Linq vs Twilio API + MCP

Linq 50

Bearer API keys in a header, never in the query string, rotated or revoked in the dashboard, scoped to the account with no per-action or read-only scopes (20 of 30). Sandbox keys reach only verified handles, and the MCP server's --code-allow-http-gets and method allow and block lists limit its code tool; no approval step for sends (10 of 20). Inbound iMessage and SMS text reaches the agent, and no prompt-injection guidance was found in the docs or the MCP instructions (0 of 15). Every response carries a trace_id; no operator request log was found in the docs (5 of 15). SOC 2 Type II reports for 2024, 2025 and 2026 and a 2026 penetration test on request, a vulnerability disclosure policy open on the trust centre and SECURITY.md in the SDK repository; no security.txt or bug bounty (15 of 20). 20 + 10 + 0 + 5 + 15 = 50.

Twilio API + MCP 85

API keys come as standard, main or restricted. Restricted keys are generally available, take up to 100 endpoint permissions each (page modified 3 August 2026, re-read on 1 November), and can be created and revoked in the console or by API. No documented option to send a secret in a query string (30). A restricted key can leave out number purchase or log reads, but no Twilio MCP asks before a send (15 of 20). Inbound SMS and WhatsApp bodies are untrusted text. Webhooks are signed with X-Twilio-Signature, and the alpha MCP README warns about injection through other MCP servers (10 of 15). The Monitor Events API keeps an audit trail of account changes, and every message has a log resource, per the 1 October check, not re-read on 1 November (15). The security page, re-read on 1 November, lists a vulnerability disclosure programme, a HackerOne bug bounty, SOC 2 Type II and ISO 27001, 27017 and 27018. No security.txt (www.twilio.com/.well-known/security.txt still returns 404 on 1 November), and OSV lists no advisories for the twilio npm package (15 of 20).

Linq 90

The MCP server has two tools, code execution against the SDK and docs search, so its definitions cost little context (25). Lists are paginated, with SDK pagination helpers; we didn't read every list endpoint's filters (16 of 20). Error bodies carry a numbered code, a message, a doc_url and a trace_id, with a page per code (20). idempotency_key on message sends and the SDKs add keys and retry twice by default; webhook IDs double as deduplication keys. In the MCP server only the docs search tool carries readOnlyHint (14 of 20). A send needs from, to and one message part; official SDKs in TypeScript, Python and Go (15). 25 + 16 + 20 + 14 + 15 = 90.

Twilio API + MCP 80

Message lists take PageSize and return next_page_uri, with no field selection (15 of 25). Lists filter by To, From and DateSent (20). Numbered error codes with causes and fixes (20). No idempotency key on message creation. A 429 is documented as safe to retry, and webhooks carry an I-Twilio-Idempotency-Token for de-duplication (10 of 20). A send needs To, a From or MessagingServiceSid, and a Body, MediaUrl or ContentSid. Official SDKs in seven languages (15). The Message resource page was re-read on 1 November; the webhook token and SDK count are per the 1 October check.

Linq 72

Closed service with clear terms from Linq App Inc. (14 April 2026); SDKs, MCP server and CLI are Apache-2.0 (15 of 30). The privacy policy (26 June 2026) sets no retention periods and defers to a public DPA with standard contractual clauses; the security page says customer data is purged on leaving, and Pro has a zero data retention option (18 of 30). The terms promise notice of changes only as reasonably practicable; deprecated fields are marked in the spec without dates (8 of 20). Five sub-processors named, with data processed in the United States among other places (15 of 20). 15 + 18 + 8 + 15 = 56.

Twilio API + MCP 81

Closed service with clear terms (last updated 16 July 2026, re-read on 1 November), Twilio Inc. or Twilio Ireland Limited by region. SDKs and the alpha MCP are MIT (15). Privacy notice, a DPA and a sub-processor list with change notifications. We didn't find a stated retention period for message logs on the pages we read (25 of 30). Dated deprecation notices in the changelog, though the Conference list default change, announced on 23 September for 30 September, came with seven days' notice (12 of 20). Sub-processors listed with processing locations (list last updated September 2026, re-read on 1 November), and Regional Twilio can keep customer content in Ireland or Australia (20). The privacy notice and DPA are per the 1 October check.

Linq 83

Read with the hosted lines. status.linqapp.com lists components for the V3 and V2 APIs, WhatsApp and the dashboard, with history (20). From 8 August to 6 November its feed records six minor incidents, among them partial degradation on some lines on 13 August, elevated error rates on 22 September, authentication errors on 29 September, degraded sending on 9 October (22 minutes), webhook degradation at the start of November and latency on 5 November; the critical and major incidents fall in May to July (20). Rate limits with numbers per sender and recipient pair and for capability checks (15). 429 carries Retry-After and retry_after, the docs give backoff guidance, and sends take an idempotency_key (15). llms.txt states 99.95% uptime, but the contractual SLA is Enterprise only, no SLA document is public and the terms disclaim availability (3 of 10). Partner API v3 is generally available (10). 20 + 20 + 15 + 15 + 3 + 10 = 83.

Twilio API + MCP 75

Status page at status.twilio.com with per-product and per-carrier components (20). Its history pages, read on 1 November, list 562 incidents from 3 August to 31 October, 511 minor, 49 marked no impact and 2 major. Neither major was Programmable Messaging (Event Streams delivery stopped for 2 hours 17 minutes on 19 August, and Deepgram speech-to-text for ConversationRelay failed on 3 August), and most entries are single-carrier or single-country delivery problems. From 20:08 PDT on 7 October to 02:35 on 8 October, an internal block stopped Verify codes reaching users in several regions and Programmable SMS delivery failed intermittently across the affected regions, for 6 hours 27 minutes. Twilio marked it minor, but it was a Twilio-side failure on the send path for hours across regions, which we read as one major. On 1 September customers could get 502 errors on REST API calls and the Console from 09:24 PDT until Twilio reported normal operation at 10:40, 76 minutes, also marked minor. That is wide errors for over an hour on the API every send goes through, so we count a second major, as the 4 October Bird check read 75 minutes of wide API errors and as the Twilio Voice re-check reads the same incident. Since 17 October, possible 503 errors for messaging traffic hit some customers in the Australia region from 07:18 to 14:32 PDT on 28 October, one region and some customers, read as partial, and the Programmable Messaging API returned 500 errors for 53 seconds on 27 October. Two majors fall between the one-major and several-majors lines (5). Throughput is published per sender, 1 message a second on a US long code, 10 on a UK long code and 100 on a short code, and messages queue for 10 hours (36,000 seconds) by default, per the scaling guide re-read on 1 November (15). The scaling guide says to implement backoff and retries on queue overflow (error 30001), and the REST best-practices page, modified 20 July 2026, says a 429 means the request wasn't processed and can be safely retried, with exponential backoff (15). The Twilio APIs SLA, last updated 9 April 2026, commits 99.95 per cent to paying customers with service credits (10). Programmable Messaging is generally available (10). 20+5+15+15+10+10 = 75.