MeetStream vs Nylas Notetaker API

MeetStream 42

A key grants full access to its workspace's bots and data, and workspaces separate keys. MCP sign-in is OAuth, which mints a key per connection. No scopes or read-only keys found (15 of 30). delete_bot_data needs confirm: true and is marked destructive, and remove_bot keeps recordings, with no read-only mode (10 of 20). Transcripts, chat and audio come from meeting participants, and no prompt-injection guidance was found (0). A dashboard bot detail page and signed webhooks, with no audit log of API calls found (5 of 15). ISO 27001 certified (630036), SOC 2 Type 2 under audit, HIPAA with a BAA, a trust centre and HMAC-signed webhooks. No security.txt (404) or bug bounty found (12 of 20). 15+10+0+5+12 = 42.

Nylas Notetaker API 78

Nylas IAM keys, launched 6 October 2026, bind a caller to one grant, workspace, application or organisation with roles and permissions, and can expire. The IAM guide (last updated 9 October) shows principals and credentials can also be created, rotated and revoked through a public /v3/iam API once a first management key is made in the Dashboard, as read for nylas-email. Application keys still reach every grant, and the IAM pages we read don't list Notetaker permissions by name. Keys travel in the Authorization header only. 1 is held back for the application key, as for nylas-email, and 1 because no Notetaker permission is named (28). IAM allows least-privilege callers, but delete is a hard delete with no confirmation step, and the MCP server's confirmation covers email sends only (12). The docs tell developers to treat email and calendar content as untrusted. No guidance names transcripts or meeting chat (8). IAM Access Activity records allowed and denied requests for 400 days, Config Changes records IAM edits, and each Notetaker has a history endpoint (13). The security page lists SOC 2 Type II, ISO 27001, ISO 27701, HIPAA and CSA STAR, a vulnerability disclosure programme, a private bug bounty and annual penetration tests. developer.nylas.com serves an RFC 9116 security.txt with security@nylas.com, valid to 1 August 2027, while www.nylas.com returns 404. That is the evidence nylas-email's 17 rests on, so the line matches it (17). 28+12+8+13+17 = 78.

MeetStream 45

Graded on the hosted REST API and MCP server with the hosted lines. No public status page was found, linked or at status.meetstream.ai (0), so no incident history could be read (5). Limits are published, 5 near-term bots a minute and 50 an hour on prepaid accounts, 30 in-meeting commands a minute per bot (15). 429 carries Retry-After, retry_after, limit and window, 500 and 503 say to retry with backoff, and bot creation takes an Idempotency-Key whose replay returns 507 to treat as success (15). No SLA found in the Terms or on the pricing page (0). Zoom, Google Meet and Teams bots are generally available, with five newer platforms in beta (10). 0+5+15+15+0+10 = 45.

Nylas Notetaker API 78

Graded on the hosted lines for the REST API. status-v3.nylas.com is a public status page with Notetaker as its own component and a dated history feed (20). The degraded Zoom joins of 17 to 23 July (resolved 23 July 13:54 PDT) left the 90-day window. From 3 August to 1 November the one Notetaker incident is degraded Teams joins for a very limited subset of US meetings on 4 September (11:34 to 14:47 PDT, marked minor), so minor incidents only (20). The 19 August incident, delayed or missing webhooks for every email and calendar provider in the US and EU (09:11 to 14:34 PDT), holds nylas-email's line at 10. Its page lists only the Webhooks v3 component, not Notetaker, and its updates speak of affected Microsoft, Google and then all provider grants, mitigated by recovering their sync state. Notetaker events don't pass through provider grant sync and no update names Notetaker, so it isn't counted here. Limits are published as 200 requests a second per grant and 50 a second per application, but the table names no Notetaker row (12). 429 handling is documented with backoff guidance, Retry-After arrives only when a provider supplies it, and invites accept no idempotency key, so a retry can send a second bot (9). The pricing page lists a 99.99 per cent availability SLA for annual Enterprise contracts, with full terms in the customer agreement, as read for nylas-email (7). No beta or preview label was found on the Notetaker docs (10). 20+20+12+9+7+10 = 78.

