Prelude vs Sinch Messaging APIs + MCP

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

Sinch Messaging APIs + MCP 50

We didn't confirm page-size or field controls on message lists (10 of 25). Pagination and filters not confirmed (10 of 20). Error responses with codes, and back-off advice for 5xx (15 of 20). No idempotency key or de-duplication found, and the 54 MCP tools carry no readOnlyHint or destructiveHint annotations (0 of 20). Official SDKs in Node, Python, Java and .NET. A send names an app, a recipient, a channel and a message object (15).

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.

Sinch Messaging APIs + MCP 77

Closed service with general terms. The contracting Sinch entity is named only in the order form (15). Privacy notice, a DPA, a sub-processor list and deletion on request, with no retention periods found (20 of 30). Dated notices in the release notes (Template Management API v1 stopped on 31 January 2026, the v1alpha and v1beta Batch endpoints end on 16 December 2026), but no general deprecation policy found (10 of 20). The sub-processor list, re-read on 2 November, gives each provider's hosting location by service and region (for example AWS for the Conversation API in the USA and Brazil) and promises 30 days' notice of a new one, as Bandwidth's list is read (20). 15 + 20 + 10 + 20 = 65.

Prelude 93

OpenAPI for the 27 SDK endpoints is public at the URL in the SDK repository's .stats.yml, and every reference page embeds its endpoint's OpenAPI (25). llms.txt and Markdown pages (10). Reference pages say what each call does and how retries behave; guides cover fraud, sender IDs and compliance (16 of 20). Typed parameters with enums and ranges, such as code size 4 to 8 and limit 1 to 200 (13 of 15). Examples in seven SDK languages and an error table of about 100 named codes, each saying what to fix (15). Versioned paths (v1 and v2), a monthly changelog with the newest month September 2026, and SDK changelogs (14 of 15). 25 + 10 + 16 + 13 + 15 + 14 = 93.

Sinch Messaging APIs + MCP 81

OpenAPI YAML for the Conversation API, linked from its reference page (25). llms.txt with Markdown pages (10). Reference pages describe each endpoint and channel, with little on when not to use one (12 of 20). Typed JSON with message types per channel, not checked for enums (10 of 15). Examples and error codes in the references (12 of 15). /v1 paths and Conversation release notes, with no versioning policy found (12 of 15).

Prelude 30

No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.

Sinch Messaging APIs + MCP 40

No x402, MPP or L402 (0). US SMS prices are published per sender type ($0.0078 a message on 10DLC and toll-free, $0.009 on short code, re-read on 2 November), and other countries and WhatsApp through a country selector without a login (20). Trial credit of 2 units of local currency and a test number, with a payment method needed only to upgrade, per Sinch's community and Voice account pages (20). A person signs up in a browser (0). 0 + 20 + 20 + 0 = 40.

Prelude 65

Read with the hosted lines. status.prelude.so has components for Verify, Auth, Watch, Intel, Notify and the dashboard, with history (20). From 8 August to 6 November its feed records one major incident, increased error rates and latencies across the APIs on 16 and 17 August, posted after it was resolved with no duration stated, and minor ones such as Verify latency on 9 and 10 August, SMS degradation in China and on Orange France and delayed webhooks on 23 October (10). No numeric API rate limits were found; only the MCP server's limits and per-window Verify retry limits are documented (7 of 15). A 429 carries Retry-After and X-Should-Retry, and repeating the create call inside the window performs a retry rather than a new verification (13 of 15). The pricing page lists a 99.95 SLA on Enterprise with no SLA document found (5 of 10). Verify and Notify v2 are generally available (10). 20 + 10 + 7 + 13 + 5 + 10 = 65.

Sinch Messaging APIs + MCP 73

Statuspage at status.sinch.com with components and history (20). Read from its own history and incident pages on 2 November (the 1 October count from IsDown, a third-party copy of the page, is struck). From 4 August to 2 November the incidents touching the SMS, Conversation and Verification APIs each name one region, one channel, one carrier or a subset of accounts. The REST API in the US had intermittent errors and delayed deliveries from 16 to 17 August (Messaging APIs, REST - US only), Conversation API WhatsApp in Brazil degraded on 4 September and Verification's Okta integration on 27 August. On 26 October a planned change took the customer dashboard down and blocked sending for a subset of accounts through a balance error (12:58 to 15:11 UTC). The other majors on the page are calling in AP-Southeast-1 and Campaigns stats. Partial incidents read as minor, so minor only (20). The Conversation API publishes 800 requests a second per project and a 500,000-message queue per app drained at 20 a second by default (15). Exceeding the limits returns 429, and 5xx errors come with exponential back-off advice, but there's no Retry-After (8 of 15). No SLA found (0). The SMS and Conversation APIs are generally available. The MCP server is a developer preview (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

Sinch Messaging APIs + MCP 55

The SMS API takes a service-plan Bearer token, and the Conversation API OAuth 2.0 client credentials from a project access key, with Basic also accepted. No per-key scopes found (25 of 30). No read-only mode or confirmation step. The MCP server's tool allow-list (--tags, or MCP_TAGS since 0.0.1-beta.7) can leave out whole groups such as provisioning, and its released version runs over stdio only (5 of 20). Inbound messages are untrusted text. Conversation API callbacks are signed with HMAC-SHA256 over the body, a nonce and a timestamp when a secret is set, and we found no prompt-injection guidance (5 of 15). Message and delivery lookups by API, no audit log found (10 of 15). The trust centre, re-read on 2 November, lists ISO 27001:2022, SOC 2 Type II, PCI and HIPAA, links security@sinch.com to report a vulnerability and posts dated notes on third-party vulnerabilities. No security.txt (404 on 2 November), no bug bounty and no advisories for the listed packages in OSV. Bandwidth's messaging listing takes 15 with a public bug bounty, so 10 of 20 here. 25 + 5 + 5 + 10 + 10 = 55.