Kudosity vs Photon

Kudosity 57

kudosity-mcp 0.5.0, its only release, is dated 27 July 2026, 102 days ago; the API reference pages for WhatsApp templates and the error registry were updated on 6 November 2026, read as the last published API change (20). The changelog's six newest entries carry no dates. Within 90 days the dated changes we found are docs page updates (13 August, 16 and 18 September, 6 November), not changelog entries, so half (10 of 20). Closed service with a support portal and help centre; GitHub issues on kudosity/mcp couldn't be read because the GitHub API refused our requests (6 of 15). com.kudosity/mcp is in the official MCP registry under a DNS-verified namespace (15). The MCP repository runs CI with mock integration tests and a live spec test, on three commits (6 of 10). 20 + 10 + 6 + 15 + 6 = 57.

Photon 78

spectrum-ts v12.14.0 tagged on 22 October 2026 (30). Nine tagged releases since 6 August, v12.8.0 (20 August), v12.9.0, v12.9.1, v12.10.0, v12.10.1, v12.11.0, v12.12.0 (16 October), v12.13.0 (21 October) and v12.14.0 (22 October), and the Beta API clients tagged 0.2.0 to 0.6.0 between 1 and 22 October (20). The SDK is open source, but GitHub issue pages are closed to our reader. Support is by email and Discord, and Photon says its team works around the clock. The weekly updates are announcements, not answers (8 of 25, per 16 October). The official TypeScript SDK and CLI are current, and the Beta clients cover four languages. No messaging MCP server, so no registry entry (12 of 15). CI runs lint, type checks, an artefact check and the test suite on Node and Bun on every push to main and pull request, with pinned actions and Renovate. Results unread (8 of 10). 30 + 20 + 8 + 12 + 8 = 78.

Kudosity 85

Read with the hosted lines. status.transmitsms.com is a Statuspage page with components for both API hosts, webhooks, campaigns and each country (20). Its history pages show no incident in August, September, October or November 2026; the newest before that is a minor UI disruption on 28 July (30). 15 calls a second per account, documented (15). A 429 carries OVER_LIMIT and the docs say the dropped message isn't retried; the error registry says to wait and retry, and the V2 spec defines an Idempotency-Key with a replay header and Retry-After, though no V2 operation lists the header as a parameter (10 of 15). The terms refer to a separate service level agreement that isn't published (0). SMS, MMS and WhatsApp on V2 are generally available; RCS is marked beta (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

Photon 67

Read with the hosted lines for Spectrum Cloud, the managed lines the SDK connects to. status.photon.codes runs on incident.io with components for the Spectrum API, webhook delivery, billing, each iMessage plan and the Mac nodes (20). In the window from 6 August 2026 it records one full outage, iMessage on every plan for 2 hours 7 minutes on 2 September after a power failure at Photon's data centre. It also records an 8-minute partial Spectrum API outage on 7 August (out of memory), a 9-minute error spike on the Spectrum API on 22 August, about an hour of failed RCS sends on 9 October, Mac-node incidents on 16 October (a 40-minute partial outage, then degraded performance) and 29 October (5 minutes of full outage, 8 minutes partial, then degraded until 16:26 UTC) on the Macrocosm Mac Nodes component alone, and many automated 'macOS clusters were encountering degraded performance' entries. Single-component incidents read as minor (10 of 30). Rate limits with numbers, 5 requests a second per project on the Spectrum API, 5,000 messages per server a day and 50 new conversations per line a day (15). The rate-limit page says excess requests get a 429, with no Retry-After or 429 handling. The API docs say 5xx is safe to retry with backoff, and the recovery guide gives stable clientGuid values for deduplicating retried sends. Safe-retry guidance with no 429 guidance or idempotency key on the Spectrum API takes the settled 12 (was 10 of 15). No SLA document. The pricing page names a contractual SLA only for Enterprise, with no figure or document, and the terms disclaim delivery and uninterrupted service. A listed SLA nobody can read gives 0 (was 3 of 10). The Stable product is generally available (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.

Kudosity 32

No x402, MPP or L402 (0). SMS is priced per part without login, 8.0 cents AUD ex GST pay as you go; MMS, RCS and WhatsApp are on request (12 of 20). A 14-day developer trial whose form asks for no card (20). A person signs up in a browser and verifies by email (0). 0 + 12 + 20 + 0 = 32.

Photon 20

No x402, MPP or L402 (0). Plan prices are public. Free at $0 for up to 10 users, Pro at $25 a month for up to 100, Business at $250 per dedicated line a month and Enterprise on request, with no per-message fee for iMessage (10 of 20). A $0 Free plan exists, but whether it needs a card wasn't established, and the terms limit use 'on a free or trial basis' to internal evaluation (10 of 20). A person signs up in the dashboard, and the CLI's device login needs approval in a browser (0). 0 + 10 + 10 + 0 = 20.

