Prelude vs Sendblue

Prelude 93

OpenAPI for the 27 SDK endpoints is public at the URL in the SDK repository's .stats.yml, and every reference page embeds its endpoint's OpenAPI (25). llms.txt and Markdown pages (10). Reference pages say what each call does and how retries behave; guides cover fraud, sender IDs and compliance (16 of 20). Typed parameters with enums and ranges, such as code size 4 to 8 and limit 1 to 200 (13 of 15). Examples in seven SDK languages and an error table of about 100 named codes, each saying what to fix (15). Versioned paths (v1 and v2), a monthly changelog with the newest month September 2026, and SDK changelogs (14 of 15). 25 + 10 + 16 + 13 + 15 + 14 = 93.

Sendblue 66

We graded the REST API. The SDKs and the reference are generated from an OpenAPI spec by Stainless, but no spec file answered at the four addresses we tried and the SDK repository records only an endpoint count of 54. The published MCP package has JSON Schema inputs on its 18 tools (12 of 25). llms.txt and a Markdown twin of every docs page at /index.md (10). The reference and llms.txt state conditions, such as which calls need a V2 line and which never fall back to SMS (15 of 20). Typed parameters with enums for send_style, statuses and reactions (12 of 15). Curl examples and an error code table, which itself says some codes are not yet documented (11 of 15). Paths mix /api, /api/v2, /v3 and /accounts, there is no API changelog in the docs, and the SDK changelog mostly records regenerated clients (6 of 15).

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

Sendblue 46

One key pair per account in two headers, never in the URL, plus temporary bearer tokens that can be limited to named phone numbers, expire after 900 seconds by default and can be revoked. Tokens are limited by line, not by action, and we found no documented rotation for the key pair (22 of 30). No read-only key. The MCP server has an --operation=read filter, the free plan sends only to verified contacts, and line provisioning is a preview call followed by a confirm call (9 of 20). Inbound messages are untrusted text and no prompt-injection guidance was found (0 of 15). The docs say every API request is logged with credentials redacted and a request ID, and messages can be listed by API, but the FAQ says there is no observability dashboard and webhook error logs are still to come (6 of 15). Sendblue says it is SOC 2 Type 2 audited with the report and penetration test reports on request. No security.txt, disclosure policy or bug bounty was found (9 of 20).

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.

Sendblue 58

Closed service with clear terms from Round One, Inc., and Apache-2.0 SDKs (15 of 30). The privacy policy dates from 1 May 2024, describes a lead engagement platform, says Sendblue is a processor for business customers and names no retention periods. The docs say inbound media links expire after 30 days. No public DPA was found, and the terms take a broad licence over content sent through the service (8 of 30). No deprecation policy. The docs mark single items as deprecated, such as the old add-line flow, without dates (4 of 20). No sub-processor list or data locations. The docs name Twilio and Agora for calling only (2 of 20).

Prelude 83

@prelude.so/sdk 0.16.0 published to npm on 16 October 2026, 21 days ago, carrying API updates (30). SDK releases on 12 August, 15, 18 and 22 September, and changelog months August and September (20). Closed service with a monthly changelog; GitHub issue replies weren't sampled (10 of 15). Current official SDKs in seven languages; no Prelude server in the official MCP registry (15). The SDK repository runs CI and publish workflows (8 of 10). 30 + 20 + 10 + 15 + 8 = 83.

Sendblue 72

sendblue on npm is at 3.22.0 per the SDK changelog, dated 30 October 2026, with tags v3.20.0 (9 October), v3.20.1 (17 October), v3.21.0 (22 October), v3.21.1 (23 October) and v3.21.2 (30 October) since the last check. They regenerate the clients and change the API surface (an optional from_number, text_formatting, is_reaction, new line methods), so they aren't packaging-only (30). 20 SDK tags from v3.11.0 (17 August) to v3.21.2 (30 October), counted half as SDK tags, still well over three (20). No API changelog in the docs, support by email, and we couldn't read the GitHub issue trackers (6 of 15). Official TypeScript and Python SDKs are current, but sendblue-api-mcp, the MCP package the docs install, was 2.0.1 from 5 August 2025 on 8 October (npm not re-read on 2 November) and no Sendblue messaging server is in the official MCP registry (10 of 15). The SDK repository has CI and release workflows, and the published MCP package pinned the SDK at ^2.0.1 (6 of 10).

Prelude 30

No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.

Sendblue 40

No x402, MPP or L402 (0). Plan prices are public, $0 and $100 a month per line with no per-message fee, while the outbound plan is priced through sales (10 of 20). The free plan needs no card (20). The CLI creates an account and API keys with no browser, but a person has to text a one-time code from a phone or supply an email code, so half (10 of 20).

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

Sendblue 76

Message lists take limit from 1 to 100, and the MCP server adds a jq_filter on every tool, a read-only filter and a three-tool dynamic mode (20 of 25). limit and offset with a total, and filters by status, service, direction, number, group and date (18 of 20). Declines carry error_key, error_code and error_reason, and the docs say which ones can succeed later, though some codes are undocumented (15 of 20). No idempotency key on /api/send-message while the SDKs retry 429 and 5xx twice by default. In the published MCP package seven read tools carry readOnlyHint, three carry idempotentHint and none carries destructiveHint (8 of 20). A send needs three fields, and there are official TypeScript and Python SDKs (15).