Linq vs WhatsApp Business Platform (Cloud API)

Linq 83

@linqapp/sdk and @linqapp/sdk-mcp 0.80.0 on 5 November 2026 (30). Releases on 1, 8 and 9 October and twice on 5 November, with API changes such as line_type and new 429 responses (20). Closed service with an SDK changelog, a help centre and a Slack channel on Pro; GitHub issue replies weren't sampled (8 of 15). io.github.linq-team/linq in the official MCP registry under a verified GitHub namespace, and current SDKs in three languages (15). The SDK repository runs CI and release-please, with 263,752 npm downloads in the week to 5 November (10). 30 + 20 + 8 + 15 + 10 = 83.

WhatsApp Business Platform (Cloud API) 34

Closed service. The newest dated API change found is the OpenAPI document's update on 11 August 2026, still its last commit on 1 November and 82 days ago, after Graph API v26.0 on 29 July (20). One dated change since 3 August, and per the 8 October check the WhatsApp changelog's last entry is 12 May 2026, so the three-entry line isn't met (0). Per the 8 October check, a changelog, developer support, a community forum, bug reports and Direct Support with a 24-hour first-response aim for partners, with one changelog entry in 2026 (8). No current official SDK. The Node.js SDK is archived at 0.0.5-Alpha from April 2023, and the MCP server isn't in the official MCP registry (3). The OpenAPI repository has had no commit since 11 August and is still at v23.0 (3). Meta's developer pages weren't re-read on 1 November, so a newer changelog entry would be unseen. 34.

Linq 90

The MCP server has two tools, code execution against the SDK and docs search, so its definitions cost little context (25). Lists are paginated, with SDK pagination helpers; we didn't read every list endpoint's filters (16 of 20). Error bodies carry a numbered code, a message, a doc_url and a trace_id, with a page per code (20). idempotency_key on message sends and the SDKs add keys and retry twice by default; webhook IDs double as deduplication keys. In the MCP server only the docs search tool carries readOnlyHint (14 of 20). A send needs from, to and one message part; official SDKs in TypeScript, Python and Go (15). 25 + 16 + 20 + 14 + 15 = 90.

WhatsApp Business Platform (Cloud API) 67

Per the 8 October check, not re-read on 1 November. Graph API reads take fields and limit, and one field, health_status, summarises whether a number can send. The MCP server isn't what we graded (20). Cursor paging on list edges and filters on template and analytics reads. Inbound messages can't be listed or paged and arrive only by webhook (18). Errors carry code, error_data.details and fbtrace_id, and the reference maps codes to causes and fixes. Some failures arrive only by webhook (18). No idempotency key for sends was found in the docs or the OpenAPI document, and webhook receivers must deduplicate. The MCP send tool asks for confirmation (5). A text send needs four fields. Receiving needs a public HTTPS server, and Meta has no current SDK for Cloud API since archiving its Node.js one (6).

Linq 50

Bearer API keys in a header, never in the query string, rotated or revoked in the dashboard, scoped to the account with no per-action or read-only scopes (20 of 30). Sandbox keys reach only verified handles, and the MCP server's --code-allow-http-gets and method allow and block lists limit its code tool; no approval step for sends (10 of 20). Inbound iMessage and SMS text reaches the agent, and no prompt-injection guidance was found in the docs or the MCP instructions (0 of 15). Every response carries a trace_id; no operator request log was found in the docs (5 of 15). SOC 2 Type II reports for 2024, 2025 and 2026 and a 2026 penetration test on request, a vulnerability disclosure policy open on the trust centre and SECURITY.md in the SDK repository; no security.txt or bug bounty (15 of 20). 20 + 10 + 0 + 5 + 15 = 50.

