Kudosity vs WhatsApp Business Platform (Cloud API)

Kudosity 37

One account-wide API key on V2 and Basic auth with the key and a secret the user types in on V1, both in headers. No scopes, read-only keys or rotation steps were found (12 of 30). No least-privilege mode. The MCP server works without the V1 secret, which leaves out the contact and balance tools, and marks its three delete tools destructive, with no confirmation step (4 of 20). Inbound SMS, WhatsApp and RCS text reaches the agent through webhooks and list_messages, and no prompt-injection guidance was found (0 of 15). Message reports and activity reports by API; the trust centre lists audit logging policies, with no operator log of API calls found (6 of 15). ISO/IEC 27001:2022 and SOC 2 Type 2 stated on kudosity.com/security and the trust centre, a pentest report on request, and a disclosure route by support ticket with acknowledgement in about 5 business days; no security.txt or bug bounty (15 of 20). 12 + 4 + 0 + 6 + 15 = 37.

WhatsApp Business Platform (Cloud API) 67

Per the 8 October check for the credential, least-privilege, injection and audit lines, not re-read on 1 November (Meta's developer pages are paused for us). OAuth access tokens with permissions that separate messaging from account management, revocable, with a chosen expiry on system user tokens. The documented debug_token call passes the token to inspect as a query parameter, which costs 10 (20). System users can hold partial, view-only access to one WhatsApp Business account, and Meta reviews templates before they can be sent. The API has no approval step before a send (13). Inbound user messages are untrusted content. Meta's MCP documentation warns about prompt injection from webhook payloads and advises against write scopes for agents that read untrusted input. The Cloud API docs carry no such guidance (8). No audit log of API calls was found. Per-message status webhooks, fbtrace_id, and messaging and pricing analytics give partial visibility (7). Meta's bug bounty takes security reports, per the CONTRIBUTING file in facebook/openapi, read on 1 November. Per the 8 October check, the data privacy page names SOC 2 Type II and ISO 27001 reports for Cloud API, with HMAC-signed webhooks and optional mutual TLS. www.facebook.com and www.whatsapp.com disallow our crawler in robots.txt, so their security.txt files, read on 8 October, are struck and unchecked, and the line is read as the Meta Marketing API listing's was with security.txt unread (19).

Kudosity 57

kudosity-mcp 0.5.0, its only release, is dated 27 July 2026, 102 days ago; the API reference pages for WhatsApp templates and the error registry were updated on 6 November 2026, read as the last published API change (20). The changelog's six newest entries carry no dates. Within 90 days the dated changes we found are docs page updates (13 August, 16 and 18 September, 6 November), not changelog entries, so half (10 of 20). Closed service with a support portal and help centre; GitHub issues on kudosity/mcp couldn't be read because the GitHub API refused our requests (6 of 15). com.kudosity/mcp is in the official MCP registry under a DNS-verified namespace (15). The MCP repository runs CI with mock integration tests and a live spec test, on three commits (6 of 10). 20 + 10 + 6 + 15 + 6 = 57.

WhatsApp Business Platform (Cloud API) 34

Closed service. The newest dated API change found is the OpenAPI document's update on 11 August 2026, still its last commit on 1 November and 82 days ago, after Graph API v26.0 on 29 July (20). One dated change since 3 August, and per the 8 October check the WhatsApp changelog's last entry is 12 May 2026, so the three-entry line isn't met (0). Per the 8 October check, a changelog, developer support, a community forum, bug reports and Direct Support with a 24-hour first-response aim for partners, with one changelog entry in 2026 (8). No current official SDK. The Node.js SDK is archived at 0.0.5-Alpha from April 2023, and the MCP server isn't in the official MCP registry (3). The OpenAPI repository has had no commit since 11 August and is still at v23.0 (3). Meta's developer pages weren't re-read on 1 November, so a newer changelog entry would be unseen. 34.

Kudosity 62

Closed service with clear terms from Known Pty Ltd (23 September 2026); the MCP server is MIT (17 of 30). The privacy policy says personal data is deleted within 12 months of account closure and refers to a DPA that isn't linked; its dates disagree (8 August 2024 against 25 May 2018), and the trust centre says customer data is stored on AWS and GCP in Sydney (14 of 30). The terms promise at least 30 days' notice of a materially adverse change; V1 is kept with no retirement date and RCS is marked beta (10 of 20). Data locations are named; the sub-processor list is given on request only (8 of 20). 17 + 14 + 10 + 8 = 49.

