fone.me vs Synthflow API + MCP

fone.me 23

Closed service. Terms of service exist at /terms but draw by script, so their content, governing law and the company they name are unchecked; no company, address or country of incorporation appears on any page read, llms.txt says San Francisco, and the MCP repository has no licence (5 of 30). Data handling was read only from guide pages, which say only the owner sees their calls and messages, calls are transcribed and callers told so, and private categories are withheld. The privacy policy and data-deletion page draw by script, so no retention period, recording statement, DPA or AI-training statement was read (8 of 30). No deprecation policy or dated notices (0). No subprocessors, telephony, model or hosting providers or data locations are named on any page read; the demo agent card's icon is served from Cloudinary (0 of 20). 5+8+0+0 = 13.

Synthflow API + MCP 75

Closed platform with clear terms. The Subscriber Terms (version 1.0, 13 May 2026) name AgentFlow AI GmbH, Berlin, HRB 255004 B (15). Recordings, transcripts and caller IDs can be set to delete after 30 days per agent, PII redaction is available, and a DPA and BAA are offered. Otherwise the privacy policy keeps data until it is no longer needed, with no platform retention period (18 of 30). The changelog's Deprecation Notices carry dates. recording_url on the calls endpoints ends on 10 January 2027, announced on 22 October, and Salesforce actions need reconnecting by 30 November 2026. No written policy with a notice period found (15). The trust centre page lists 20 subprocessors, each with its purpose and processing location, among them AWS, Google Cloud, Microsoft Azure, OpenAI, Anthropic, Deepgram, ElevenLabs and Twilio. 18 process in the US and EU and two, Cerebrium and Hex Tech, in the US. The docs give Global, US and EU regions (20). 15 + 18 + 15 + 20 = 68.

fone.me 50

No x402, MPP or L402 on any page read (0). Premium is $9.99 a month on llms.txt and the Smith.ai comparison page, with no minute allowance or per-call price (10 of 20). The MCP server, search API and A2A endpoints are free with no account, and the agent, first link and chat button are free for owners; no page mentions a card for any of these (20). An outside agent needs no sign-up, key or payment to find and message an agent (20). 0+10+20+20 = 50.

Synthflow API + MCP 0

No x402, MPP or L402 (0 of 40). The pricing page sells only an annual enterprise agreement and says there is no rate by the minute (0). It also says there is no free plan or trial (0). An agent can't get access without a sales process (0).

fone.me 23

Closed service. The newest dated change to the agent surface found is the MCP repository github.com/spearisa/fone-me-mcp, created 5 October 2026 with server.json version 1.0.0, 31 days ago (20). The comparison page marked 'Checked October 28, 2026' and the profile lastmods in the sitemap are content, not releases. No changelog, release notes or three dated changes in 90 days (0 of 20). The support page and FAQ draw by script and no support email, forum or community channel was found; responsiveness unchecked (3 of 15). server.json names the server me.fone.www/agents, a namespace that needs proof of the domain, but the official MCP registry could not be read, so presence is scored absent (0 of 15). No package, public code or CI (0 of 10). 20+0+3+0+0 = 23.

Synthflow API + MCP 65

API changes dated 23 October 2026 (List agent versions, new MCP server tools), 12 days before this check. The 30 October entry is a dashboard function the API doesn't serve (30). Ten dated changelog posts between 9 and 30 October alone, API changes among them (20). Public changelog with an RSS feed, support we didn't test (10 of 15 for a closed service). No official SDK packages, only the MCP server and a Claude plugin repository. Earlier partial kept (5 of 15). No packages. The plugin repository has no CI and its last commit is 30 July 2026. Down from 3, which no package earned (0).

fone.me 15

Hosted reading, for the MCP server and A2A endpoints and the service behind them. No status page is linked from llms.txt, the home page or any guide page read, and https://www.fone.me/status failed to load (0). No readable incident history, so the floor (5). No request rate limit for the MCP server, the search API or A2A is published; the only limits are on the agent's own outbound calls (8 am to 9 pm in the callee's time zone, 'limited per day' with no number), which are not request limits (0 of 15). No 429, overload or retry guidance and no idempotency key for message_agent or message/send (0 of 15). No SLA (0). Nothing on the MCP server, the agent cards or llms.txt is marked beta or preview, and the MCP repository's server.json is version 1.0.0 (10). 0+5+0+0+0+10 = 15.