Kudosity 86

OpenAPI 3.0.3 files for V2 (16 paths, 23 operations) and V1 are public on developers.kudosity.com, and the MCP tools have typed zod inputs (25). llms.txt per section and a Markdown twin of every page (10). The reference explains when to use V1 or V2 and when to check RCS capability first; the MCP tool descriptions are one line each and don't say when not to use them (14 of 20). Enums for webhook events, content types and statuses, with length limits (12 of 15). Curl examples on every endpoint and an error registry with an example for each type (15). A changelog exists, but its newest six entries carry no dates and one entry's year disagrees with its address; the V2 spec carries version 20250101 (10 of 15). 25 + 10 + 14 + 12 + 15 + 10 = 86.

Photon 75

Read for the Stable surface. Public OpenAPI 3.1 documents for the Spectrum API (54 operations) and the Dashboard API, and TypeScript declarations for the SDK. Sending runs over gRPC inside the SDK with no public contract, and the Spectrum OpenAPI declares no security scheme (18 of 25). llms.txt, llms-full.txt, a Markdown twin of every page and a documentation MCP server (10). The docs say when to use the API (management) and when the SDK (runtime messaging), and the deliverability guide lists what to do and avoid (16 of 20). Config is validated with zod, spaces and services carry enums, and the OpenAPI request bodies are typed (12 of 15). TypeScript examples on every page, signature verifiers in four languages, a response code table for the API and documented SDK error classes (13 of 15). spectrum-ts follows semver and reached 12.14.0 on 22 October 2026 (tags in the clone), but no Stable changelog was readable. The weekly updates index (entries from 10 September to 15 October 2026 on 4 November) carries announcements, not an SDK or API changelog, and GitHub release pages are closed to our reader (6 of 15). 18 + 10 + 16 + 12 + 13 + 6 = 75.

Kudosity 73

19 compact MCP tools, including four that look up endpoints in the live specs instead of loading them, with no toolsets or read-only subset; V2 list calls take limits and date presets (17 of 25). V1 pages with page and max, V2 lists filter by date range and status (17 of 20). Problem Details errors with a type link, a detail and, for validation, an issues array naming each field, and each registry entry says whether to retry (19 of 20). Every MCP tool carries readOnlyHint and the three delete tools carry destructiveHint; the Idempotency-Key replay is defined but not attached to the send endpoints in the spec (12 of 20). A send needs three fields. Official packages are the MCP server and LangChain.js tools, both JavaScript, with no SDK in a second language (8 of 15). 17 + 17 + 19 + 12 + 8 = 73.

Photon 63

Read for the TypeScript SDK an agent server runs. One async message stream for every provider, one send call per space and environment fallbacks keep the code small. Management responses can't be sized beyond list limits (17 of 25). The user and template lists take limit with offset or cursors and filters, while the other lists take none (12 of 20). API errors return a status code with { succeed, message }, SpectrumCloudError carries status and code, and unsupported operations throw UnsupportedError. No error-code catalogue for Stable was found (13 of 20). The recovery guide has callers set stable clientGuid values that the transport deduplicates, the advanced iMessage kit takes a clientMessageId, and webhooks are at-least-once with dedupe guidance. Spectrum API writes take no idempotency key (13 of 20). imessage.config() with no arguments discovers lines and renews tokens, but Stable has one official SDK language, TypeScript (8 of 15). 17 + 12 + 13 + 13 + 8 = 63.

Kudosity 37

One account-wide API key on V2 and Basic auth with the key and a secret the user types in on V1, both in headers. No scopes, read-only keys or rotation steps were found (12 of 30). No least-privilege mode. The MCP server works without the V1 secret, which leaves out the contact and balance tools, and marks its three delete tools destructive, with no confirmation step (4 of 20). Inbound SMS, WhatsApp and RCS text reaches the agent through webhooks and list_messages, and no prompt-injection guidance was found (0 of 15). Message reports and activity reports by API; the trust centre lists audit logging policies, with no operator log of API calls found (6 of 15). ISO/IEC 27001:2022 and SOC 2 Type 2 stated on kudosity.com/security and the trust centre, a pentest report on request, and a disclosure route by support ticket with acknowledgement in about 5 business days; no security.txt or bug bounty (15 of 20). 12 + 4 + 0 + 6 + 15 = 37.

Photon 29

Project ID and secret over HTTP Basic for the Spectrum API. The secret grants full management access to the project, doesn't expire on its own and is rotated with photon projects regenerate-secret. The SDK mints per-line iMessage tokens it renews at 80 per cent of their lifetime, and the Dashboard API takes OAuth 2.1 with PKCE and consented scopes. No secret in a URL is documented (17 of 30). No read-only project credential. The CLI asks before removing a user (3 of 20). Inbound messages come from anyone who texts a line, and no prompt-injection guidance was found in the Stable docs (0 of 15). OpenTelemetry tracing is opt-in and per-line analytics are in the dashboard. API logs and traces arrive with Photon 2.0, not Stable (4 of 15). No security.txt on photon.codes. The Beta API clients' repository has a SECURITY.md with private vulnerability reporting and no acknowledgement time, while spectrum-ts has none, and the privacy policy mentions regular penetration testing. No bug bounty or certification was found, and osv.dev lists nothing for spectrum-ts, @photon-ai or photonhq-api on 4 November. The policy covers only the Beta clients, so the line keeps its partial 5 of 20 rather than the settled 7. 17 + 3 + 0 + 4 + 5 = 29.