Pipecat vs Vaani Developer Platform

Pipecat 83

BSD-2-Clause (30). The framework keeps no data. Daily's privacy policy (6 January 2025) keeps personal data while an account is open, the Pipecat Cloud security guide says session data is removed when a session ends, logs are stored by default and administrative API calls are kept a year, and Daily publishes a DPA (1 May 2025) and a sub-processor list (1 September 2026), per the 17 October check. Control-plane data is in the US whatever the agent's region (24 of 30). The changelog has Deprecated sections in most releases, and recent entries name removal in 2.0.0, with a migration guide to 1.0, but no dated removal windows (13 of 20). No telemetry found, and tracing is opt-in, which the OpenTelemetry reference now states too. The optional ai-coustics filter still registers a Pipecat identifier with that vendor's SDK in 1.15.0, which the docs don't mention (18 of 20, was 16). 30 + 24 + 13 + 18 = 85.

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

Pipecat 68

Local-software reading of the framework. pipecat-ai installs from PyPI with Python 3.11 or later declared (1.15.0's pyproject), and a compatibility workflow builds it on 3.11 to 3.14 (20). A public tests workflow runs pytest (406 Python files under tests/ in 1.15.0), on pushes to main and on pull requests, with coverage and licence-check jobs, but GitHub's Actions pages weren't readable on 17 October or 1 November, so a green main is not confirmed (15 of 25). The issue tracker couldn't be read, since GitHub's pages answer 403. The 17 October reading of open issues came from a third-party copy of GitHub data, which we no longer use, so it is struck. The clone shows 3,539 commits in the 90 days to 1 November, fixes that cite the issues they close (#6162 on 15 October, #6256 on 20 October, #6410 from an outside contributor on 28 October) and 151 merged pull requests from outside forks, so 8 of 25 on that evidence alone (was 12). Keep a Changelog with dates, semver stated and breaking changes flagged with a warning sign, but minor releases keep carrying them, 16 flagged in 1.8.0, 4 in 1.9.0, 4 in 1.10.0, 6 in 1.13.0, 1 in 1.14.0 and 5 in 1.15.0 (10 of 15). 1.15.0, classed Production/Stable (15). 20 + 15 + 8 + 10 + 15 = 68.

Vaani Developer Platform 28

Graded on the hosted REST API at api.vaanivoice.ai. No status page. status.vaani.dev and status.vaanivoice.ai don't resolve, and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits are published. The docs give 2 concurrent calls on pay as you go and a per-organisation campaign concurrency cap, so partial credit (5). The SDK raises RateLimitError on 429 and the MCP client retries once after 600 ms, but no Retry-After, backoff guidance or idempotency key for call creation is documented (3). The pricing table lists a 99.50 per cent uptime SLA on both plans, but no SLA document or service credits were found and the terms supply the service "as-is" with no warranties, so half (5). The API is version 2.0.0 and isn't labelled beta (10). 0+5+5+3+5+10 = 28.

Pipecat 60

No x402, MPP or L402 (0). Read with the self-hosted rule, with the pricing line scored on Pipecat Cloud, the paid option. Its per-minute prices by agent size, transport, telephony and recording are published without a login, re-read on 1 November ($0.01 an active minute for agent-1x, $0.018 a minute for Daily PSTN) (20). The BSD-2-Clause package installs with no card. Pipecat Cloud needs billing credentials or a trial code before sessions start (20, on the package). The framework runs with no account, on the developer's own provider keys (20). 0 + 20 + 20 + 20 = 60.

Vaani Developer Platform 22

No x402, MPP or L402 (0 of 40). The ₹1 ($0.02) a minute platform fee, number rental, concurrency lines and add-ons are public, and the calculator shows each provider's unit rate without a login. Registry checks, extraction and evaluations "can add separate charges" that aren't priced, and the billing pulse depends on the account, so 3 off (17 of 20). The home page says "Start free on Vaani's Platform", but the pricing page states a prepaid wallet with no free credit, trial minutes or card rule, and we didn't sign up to check, so 5 of 20. A person signs up with email verification at platform.vaani.dev and creates keys in the dashboard (0). 0+17+5+0 = 22.

