Photon vs Prelude

Photon 29

Project ID and secret over HTTP Basic for the Spectrum API. The secret grants full management access to the project, doesn't expire on its own and is rotated with photon projects regenerate-secret. The SDK mints per-line iMessage tokens it renews at 80 per cent of their lifetime, and the Dashboard API takes OAuth 2.1 with PKCE and consented scopes. No secret in a URL is documented (17 of 30). No read-only project credential. The CLI asks before removing a user (3 of 20). Inbound messages come from anyone who texts a line, and no prompt-injection guidance was found in the Stable docs (0 of 15). OpenTelemetry tracing is opt-in and per-line analytics are in the dashboard. API logs and traces arrive with Photon 2.0, not Stable (4 of 15). No security.txt on photon.codes. The Beta API clients' repository has a SECURITY.md with private vulnerability reporting and no acknowledgement time, while spectrum-ts has none, and the privacy policy mentions regular penetration testing. No bug bounty or certification was found, and osv.dev lists nothing for spectrum-ts, @photon-ai or photonhq-api on 4 November. The policy covers only the Beta clients, so the line keeps its partial 5 of 20 rather than the settled 7. 17 + 3 + 0 + 4 + 5 = 29.

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

Photon 63

Read for the TypeScript SDK an agent server runs. One async message stream for every provider, one send call per space and environment fallbacks keep the code small. Management responses can't be sized beyond list limits (17 of 25). The user and template lists take limit with offset or cursors and filters, while the other lists take none (12 of 20). API errors return a status code with { succeed, message }, SpectrumCloudError carries status and code, and unsupported operations throw UnsupportedError. No error-code catalogue for Stable was found (13 of 20). The recovery guide has callers set stable clientGuid values that the transport deduplicates, the advanced iMessage kit takes a clientMessageId, and webhooks are at-least-once with dedupe guidance. Spectrum API writes take no idempotency key (13 of 20). imessage.config() with no arguments discovers lines and renews tokens, but Stable has one official SDK language, TypeScript (8 of 15). 17 + 12 + 13 + 13 + 8 = 63.

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

Photon 75

Read for the Stable surface. Public OpenAPI 3.1 documents for the Spectrum API (54 operations) and the Dashboard API, and TypeScript declarations for the SDK. Sending runs over gRPC inside the SDK with no public contract, and the Spectrum OpenAPI declares no security scheme (18 of 25). llms.txt, llms-full.txt, a Markdown twin of every page and a documentation MCP server (10). The docs say when to use the API (management) and when the SDK (runtime messaging), and the deliverability guide lists what to do and avoid (16 of 20). Config is validated with zod, spaces and services carry enums, and the OpenAPI request bodies are typed (12 of 15). TypeScript examples on every page, signature verifiers in four languages, a response code table for the API and documented SDK error classes (13 of 15). spectrum-ts follows semver and reached 12.14.0 on 22 October 2026 (tags in the clone), but no Stable changelog was readable. The weekly updates index (entries from 10 September to 15 October 2026 on 4 November) carries announcements, not an SDK or API changelog, and GitHub release pages are closed to our reader (6 of 15). 18 + 10 + 16 + 12 + 13 + 6 = 75.

Prelude 93

OpenAPI for the 27 SDK endpoints is public at the URL in the SDK repository's .stats.yml, and every reference page embeds its endpoint's OpenAPI (25). llms.txt and Markdown pages (10). Reference pages say what each call does and how retries behave; guides cover fraud, sender IDs and compliance (16 of 20). Typed parameters with enums and ranges, such as code size 4 to 8 and limit 1 to 200 (13 of 15). Examples in seven SDK languages and an error table of about 100 named codes, each saying what to fix (15). Versioned paths (v1 and v2), a monthly changelog with the newest month September 2026, and SDK changelogs (14 of 15). 25 + 10 + 16 + 13 + 15 + 14 = 93.

Photon 57

spectrum-ts, its providers, imessage-kit and the CLI are MIT, while Spectrum Cloud and the managed lines are closed. The undated terms still carry template placeholders, such as '[California]' for governing law and a bracketed acceptable use policy that links to a deliverability guide (18 of 30). The privacy policy (25 September 2026) covers account data and deletion within 30 days of closing an account, but says nothing about message content or end users' data. The terms let Photon use de-identified Usage Data to train its models. No DPA or retention period for messages was found (8 of 30). No deprecation policy. Migration notes for removed SDK options carry no dates (4 of 20). SDK telemetry is opt-in and documented with its OTLP endpoint. Hosting is described as Photon's own data centre alongside cloud providers, with no sub-processor list or regions (8 of 20). 18 + 8 + 4 + 8 = 38.

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.

Photon 20

No x402, MPP or L402 (0). Plan prices are public. Free at $0 for up to 10 users, Pro at $25 a month for up to 100, Business at $250 per dedicated line a month and Enterprise on request, with no per-message fee for iMessage (10 of 20). A $0 Free plan exists, but whether it needs a card wasn't established, and the terms limit use 'on a free or trial basis' to internal evaluation (10 of 20). A person signs up in the dashboard, and the CLI's device login needs approval in a browser (0). 0 + 10 + 10 + 0 = 20.

Prelude 30

No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.

Photon 78

spectrum-ts v12.14.0 tagged on 22 October 2026 (30). Nine tagged releases since 6 August, v12.8.0 (20 August), v12.9.0, v12.9.1, v12.10.0, v12.10.1, v12.11.0, v12.12.0 (16 October), v12.13.0 (21 October) and v12.14.0 (22 October), and the Beta API clients tagged 0.2.0 to 0.6.0 between 1 and 22 October (20). The SDK is open source, but GitHub issue pages are closed to our reader. Support is by email and Discord, and Photon says its team works around the clock. The weekly updates are announcements, not answers (8 of 25, per 16 October). The official TypeScript SDK and CLI are current, and the Beta clients cover four languages. No messaging MCP server, so no registry entry (12 of 15). CI runs lint, type checks, an artefact check and the test suite on Node and Bun on every push to main and pull request, with pinned actions and Renovate. Results unread (8 of 10). 30 + 20 + 8 + 12 + 8 = 78.

Prelude 83

@prelude.so/sdk 0.16.0 published to npm on 16 October 2026, 21 days ago, carrying API updates (30). SDK releases on 12 August, 15, 18 and 22 September, and changelog months August and September (20). Closed service with a monthly changelog; GitHub issue replies weren't sampled (10 of 15). Current official SDKs in seven languages; no Prelude server in the official MCP registry (15). The SDK repository runs CI and publish workflows (8 of 10). 30 + 20 + 10 + 15 + 8 = 83.