fone.me vs Harmony.ai

fone.me 31

MCP reading, since the MCP server is what an outside agent calls. No tool arguments or input schemas are published in llms.txt, the guide pages or the GitHub README, and robots.txt disallows /mcp, so no session was opened and tools/list was not read. Per-link A2A agent cards are machine-readable JSON (protocol 0.3.0, JSONRPC, input and output modes, skills with examples) and server.json names the remote, but neither types the MCP tools (8 of 25). llms.txt is a real document for agents covering the MCP server, A2A, the search API and the widget (10). Each tool has a one-line purpose in llms.txt and the README, and the how-it-works page states what the agent will and won't do; nothing says when not to use a tool (6 of 20). No typed inputs, enums, constraints or required fields published (0 of 15). Example prompts in the README, per-skill examples in agent cards and widget code for eight site builders; no error response is documented (4 of 15). server.json and the agent cards carry version 1.0.0 and the cards a protocol version; no changelog (3 of 15). 8+10+6+0+4+3 = 31.

Harmony.ai 77

A public OpenAPI 3.0.3 file covering all 11 operations at docs.harmony.ai/openapi.json (25). llms.txt, llms-full.txt and Markdown pages (10). Each operation has a short description, and the guides say who the API is for, that multi-customer integrations aren't supported, and what each write does to calling (12 of 20). 45 enums, a page size bounded at 1 to 100, required fields and a 1,000-contact cap on imports (12 of 15). The docs have curl and TypeScript examples and a documented error body with named codes, while the OpenAPI file has no examples (11 of 15). The major version is in the path and a versioning policy is published, with no changelog (7 of 15).

fone.me 29

MCP reading. Four tools named in llms.txt, a small set, but their definitions were not read, so short of full marks (18 of 25). find_agents searches by what someone does and the search API takes a query; no limit, paging or output-size controls are documented (3 of 20). No error codes or messages documented for the MCP server, the search API or A2A (0 of 20). No readOnlyHint or destructiveHint seen and no idempotency key; the three lookups are read-only by name and description, while message_agent writes to a real person's inbox and continues the conversation across calls (2 of 20). No credentials, no configuration beyond the URL, and few stated inputs; no SDK in any language (6 of 15). 18+3+0+2+6 = 29.

Harmony.ai 65

Lists take limit up to 100 and a CSV form, with no field selection or summaries (15 of 25). Cursor pagination with nextToken, and contact search filters by status, source, workflow, date added and a search term (18 of 20). Every error has a stable code, a requestId and an x-request-id header, with specific 422 reasons and a 409 that lists the matching contacts (17 of 20). No idempotency keys. Upserts deduplicate by the Account's fields and the docs spell out when a retry calls a contact twice. The six MCP tools are read-only, though no annotations were seen since the tool list wasn't fetched from the server (10 of 20). Few required fields, no SDK in any language (5 of 15).

fone.me 50

No x402, MPP or L402 on any page read (0). Premium is $9.99 a month on llms.txt and the Smith.ai comparison page, with no minute allowance or per-call price (10 of 20). The MCP server, search API and A2A endpoints are free with no account, and the agent, first link and chat button are free for owners; no page mentions a card for any of these (20). An outside agent needs no sign-up, key or payment to find and message an agent (20). 0+10+20+20 = 50.

Harmony.ai 15

No x402, MPP or L402 (0 of 40). Pro is $0.39 a minute plus a $250 monthly platform fee, published without a login, with the minute rate varying by voice model and a custom implementation fee (15 of 20). A Try for free signup is linked, with no trial terms on public pages and the signup not tried, so no free tier is counted (0). A person signs up in a browser and creates keys in the web app (0).

fone.me 23

Closed service. Terms of service exist at /terms but draw by script, so their content, governing law and the company they name are unchecked; no company, address or country of incorporation appears on any page read, llms.txt says San Francisco, and the MCP repository has no licence (5 of 30). Data handling was read only from guide pages, which say only the owner sees their calls and messages, calls are transcribed and callers told so, and private categories are withheld. The privacy policy and data-deletion page draw by script, so no retention period, recording statement, DPA or AI-training statement was read (8 of 30). No deprecation policy or dated notices (0). No subprocessors, telephony, model or hosting providers or data locations are named on any page read; the demo agent card's icon is served from Cloudinary (0 of 20). 5+8+0+0 = 13.

