GPT-Live vs Vaani Developer Platform

GPT-Live 90

Closed service. The Python SDK is Apache-2.0, and the OpenAPI file and the Live Console sample are MIT. The services agreement is scored as the OpenAI API listing scores it, per that listing's check, since openai.com answered our reader with 403 (15 of 30, was 10, the reading every other OpenAI listing carries). The data controls page, re-read on 1 November, says /v1/live/sessions data is not used for training, abuse logs are kept up to 30 days, recordings are stored for 30 days only when store is true and storage is enabled, and Zero Data Retention treats store as false. It also says there is no public endpoint to delete a stored session. Those are stated conditions, not statements that disagree. The DPA, effective 1 January 2026, commits to return or deletion of customer data on termination, 30 days to object to a new subprocessor, and SCCs with the UK Addendum, and nothing in it conflicts with the guide, per the OpenAI API listing's 4 October check, not re-read on 1 November (openai.com answered 403). The same reading as the other OpenAI listings (30 of 30, was 18). The deprecations page states at least six months' notice for generally available models and lists dated shutdowns (20 of 20). The data-controls guide lists /v1/live/sessions for storage and processing in the United States and Europe only, narrower than most OpenAI endpoints, and the subprocessor list, updated 9 July 2026, names third-party subprocessors and OpenAI affiliates with processing countries and a notice form, per the OpenAI API listing's 4 October check. Locations and subprocessors are disclosed, which is what the line scores (20 of 20, was 10). 15 + 30 + 20 + 20 = 85.

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

GPT-Live 81

The project API key is sent as a Bearer header from a server, and WebSocket connections take no query parameters. GPT-Live has no browser client secret, so the key never reaches a browser and the server creates each session. Project keys carry their own permissions, service-account keys come through the Administration API, and the docs index lists workload identity federation, mutual TLS and IP allowlists. The access-control guide, re-read on 1 November, has no permission of its own for /v1/live/sessions, so a restricted key can't be confirmed to reach Live alone, the reading the OpenAI Decisions API and speech-to-text listings got (27 of 30, was 24). The WebRTC data channel can be limited to listed client and server events for an untrusted frontend, though the default allows all. The application runs custom functions and answers MCP approval requests (15 of 20). The guardrails guide describes checking input transcripts for jailbreak attempts and blocking actions until checks pass, the SIP guide says to treat SIP headers as untrusted, and the session guide says to keep trusted instructions apart from user messages and results. No guidance on injected content in hosted tool results was found (9 of 15). Usage events per session, a final session snapshot, optional stored recordings and Admin APIs with audit log retrieval. The OpenAPI file has no /organization/usage/ endpoint for Live sessions, so the per-key usage view other OpenAI listings get 15 for isn't there (10 of 15). security.txt, re-read on 1 November, is PGP-signed with a Bugcrowd bug bounty and a coordinated disclosure policy and has no Expires field, and trust.openai.com names SOC 2 Type 2 and ISO/IEC 27001, per the OpenAI speech-to-text listing's 1 November read. The bounty and disclosure policy carry the line, as on the other OpenAI listings (20 of 20, was 8). 27 + 15 + 9 + 10 + 20 = 81.

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.

GPT-Live 62

Graded as a hosted API. status.openai.com has a Live component under APIs, with data available from 19:53 UTC on 16 October 2026, five weeks after general availability (20). Re-read on 1 November. The feed (102 items) names Live in one incident, the 21 October degraded performance across ChatGPT, Codex and the APIs, where the incident page has Live degraded from 02:26 to 02:48 UTC, 22 minutes and minor. The API-wide majors of 17 and 29 September fall before the component existed, so whether they touched Live can't be read, and most of the window since general availability on 10 September has no readable history. An unreadable window isn't credited (5 of 30). The model page, re-read on 1 November, publishes concurrent session limits per tier, 50 on Build, 300 on Launch and 500 on Grow, and the SIP guide gives a 3-minute ringing limit and a 2-hour call limit (15). The OpenAPI file lists 429 and 503 on session creation and the rate limits guide documents Retry-After and backoff. Safe-retry guidance is explicit (check an action's outcome before retrying, deduplicate webhooks and events by ID, never retry an outbound call after a timeout), but session creation has no idempotency key (12 of 15). No SLA was found in the developer docs (0). Generally available since 10 September 2026 (10). Native Decisions delegation rests on the Decisions API, generally available since 22 October. 20 + 5 + 15 + 12 + 0 + 10 = 62.

Vaani Developer Platform 28

Graded on the hosted REST API at api.vaanivoice.ai. No status page. status.vaani.dev and status.vaanivoice.ai don't resolve, and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits are published. The docs give 2 concurrent calls on pay as you go and a per-organisation campaign concurrency cap, so partial credit (5). The SDK raises RateLimitError on 429 and the MCP client retries once after 600 ms, but no Retry-After, backoff guidance or idempotency key for call creation is documented (3). The pricing table lists a 99.50 per cent uptime SLA on both plans, but no SLA document or service credits were found and the terms supply the service "as-is" with no warranties, so half (5). The API is version 2.0.0 and isn't labelled beta (10). 0+5+5+3+5+10 = 28.

