Kudosity vs Twilio API + MCP

Kudosity 37

One account-wide API key on V2 and Basic auth with the key and a secret the user types in on V1, both in headers. No scopes, read-only keys or rotation steps were found (12 of 30). No least-privilege mode. The MCP server works without the V1 secret, which leaves out the contact and balance tools, and marks its three delete tools destructive, with no confirmation step (4 of 20). Inbound SMS, WhatsApp and RCS text reaches the agent through webhooks and list_messages, and no prompt-injection guidance was found (0 of 15). Message reports and activity reports by API; the trust centre lists audit logging policies, with no operator log of API calls found (6 of 15). ISO/IEC 27001:2022 and SOC 2 Type 2 stated on kudosity.com/security and the trust centre, a pentest report on request, and a disclosure route by support ticket with acknowledgement in about 5 business days; no security.txt or bug bounty (15 of 20). 12 + 4 + 0 + 6 + 15 = 37.

Twilio API + MCP 85

API keys come as standard, main or restricted. Restricted keys are generally available, take up to 100 endpoint permissions each (page modified 3 August 2026, re-read on 1 November), and can be created and revoked in the console or by API. No documented option to send a secret in a query string (30). A restricted key can leave out number purchase or log reads, but no Twilio MCP asks before a send (15 of 20). Inbound SMS and WhatsApp bodies are untrusted text. Webhooks are signed with X-Twilio-Signature, and the alpha MCP README warns about injection through other MCP servers (10 of 15). The Monitor Events API keeps an audit trail of account changes, and every message has a log resource, per the 1 October check, not re-read on 1 November (15). The security page, re-read on 1 November, lists a vulnerability disclosure programme, a HackerOne bug bounty, SOC 2 Type II and ISO 27001, 27017 and 27018. No security.txt (www.twilio.com/.well-known/security.txt still returns 404 on 1 November), and OSV lists no advisories for the twilio npm package (15 of 20).

Kudosity 57

kudosity-mcp 0.5.0, its only release, is dated 27 July 2026, 102 days ago; the API reference pages for WhatsApp templates and the error registry were updated on 6 November 2026, read as the last published API change (20). The changelog's six newest entries carry no dates. Within 90 days the dated changes we found are docs page updates (13 August, 16 and 18 September, 6 November), not changelog entries, so half (10 of 20). Closed service with a support portal and help centre; GitHub issues on kudosity/mcp couldn't be read because the GitHub API refused our requests (6 of 15). com.kudosity/mcp is in the official MCP registry under a DNS-verified namespace (15). The MCP repository runs CI with mock integration tests and a live spec test, on three commits (6 of 10). 20 + 10 + 6 + 15 + 6 = 57.

Twilio API + MCP 85

twilio-node 6.2.0 tagged on 2026-10-12, still the newest tag on 1 November, 20 days old (30). Releases 6.1.0 (2026-08-11), 6.1.1 (2026-09-10), 6.1.2 (2026-09-28) and 6.2.0 in the 90 days from 3 August (20). Closed service with a public changelog and paid support, which the changelog says gained live chat across the platform from 5 October. The twilio-labs/mcp repo's last commit and the last npm publish of @twilio-alpha/mcp (0.7.0) were on 2025-07-07, the commit re-read on 1 November and the npm publish per the 17 October check (10 of 15). Official SDKs current in seven languages, per the 1 October check (15). twilio-node needs Node 20 or later and runs CI on GitHub Actions (10).

Kudosity 62

Closed service with clear terms from Known Pty Ltd (23 September 2026); the MCP server is MIT (17 of 30). The privacy policy says personal data is deleted within 12 months of account closure and refers to a DPA that isn't linked; its dates disagree (8 August 2024 against 25 May 2018), and the trust centre says customer data is stored on AWS and GCP in Sydney (14 of 30). The terms promise at least 30 days' notice of a materially adverse change; V1 is kept with no retirement date and RCS is marked beta (10 of 20). Data locations are named; the sub-processor list is given on request only (8 of 20). 17 + 14 + 10 + 8 = 49.

Twilio API + MCP 81

Closed service with clear terms (last updated 16 July 2026, re-read on 1 November), Twilio Inc. or Twilio Ireland Limited by region. SDKs and the alpha MCP are MIT (15). Privacy notice, a DPA and a sub-processor list with change notifications. We didn't find a stated retention period for message logs on the pages we read (25 of 30). Dated deprecation notices in the changelog, though the Conference list default change, announced on 23 September for 30 September, came with seven days' notice (12 of 20). Sub-processors listed with processing locations (list last updated September 2026, re-read on 1 November), and Regional Twilio can keep customer content in Ireland or Australia (20). The privacy notice and DPA are per the 1 October check.

