Kudosity vs Sinch Messaging APIs + MCP

Kudosity 57

kudosity-mcp 0.5.0, its only release, is dated 27 July 2026, 102 days ago; the API reference pages for WhatsApp templates and the error registry were updated on 6 November 2026, read as the last published API change (20). The changelog's six newest entries carry no dates. Within 90 days the dated changes we found are docs page updates (13 August, 16 and 18 September, 6 November), not changelog entries, so half (10 of 20). Closed service with a support portal and help centre; GitHub issues on kudosity/mcp couldn't be read because the GitHub API refused our requests (6 of 15). com.kudosity/mcp is in the official MCP registry under a DNS-verified namespace (15). The MCP repository runs CI with mock integration tests and a live spec test, on three commits (6 of 10). 20 + 10 + 6 + 15 + 6 = 57.

Sinch Messaging APIs + MCP 83

Dated Conversation API release notes, the latest dated entry on 14 October 2026, and @sinch/sdk-core 1.8.0, sinch (Python) 2.4.0 and sinch-sdk-java 2.4.0 tagged on 28 October 2026 (30). Release notes on 19 August, 2 October and 14 October, plus SDK tags (Node 1.6.0, 1.7.0, 1.8.0, Python 2.2.0, 2.3.0, 2.4.0, Java 2.2.0, 2.3.0, 2.4.0) in the 90 days (20). Closed service with Conversation release notes. The MCP repository tagged 0.0.1-beta.7 on 30 October 2026, its first tag since 0.0.1-alpha6 on 14 April (10 of 15). Official SDKs current in Node, Python, Java and .NET (15). The MCP repository runs lint, build and tests in CI (8 of 10). 30 + 20 + 10 + 15 + 8 = 83.

Kudosity 73

19 compact MCP tools, including four that look up endpoints in the live specs instead of loading them, with no toolsets or read-only subset; V2 list calls take limits and date presets (17 of 25). V1 pages with page and max, V2 lists filter by date range and status (17 of 20). Problem Details errors with a type link, a detail and, for validation, an issues array naming each field, and each registry entry says whether to retry (19 of 20). Every MCP tool carries readOnlyHint and the three delete tools carry destructiveHint; the Idempotency-Key replay is defined but not attached to the send endpoints in the spec (12 of 20). A send needs three fields. Official packages are the MCP server and LangChain.js tools, both JavaScript, with no SDK in a second language (8 of 15). 17 + 17 + 19 + 12 + 8 = 73.

Sinch Messaging APIs + MCP 50

We didn't confirm page-size or field controls on message lists (10 of 25). Pagination and filters not confirmed (10 of 20). Error responses with codes, and back-off advice for 5xx (15 of 20). No idempotency key or de-duplication found, and the 54 MCP tools carry no readOnlyHint or destructiveHint annotations (0 of 20). Official SDKs in Node, Python, Java and .NET. A send names an app, a recipient, a channel and a message object (15).

Kudosity 37

One account-wide API key on V2 and Basic auth with the key and a secret the user types in on V1, both in headers. No scopes, read-only keys or rotation steps were found (12 of 30). No least-privilege mode. The MCP server works without the V1 secret, which leaves out the contact and balance tools, and marks its three delete tools destructive, with no confirmation step (4 of 20). Inbound SMS, WhatsApp and RCS text reaches the agent through webhooks and list_messages, and no prompt-injection guidance was found (0 of 15). Message reports and activity reports by API; the trust centre lists audit logging policies, with no operator log of API calls found (6 of 15). ISO/IEC 27001:2022 and SOC 2 Type 2 stated on kudosity.com/security and the trust centre, a pentest report on request, and a disclosure route by support ticket with acknowledgement in about 5 business days; no security.txt or bug bounty (15 of 20). 12 + 4 + 0 + 6 + 15 = 37.

Sinch Messaging APIs + MCP 55

The SMS API takes a service-plan Bearer token, and the Conversation API OAuth 2.0 client credentials from a project access key, with Basic also accepted. No per-key scopes found (25 of 30). No read-only mode or confirmation step. The MCP server's tool allow-list (--tags, or MCP_TAGS since 0.0.1-beta.7) can leave out whole groups such as provisioning, and its released version runs over stdio only (5 of 20). Inbound messages are untrusted text. Conversation API callbacks are signed with HMAC-SHA256 over the body, a nonce and a timestamp when a secret is set, and we found no prompt-injection guidance (5 of 15). Message and delivery lookups by API, no audit log found (10 of 15). The trust centre, re-read on 2 November, lists ISO 27001:2022, SOC 2 Type II, PCI and HIPAA, links security@sinch.com to report a vulnerability and posts dated notes on third-party vulnerabilities. No security.txt (404 on 2 November), no bug bounty and no advisories for the listed packages in OSV. Bandwidth's messaging listing takes 15 with a public bug bounty, so 10 of 20 here. 25 + 5 + 5 + 10 + 10 = 55.

