# Photon vs Wati (slim)

> Photon scores 53.2 (D) to Wati's 51.1 (D) for whatsapp messaging. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/photon-vs-wati.md (~5,100 tokens) · this version ~3,030 tokens · JSON https://www.anchorterminal.com/compare/photon-vs-wati.json · canonical https://www.anchorterminal.com/compare/photon-vs-wati
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Photon scores 53.2 (D) on agent readiness against Wati's 51.1 (D), and leads in 4 of 7 scored categories. Wati leads on security & auth. Both do whatsapp messaging.

- Photon: D 53.2, rank #956 of 1510 · https://www.anchorterminal.com/tools/photon.min.md
- Wati: D 51.1, rank #1044 of 1510 · https://www.anchorterminal.com/tools/wati.min.md
- Photon, good for Agents that talk to people over iMessage, with WhatsApp Business, Telegram and SIP voice on the same agent loop in TypeScript. Ahead on Reliability, 67 against 55; Agent ergonomics, 63 against 48; Maintenance & community, 78 against 62; Transparency & trust, 57 against 52.
- Wati, good for Businesses whose customers are on WhatsApp and Instagram and who want an inbox, campaigns and an agent on one account. Ahead on Security & auth, 40 against 29.

| Category | Photon | Wati |
| --- | --- | --- |
| Reliability (16%) | 67 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 75 | 79 |
| Agent ergonomics (13%) | 63 | 48 |
| Security & auth (14%) | 29 | 40 |
| Payments & pricing (10%) | 20 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 78 | 62 |
| Transparency & trust (7%) | 57 | 52 |

| Fact (where they differ) | Photon | Wati |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Photon | Clare.AI Limited (Wati) |
| Hosted endpoint | `https://spectrum.photon.codes` | `https://mcp.wati.io/mcp` |
| Transports | HTTP | HTTP, Streamable HTTP |
| Auth | API key | OAuth or key |
| Pricing | Freemium | Paid |
| Licence | Proprietary hosted service under Something Great Inc.'s terms of service. The spectrum-ts SDK and its provider packages, imessage-kit, the CLI and the Photon 2.0 API clients are MIT | Proprietary service under Clare.AI Limited's terms and conditions. The wati-mcp repository (setup docs and skills for the hosted server) is MIT |
| Tools exposed | none | 73 |
| MCP registry | not listed | `io.github.wati-io/wati-mcp` |
| Last release | 2026-10-22 | 2026-11-03 |
| Terms last updated | no date given | 2025-12-08 |
| Privacy policy last updated | 2026-09-25 | 2026-08-10 |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 107k npm/wk | none |
| Agent reviews | 2.8/5 (4) | none |

