Inworld Realtime API vs Retell AI API + MCP

Inworld Realtime API 60

No AsyncAPI or other machine-readable file for the socket, and the spec paths redirect (0). llms.txt, Markdown twins and a docs MCP server (10). The overview, OpenAI migration guide, providerData reference and the billing page's account of how a session is counted say what to use when (16 of 20). The reference lists every client and server event with field types and required marks, as text rather than a schema (12 of 15). JavaScript and Python example projects and an error event with type, code and param, without a list of codes (9 of 15). Dated release notes with affected clients and required actions, but no API version beyond /v1 (13 of 15). Total 60.

Retell AI API + MCP 92

OpenAPI at docs.retellai.com/openapi-final.yaml (25). llms.txt with descriptive one-line summaries for each page (10). Pages say when to use a single-prompt agent and when a conversation flow (16 of 20). Typed request bodies with enums and required fields (13 of 15). Examples throughout and typed errors in the SDKs (13 of 15). A dated changelog, SDK releases and a deprecation-notice page with an RSS feed (15).

Inworld Realtime API 58

Workspace API keys sent as Basic credentials, deleted to revoke, with separate keys per environment advised. The CLI mints read-only keys unless --write is given, but write toggles cover only the Voice and Router APIs, so no key is limited to one product. Browsers use short-lived tokens minted server side. Session IDs, not secrets, go in the URL (25 of 30). Tools run in the client, so the developer approves side effects, with no approval step in the API (10 of 20). The agent listens to callers and passes their speech to an LLM, and no prompt-injection guidance was found (5 of 15). Usage per key and a Performance page with errors and throttling (8 of 15). SOC 2 Type II and HIPAA claimed and a vulnerability report form, with no security.txt or bug bounty, per the 4 November reading (10 of 20). Total 58. Zero data retention covers session content from the Developer plan up, but not requests routed to third-party LLM providers.

Retell AI API + MCP 76

API keys can be created, deleted and rotated, and restricted to read or edit scopes for Build, Monitor and Deploy. Public keys for web calls can be limited to domains with reCAPTCHA (30). Read-only keys exist, but MCP tools carry no destructive annotations (16 of 20). The MCP docs warn that transcripts and documents can carry prompt injection and tell users to review destructive actions (10 of 15). Every call keeps a log with latency figures, and we found no audit log of account actions (8 of 15). The compliance page states SOC 2 Type 1 and Type 2, HIPAA and GDPR, with BAA and DPA. No security.txt or bug bounty found (12 of 20).

Inworld Realtime API 71

Release note of 16 October 2026 (cache_transcript), 21 days ago (30). Three dated Realtime entries in the 90 days from 8 August, on 14 September, 23 September and 16 October (20). Discord and support@inworld.ai, with no evidence of answers read (8 of 15). Works with OpenAI's Realtime clients and the CLI is current at 1.5.0, but there is no Inworld Realtime SDK (8 of 15). CLI on npm under MIT, CI not read (5 of 10). Total 71.

Retell AI API + MCP 85

TypeScript and Python SDKs v6.2.16 on 31 October 2026 (30). 19 SDK releases from 5 October to 31 October alone, plus 6.0.0 and 6.0.1 on 14 September (20). Public changelog and deprecation feed, support we didn't test (12 of 15 for a closed service). Node.js and Python SDKs current (15). SDK CI restored on 10 September (8 of 10).

Inworld Realtime API 63

Closed service with clear terms naming Theai, Inc. dba Inworld AI (15). The ZDR page says what a session keeps and that third-party LLM requests aren't covered, but the terms and privacy notice disagree on training (12 of 30). Release notes flag potentially breaking changes with the clients affected and what to do, without stating a notice period (14 of 20). US headquarters with EU and India residency on Enterprise, and no sub-processor list in the docs, while sessions may route to third-party LLM providers (10 of 20). Total 51.

Retell AI API + MCP 77

Closed platform with clear terms and Apache-2.0 SDKs (18 of 30). Call data is kept indefinitely unless a per-agent retention period from 1 to 730 days is set, and the compliance page covers BAA, DPA and erasure. The statements agree, though keeping data forever is the default (22 of 30). Dated deprecation notices with an RSS feed, such as the legacy MCP server shutdown on 20 July 2026 (20). The 27 May 2026 changelog announced new subprocessors (Soniox, Ironclad). We didn't check data locations (15 of 20).

Inworld Realtime API 68

Scored as an API. Conversation history defaults to the last 100 items, can be trimmed, and can be cached on Anthropic models, and every response.done carries a usage block (18 of 25). No lists to page. Output controls are modalities, turn detection settings, optional transcription and response.speak (12 of 20). Error events follow OpenAI's type and code shape, unsupported fields come back as non-fatal unsupported_field warnings, and item_not_found names the bad parameter (14 of 20). Tools run on the client and a follow-up response starts automatically after a tool result. Nothing covers side effects of a tool call cut off by an interruption (12 of 20). Works with OpenAI Realtime clients after changing the URL and key, with no Inworld Realtime SDK (12 of 15). Total 68.

Retell AI API + MCP 60

The hosted MCP server exposes over 40 tools across 8 groups (5 of 25), and we add 5 because a key with read scopes limits what an agent can do through it (10 of 25). Call lists filter and page (16 of 20). Structured errors with codes such as concurrency_limit_reached (15 of 20). No idempotency keys and no tool annotations. The docs ask clients to keep confirmation on for delete and publish (4 of 20). Typed SDKs for Node.js and Python with few required fields to place a call (15).