Kudosity vs Vonage Messages API + MCP

Kudosity 37

One account-wide API key on V2 and Basic auth with the key and a secret the user types in on V1, both in headers. No scopes, read-only keys or rotation steps were found (12 of 30). No least-privilege mode. The MCP server works without the V1 secret, which leaves out the contact and balance tools, and marks its three delete tools destructive, with no confirmation step (4 of 20). Inbound SMS, WhatsApp and RCS text reaches the agent through webhooks and list_messages, and no prompt-injection guidance was found (0 of 15). Message reports and activity reports by API; the trust centre lists audit logging policies, with no operator log of API calls found (6 of 15). ISO/IEC 27001:2022 and SOC 2 Type 2 stated on kudosity.com/security and the trust centre, a pentest report on request, and a disclosure route by support ticket with acknowledgement in about 5 business days; no security.txt or bug bounty (15 of 20). 12 + 4 + 0 + 6 + 15 = 37.

Vonage Messages API + MCP 73

Sends can be authorised with an application JWT signed RS256, whose ACL claim limits paths and methods and whose lifetime runs from 30 seconds to 24 hours, or with Basic auth on the account key and secret (30). JWT ACLs can narrow a token, with no confirmation step for sends (15 of 20). Inbound messages are untrusted text. Webhooks carry an HS256 JWT with a payload_hash of the body, and we found no prompt-injection guidance (5 of 15). Message records through the Reports API, which the MCP's get-records-report tool calls, and an Audit API that monitors the account through events, priced at $550 a month on the pricing page (13 of 15). Per the 2 October check (www.vonage.com answered a bot check on 1 November), the security page says Vonage holds ISO 27001, PCI-DSS, SOC, HITRUST and CSA STAR across its product lines without saying which cover the Communications APIs, and links a CSA STAR registry entry. www.vonage.com/.well-known/security.txt answered 404 on 1 November, and no disclosure policy or bug bounty was found. OSV lists no advisory for @vonage/server-sdk, vonage, @vonage/messages or the MCP package (10 of 20).

Kudosity 73

19 compact MCP tools, including four that look up endpoints in the live specs instead of loading them, with no toolsets or read-only subset; V2 list calls take limits and date presets (17 of 25). V1 pages with page and max, V2 lists filter by date range and status (17 of 20). Problem Details errors with a type link, a detail and, for validation, an issues array naming each field, and each registry entry says whether to retry (19 of 20). Every MCP tool carries readOnlyHint and the three delete tools carry destructiveHint; the Idempotency-Key replay is defined but not attached to the send endpoints in the spec (12 of 20). A send needs three fields. Official packages are the MCP server and LangChain.js tools, both JavaScript, with no SDK in a second language (8 of 15). 17 + 17 + 19 + 12 + 8 = 73.

Vonage Messages API + MCP 50

The Messages API sends and updates messages and returns a message_uuid. Lists and searches live in the separate Reports API (15 of 25). Filtering only through Reports (10 of 20). A shared error catalogue with codes an agent can look up (15 of 20). No idempotency key on sends, and channel-level rejections arrive later by status webhook after a 202 (0 of 20). SDKs in Node, Python and four more languages. Basic auth works for sends, but application webhooks need a JWT application (10 of 15).

Kudosity 57

kudosity-mcp 0.5.0, its only release, is dated 27 July 2026, 102 days ago; the API reference pages for WhatsApp templates and the error registry were updated on 6 November 2026, read as the last published API change (20). The changelog's six newest entries carry no dates. Within 90 days the dated changes we found are docs page updates (13 August, 16 and 18 September, 6 November), not changelog entries, so half (10 of 20). Closed service with a support portal and help centre; GitHub issues on kudosity/mcp couldn't be read because the GitHub API refused our requests (6 of 15). com.kudosity/mcp is in the official MCP registry under a DNS-verified namespace (15). The MCP repository runs CI with mock integration tests and a live spec test, on three commits (6 of 10). 20 + 10 + 6 + 15 + 6 = 57.