WhatsApp Business Platform (Cloud API) 73

Editorial half only. Closed service with named terms and policies and an MIT OpenAPI document. The Meta Terms for WhatsApp Business Platform sit on www.facebook.com, which disallows our crawler, and weren't read (15). Per the 8 October check, the docs state Meta is processor for Cloud API and messages are kept at most 30 days and encrypted at rest. The WhatsApp Business Data Processing Terms read on 8 October sit on www.whatsapp.com, whose robots.txt disallows ClaudeBot, so that reading is struck and the docs' statements can't be checked against a second document (18). Graph API versions carry end dates about two years out, the pricing calendar fixes one, three and six months' notice, and deprecated fields are flagged in the docs, per the 8 October check (20). Processing is in Meta data centres with optional in-country storage, per the docs. The sub-processor terms read on 8 October are struck with the data processing terms, and no sub-processor list was read (8). 61.

Kudosity 85

Read with the hosted lines. status.transmitsms.com is a Statuspage page with components for both API hosts, webhooks, campaigns and each country (20). Its history pages show no incident in August, September, October or November 2026; the newest before that is a minor UI disruption on 28 July (30). 15 calls a second per account, documented (15). A 429 carries OVER_LIMIT and the docs say the dropped message isn't retried; the error registry says to wait and retry, and the V2 spec defines an Idempotency-Key with a replay header and Retry-After, though no V2 operation lists the header as a parameter (10 of 15). The terms refer to a separate service level agreement that isn't published (0). SMS, MMS and WhatsApp on V2 are generally available; RCS is marked beta (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

WhatsApp Business Platform (Cloud API) 75

Graded on the public Cloud API, with the hosted lines. metastatus.com lists the WhatsApp Business Platform with a Cloud API component, an incident history and availability and latency figures, per the 8 October check (20). Per the 8 October check, the Cloud API component showed no incident in the 90 days to 8 October 2026; the Marketing Messages API (19 July) and Meta Business Agent (1 October) incidents aren't the listed product and don't count. metastatus.com renders only with JavaScript and its history comes from the site's own data files, which this run doesn't call, and Meta hosts are paused for us beyond robots.txt, so the window since 8 October is unread. An unread part of the window is never credited, so the line is held at minor-only, as on the Meta Marketing API listing (20). Per the 8 October check, limits are published with numbers for throughput, per recipient and management calls (15). Throttling codes are documented with a 4^X second backoff rule for the per-recipient limit, with no Retry-After header on message sends and no idempotency key (10). No SLA found, and Meta's terms on www.facebook.com, which disallows our crawler, weren't read (0). Cloud API is generally available (10). 75.

Kudosity 32

No x402, MPP or L402 (0). SMS is priced per part without login, 8.0 cents AUD ex GST pay as you go; MMS, RCS and WhatsApp are on request (12 of 20). A 14-day developer trial whose form asks for no card (20). A person signs up in a browser and verifies by email (0). 0 + 12 + 20 + 0 = 32.

WhatsApp Business Platform (Cloud API) 40

Per the 8 October check, not re-read on 1 November. No x402, MPP or L402 (0). Per-message pricing is public without a login, as CSV and PDF rate cards in 16 currencies and an interactive table on whatsappbusiness.com. We couldn't open the rate files and scored the line on the public pages that list them (20). A test WhatsApp Business account and number send template messages with no payment method (20). A person has to create a Meta account, a developer app and a system user in a browser (0).

Kudosity 73

19 compact MCP tools, including four that look up endpoints in the live specs instead of loading them, with no toolsets or read-only subset; V2 list calls take limits and date presets (17 of 25). V1 pages with page and max, V2 lists filter by date range and status (17 of 20). Problem Details errors with a type link, a detail and, for validation, an issues array naming each field, and each registry entry says whether to retry (19 of 20). Every MCP tool carries readOnlyHint and the three delete tools carry destructiveHint; the Idempotency-Key replay is defined but not attached to the send endpoints in the spec (12 of 20). A send needs three fields. Official packages are the MCP server and LangChain.js tools, both JavaScript, with no SDK in a second language (8 of 15). 17 + 17 + 19 + 12 + 8 = 73.

WhatsApp Business Platform (Cloud API) 67

Per the 8 October check, not re-read on 1 November. Graph API reads take fields and limit, and one field, health_status, summarises whether a number can send. The MCP server isn't what we graded (20). Cursor paging on list edges and filters on template and analytics reads. Inbound messages can't be listed or paged and arrive only by webhook (18). Errors carry code, error_data.details and fbtrace_id, and the reference maps codes to causes and fixes. Some failures arrive only by webhook (18). No idempotency key for sends was found in the docs or the OpenAPI document, and webhook receivers must deduplicate. The MCP send tool asks for confirmation (5). A text send needs four fields. Receiving needs a public HTTPS server, and Meta has no current SDK for Cloud API since archiving its Node.js one (6).