Pipecat PhoneLLM vs Vaani Developer Platform

Pipecat PhoneLLM 53

Hosted lines, read on Workers AI for Mini, the only per-token route. www.cloudflarestatus.com is a Statuspage with a Workers AI component (20). The incidents feed covers 7 to 16 October 2026 and holds one Workers AI incident, minor, on 15 October from 07:10 to 09:37 UTC, naming five other models and not PhoneLLM. The history page loads by script, so the rest of the 90 days went unread, and the model is two days old (10 of 30, as the Workers AI listing scored the same record). The limits page gives Text Generation 300 requests a minute, and the model page doesn't mark Mini as paid-only, though PhoneLLM isn't named (13 of 15). A 429 carries code 3036 for a spent free allocation or 3040 for capacity, and rejectIfBusy fails fast. No Retry-After is documented for 3040. Inference has no side effects, so a retry is safe (10 of 15). No SLA for Workers AI found (0). Workers AI is generally available and the model page has no beta label, but Daily names the model Alpha 2 and the limits page says beta models may get lower limits, so the surface isn't counted as GA (0). Max has no serverless route to read. 53.

Vaani Developer Platform 28

Graded on the hosted REST API at api.vaanivoice.ai. No status page. status.vaani.dev and status.vaanivoice.ai don't resolve, and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits are published. The docs give 2 concurrent calls on pay as you go and a per-organisation campaign concurrency cap, so partial credit (5). The SDK raises RateLimitError on 429 and the MCP client retries once after 600 ms, but no Retry-After, backoff guidance or idempotency key for call creation is documented (3). The pricing table lists a 99.50 per cent uptime SLA on both plans, but no SLA document or service credits were found and the terms supply the service "as-is" with no warranties, so half (5). The API is version 2.0.0 and isn't labelled beta (10). 0+5+5+3+5+10 = 28.

Pipecat PhoneLLM 66

Model reading. On Workers AI, Cloudflare API tokens limited to Workers AI permissions on chosen accounts, revocable, with expiry and IP filters, per the Workers AI listing's check of 9 October. Permission is per account, not per model (27 of 30). Cloudflare's data usage page and service terms say customer content isn't used to train models without consent, with clause 9 allowing use to provide and improve services, per the same check. Self-hosted, prompts stay on the owner's hardware (17 of 20). The model is built to take a caller's transcribed speech and call tools. Neither card nor the post has limitations, a safety evaluation, or guidance on injected or hostile input. The template wraps tool results in <tool_response> and does nothing to neutralise caller text. Mini self-hosted runs modelling code from the repository with --trust-remote-code (3 of 15). Direct Workers AI calls have no per-request log that we found. AI Gateway logs prompts and responses when a call is routed through it (6 of 15). Cloudflare's security.txt names a HackerOne programme, per the Workers AI check. Daily has no security.txt and a disclosure policy with no bounty, per the Pipecat check of 17 October, and the cards give no security contact (13 of 20). 66.

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.

Pipecat PhoneLLM 40

Read on Workers AI for Mini. Machine Payments takes x402 on POST /ai/run for four models, and PhoneLLM Mini isn't one of them (0). $0.06 per million input and $0.24 per million output tokens, published without a login on the model and pricing pages (20). 10,000 neurons a day are free on the Workers Free plan, about 1.8 million input tokens. We didn't sign up to confirm that no card is asked for, and scored it as the Workers AI listing did (20). A person signs up with Cloudflare in a browser for a token. The weights download from Hugging Face without an account, but other open-weight listings graded on a hosted route get no onboarding credit for that, so this one doesn't either (0). Max has no per-token price anywhere, only GPU time at Modal or Baseten. 40.

Vaani Developer Platform 22

No x402, MPP or L402 (0 of 40). The ₹1 ($0.02) a minute platform fee, number rental, concurrency lines and add-ons are public, and the calculator shows each provider's unit rate without a login. Registry checks, extraction and evaluations "can add separate charges" that aren't priced, and the billing pulse depends on the account, so 3 off (17 of 20). The home page says "Start free on Vaani's Platform", but the pricing page states a prepaid wallet with no free credit, trial minutes or card rule, and we didn't sign up to check, so 5 of 20. A person signs up with email verification at platform.vaani.dev and creates keys in the dashboard (0). 0+17+5+0 = 22.

Pipecat PhoneLLM 58

Mini is BSD-2-Clause, an OSI licence, with NVIDIA's Nemotron Open Model License kept for the base work, and the card explains how the two apply. Max is OpenMDW-1.1, permissive but not on the OSI list. Training data and code aren't published, and the hosted route runs under Cloudflare's terms (22 of 30). The post says training data is fully synthetic, from unnamed open-weight teachers. On Workers AI, Cloudflare's no-training statements agree with each other apart from clause 9, per the Workers AI check. Self-hosted, nothing leaves the owner's hardware. Daily's privacy policy and DPA weren't re-read for the models (18 of 30). No deprecation policy or dated notices from Daily. Workers AI posts dated notices but has no policy (5 of 20). Cloudflare publishes a sub-processor page, and where a Workers AI request runs isn't stated beyond its network. The weights are safetensors, but Mini's repository ships Python modelling code that a self-hosted run executes (10 of 20). 55.

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

Pipecat PhoneLLM 72

Model reading on the API lines. Each Workers AI model page links JSON Schemas for input and output. Mini's synchronous input schema lists required: ["prompt"] and has no messages property, while the page's TypeScript, Python and curl examples and Cloudflare's changelog all send messages. It also carries audio, modalities and web_search_options, which a text-only model has no use for (18 of 25). developers.cloudflare.com/llms.txt and a Markdown copy of the model page and changelog. The cards are Markdown on Hugging Face (10). The post and cards say what each size is for (Mini for speed, Max for accuracy, both for phone agents with tool calling and Pipecat Flows). Neither card has a limitations or out-of-scope section, and English-only is in the metadata, not the text (12 of 20). temperature bounded 0 to 2, tool_choice an enum or a forced function, response_format a typed one-of, and chat_template_kwargs.enable_thinking typed and described (12 of 15). Examples in TypeScript, Python, curl and vLLM recipes for both sizes. The Workers AI examples omit the temperature: 0 and enable_thinking: false that Cloudflare's changelog asks for, and the error table is Workers AI's generic one (11 of 15). The version is in the model ID (alpha-2), Alpha 1 stays published, and Hugging Face keeps commit history (three commits each). No changelog of PhoneLLM's own. Changes are listed in the post and Cloudflare's changelog entry (9 of 15). 72.

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.