Linq vs Vonage Messages API + MCP

Linq 90

The MCP server has two tools, code execution against the SDK and docs search, so its definitions cost little context (25). Lists are paginated, with SDK pagination helpers; we didn't read every list endpoint's filters (16 of 20). Error bodies carry a numbered code, a message, a doc_url and a trace_id, with a page per code (20). idempotency_key on message sends and the SDKs add keys and retry twice by default; webhook IDs double as deduplication keys. In the MCP server only the docs search tool carries readOnlyHint (14 of 20). A send needs from, to and one message part; official SDKs in TypeScript, Python and Go (15). 25 + 16 + 20 + 14 + 15 = 90.

Vonage Messages API + MCP 50

The Messages API sends and updates messages and returns a message_uuid. Lists and searches live in the separate Reports API (15 of 25). Filtering only through Reports (10 of 20). A shared error catalogue with codes an agent can look up (15 of 20). No idempotency key on sends, and channel-level rejections arrive later by status webhook after a 202 (0 of 20). SDKs in Node, Python and four more languages. Basic auth works for sends, but application webhooks need a JWT application (10 of 15).

Linq 50

Bearer API keys in a header, never in the query string, rotated or revoked in the dashboard, scoped to the account with no per-action or read-only scopes (20 of 30). Sandbox keys reach only verified handles, and the MCP server's --code-allow-http-gets and method allow and block lists limit its code tool; no approval step for sends (10 of 20). Inbound iMessage and SMS text reaches the agent, and no prompt-injection guidance was found in the docs or the MCP instructions (0 of 15). Every response carries a trace_id; no operator request log was found in the docs (5 of 15). SOC 2 Type II reports for 2024, 2025 and 2026 and a 2026 penetration test on request, a vulnerability disclosure policy open on the trust centre and SECURITY.md in the SDK repository; no security.txt or bug bounty (15 of 20). 20 + 10 + 0 + 5 + 15 = 50.

Vonage Messages API + MCP 73

Sends can be authorised with an application JWT signed RS256, whose ACL claim limits paths and methods and whose lifetime runs from 30 seconds to 24 hours, or with Basic auth on the account key and secret (30). JWT ACLs can narrow a token, with no confirmation step for sends (15 of 20). Inbound messages are untrusted text. Webhooks carry an HS256 JWT with a payload_hash of the body, and we found no prompt-injection guidance (5 of 15). Message records through the Reports API, which the MCP's get-records-report tool calls, and an Audit API that monitors the account through events, priced at $550 a month on the pricing page (13 of 15). Per the 2 October check (www.vonage.com answered a bot check on 1 November), the security page says Vonage holds ISO 27001, PCI-DSS, SOC, HITRUST and CSA STAR across its product lines without saying which cover the Communications APIs, and links a CSA STAR registry entry. www.vonage.com/.well-known/security.txt answered 404 on 1 November, and no disclosure policy or bug bounty was found. OSV lists no advisory for @vonage/server-sdk, vonage, @vonage/messages or the MCP package (10 of 20).

Linq 72

Closed service with clear terms from Linq App Inc. (14 April 2026); SDKs, MCP server and CLI are Apache-2.0 (15 of 30). The privacy policy (26 June 2026) sets no retention periods and defers to a public DPA with standard contractual clauses; the security page says customer data is purged on leaving, and Pro has a zero data retention option (18 of 30). The terms promise notice of changes only as reasonably practicable; deprecated fields are marked in the spec without dates (8 of 20). Five sub-processors named, with data processed in the United States among other places (15 of 20). 15 + 18 + 8 + 15 = 56.

Vonage Messages API + MCP 49

Closed service. The legal hub, DPA and privacy pages are per the 2 October check, since www.vonage.com answered a bot check on 1 November. The API terms set the contracting entity by region in a schedule, and the terms body didn't render for our reader on 2 October either. The MCP server is Apache-2.0 (15). The legal hub links a Data Processing Addendum and HIPAA BAAs are sold as an add-on, but we found no retention periods, and the privacy policy page rendered only as a landing page (13 of 30). SDK deprecation warnings, but no dated deprecation policy found (0 of 20). No sub-processor list or data locations found on the legal hub, the security page or the DPA landing page (0).

Linq 83

Read with the hosted lines. status.linqapp.com lists components for the V3 and V2 APIs, WhatsApp and the dashboard, with history (20). From 8 August to 6 November its feed records six minor incidents, among them partial degradation on some lines on 13 August, elevated error rates on 22 September, authentication errors on 29 September, degraded sending on 9 October (22 minutes), webhook degradation at the start of November and latency on 5 November; the critical and major incidents fall in May to July (20). Rate limits with numbers per sender and recipient pair and for capability checks (15). 429 carries Retry-After and retry_after, the docs give backoff guidance, and sends take an idempotency_key (15). llms.txt states 99.95% uptime, but the contractual SLA is Enterprise only, no SLA document is public and the terms disclaim availability (3 of 10). Partner API v3 is generally available (10). 20 + 20 + 15 + 15 + 3 + 10 = 83.

Vonage Messages API + MCP 77

Statuspage at vonageapi.statuspage.io with components and history (20). Its history pages, read on 1 November, list 565 entries from 3 August, 444 of them maintenance, 101 minor and 20 with no impact set, and none major or critical. Messaging incidents hit one carrier, country or region, such as outbound SMS in the APAC region for 19 minutes on 21 October and T-Mobile delivery on a subset of 10DLC numbers on 1 October, so partial and minor (20). The earlier IsDown count is struck, since a third-party copy of a status page isn't evidence in this run. The Messages API allows 75 requests a second per API key by default, and exceeding it returns 429 (15). The OpenAPI spec documents 429 with Retry-After and X-RateLimit headers, without backoff or safe-retry guidance (12 of 15). No SLA found on the legal hub or security page, per the 2 October check, not re-read on 1 November (0). The Messages API is generally available (10). 20 + 20 + 15 + 12 + 0 + 10 = 77.