or three dated changes in 90 days (0 of 20). The support page and FAQ draw by script and no support email, forum or community channel was found; responsiveness unchecked (3 of 15). server.json names the server me.fone.www/agents, a namespace that needs proof of the domain, but the official MCP registry could not be read, so presence is scored absent (0 of 15). No package, public code or CI (0 of 10). 20+0+3+0+0 = 23.

GPT-Live 82

The last dated changelog entry tagged v1/live/sessions is still 16 October 2026, and the Live contract changed again after it, with the Decisions inputs revised on 24 October and a SIP DTMF command added on 28 October in the OpenAPI file, shipped in the Python SDK 3.42.0 on 31 October (30). Three changelog entries in the last 90 days, on 10 September, 15 October and 16 October (20). Closed service with a changelog updated several times a week and a community forum and Discord linked from the docs, which we did not test (10 of 15). Current official SDKs, with openai for Python at 3.42.0 on 31 October 2026 and Live changes in several releases since 10 September (15). The SDK is Apache-2.0 and released often. Its CI results were not read (7 of 10). 30 + 20 + 10 + 15 + 7 = 82.

fone.me 31

MCP reading, since the MCP server is what an outside agent calls. No tool arguments or input schemas are published in llms.txt, the guide pages or the GitHub README, and robots.txt disallows /mcp, so no session was opened and tools/list was not read. Per-link A2A agent cards are machine-readable JSON (protocol 0.3.0, JSONRPC, input and output modes, skills with examples) and server.json names the remote, but neither types the MCP tools (8 of 25). llms.txt is a real document for agents covering the MCP server, A2A, the search API and the widget (10). Each tool has a one-line purpose in llms.txt and the README, and the how-it-works page states what the agent will and won't do; nothing says when not to use a tool (6 of 20). No typed inputs, enums, constraints or required fields published (0 of 15). Example prompts in the README, per-skill examples in agent cards and widget code for eight site builders; no error response is documented (4 of 15). server.json and the agent cards carry version 1.0.0 and the cards a protocol version; no changelog (3 of 15). 8+10+6+0+4+3 = 31.

GPT-Live 87

The OpenAPI 3.1 file in openai/openai-openapi (re-read from a clone at its 31 October commit) has seven /live/sessions paths and 190 component schemas whose names start with Live by our count, up from the 17 October file with the 24 October revision of Decisions inputs and the 28 October DTMF command, and typed client and server events on the primary and sideband connections. It is not an AsyncAPI document, so the WebSocket channels are described only as event schemas (22 of 25). llms.txt and a Markdown twin of every page (10). The delegation guide has a table of when to choose Responses or client delegation, the connection guides say when to use WebRTC, WebSocket or SIP, and the Decisions guide says when to delegate or react to transcripts (17 of 20). Fields carry enums and limits, such as delegation.type, SIP reject codes 300 to 699 and 500-token appends, but model also accepts any string and the Live MCP tool schema types only type (12 of 15). Python and JavaScript examples on every guide, an error event with a documented shape and several named codes, and a table of close reasons. No full catalogue of Live error codes was found, and three JavaScript examples in the Markdown twins are empty (12 of 15). A dated changelog tags entries with v1/live/sessions, there is one snapshot, and the deprecated webhook event is named (14 of 15).

fone.me 30

No credential exists for callers. llms.txt gives auth 'none', the README says the server is 'public, like the links themselves', and the two agent cards read declare no security scheme. There is nothing to leak or rotate, but fone.me and an owner can tell callers apart only by the name they give ('Maria via ChatGPT' in the README) and by traffic, and no caller identity or verification is documented (10 of 30). Three of four MCP tools are lookups; message_agent and A2A message/send reach any owner's agent. On the owner's side the vendor says the agent asks before agreeing to anything or spending money, the owner approves what it will say before a call, outbound calls run only 8 am to 9 pm local, pause when reported and stop permanently on request, and the owner can take over any chat. No read-only mode and no confirmation on the caller's side (8 of 20). message_agent returns text generated from what the owner taught the agent, and every agent on the platform reads messages from anyone; the only guidance is the how-it-works statement that the agent keeps relationship status, health, money and address private, with no documented prompt-injection or spam handling for the open channel, and the call-screening page says it does not promise to block calls (4 of 15). Owners see every call and chat with a transcript in one inbox; nothing is logged for the calling agent (8 of 15). /.well-known/security.txt answers with the app shell, and no disclosure policy, bug bounty or certification appears on any page read (0 of 20). 10+8+4+8+0 = 30.