MeetStream 57

Closed service with clear terms of 7 August 2026 naming MeetStream Corp. (15 of 30). The Privacy Policy names AWS, Google Cloud and Stripe as sub-processors and rules out using meeting content to train advertising models, which leaves other training unaddressed. Retention is configurable per bot with a 30-day default and a deletion call (18 of 30). Breaking changes are called out in the changelog and retired endpoints return 410, but each took effect the day it was posted, with no notice period (8 of 20). Sub-processors named, data locations not stated (10 of 20). 15+18+8+10 = 51.

Nylas Notetaker API 77

Closed service with Terms of Use naming Nylas, Inc., and MIT SDKs and CLI. The terms describe email, calendar and contacts and do not mention Notetaker (15). The docs state a 14-day default media retention, a 5-minute to 30-day range and permanent deletion, and the Privacy Policy defers to the API docs for end-user data. The policy does not mention meeting recordings, the DPA is available only through sales, and the security page says Nylas does not sell personal information while the policy says website activity data was sold and shared for advertising in the prior 12 months (19). Legacy Notetaker fields are marked deprecated with a migration page and no removal date. No written deprecation policy was found, and the terms allow Nylas to change or end any part of the Services without notice (6). The sub-processor list gives data, purpose and locations and is dated 28 August 2026, with changes announced on the status page. Oxylabs appears as a status-page dependency but not on that list (18).

MeetStream 88

19 MCP tools (15), plus 2 because media come back as links rather than inline files (17 of 25). Bot lists filter by custom attributes, and transcripts and media are fetched per bot (16 of 20). Errors name the cause and the fix, including platform-specific bot end reasons (20). Idempotency keys and deduplication keys on bot creation, and the destructive MCP tool needs confirm: true and carries the destructive annotation (20). Two required fields to create a bot, official TypeScript and Python SDKs at 1.x and a CLI (15). 17+16+20+20+15 = 88.

Nylas Notetaker API 77

Media comes back as download links, select trims responses to named top-level fields, and limit caps list size (20). List calls page by cursor with next_cursor and page_token, 50 by default and 200 at most, with filters by state and join time and three sort fields (20). Errors carry type, message and request_id, join failures name a reason such as bad_meeting_link or entry_denied, and the media endpoint separates 404 for processing from 410 for deleted (17). Invites accept no idempotency key and every request schedules a new bot. Deduplication covers only Notetakers with a future join_time, and the media endpoint is documented as idempotent (6). An invite needs only meeting_link, and SDKs exist for Node.js, Python, Ruby and Kotlin/Java. The quickstart's SDK samples still use the deprecated name and meeting_settings fields (14).

MeetStream 83

No OpenAPI file was found linked from the docs or llms.txt. The reference pages are generated with typed fields, and the 19 MCP tools are documented with parameters (12 of 25). llms.txt per section, a Markdown copy of every page and a docs MCP server (10). Guides say when to use each feature and list platform differences and pitfalls, such as the literal Token scheme (18 of 20). Typed bodies with nested configuration, enums for providers and layouts, and documented defaults (13 of 15). Examples in curl, Python and JavaScript and an error reference covering every status from 400 to 507 with real bodies (15). /api/v1 paths and a dated changelog that flags breaking changes (15). 12+10+18+13+15+15 = 83.

Nylas Notetaker API 89

A public OpenAPI 3.1 file covers 244 operations on 140 paths, 23 of them for Notetaker (25). llms.txt, llms-full.txt and a Markdown twin of every page are served (10). Operation descriptions say what each call does and when it applies, such as cancel before joining, leave while attending and delete in any state (16). Notetaker schemas use enums for state, recording type and ordering, ranges for retention and silence timeout, and one required field, with no untyped objects found (13). Each operation documents its 400, 401, 404, 409, 410 and 429 responses, and the media endpoints now a 207 for partial results, with examples and code samples in five languages. The error type is a plain string and the error table lists no Notetaker-specific types (12). The path is versioned as v3 and a dated changelog with an Atom feed tags Notetaker entries. No dated versions within v3 were found (13).