Vonage Messages API + MCP 80

vonage-python-sdk v4.9.1 tagged on 2026-10-21, fixing the SMS text length limit in the Messages package (30). In the 90 days from 3 August, vonage-node-sdk v3.30.0 (1 September) and v3.30.1 (8 September, a version bump only, counted half) and vonage-python-sdk v4.9.0 (16 September) and v4.9.1 (21 October), 3.5 in all. The developer changelog index carries only Video entries (20). Closed service with a changelog index and a support site. We didn't sample issue replies (8 of 15). Official SDKs current in six languages (15). The MCP repo runs CI, which since 21 October fails on test errors, but its last release is still v1.5.1 on 2026-05-26, with nine commits since then unreleased on 1 November (7 of 10). 30 + 20 + 8 + 15 + 7 = 80.

Kudosity 62

Closed service with clear terms from Known Pty Ltd (23 September 2026); the MCP server is MIT (17 of 30). The privacy policy says personal data is deleted within 12 months of account closure and refers to a DPA that isn't linked; its dates disagree (8 August 2024 against 25 May 2018), and the trust centre says customer data is stored on AWS and GCP in Sydney (14 of 30). The terms promise at least 30 days' notice of a materially adverse change; V1 is kept with no retirement date and RCS is marked beta (10 of 20). Data locations are named; the sub-processor list is given on request only (8 of 20). 17 + 14 + 10 + 8 = 49.

Vonage Messages API + MCP 49

Closed service. The legal hub, DPA and privacy pages are per the 2 October check, since www.vonage.com answered a bot check on 1 November. The API terms set the contracting entity by region in a schedule, and the terms body didn't render for our reader on 2 October either. The MCP server is Apache-2.0 (15). The legal hub links a Data Processing Addendum and HIPAA BAAs are sold as an add-on, but we found no retention periods, and the privacy policy page rendered only as a landing page (13 of 30). SDK deprecation warnings, but no dated deprecation policy found (0 of 20). No sub-processor list or data locations found on the legal hub, the security page or the DPA landing page (0).

Kudosity 85

Read with the hosted lines. status.transmitsms.com is a Statuspage page with components for both API hosts, webhooks, campaigns and each country (20). Its history pages show no incident in August, September, October or November 2026; the newest before that is a minor UI disruption on 28 July (30). 15 calls a second per account, documented (15). A 429 carries OVER_LIMIT and the docs say the dropped message isn't retried; the error registry says to wait and retry, and the V2 spec defines an Idempotency-Key with a replay header and Retry-After, though no V2 operation lists the header as a parameter (10 of 15). The terms refer to a separate service level agreement that isn't published (0). SMS, MMS and WhatsApp on V2 are generally available; RCS is marked beta (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

Vonage Messages API + MCP 77

Statuspage at vonageapi.statuspage.io with components and history (20). Its history pages, read on 1 November, list 565 entries from 3 August, 444 of them maintenance, 101 minor and 20 with no impact set, and none major or critical. Messaging incidents hit one carrier, country or region, such as outbound SMS in the APAC region for 19 minutes on 21 October and T-Mobile delivery on a subset of 10DLC numbers on 1 October, so partial and minor (20). The earlier IsDown count is struck, since a third-party copy of a status page isn't evidence in this run. The Messages API allows 75 requests a second per API key by default, and exceeding it returns 429 (15). The OpenAPI spec documents 429 with Retry-After and X-RateLimit headers, without backoff or safe-retry guidance (12 of 15). No SLA found on the legal hub or security page, per the 2 October check, not re-read on 1 November (0). The Messages API is generally available (10). 20 + 20 + 15 + 12 + 0 + 10 = 77.

Kudosity 32

No x402, MPP or L402 (0). SMS is priced per part without login, 8.0 cents AUD ex GST pay as you go; MMS, RCS and WhatsApp are on request (12 of 20). A 14-day developer trial whose form asks for no card (20). A person signs up in a browser and verifies by email (0). 0 + 12 + 20 + 0 = 32.

Vonage Messages API + MCP 37

No x402, MPP or L402 (0). Per the 2 October check of the pricing page, which answered a bot check on 1 November, Messenger is $0.0011 per delivered message, while SMS, MMS, RCS and WhatsApp rates appear per country through a selector or a downloadable sheet, with no login, and Viber is custom (17 of 20). Free trial with no card, per the pricing page, and €2 of test credit per the 30 September check (20). A person signs up in a browser (0).