GPT-Live 81

The project API key is sent as a Bearer header from a server, and WebSocket connections take no query parameters. GPT-Live has no browser client secret, so the key never reaches a browser and the server creates each session. Project keys carry their own permissions, service-account keys come through the Administration API, and the docs index lists workload identity federation, mutual TLS and IP allowlists. The access-control guide, re-read on 1 November, has no permission of its own for /v1/live/sessions, so a restricted key can't be confirmed to reach Live alone, the reading the OpenAI Decisions API and speech-to-text listings got (27 of 30, was 24). The WebRTC data channel can be limited to listed client and server events for an untrusted frontend, though the default allows all. The application runs custom functions and answers MCP approval requests (15 of 20). The guardrails guide describes checking input transcripts for jailbreak attempts and blocking actions until checks pass, the SIP guide says to treat SIP headers as untrusted, and the session guide says to keep trusted instructions apart from user messages and results. No guidance on injected content in hosted tool results was found (9 of 15). Usage events per session, a final session snapshot, optional stored recordings and Admin APIs with audit log retrieval. The OpenAPI file has no /organization/usage/ endpoint for Live sessions, so the per-key usage view other OpenAI listings get 15 for isn't there (10 of 15). security.txt, re-read on 1 November, is PGP-signed with a Bugcrowd bug bounty and a coordinated disclosure policy and has no Expires field, and trust.openai.com names SOC 2 Type 2 and ISO/IEC 27001, per the OpenAI speech-to-text listing's 1 November read. The bounty and disclosure policy carry the line, as on the other OpenAI listings (20 of 20, was 8). 27 + 15 + 9 + 10 + 20 = 81.

fone.me 15

Hosted reading, for the MCP server and A2A endpoints and the service behind them. No status page is linked from llms.txt, the home page or any guide page read, and https://www.fone.me/status failed to load (0). No readable incident history, so the floor (5). No request rate limit for the MCP server, the search API or A2A is published; the only limits are on the agent's own outbound calls (8 am to 9 pm in the callee's time zone, 'limited per day' with no number), which are not request limits (0 of 15). No 429, overload or retry guidance and no idempotency key for message_agent or message/send (0 of 15). No SLA (0). Nothing on the MCP server, the agent cards or llms.txt is marked beta or preview, and the MCP repository's server.json is version 1.0.0 (10). 0+5+0+0+0+10 = 15.

GPT-Live 62

Graded as a hosted API. status.openai.com has a Live component under APIs, with data available from 19:53 UTC on 16 October 2026, five weeks after general availability (20). Re-read on 1 November. The feed (102 items) names Live in one incident, the 21 October degraded performance across ChatGPT, Codex and the APIs, where the incident page has Live degraded from 02:26 to 02:48 UTC, 22 minutes and minor. The API-wide majors of 17 and 29 September fall before the component existed, so whether they touched Live can't be read, and most of the window since general availability on 10 September has no readable history. An unreadable window isn't credited (5 of 30). The model page, re-read on 1 November, publishes concurrent session limits per tier, 50 on Build, 300 on Launch and 500 on Grow, and the SIP guide gives a 3-minute ringing limit and a 2-hour call limit (15). The OpenAPI file lists 429 and 503 on session creation and the rate limits guide documents Retry-After and backoff. Safe-retry guidance is explicit (check an action's outcome before retrying, deduplicate webhooks and events by ID, never retry an outbound call after a timeout), but session creation has no idempotency key (12 of 15). No SLA was found in the developer docs (0). Generally available since 10 September 2026 (10). Native Decisions delegation rests on the Decisions API, generally available since 22 October. 20 + 5 + 15 + 12 + 0 + 10 = 62.

fone.me 29

MCP reading. Four tools named in llms.txt, a small set, but their definitions were not read, so short of full marks (18 of 25). find_agents searches by what someone does and the search API takes a query; no limit, paging or output-size controls are documented (3 of 20). No error codes or messages documented for the MCP server, the search API or A2A (0 of 20). No readOnlyHint or destructiveHint seen and no idempotency key; the three lookups are read-only by name and description, while message_agent writes to a real person's inbox and continues the conversation across calls (2 of 20). No credentials, no configuration beyond the URL, and few stated inputs; no SDK in any language (6 of 15). 18+3+0+2+6 = 29.

GPT-Live 76

Scored as a model API. Context is managed by the service in a 128,000-token window with background summaries, startup history is capped at 128 messages and 8,192 tokens, and session.usage.updated reports a context usage_ratio. The client cannot set its own truncation (20 of 25). There are no lists to page. The WebRTC frontend can be restricted to listed server events, transcripts are optional, and backend max_output_tokens is configurable (12 of 20). Errors carry code, param and the client_event_id of the failed command, configuration errors have their own code, and session.closed gives a reason (17 of 20). Commands are matched to acknowledgements by event_id, the sideband replays 3 seconds with original event IDs, and stored sessions can be forked to resume after a drop. Session creation has no idempotency key and outbound calls must not be retried (12 of 20). Only model is required, the voice defaults to marin, and the openai SDKs for Python and Node.js have Live resources, with partner integrations for LiveKit and Pipecat (15).