Linq vs Telnyx API + MCP

Linq 40

No x402, MPP or L402 (0). Public plan prices only, Hobby $0 and Pro from $260 a month, with no per-message fee (10 of 20). Hobby is free with no card, and the Pro trial needs no card (20). linq signup creates an account, an API key and a number from a terminal, but a person has to read back the emailed code, so half (10 of 20). 0 + 10 + 20 + 10 = 40.

Telnyx API + MCP 65

x402 exists on Telnyx's own API at /v2/x402/credit_account (USDC on Base), with MPP at /v2/machine-payments/account-credit (Stripe Link or Tempo USDC), but both top up account credit rather than pay per message. Telnyx's x402 skill says x402 sits behind an account feature flag (403 when it's off) and that per-payment minimum and maximum limits are configurable and stated in 422 errors; the MPP skill names no flag (25 of 40). Per-part SMS and MMS rates and carrier passthrough fees are published without a login, also as pricing.md (20). No free credit, a new account starts at zero (0). An agent can sign up through /v2/bot_challenge and /v2/bot_signup, confirm by a magic link sent to a mailbox it can read, mint a key at /v2/api_keys and fund the account by MPP or x402 with no browser (20).

Linq 50

Bearer API keys in a header, never in the query string, rotated or revoked in the dashboard, scoped to the account with no per-action or read-only scopes (20 of 30). Sandbox keys reach only verified handles, and the MCP server's --code-allow-http-gets and method allow and block lists limit its code tool; no approval step for sends (10 of 20). Inbound iMessage and SMS text reaches the agent, and no prompt-injection guidance was found in the docs or the MCP instructions (0 of 15). Every response carries a trace_id; no operator request log was found in the docs (5 of 15). SOC 2 Type II reports for 2024, 2025 and 2026 and a 2026 penetration test on request, a vulnerability disclosure policy open on the trust centre and SECURITY.md in the SDK repository; no security.txt or bug bounty (15 of 20). 20 + 10 + 0 + 5 + 15 = 50.

Telnyx API + MCP 45

Bearer API keys created and revoked in the portal, with no per-key scopes found. Claude connectors can authorise through the portal instead, and the OAuth authorisation-server metadata, re-read on 1 November, still lists 32 product scopes such as messaging.read, messaging.write and numbers.write, but no document says how a client picks them or that a token is held to them, so the line stays at plain revocable keys (20). No read-only key mode found. The hosted MCP's invoke_api_endpoint carries destructiveHint true but can send messages or buy numbers with no confirmation step on Telnyx's side (0 of 20). Inbound SMS and WhatsApp bodies are untrusted text. Messaging webhooks are signed, and we found no prompt-injection guidance (5 of 15). Message and detail records by API, with no account audit log found (10 of 15). SOC 2 Type II and ISO 27001 per Telnyx's compliance file, and telnyx-node has a SECURITY.md with a reporting route. security.txt returned 404 at both locations on 1 November and no bug bounty found (10 of 20). 20 + 0 + 5 + 10 + 10 = 45.