Infobip API + MCP vs Prelude

Infobip API + MCP 82

Closed service with clear service terms (15). Privacy notice, a data retention notice, a data transfer agreement, information security terms and a sub-processor page, per the 1 October check (25 of 30). A deprecation policy, re-read on 4 November, says deprecated endpoints keep working until a sunset date, are flagged in the OpenAPI file and in Deprecation, Sunset and Link response headers, and trigger email to active users. Infobip sets the period per endpoint with no fixed minimum, and no dated messaging notice was found in the release notes read (10 of 20, as the Infobip Calls listing). The sub-processor page says where customer data is stored and accessed, lists the EU region-locked data centre separately, and sends change alerts by email, per the 1 October check (15 of 20). 15 + 25 + 10 + 15 = 65.

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.

Infobip API + MCP 66

The MCP servers split by channel, from 1 or 2 tools on the Message server to 27 on RCS, with SMS at 10, re-read in the repository on 4 November. API lists weren't checked for field selection (18 of 25). Message logs and delivery reports by API, filters not re-checked (15 of 20). An error code reference and a handling-errors guide that says which errors to retry (15 of 20). No idempotency key, but the handling-errors guide says a retried send may deliver twice and to look the message up in the logs or wait for a delivery report first (10 of 20, documented retry semantics without a key, as the Infobip Calls listing, scalekit-agentkit and deepl-api). The official Python client's last release was 6.0.0 in January 2026, the JavaScript SDK's in 2023, and each account has its own base URL (8 of 15). 18 + 15 + 15 + 10 + 8 = 66.

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

Infobip API + MCP 70

The Jasper release notes of 14 October 2026 carry messaging items, among them RCS interactive-session traffic split in webhooks and WhatsApp country bid multipliers (30). Three dated entries in the 90 days from 6 August, the Ink release notes (9 September), Jasper (14 October) and the MCP repository's Observe server for delivery metrics and message logs (12 September) (20). Closed service with release notes and support (8 of 15). The MCP is in the official registry as com.infobip/mcp, and the official Python client 6.0.0 (22 January 2026) is current, while the JavaScript SDK's last release was in November 2023 (10 of 15). The JavaScript SDK's dependencies are stale (2 of 10). 30 + 20 + 8 + 10 + 2 = 70.

Prelude 83

@prelude.so/sdk 0.16.0 published to npm on 16 October 2026, 21 days ago, carrying API updates (30). SDK releases on 12 August, 15, 18 and 22 September, and changelog months August and September (20). Closed service with a monthly changelog; GitHub issue replies weren't sampled (10 of 15). Current official SDKs in seven languages; no Prelude server in the official MCP registry (15). The SDK repository runs CI and publish workflows (8 of 10). 30 + 20 + 10 + 15 + 8 = 83.

Infobip API + MCP 74

API keys with scopes, expiry dates and optional IP allowlists, plus OAuth 2.0. The hosted MCP servers accept OAuth 2.1 with discovery (30). Scopes separate reading logs from sending traffic, and splitting MCP servers by job keeps an agent to one channel. No confirmation step before sends (15 of 20). Inbound messages are untrusted text. Webhook subscriptions can carry HMAC signatures (X-Hub-Signature), Basic or OAuth credentials or mTLS so an endpoint can verify events, as the webhooks page read on 4 November for the Infobip Calls listing says, but there is no prompt-injection guidance (0 of 15). Message logs and delivery reports by API, and the Account Management MCP lists audit logs among its tools (12 of 15). security.txt, re-read on 4 November, is valid to 2030 and points to a coordinated vulnerability disclosure policy, and the security procedures page says to email Infobip to request access to its bug bounty on Bugcrowd. ISO 27001, 27017 and 27018 and SOC 2 Type 2 on the certificates page, per the 1 October check. No public advisories found (17 of 20, as the Infobip Calls listing and Perplexity's decision-model listing read a disclosure programme, a private Bugcrowd bounty and SOC 2). 30 + 15 + 0 + 12 + 17 = 74.

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

Infobip API + MCP 72

Statuspage at status.infobip.com with components and history (20). Its history pages, re-read on 4 November, list no incident since 6 August that stopped the messaging APIs everywhere. The largest were a Global (Europe) traffic processing degradation on 15 August (03:42 to 05:52 UTC), a Global (Europe) Customer Portal and HTTP API degradation on 26 August (11:41 to 12:56 UTC), processing issues in five regions on 25 September (12:27 to 12:57 UTC, the United States not among them), SMPP down for accounts on US infrastructure from 23:02 UTC on 19 October to 00:40 on 20 October, and a US HTTP API degradation on 28 October (17:15 to 17:42 UTC). Each names one region, a group of regions, one channel or one protocol, so this run reads them as partial and minor (20), where the 1 October check read the 10 and 15 August Europe degradations as two majors (5). The 1 October third-party incident count (IsDown) is struck, a barred status mirror. The rate-limits page gives numbers for some messaging endpoints (120 requests a minute for SMS logs, 60 for Email logs and reports), says most send endpoints have none and that each endpoint's reference lists its limits, but the references render by script and weren't read (10 of 15). The rate-limits and handling-errors pages give exponential backoff with a retry cap for 429, and say a retried send may deliver twice, Infobip has no public idempotency key, and to check message logs or delivery reports before retrying (12, safe-retry guidance without a key, as the Infobip Calls listing). No SLA found (0). The SMS and WhatsApp APIs are generally available, and the Message, Provision and Observe MCP servers are early access (10). 20 + 20 + 10 + 12 + 0 + 10 = 72.

Prelude 65

Read with the hosted lines. status.prelude.so has components for Verify, Auth, Watch, Intel, Notify and the dashboard, with history (20). From 8 August to 6 November its feed records one major incident, increased error rates and latencies across the APIs on 16 and 17 August, posted after it was resolved with no duration stated, and minor ones such as Verify latency on 9 and 10 August, SMS degradation in China and on Orange France and delayed webhooks on 23 October (10). No numeric API rate limits were found; only the MCP server's limits and per-window Verify retry limits are documented (7 of 15). A 429 carries Retry-After and X-Should-Retry, and repeating the create call inside the window performs a retry rather than a new verification (13 of 15). The pricing page lists a 99.95 SLA on Enterprise with no SLA document found (5 of 10). Verify and Notify v2 are generally available (10). 20 + 10 + 7 + 13 + 5 + 10 = 65.

Infobip API + MCP 25

No x402, MPP or L402 (0). Per-country SMS prices are public but shown as averages across networks, with per-network prices in the portal. The page's wording was re-read on 4 November, while its figures load by script and rest on the 30 September check (15 of 20). The free trial page, re-read on 4 November, gives self-signup accounts 60 days with free credits that cover about 100 messages a channel, sending only to the phone number and email address verified at sign-up. It doesn't say whether a card is needed (10 of 20). A person signs up in a browser (0). 0 + 15 + 10 + 0 = 25.

Prelude 30

No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.