Why the edge:
- Maintenance & community, Photon +16: Photon 78 (spectrum-ts v12.14.0 tagged on 22 October 2026 (30). Nine tagged releases since 6 August, v12.8.0 (20 August), v12.9.0, v12.9.1, v12.10.0, v12.10.1, v12.11.0, v12.12.0 (16 October), v12.13.0 (21 October) and v12.14.0 (22 October), and the Beta API clients tagged 0.2.0 to 0.6.0 between 1 and 22 October (20). The SDK is open source, but GitHub issue pages are closed to our reader. Support is by email and Discord, and Photon says its team works around the clock. The weekly updates are announcements, not answers (8 of 25, per 16 October). The official TypeScript SDK and CLI are current, and the Beta clients cover four languages. No messaging MCP server, so no registry entry (12 of 15). CI runs lint, type checks, an artefact check and the test suite on Node and Bun on every push to main and pull request, with pinned actions and Renovate. Results unread (8 of 10). 30 + 20 + 8 + 12 + 8 = 78.); Wati 62 (The API reference, authentication and error pages were updated on 3 November 2026 under documentation version 2.6, read as the last published API change (30). No changelog; the MCP registry entry moved to 1.1.0 on 9 October and the repository changed on 15 and 20 October, which count for half (10 of 20). Closed service with a public roadmap and support by plan; GitHub issue replies weren't sampled (6 of 15). `io.github.wati-io/wati-mcp` is in the official MCP registry under a verified GitHub namespace, with no official SDKs (12 of 15). The repository holds setup docs for a hosted server, with a registry publish workflow (4 of 10). 30 + 10 + 6 + 12 + 4 = 62.)
- Agent ergonomics, Photon +15: Photon 63 (Read for the TypeScript SDK an agent server runs. One async message stream for every provider, one send call per space and environment fallbacks keep the code small. Management responses can't be sized beyond list limits (17 of 25). The user and template lists take `limit` with `offset` or cursors and filters, while the other lists take none (12 of 20). API errors return a status code with `{ succeed, message }`, `SpectrumCloudError` carries `status` and `code`, and unsupported operations throw `UnsupportedError`. No error-code catalogue for Stable was found (13 of 20). The recovery guide has callers set stable `clientGuid` values that the transport deduplicates, the advanced iMessage kit takes a `clientMessageId`, and webhooks are at-least-once with dedupe guidance. Spectrum API writes take no idempotency key (13 of 20). `imessage.config()` with no arguments discovers lines and renews tokens, but Stable has one official SDK language, TypeScript (8 of 15). 17 + 12 + 13 + 13 + 8 = 63.); Wati 48 (The MCP catalogue lists 73 WATI tools plus Astra groups, some loaded on demand through `list_skills` and `activate_skill` (10 of 25). Page and page size with filters on lists, and bounded search (17 of 20). Error handling is documented per status, but bodies can be JSON, plain text or empty, so an agent can't rely on one shape (10 of 20). No idempotency keys; tag add and remove are idempotent, and the docs say to reconcile rather than retry sends (5 of 20). No official SDK; runnable examples in five languages, and region-specific hosts add setup (6 of 15). 10 + 17 + 10 + 5 + 6 = 48.)
- Reliability, Photon +12: Photon 67 (Read with the hosted lines for Spectrum Cloud, the managed lines the SDK connects to. status.photon.codes runs on incident.io with components for the Spectrum API, webhook delivery, billing, each iMessage plan and the Mac nodes (20). In the window from 6 August 2026 it records one full outage, iMessage on every plan for 2 hours 7 minutes on 2 September after a power failure at Photon's data centre. It also records an 8-minute partial Spectrum API outage on 7 August (out of memory), a 9-minute error spike on the Spectrum API on 22 August, about an hour of failed RCS sends on 9 October, Mac-node incidents on 16 October (a 40-minute partial outage, then degraded performance) and 29 October (5 minutes of full outage, 8 minutes partial, then degraded until 16:26 UTC) on the Macrocosm Mac Nodes component alone, and many automated 'macOS clusters were encountering degraded performance' entries. Single-component incidents read as minor (10 of 30). Rate limits with numbers, 5 requests a second per project on the Spectrum API, 5,000 messages per server a day and 50 new conversations per line a day (15). The rate-limit page says excess requests get a 429, with no Retry-After or 429 handling. The API docs say 5xx is safe to retry with backoff, and the recovery guide gives stable `clientGuid` values for deduplicating retried sends. Safe-retry guidance with no 429 guidance or idempotency key on the Spectrum API takes the settled 12 (was 10 of 15). No SLA document. The pricing page names a contractual SLA only for Enterprise, with no figure or document, and the terms disclaim delivery and uninterrupted service. A listed SLA nobody can read gives 0 (was 3 of 10). The Stable product is generally available (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.); Wati 55 (Read with the hosted lines. status.wati.io is a Site24x7 StatusIQ page with components for the API, webhooks and inbox on each regional host (20). Its incident history is drawn by script and wasn't readable by our reader, so the record is scored as unreadable (5). Request limits are published only for legacy V1 operations, by plan; V3 limits are account-specific and unpublished (8 of 15). The docs say to honour Retry-After when present, use bounded backoff and reconcile unknown writes before resending, with no idempotency keys (10 of 15). The pricing page names a basic or standard SLA by plan, with no SLA document or uptime figure (2 of 10). The V3 API is the documented default (10). 20 + 5 + 8 + 10 + 2 + 10 = 55.)
- Security & auth, Wati +11: Photon 29 (Project ID and secret over HTTP Basic for the Spectrum API. The secret grants full management access to the project, doesn't expire on its own and is rotated with `photon projects regenerate-secret`. The SDK mints per-line iMessage tokens it renews at 80 per cent of their lifetime, and the Dashboard API takes OAuth 2.1 with PKCE and consented scopes. No secret in a URL is documented (17 of 30). No read-only project credential. The CLI asks before removing a user (3 of 20). Inbound messages come from anyone who texts a line, and no prompt-injection guidance was found in the Stable docs (0 of 15). OpenTelemetry tracing is opt-in and per-line analytics are in the dashboard. API logs and traces arrive with Photon 2.0, not Stable (4 of 15). No security.txt on photon.codes. The Beta API clients' repository has a SECURITY.md with private vulnerability reporting and no acknowledgement time, while spectrum-ts has none, and the privacy policy mentions regular penetration testing. No bug bounty or certification was found, and osv.dev lists nothing for spectrum-ts, @photon-ai or photonhq-api on 4 November. The policy covers only the Beta clients, so the line keeps its partial 5 of 20 rather than the settled 7. 17 + 3 + 0 + 4 + 5 = 29.); Wati 40 (REST tokens carry per-endpoint read and write scopes, an expiry and revocation, and the docs forbid tokens in URLs; the MCP server's OAuth metadata lists a single `all` scope (25 of 30). Read-only REST tokens are possible through scopes; the MCP server has no read-only mode and relies on the client to confirm writes (10 of 20). Inbound WhatsApp and Instagram text and comments reach the agent, and no prompt-injection guidance was found (2 of 15). No operator request log found in the docs (3 of 15). The trust centre answered 403, security.txt answers 404, and no certification or disclosure policy could be read (0 of 20). 25 + 10 + 2 + 3 + 0 = 40.)
- Transparency & trust, Photon +5: Photon 57 (spectrum-ts, its providers, imessage-kit and the CLI are MIT, while Spectrum Cloud and the managed lines are closed. The undated terms still carry template placeholders, such as '[California]' for governing law and a bracketed acceptable use policy that links to a deliverability guide (18 of 30). The privacy policy (25 September 2026) covers account data and deletion within 30 days of closing an account, but says nothing about message content or end users' data. The terms let Photon use de-identified Usage Data to train its models. No DPA or retention period for messages was found (8 of 30). No deprecation policy. Migration notes for removed SDK options carry no dates (4 of 20). SDK telemetry is opt-in and documented with its OTLP endpoint. Hosting is described as Photon's own data centre alongside cloud providers, with no sub-processor list or regions (8 of 20). 18 + 8 + 4 + 8 = 38.); Wati 52 (Closed service with clear terms from Clare.AI Limited (8 December 2025); the MCP repository is MIT (15 of 30). The privacy policy (10 August 2026) says Cloud API messages are deleted after 30 days and customer data on termination, names no hosting regions and doesn't mention a DPA (14 of 30). Legacy V1 and V2 routes are kept for listed exceptions with no retirement dates, and the terms let AI functions change without notice (5 of 20). The sub-processor list is on the trust centre, which refused our reader; the privacy policy names categories and the AI providers of one extension (5 of 20). 15 + 14 + 5 + 5 = 39.)