WhatsApp Business Platform (Cloud API) 67

Per the 8 October check for the credential, least-privilege, injection and audit lines, not re-read on 1 November (Meta's developer pages are paused for us). OAuth access tokens with permissions that separate messaging from account management, revocable, with a chosen expiry on system user tokens. The documented debug_token call passes the token to inspect as a query parameter, which costs 10 (20). System users can hold partial, view-only access to one WhatsApp Business account, and Meta reviews templates before they can be sent. The API has no approval step before a send (13). Inbound user messages are untrusted content. Meta's MCP documentation warns about prompt injection from webhook payloads and advises against write scopes for agents that read untrusted input. The Cloud API docs carry no such guidance (8). No audit log of API calls was found. Per-message status webhooks, fbtrace_id, and messaging and pricing analytics give partial visibility (7). Meta's bug bounty takes security reports, per the CONTRIBUTING file in facebook/openapi, read on 1 November. Per the 8 October check, the data privacy page names SOC 2 Type II and ISO 27001 reports for Cloud API, with HMAC-signed webhooks and optional mutual TLS. www.facebook.com and www.whatsapp.com disallow our crawler in robots.txt, so their security.txt files, read on 8 October, are struck and unchecked, and the line is read as the Meta Marketing API listing's was with security.txt unread (19).

Linq 93

OpenAPI 3.1 file for the Partner API and another for WhatsApp, both public (25). llms.txt, llms-full.txt and Markdown for every page (10). Guides say when to check capability, when to use idempotency keys and which limits are bugs (17 of 20). 93 enums in the spec and typed parts for messages (14 of 15). Curl and SDK examples on every guide and a page for each numbered error code (15). Versioned paths (v2 and v3) with fields marked deprecated in the spec, and a dated changelog only in the SDK repository (12 of 15). 25 + 10 + 17 + 14 + 15 + 12 = 93.

WhatsApp Business Platform (Cloud API) 82

Per the 8 October check, not re-read on 1 November, except the OpenAPI document. A public OpenAPI 3.1 document in facebook/openapi with 78 paths, 113 operations and 369 schemas, unchanged since 11 August 2026 on 1 November. It is pinned to v23.0 while the Graph API is at v26.0, so 3 off (22). llms.txt indexes and a Markdown copy of every guide and reference page (10). Guides explain when a template is required, when the service window applies and which token type suits which developer. Reference text is thin in places, and the send endpoint's description reads only Send Message (13). Request schemas carry types, required marks and 201 enum lists, with templates and interactive messages as nested objects (12). Request examples on most pages, example webhook payloads and an error code reference. Examples mix v17.0, v23.0 and v25.0 (13). Graph API versions with a dated table, and a WhatsApp changelog whose only 2026 entry is 12 May (12).

Linq 83

Read with the hosted lines. status.linqapp.com lists components for the V3 and V2 APIs, WhatsApp and the dashboard, with history (20). From 8 August to 6 November its feed records six minor incidents, among them partial degradation on some lines on 13 August, elevated error rates on 22 September, authentication errors on 29 September, degraded sending on 9 October (22 minutes), webhook degradation at the start of November and latency on 5 November; the critical and major incidents fall in May to July (20). Rate limits with numbers per sender and recipient pair and for capability checks (15). 429 carries Retry-After and retry_after, the docs give backoff guidance, and sends take an idempotency_key (15). llms.txt states 99.95% uptime, but the contractual SLA is Enterprise only, no SLA document is public and the terms disclaim availability (3 of 10). Partner API v3 is generally available (10). 20 + 20 + 15 + 15 + 3 + 10 = 83.

WhatsApp Business Platform (Cloud API) 75

Graded on the public Cloud API, with the hosted lines. metastatus.com lists the WhatsApp Business Platform with a Cloud API component, an incident history and availability and latency figures, per the 8 October check (20). Per the 8 October check, the Cloud API component showed no incident in the 90 days to 8 October 2026; the Marketing Messages API (19 July) and Meta Business Agent (1 October) incidents aren't the listed product and don't count. metastatus.com renders only with JavaScript and its history comes from the site's own data files, which this run doesn't call, and Meta hosts are paused for us beyond robots.txt, so the window since 8 October is unread. An unread part of the window is never credited, so the line is held at minor-only, as on the Meta Marketing API listing (20). Per the 8 October check, limits are published with numbers for throughput, per recipient and management calls (15). Throttling codes are documented with a 4^X second backoff rule for the per-recipient limit, with no Retry-After header on message sends and no idempotency key (10). No SLA found, and Meta's terms on www.facebook.com, which disallows our crawler, weren't read (0). Cloud API is generally available (10). 75.