Prelude vs Telnyx API + MCP

Prelude 30

No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.

Telnyx API + MCP 65

x402 exists on Telnyx's own API at /v2/x402/credit_account (USDC on Base), with MPP at /v2/machine-payments/account-credit (Stripe Link or Tempo USDC), but both top up account credit rather than pay per message. Telnyx's x402 skill says x402 sits behind an account feature flag (403 when it's off) and that per-payment minimum and maximum limits are configurable and stated in 422 errors; the MPP skill names no flag (25 of 40). Per-part SMS and MMS rates and carrier passthrough fees are published without a login, also as pricing.md (20). No free credit, a new account starts at zero (0). An agent can sign up through /v2/bot_challenge and /v2/bot_signup, confirm by a magic link sent to a mailbox it can read, mint a key at /v2/api_keys and fund the account by MPP or x402 with no browser (20).

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.

Telnyx API + MCP 72

Closed service with clear terms (15). Privacy policy (last updated effective 1 March 2026, read on 17 October, not re-read on 1 November) covering retention as long as reasonably necessary, a Telnyx DPA referenced from the sub-processor page, and about 50 sub-processors. We didn't find stated retention periods for message records (25 of 30). No deprecation policy or dated deprecation notices found, and the release notes read on 1 November carry none (0 of 20). Each sub-processor is listed with its entity, address, products and data categories, with change alerts, per the 6 October check (15 of 20).

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

Telnyx API + MCP 45

Bearer API keys created and revoked in the portal, with no per-key scopes found. Claude connectors can authorise through the portal instead, and the OAuth authorisation-server metadata, re-read on 1 November, still lists 32 product scopes such as messaging.read, messaging.write and numbers.write, but no document says how a client picks them or that a token is held to them, so the line stays at plain revocable keys (20). No read-only key mode found. The hosted MCP's invoke_api_endpoint carries destructiveHint true but can send messages or buy numbers with no confirmation step on Telnyx's side (0 of 20). Inbound SMS and WhatsApp bodies are untrusted text. Messaging webhooks are signed, and we found no prompt-injection guidance (5 of 15). Message and detail records by API, with no account audit log found (10 of 15). SOC 2 Type II and ISO 27001 per Telnyx's compliance file, and telnyx-node has a SECURITY.md with a reporting route. security.txt returned 404 at both locations on 1 November and no bug bounty found (10 of 20). 20 + 0 + 5 + 10 + 10 = 45.

Prelude 65

Read with the hosted lines. status.prelude.so has components for Verify, Auth, Watch, Intel, Notify and the dashboard, with history (20). From 8 August to 6 November its feed records one major incident, increased error rates and latencies across the APIs on 16 and 17 August, posted after it was resolved with no duration stated, and minor ones such as Verify latency on 9 and 10 August, SMS degradation in China and on Orange France and delayed webhooks on 23 October (10). No numeric API rate limits were found; only the MCP server's limits and per-window Verify retry limits are documented (7 of 15). A 429 carries Retry-After and X-Should-Retry, and repeating the create call inside the window performs a retry rather than a new verification (13 of 15). The pricing page lists a 99.95 SLA on Enterprise with no SLA document found (5 of 10). Verify and Notify v2 are generally available (10). 20 + 10 + 7 + 13 + 5 + 10 = 65.

Telnyx API + MCP 80

Read as a hosted API, as on 1, 6 and 17 October. Status page at status.telnyx.com (run on incident.io) with a readable incident feed and history (20). In the 90 days to 1 November, one incident Telnyx marked major hit the API broadly, intermittent 5XX responses across endpoints from 13:49 to 15:50 UTC on 23 September. Telnyx also marked two single-carrier messaging incidents major, MMS delays to AT&T (about 3 hours the same day) and delayed delivery of 10DLC SMS to AT&T from about 15:00 UTC on 6 October to 13:03 on 7 October, with messages accepted and other carriers unaffected. We count both as single-carrier routes, as on 6 and 17 October. Partial incidents read as minor. From 20:55 UTC on 5 August to 14:03 on 6 August a small percentage of Messaging API requests returned 503 or 504 (degraded performance, delivery unaffected), first read on 1 November. On 21 October, between about 18:17 and 19:20 UTC, a network fault caused intermittent failures across services, which Telnyx posted two days later with impact none, and we read it as partial, as for the Telnyx Voice API listing. Others include outbound messaging latency from 15 September, intermittent outbound errors and v2 API processing delays on 13 October, MMS delivery receipt queueing on 27 October and webhook delays on 29 and 30 October. The other majors since 17 October are other products, Programmable Video (critical, 16 October) and Wireless connectivity (21 October) (10). The 23 September major leaves the window after 22 December. pricing.md lists 50 SMS a second and 100 API requests a second on pay-as-you-go, and the messaging rate-limit page lists 50 SMS, 15 MMS and 1 RCS a second per account with per-sender limits, both read on 1 November (15). The rate-limiting page, re-read on 1 November, documents 429 with error 10011, Retry-After and x-ratelimit headers, bounded exponential backoff with jitter and retrying only safely repeatable operations, and the retries page says never to auto-retry a timed-out send without reconciling first (15). The SLA file at telnyx.com/ai/sla.json, re-read on 1 November, states 99.99 per cent for core voice and messaging with credits of 10, 25 and 50 per cent, without saying who qualifies (10). Messaging is generally available (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

Telnyx API + MCP 90

List endpoints take page size and number, with no field selection. The hosted MCP lists 6 tools on 1 November (3 meta-tools that load endpoint schemas on demand and 3 read-only MCP App launchers), but we scored the API (15 of 25). Filters on message and number lists (20). JSON errors with a code, title and detail, and a documented code list (20). POST /v2/messages now declares an optional Idempotency-Key header in its reference, and so do the seven other send endpoints in the OpenAPI file (long code, short code, number pool, alphanumeric sender ID, group MMS, RCS and WhatsApp). Scheduled sends (POST /v2/messages/schedule) and account writes such as messaging profiles and number orders take none. That is the coverage the Telnyx Voice API listing earns 20 for, where command_id is on 38 of 40 call commands. Only successful responses are replayed, for up to 24 hours, a key still in progress returns 409 and a key reused with a different request returns 422. The Node SDK carries it from v7.27.0 (21 October 2026), where 17 October found none (20). A send needs from or a messaging profile, to and text. Official SDKs in Node, Python and more (15). 15 + 20 + 20 + 20 + 15 = 90.