Harmony.ai 55

Closed service with conflicting terms. The Terms of Service are One AI Inc.'s, undated, referring to oneai.com sites and pricing, while the DPA of 10 September 2026 names monday.com Ltd. and incorporates monday.com's Terms of Service (7 of 30). Data handling statements disagree. The privacy policy (24 August 2026) keeps data while the account is active and says data may be used to train One AI's systems. The trust page says retention is configurable with no cross-customer training. The terms say all calls are recorded unless the customer opts out in writing, and the trust page lists US, EU and APAC regions while the sub-processor page lists US and EU. The DPA commits to deletion or return at termination (10 of 30). The versioning page keeps an old major version for at least 12 months after a new one, once the API is generally available (10 of 20). Nine sub-processors named with hosting regions, with a seven-day objection window in the DPA (18 of 20).

fone.me 23

Closed service. The newest dated change to the agent surface found is the MCP repository github.com/spearisa/fone-me-mcp, created 5 October 2026 with server.json version 1.0.0, 31 days ago (20). The comparison page marked 'Checked October 28, 2026' and the profile lastmods in the sitemap are content, not releases. No changelog, release notes or three dated changes in 90 days (0 of 20). The support page and FAQ draw by script and no support email, forum or community channel was found; responsiveness unchecked (3 of 15). server.json names the server me.fone.www/agents, a namespace that needs proof of the domain, but the official MCP registry could not be read, so presence is scored absent (0 of 15). No package, public code or CI (0 of 10). 20+0+3+0+0 = 23.

Harmony.ai 42

Read for a closed service. The press page dates the launch to October 2026, within 30 days (30). No changelog or dated releases (0). Support is through a contact form and the docs' request ID guidance, with no public changelog or community channel found (4 of 15). A hosted MCP server, not in the official registry, and no SDK (5 of 15). No package to assess (3 of 10).

fone.me 30

No credential exists for callers. llms.txt gives auth 'none', the README says the server is 'public, like the links themselves', and the two agent cards read declare no security scheme. There is nothing to leak or rotate, but fone.me and an owner can tell callers apart only by the name they give ('Maria via ChatGPT' in the README) and by traffic, and no caller identity or verification is documented (10 of 30). Three of four MCP tools are lookups; message_agent and A2A message/send reach any owner's agent. On the owner's side the vendor says the agent asks before agreeing to anything or spending money, the owner approves what it will say before a call, outbound calls run only 8 am to 9 pm local, pause when reported and stop permanently on request, and the owner can take over any chat. No read-only mode and no confirmation on the caller's side (8 of 20). message_agent returns text generated from what the owner taught the agent, and every agent on the platform reads messages from anyone; the only guidance is the how-it-works statement that the agent keeps relationship status, health, money and address private, with no documented prompt-injection or spam handling for the open channel, and the call-screening page says it does not promise to block calls (4 of 15). Owners see every call and chat with a transcript in one inbox; nothing is logged for the calling agent (8 of 15). /.well-known/security.txt answers with the app shell, and no disclosure policy, bug bounty or certification appears on any page read (0 of 20). 10+8+4+8+0 = 30.

Harmony.ai 48

Revocable Bearer keys, shown once, with a last-used time, but no scopes, no expiry and the full access of the user who made them. Keys never travel in a URL (20 of 30). The MCP server is read-only, but a REST key can import contacts into workflows that place real calls, with no read-only key (8 of 20). The MCP docs say tool results carry text from contacts and teammates and tell the user to treat it as untrusted input (10 of 15). Request IDs on every response and key last-used times. No audit log of account actions documented (6 of 15). harmony.ai/.well-known/security.txt returns 404. The trust page claims SOC 2 Type II, ISO 27001, an annual pen test and a public disclosure programme with bounties, but names no auditor, report, certificate or contact, and shares reports only under NDA (4 of 20).