Pipecat 92

Framework reading. Typed Python (py.typed) with an API reference page per service, transport, frame type and utility (25). llms.txt, Markdown copies of each page and llms-full.txt (4.7 MB on 1 November) (10). Guides say when to reach for Flows, multiple LLM agents or a single pipeline, and the error-handling page says which failures are worth retrying. The OpenTelemetry reference now gives PipelineWorker defaults of enable_tracing False and enable_turn_tracking True, matching the 1.15.0 source, so the mismatch the 17 October check found is gone (16 of 20, was 14). Pydantic Settings classes per service, a provider-neutral FunctionSchema, and an ErrorCategory enum (12 of 15). Example folders from function calling and MCP to telephony, and documented error categories and Pipecat Cloud error codes (14 of 15). Dated changelog with pull-request links, towncrier fragments and a migration guide to 1.0 (15). 25 + 10 + 16 + 12 + 14 + 15 = 92.

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.

Pipecat 85

pipecat-ai 1.15.0, dated 28 October 2026 in the changelog and tagged that day, 4 days before the check (30). Nine releases in the 90 days to 1 November, 1.8.0 on 26 August to 1.15.0 (20). Issue and pull-request reply times couldn't be read, since GitHub's pages answer 403, and the 17 October figures came from a third-party copy of GitHub data, now struck. The clone shows 151 pull requests from outside forks merged in the 90 days to 1 November, fixes that cite the issues they close, and a needs-repro workflow that labels issues (13 of 25, was 15). The Python framework and the JavaScript client (@pipecat-ai/client-js 1.16.0, tagged 28 October) are current, with client SDKs in six languages (15). CI, coverage, a licence check, a uv lockfile and trusted publishing to PyPI are configured. Dependabot was added on 23 October, for the pinned GitHub Actions only, and a passing main wasn't confirmed (7 of 10). 30 + 20 + 13 + 15 + 7 = 85.

Vaani Developer Platform 59

vaani-research-mcp 0.1.1 on 2026-10-14 (30). In the last 90 days, vaani-sdk 0.3.1 on 28 September and three npm versions (0.0.0-stage, 0.1.0, 0.1.1) within 40 minutes on 14 October. No dated changelog, so half (10 of 20). A closed service with no public changelog, issue tracker or community channel found. Contact is hello@vaaniresearch.com and a booking link, and we didn't test whether they answer. The MCP repository on GitHub couldn't be read from this session (4 of 15, the closed-service reading). A current official Python SDK, released seven times since April 2026. The MCP server isn't in the official MCP registry (10 of 15). The SDK's sdist ships its tests and current httpx and pydantic dependencies, and the MCP package runs its tests before publishing, but no public CI was found and the SDK has no repository (5 of 10). 30+10+4+10+5 = 59.

Pipecat 67

Framework reading, as for the frameworks category. We found no telemetry in the source, and tracing is off by default and needs an exporter the developer supplies. The two credential flaws the 17 October check found on 1.12.0 are fixed in released versions. 1.13.0 (18 October) makes the services for OpenAI-compatible providers raise an error when given no key instead of falling back to OPENAI_API_KEY, and masks API keys, tokens and signed URLs in error messages, and 1.14.0 (23 October) closes a gap in that masking (30 of 30, was 20). No tool-approval or confirmation primitive. tools_filter allowlists MCP tools and tools_arguments pins values the model cannot change (8 of 20). A caller's speech and MCP tool results go to the model, and we found no prompt-injection guidance in the docs, re-searched in llms-full.txt on 1 November (3 of 15). OpenTelemetry spans per service and tool call, with FunctionCallObserver and LLMLogObserver for per-call visibility (15). SECURITY.md routes reports to an email address at Daily, and GitHub advisories are published with CVEs and fixed versions, four since April 2026 (OSV, re-read on 1 November, lists no new one). The OPENAI_API_KEY fix shipped without an advisory. No security.txt or bug bounty. Daily states SOC 2 Type 2, which isn't scored for a framework (11 of 20). 30 + 8 + 3 + 15 + 11 = 67.

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.