GPT-Live 87

The OpenAPI 3.1 file in openai/openai-openapi (re-read from a clone at its 31 October commit) has seven /live/sessions paths and 190 component schemas whose names start with Live by our count, up from the 17 October file with the 24 October revision of Decisions inputs and the 28 October DTMF command, and typed client and server events on the primary and sideband connections. It is not an AsyncAPI document, so the WebSocket channels are described only as event schemas (22 of 25). llms.txt and a Markdown twin of every page (10). The delegation guide has a table of when to choose Responses or client delegation, the connection guides say when to use WebRTC, WebSocket or SIP, and the Decisions guide says when to delegate or react to transcripts (17 of 20). Fields carry enums and limits, such as delegation.type, SIP reject codes 300 to 699 and 500-token appends, but model also accepts any string and the Live MCP tool schema types only type (12 of 15). Python and JavaScript examples on every guide, an error event with a documented shape and several named codes, and a table of close reasons. No full catalogue of Live error codes was found, and three JavaScript examples in the Markdown twins are empty (12 of 15). A dated changelog tags entries with v1/live/sessions, there is one snapshot, and the deprecated webhook event is named (14 of 15).

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.

GPT-Live 82

The last dated changelog entry tagged v1/live/sessions is still 16 October 2026, and the Live contract changed again after it, with the Decisions inputs revised on 24 October and a SIP DTMF command added on 28 October in the OpenAPI file, shipped in the Python SDK 3.42.0 on 31 October (30). Three changelog entries in the last 90 days, on 10 September, 15 October and 16 October (20). Closed service with a changelog updated several times a week and a community forum and Discord linked from the docs, which we did not test (10 of 15). Current official SDKs, with openai for Python at 3.42.0 on 31 October 2026 and Live changes in several releases since 10 September (15). The SDK is Apache-2.0 and released often. Its CI results were not read (7 of 10). 30 + 20 + 10 + 15 + 7 = 82.

Vaani Developer Platform 59

vaani-research-mcp 0.1.1 on 2026-10-14 (30). In the last 90 days, vaani-sdk 0.3.1 on 28 September and three npm versions (0.0.0-stage, 0.1.0, 0.1.1) within 40 minutes on 14 October. No dated changelog, so half (10 of 20). A closed service with no public changelog, issue tracker or community channel found. Contact is hello@vaaniresearch.com and a booking link, and we didn't test whether they answer. The MCP repository on GitHub couldn't be read from this session (4 of 15, the closed-service reading). A current official Python SDK, released seven times since April 2026. The MCP server isn't in the official MCP registry (10 of 15). The SDK's sdist ships its tests and current httpx and pydantic dependencies, and the MCP package runs its tests before publishing, but no public CI was found and the SDK has no repository (5 of 10). 30+10+4+10+5 = 59.

GPT-Live 76

Scored as a model API. Context is managed by the service in a 128,000-token window with background summaries, startup history is capped at 128 messages and 8,192 tokens, and session.usage.updated reports a context usage_ratio. The client cannot set its own truncation (20 of 25). There are no lists to page. The WebRTC frontend can be restricted to listed server events, transcripts are optional, and backend max_output_tokens is configurable (12 of 20). Errors carry code, param and the client_event_id of the failed command, configuration errors have their own code, and session.closed gives a reason (17 of 20). Commands are matched to acknowledgements by event_id, the sideband replays 3 seconds with original event IDs, and stored sessions can be forked to resume after a drop. Session creation has no idempotency key and outbound calls must not be retried (12 of 20). Only model is required, the voice defaults to marin, and the openai SDKs for Python and Node.js have Live resources, with partner integrations for LiveKit and Pipecat (15).

Vaani Developer Platform 64

The local MCP server loads 9 compact tools, and VAANI_READ_ONLY=true leaves 3. Transcripts are cut at 20,000 characters by default with a note. The REST API has no field selection or summaries, so 3 off (22 of 25). Call history pages by page and page_size up to 200 with no filters. The MCP agent filter runs client-side on one page. Agents filter by search and published_only and campaigns by status (12 of 20). Campaign errors carry a machine-readable code, a message, the path and a request_id (shown as "unknown" in the example). Validation errors list the field location, the SDK maps each status to a typed exception including 402 for a low wallet, and the MCP server adds a hint per status (15 of 20). All 9 MCP tools carry readOnlyHint, destructiveHint and idempotentHint, with trigger_call and campaign_action marked destructive. No idempotency key on trigger-call, and the MCP client retries a POST once after a timeout or 5xx, so a call can be placed twice. The webhook docs say to deduplicate by event id (8 of 20). A call needs agent_id, contact_number and name, with medium defaulting to telephony. One official SDK, Python, sync and async. The npm package is an MCP server, not an SDK (7 of 15). 22+12+15+8+7 = 64.