Synthflow API + MCP 55

Status page at status.synthflow.ai, now on incident.io, with Dashboard, API and End to End calling components for the Legacy, US and EU infrastructure, and a 90-day history on the page that covers the window from 6 August (20). In the 90 days from 6 August there were post-call AI outputs missing from webhooks from 08:20 to 11:10 UTC on 7 August (calls and webhook delivery unaffected), 9 to 12 minutes of failed calls in the EU and US regions with intermittent warm-transfer failures on 17 August, a white-label login fault on 7 September, PUT /v2/subaccounts rejecting two fields from 23 to 26 October, dashboard access and slower API responses on 26 October, and the settings page and SSO login unavailable for some workspaces from 27 October, which also hid some subaccount workspaces in the dashboard. Each touched one function, region or group of requests, so all read as minor. The 7 August webhook fault was counted as a major on 1 October (20). Concurrency and calls-per-second limits are set per contract and no numbers are published (0). The concurrency page documents 429 on reaching either limit and suggests a 1-second delay between calls started from automation tools, with no Retry-After, backoff or idempotency guidance. Earlier partial kept (5). No SLA published, and the pricing page sets availability terms in each agreement (0). The Platform API is generally available (10).

fone.me 31

MCP reading, since the MCP server is what an outside agent calls. No tool arguments or input schemas are published in llms.txt, the guide pages or the GitHub README, and robots.txt disallows /mcp, so no session was opened and tools/list was not read. Per-link A2A agent cards are machine-readable JSON (protocol 0.3.0, JSONRPC, input and output modes, skills with examples) and server.json names the remote, but neither types the MCP tools (8 of 25). llms.txt is a real document for agents covering the MCP server, A2A, the search API and the widget (10). Each tool has a one-line purpose in llms.txt and the README, and the how-it-works page states what the agent will and won't do; nothing says when not to use a tool (6 of 20). No typed inputs, enums, constraints or required fields published (0 of 15). Example prompts in the README, per-skill examples in agent cards and widget code for eight site builders; no error response is documented (4 of 15). server.json and the agent cards carry version 1.0.0 and the cards a protocol version; no changelog (3 of 15). 8+10+6+0+4+3 = 31.

Synthflow API + MCP 62

The 1 October check read an OpenAPI file at docs.synthflow.ai/openapi.json. No docs page read on 4 November links it, llms.txt, the API introduction and the Make a call reference included, and the reference pages give typed request bodies, three regional servers and Bearer authentication only as rendered pages. A file with no visible link isn't counted as a published contract, down from 25 (0). llms.txt, llms-full.txt and a Markdown copy of every page (10). Guides cover agents, actions and SIP connectors with when-to-use advice (14 of 20). Typed request bodies, with agent configuration as large nested objects (12 of 15). Examples throughout and nine named transfer failure reasons (11 of 15). A dated changelog with Product Updates, API Changes and Deprecation Notices categories, an RSS feed and a v2 API (15). 0 + 10 + 14 + 12 + 11 + 15 = 62.

fone.me 30

No credential exists for callers. llms.txt gives auth 'none', the README says the server is 'public, like the links themselves', and the two agent cards read declare no security scheme. There is nothing to leak or rotate, but fone.me and an owner can tell callers apart only by the name they give ('Maria via ChatGPT' in the README) and by traffic, and no caller identity or verification is documented (10 of 30). Three of four MCP tools are lookups; message_agent and A2A message/send reach any owner's agent. On the owner's side the vendor says the agent asks before agreeing to anything or spending money, the owner approves what it will say before a call, outbound calls run only 8 am to 9 pm local, pause when reported and stop permanently on request, and the owner can take over any chat. No read-only mode and no confirmation on the caller's side (8 of 20). message_agent returns text generated from what the owner taught the agent, and every agent on the platform reads messages from anyone; the only guidance is the how-it-works statement that the agent keeps relationship status, health, money and address private, with no documented prompt-injection or spam handling for the open channel, and the call-screening page says it does not promise to block calls (4 of 15). Owners see every call and chat with a transcript in one inbox; nothing is logged for the calling agent (8 of 15). /.well-known/security.txt answers with the app shell, and no disclosure policy, bug bounty or certification appears on any page read (0 of 20). 10+8+4+8+0 = 30.

Synthflow API + MCP 55

Bearer API keys made per workspace under Workspace Settings, with 2FA and SSO on the account. The MCP server signs in through Synthflow in a browser and picks the workspace and region, with an API key for headless use (20). Deletes are confirmation-gated, but there's no read-only key and other writes run without a check (10 of 20). No prompt-injection guidance found, though the MCP server has a fetch_url tool and knowledge bases crawl websites. PII redaction for transcripts, webhooks and logs is a separate data control (5 of 15). Call logs and webhook delivery logs, and no audit log of account actions documented (8 of 15). The SafeBase trust centre at security.synthflow.ai lists SOC 2 Type 2, ISO/IEC 27001, ISO/IEC 42001 and HIPAA, with reports behind an NDA request, and states a responsible disclosure process with no reporting address. No security.txt (404) and no public bug bounty. Read as SOC 2 Type 2 and ISO 27001 claims with no disclosure route, as people-data-labs, fireworks-inference and complyadvantage are (12). 20 + 10 + 5 + 8 + 12 = 55.