Kudosity vs Sendblue

Kudosity 85

Read with the hosted lines. status.transmitsms.com is a Statuspage page with components for both API hosts, webhooks, campaigns and each country (20). Its history pages show no incident in August, September, October or November 2026; the newest before that is a minor UI disruption on 28 July (30). 15 calls a second per account, documented (15). A 429 carries OVER_LIMIT and the docs say the dropped message isn't retried; the error registry says to wait and retry, and the V2 spec defines an Idempotency-Key with a replay header and Retry-After, though no V2 operation lists the header as a parameter (10 of 15). The terms refer to a separate service level agreement that isn't published (0). SMS, MMS and WhatsApp on V2 are generally available; RCS is marked beta (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

Sendblue 61

Read with the hosted lines. status.sendblue.com is an UptimeRobot page, kept at 20 as awarded on 8 October. Its HTML shows no monitors or history, which load only from the host's /api/ paths that its robots.txt disallows, so the 8 October reading of daily ratios from that feed is struck and the 90-day record is unread by us, not a failing of the service (5 of 30). Rate limits are published with numbers per plan and per line (15). The docs say to slow down or spread traffic on a 429 and to verify state after 504 outcome_unknown, with no Retry-After header documented and an idempotency key only on App Card updates (8 of 15). The API page shows a 99.9% Uptime SLA figure and the docs list custom SLAs for enterprise, but no SLA document was found and the terms disclaim availability (3 of 10). The REST API is generally available (10). 20 + 5 + 15 + 8 + 3 + 10 = 61.

Kudosity 86

OpenAPI 3.0.3 files for V2 (16 paths, 23 operations) and V1 are public on developers.kudosity.com, and the MCP tools have typed zod inputs (25). llms.txt per section and a Markdown twin of every page (10). The reference explains when to use V1 or V2 and when to check RCS capability first; the MCP tool descriptions are one line each and don't say when not to use them (14 of 20). Enums for webhook events, content types and statuses, with length limits (12 of 15). Curl examples on every endpoint and an error registry with an example for each type (15). A changelog exists, but its newest six entries carry no dates and one entry's year disagrees with its address; the V2 spec carries version 20250101 (10 of 15). 25 + 10 + 14 + 12 + 15 + 10 = 86.

Sendblue 66

We graded the REST API. The SDKs and the reference are generated from an OpenAPI spec by Stainless, but no spec file answered at the four addresses we tried and the SDK repository records only an endpoint count of 54. The published MCP package has JSON Schema inputs on its 18 tools (12 of 25). llms.txt and a Markdown twin of every docs page at /index.md (10). The reference and llms.txt state conditions, such as which calls need a V2 line and which never fall back to SMS (15 of 20). Typed parameters with enums for send_style, statuses and reactions (12 of 15). Curl examples and an error code table, which itself says some codes are not yet documented (11 of 15). Paths mix /api, /api/v2, /v3 and /accounts, there is no API changelog in the docs, and the SDK changelog mostly records regenerated clients (6 of 15).

Kudosity 57

kudosity-mcp 0.5.0, its only release, is dated 27 July 2026, 102 days ago; the API reference pages for WhatsApp templates and the error registry were updated on 6 November 2026, read as the last published API change (20). The changelog's six newest entries carry no dates. Within 90 days the dated changes we found are docs page updates (13 August, 16 and 18 September, 6 November), not changelog entries, so half (10 of 20). Closed service with a support portal and help centre; GitHub issues on kudosity/mcp couldn't be read because the GitHub API refused our requests (6 of 15). com.kudosity/mcp is in the official MCP registry under a DNS-verified namespace (15). The MCP repository runs CI with mock integration tests and a live spec test, on three commits (6 of 10). 20 + 10 + 6 + 15 + 6 = 57.

Sendblue 72

sendblue on npm is at 3.22.0 per the SDK changelog, dated 30 October 2026, with tags v3.20.0 (9 October), v3.20.1 (17 October), v3.21.0 (22 October), v3.21.1 (23 October) and v3.21.2 (30 October) since the last check. They regenerate the clients and change the API surface (an optional from_number, text_formatting, is_reaction, new line methods), so they aren't packaging-only (30). 20 SDK tags from v3.11.0 (17 August) to v3.21.2 (30 October), counted half as SDK tags, still well over three (20). No API changelog in the docs, support by email, and we couldn't read the GitHub issue trackers (6 of 15). Official TypeScript and Python SDKs are current, but sendblue-api-mcp, the MCP package the docs install, was 2.0.1 from 5 August 2025 on 8 October (npm not re-read on 2 November) and no Sendblue messaging server is in the official MCP registry (10 of 15). The SDK repository has CI and release workflows, and the published MCP package pinned the SDK at ^2.0.1 (6 of 10).

Kudosity 37

One account-wide API key on V2 and Basic auth with the key and a secret the user types in on V1, both in headers. No scopes, read-only keys or rotation steps were found (12 of 30). No least-privilege mode. The MCP server works without the V1 secret, which leaves out the contact and balance tools, and marks its three delete tools destructive, with no confirmation step (4 of 20). Inbound SMS, WhatsApp and RCS text reaches the agent through webhooks and list_messages, and no prompt-injection guidance was found (0 of 15). Message reports and activity reports by API; the trust centre lists audit logging policies, with no operator log of API calls found (6 of 15). ISO/IEC 27001:2022 and SOC 2 Type 2 stated on kudosity.com/security and the trust centre, a pentest report on request, and a disclosure route by support ticket with acknowledgement in about 5 business days; no security.txt or bug bounty (15 of 20). 12 + 4 + 0 + 6 + 15 = 37.

Sendblue 46

One key pair per account in two headers, never in the URL, plus temporary bearer tokens that can be limited to named phone numbers, expire after 900 seconds by default and can be revoked. Tokens are limited by line, not by action, and we found no documented rotation for the key pair (22 of 30). No read-only key. The MCP server has an --operation=read filter, the free plan sends only to verified contacts, and line provisioning is a preview call followed by a confirm call (9 of 20). Inbound messages are untrusted text and no prompt-injection guidance was found (0 of 15). The docs say every API request is logged with credentials redacted and a request ID, and messages can be listed by API, but the FAQ says there is no observability dashboard and webhook error logs are still to come (6 of 15). Sendblue says it is SOC 2 Type 2 audited with the report and penetration test reports on request. No security.txt, disclosure policy or bug bounty was found (9 of 20).

Kudosity 32

No x402, MPP or L402 (0). SMS is priced per part without login, 8.0 cents AUD ex GST pay as you go; MMS, RCS and WhatsApp are on request (12 of 20). A 14-day developer trial whose form asks for no card (20). A person signs up in a browser and verifies by email (0). 0 + 12 + 20 + 0 = 32.

Sendblue 40

No x402, MPP or L402 (0). Plan prices are public, $0 and $100 a month per line with no per-message fee, while the outbound plan is priced through sales (10 of 20). The free plan needs no card (20). The CLI creates an account and API keys with no browser, but a person has to text a one-time code from a phone or supply an email code, so half (10 of 20).