Kudosity 85

Read with the hosted lines. status.transmitsms.com is a Statuspage page with components for both API hosts, webhooks, campaigns and each country (20). Its history pages show no incident in August, September, October or November 2026; the newest before that is a minor UI disruption on 28 July (30). 15 calls a second per account, documented (15). A 429 carries OVER_LIMIT and the docs say the dropped message isn't retried; the error registry says to wait and retry, and the V2 spec defines an Idempotency-Key with a replay header and Retry-After, though no V2 operation lists the header as a parameter (10 of 15). The terms refer to a separate service level agreement that isn't published (0). SMS, MMS and WhatsApp on V2 are generally available; RCS is marked beta (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

Twilio API + MCP 75

Status page at status.twilio.com with per-product and per-carrier components (20). Its history pages, read on 1 November, list 562 incidents from 3 August to 31 October, 511 minor, 49 marked no impact and 2 major. Neither major was Programmable Messaging (Event Streams delivery stopped for 2 hours 17 minutes on 19 August, and Deepgram speech-to-text for ConversationRelay failed on 3 August), and most entries are single-carrier or single-country delivery problems. From 20:08 PDT on 7 October to 02:35 on 8 October, an internal block stopped Verify codes reaching users in several regions and Programmable SMS delivery failed intermittently across the affected regions, for 6 hours 27 minutes. Twilio marked it minor, but it was a Twilio-side failure on the send path for hours across regions, which we read as one major. On 1 September customers could get 502 errors on REST API calls and the Console from 09:24 PDT until Twilio reported normal operation at 10:40, 76 minutes, also marked minor. That is wide errors for over an hour on the API every send goes through, so we count a second major, as the 4 October Bird check read 75 minutes of wide API errors and as the Twilio Voice re-check reads the same incident. Since 17 October, possible 503 errors for messaging traffic hit some customers in the Australia region from 07:18 to 14:32 PDT on 28 October, one region and some customers, read as partial, and the Programmable Messaging API returned 500 errors for 53 seconds on 27 October. Two majors fall between the one-major and several-majors lines (5). Throughput is published per sender, 1 message a second on a US long code, 10 on a UK long code and 100 on a short code, and messages queue for 10 hours (36,000 seconds) by default, per the scaling guide re-read on 1 November (15). The scaling guide says to implement backoff and retries on queue overflow (error 30001), and the REST best-practices page, modified 20 July 2026, says a 429 means the request wasn't processed and can be safely retried, with exponential backoff (15). The Twilio APIs SLA, last updated 9 April 2026, commits 99.95 per cent to paying customers with service credits (10). Programmable Messaging is generally available (10). 20+5+15+15+10+10 = 75.

Kudosity 32

No x402, MPP or L402 (0). SMS is priced per part without login, 8.0 cents AUD ex GST pay as you go; MMS, RCS and WhatsApp are on request (12 of 20). A 14-day developer trial whose form asks for no card (20). A person signs up in a browser and verifies by email (0). 0 + 12 + 20 + 0 = 32.

Twilio API + MCP 40

No x402, MPP or L402 found in the docs, pricing or MCP pages on 1 November (0). Per-segment US prices, carrier fees by carrier and direction, number rental and the $0.001 failed-message fee are published without a login, re-read on 1 November (20). A 30-day trial without a card, with free units including 100 SMS, per the trials page modified 20 October 2026 (20). A person signs up in a browser and verifies an email address and a phone number (0).

Kudosity 73

19 compact MCP tools, including four that look up endpoints in the live specs instead of loading them, with no toolsets or read-only subset; V2 list calls take limits and date presets (17 of 25). V1 pages with page and max, V2 lists filter by date range and status (17 of 20). Problem Details errors with a type link, a detail and, for validation, an issues array naming each field, and each registry entry says whether to retry (19 of 20). Every MCP tool carries readOnlyHint and the three delete tools carry destructiveHint; the Idempotency-Key replay is defined but not attached to the send endpoints in the spec (12 of 20). A send needs three fields. Official packages are the MCP server and LangChain.js tools, both JavaScript, with no SDK in a second language (8 of 15). 17 + 17 + 19 + 12 + 8 = 73.

Twilio API + MCP 80

Message lists take PageSize and return next_page_uri, with no field selection (15 of 25). Lists filter by To, From and DateSent (20). Numbered error codes with causes and fixes (20). No idempotency key on message creation. A 429 is documented as safe to retry, and webhooks carry an I-Twilio-Idempotency-Token for de-duplication (10 of 20). A send needs To, a From or MessagingServiceSid, and a Body, MediaUrl or ContentSid. Official SDKs in seven languages (15). The Message resource page was re-read on 1 November; the webhook token and SDK count are per the 1 October check.