Granola vs Zoom Realtime Media Streams (RTMS)

Granola 25

No x402, MPP or L402 (0). Plan prices are public, $0, $14 and $35 a user a month, with nothing priced per call (10). The free Basic plan includes MCP for personal notes from the last 30 days with some tools withheld, while the REST API and webhooks need a paid plan or a time-limited trial (15 of 20). A person installs the app, signs in with Google or Microsoft and creates a key or approves OAuth (0).

Zoom Realtime Media Streams (RTMS) 0

No x402, MPP or L402 (0). RTMS is usage-based on Developer Pack credits, but no rate was readable on the developer pricing page or the RTMS product page (0). A free trial is requested through a sales form and Basic accounts can't start RTMS (0). A person creates the app, buys credits and submits the app for review (0). 0+0+0+0 = 0.

Granola 60

The newest API changelog entry is v1.6.0, labelled October 2026 with no day. Our 8 October check found v1.5.0 as the newest entry, so v1.6.0 was posted after 8 October, and the docs sitemap dates the changelog and the new Search notes page 27 October and the List Spaces page 9 October, all within 30 days (30). Entries in the last 90 days are v1.4.0 (August, 28 of whose 31 days fall after 4 August; the Get Transcript page it added carries a sitemap date of 11 August), v1.5.0 (September) and v1.6.0 (October) (20). A public changelog, a support address, incidents each closed with a note, and published security reports. No public issue tracker (10 of 15). No entry from Granola in the official MCP registry, where the one match is a third party's server, and no official SDK (0). No packages to assess (0). 30 + 20 + 10 + 0 + 0 = 60.

Zoom Realtime Media Streams (RTMS) 73

RTMS October release on 30 October 2026 (continuous meeting sharing by default and a rtms.request_status webhook) (30). Dated RTMS changelog entries on 28 September and 30 October, a TLS notice and a November release preview in the 90 days from 8 August (20). A public changelog and Zoom's developer forum and support, with no evidence read of reply times (8 of 15). The official @zoom/rtms SDK is at 1.1.0 from 16 April 2026, behind the protocol changes since (10 of 15). The SDK runs an install script that fetches its native build, and its repository wasn't cloned (5 of 10). 30+20+8+10+5 = 73.

Granola 71

The MCP server has nine tools per the docs, and the definitions themselves need a sign-in to read. On REST the transcript is returned only with include=transcript, and large ones move to a paged endpoint (21 of 25). Cursor pagination with page_size up to 30 for notes and 100 for transcript items, filters for created and updated dates, folder and space, and since v1.6.0 POST /v1/notes/search over titles and shared summaries with participant, folder, space, meeting date and update time filters (20). Errors return a JSON body with an error name and message, and a few codes are documented, with no error catalogue or schema (11 of 20). The notes endpoints are read-only and webhook deliveries can be deduplicated by event_id. No idempotency key on webhook or legal hold creation, and MCP annotations could not be read (11 of 20). Few required parameters. No official SDK was found (8 of 15). 21 + 20 + 11 + 11 + 8 = 71.

Zoom Realtime Media Streams (RTMS) 59

Streaming reading of the checklist. Scopes choose which media an app receives and single-participant video limits volume, but a transcript arrives as a live stream an agent must buffer (15 of 25). Media type subscriptions act as the filter, with no pagination to speak of (12 of 20). Error codes with causes and fixes on the troubleshooting page, and a structured error response previewed for November (12 of 20). Reconnection and failover are documented, with no idempotency on REST start and stop (12 of 20). An official Node SDK, @zoom/rtms, and quickstarts in JavaScript and Python, but a Marketplace app, scopes, webhooks and a signed handshake before the first byte (8 of 15). 15+12+12+12+8 = 59.

Granola 82

A public OpenAPI 3.1.0 document covers 19 operations across notes, search, transcripts, folders, spaces, audit, webhooks and legal holds (25). llms.txt and a Markdown copy of every page (10). Parameter and scope descriptions state behaviour and limits. The nine MCP tools have one line each in the docs and their input schemas are not published (14 of 20). IDs carry patterns, scopes and events are enums and page sizes have bounds (13 of 15). The document carries about 180 example values and the guides show curl requests with responses. Error responses are a status code and a one-line description with no body schema, though codes such as TRANSCRIPT_TOO_LARGE and VALIDATION_ERROR are named in prose (9 of 15). The path is versioned v1 and a changelog runs from v1.0.0 in February 2026 to v1.6.0 in October 2026, labelled by month, while the OpenAPI document still says version 1.0.0 (11 of 15).

Zoom Realtime Media Streams (RTMS) 71

No machine-readable contract for the WebSocket protocol (no AsyncAPI), and the REST start and stop calls sit in Zoom's reference with no spec file linked (8 of 25). llms.txt and a Markdown copy of each page (10). Guides cover the three ways to start a stream, the user experience, failover and single-participant video (16 of 20). Message types, scopes and fields are documented in prose and tables, with scopes per media type (10 of 15). Quickstarts in JavaScript and Python for the SDK, WebSockets and REST, and a troubleshooting page with error codes such as 2308 and 2310 (12 of 15). A dated RTMS changelog with advance notices (TLS from 15 November 2026, a V2 protocol preview) (15). 8+10+16+10+12+15 = 71.

Granola 70

API keys go in a Bearer header, carry Personal notes, Public notes or both, and can be edited and revoked. Workspace keys do not expire. Audit and legal hold keys do one job each, capped at five active keys. The MCP server uses OAuth with S256 PKCE, dynamic client registration and one scope, mcp, or enterprise-managed authorisation (25 of 30). The notes API cannot edit or delete notes, Enterprise admins can limit scopes and switch off transcripts for MCP, and webhook payloads carry no note content. A notes key can still register a webhook to any public HTTPS URL (16 of 20). Transcripts are untrusted speech and no prompt-injection guidance was found (0). The Audit API records each API key use and MCP tool call for a year, on Enterprise only (12 of 15). SOC 2 Type II, a valid security.txt, a disclosure policy with safe harbour and paid rewards, and published post-mortems. No formal bug bounty (17 of 20).

Zoom Realtime Media Streams (RTMS) 63

OAuth 2.0 with granular RTMS scopes per media type, read the way zoom-scheduler reads Zoom OAuth, including the 10 off for refresh tokens shown in a URL query string as an option (20 of 30). Least privilege is strong. Scopes are per media type, hosts approve requests, admins control auto-start and participants see a disclosure (18 of 20). Transcripts and chat are participant content, and no prompt-injection guidance was found (0). Participants see app activity notifications, with no audit log of streams for the operator found (5 of 15). Zoom's security.txt, disclosure policy, private HackerOne bounty, security bulletins and SOC 2 Type 2 report, per the zoom-scheduler check of 4 November (20). 20+18+0+5+20 = 63.