Kudosity 62

Closed service with clear terms from Known Pty Ltd (23 September 2026); the MCP server is MIT (17 of 30). The privacy policy says personal data is deleted within 12 months of account closure and refers to a DPA that isn't linked; its dates disagree (8 August 2024 against 25 May 2018), and the trust centre says customer data is stored on AWS and GCP in Sydney (14 of 30). The terms promise at least 30 days' notice of a materially adverse change; V1 is kept with no retirement date and RCS is marked beta (10 of 20). Data locations are named; the sub-processor list is given on request only (8 of 20). 17 + 14 + 10 + 8 = 49.

Sinch Messaging APIs + MCP 77

Closed service with general terms. The contracting Sinch entity is named only in the order form (15). Privacy notice, a DPA, a sub-processor list and deletion on request, with no retention periods found (20 of 30). Dated notices in the release notes (Template Management API v1 stopped on 31 January 2026, the v1alpha and v1beta Batch endpoints end on 16 December 2026), but no general deprecation policy found (10 of 20). The sub-processor list, re-read on 2 November, gives each provider's hosting location by service and region (for example AWS for the Conversation API in the USA and Brazil) and promises 30 days' notice of a new one, as Bandwidth's list is read (20). 15 + 20 + 10 + 20 = 65.

Kudosity 85

Read with the hosted lines. status.transmitsms.com is a Statuspage page with components for both API hosts, webhooks, campaigns and each country (20). Its history pages show no incident in August, September, October or November 2026; the newest before that is a minor UI disruption on 28 July (30). 15 calls a second per account, documented (15). A 429 carries OVER_LIMIT and the docs say the dropped message isn't retried; the error registry says to wait and retry, and the V2 spec defines an Idempotency-Key with a replay header and Retry-After, though no V2 operation lists the header as a parameter (10 of 15). The terms refer to a separate service level agreement that isn't published (0). SMS, MMS and WhatsApp on V2 are generally available; RCS is marked beta (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

Sinch Messaging APIs + MCP 73

Statuspage at status.sinch.com with components and history (20). Read from its own history and incident pages on 2 November (the 1 October count from IsDown, a third-party copy of the page, is struck). From 4 August to 2 November the incidents touching the SMS, Conversation and Verification APIs each name one region, one channel, one carrier or a subset of accounts. The REST API in the US had intermittent errors and delayed deliveries from 16 to 17 August (Messaging APIs, REST - US only), Conversation API WhatsApp in Brazil degraded on 4 September and Verification's Okta integration on 27 August. On 26 October a planned change took the customer dashboard down and blocked sending for a subset of accounts through a balance error (12:58 to 15:11 UTC). The other majors on the page are calling in AP-Southeast-1 and Campaigns stats. Partial incidents read as minor, so minor only (20). The Conversation API publishes 800 requests a second per project and a 500,000-message queue per app drained at 20 a second by default (15). Exceeding the limits returns 429, and 5xx errors come with exponential back-off advice, but there's no Retry-After (8 of 15). No SLA found (0). The SMS and Conversation APIs are generally available. The MCP server is a developer preview (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.

Kudosity 32

No x402, MPP or L402 (0). SMS is priced per part without login, 8.0 cents AUD ex GST pay as you go; MMS, RCS and WhatsApp are on request (12 of 20). A 14-day developer trial whose form asks for no card (20). A person signs up in a browser and verifies by email (0). 0 + 12 + 20 + 0 = 32.

Sinch Messaging APIs + MCP 40

No x402, MPP or L402 (0). US SMS prices are published per sender type ($0.0078 a message on 10DLC and toll-free, $0.009 on short code, re-read on 2 November), and other countries and WhatsApp through a country selector without a login (20). Trial credit of 2 units of local currency and a test number, with a payment method needed only to upgrade, per Sinch's community and Voice account pages (20). A person signs up in a browser (0). 0 + 20 + 20 + 0 = 40.