Prelude vs Vonage Messages API + MCP

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

Vonage Messages API + MCP 50

The Messages API sends and updates messages and returns a message_uuid. Lists and searches live in the separate Reports API (15 of 25). Filtering only through Reports (10 of 20). A shared error catalogue with codes an agent can look up (15 of 20). No idempotency key on sends, and channel-level rejections arrive later by status webhook after a 202 (0 of 20). SDKs in Node, Python and four more languages. Basic auth works for sends, but application webhooks need a JWT application (10 of 15).

Prelude 65

Read with the hosted lines. status.prelude.so has components for Verify, Auth, Watch, Intel, Notify and the dashboard, with history (20). From 8 August to 6 November its feed records one major incident, increased error rates and latencies across the APIs on 16 and 17 August, posted after it was resolved with no duration stated, and minor ones such as Verify latency on 9 and 10 August, SMS degradation in China and on Orange France and delayed webhooks on 23 October (10). No numeric API rate limits were found; only the MCP server's limits and per-window Verify retry limits are documented (7 of 15). A 429 carries Retry-After and X-Should-Retry, and repeating the create call inside the window performs a retry rather than a new verification (13 of 15). The pricing page lists a 99.95 SLA on Enterprise with no SLA document found (5 of 10). Verify and Notify v2 are generally available (10). 20 + 10 + 7 + 13 + 5 + 10 = 65.

Vonage Messages API + MCP 77

Statuspage at vonageapi.statuspage.io with components and history (20). Its history pages, read on 1 November, list 565 entries from 3 August, 444 of them maintenance, 101 minor and 20 with no impact set, and none major or critical. Messaging incidents hit one carrier, country or region, such as outbound SMS in the APAC region for 19 minutes on 21 October and T-Mobile delivery on a subset of 10DLC numbers on 1 October, so partial and minor (20). The earlier IsDown count is struck, since a third-party copy of a status page isn't evidence in this run. The Messages API allows 75 requests a second per API key by default, and exceeding it returns 429 (15). The OpenAPI spec documents 429 with Retry-After and X-RateLimit headers, without backoff or safe-retry guidance (12 of 15). No SLA found on the legal hub or security page, per the 2 October check, not re-read on 1 November (0). The Messages API is generally available (10). 20 + 20 + 15 + 12 + 0 + 10 = 77.

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

Vonage Messages API + MCP 73

Sends can be authorised with an application JWT signed RS256, whose ACL claim limits paths and methods and whose lifetime runs from 30 seconds to 24 hours, or with Basic auth on the account key and secret (30). JWT ACLs can narrow a token, with no confirmation step for sends (15 of 20). Inbound messages are untrusted text. Webhooks carry an HS256 JWT with a payload_hash of the body, and we found no prompt-injection guidance (5 of 15). Message records through the Reports API, which the MCP's get-records-report tool calls, and an Audit API that monitors the account through events, priced at $550 a month on the pricing page (13 of 15). Per the 2 October check (www.vonage.com answered a bot check on 1 November), the security page says Vonage holds ISO 27001, PCI-DSS, SOC, HITRUST and CSA STAR across its product lines without saying which cover the Communications APIs, and links a CSA STAR registry entry. www.vonage.com/.well-known/security.txt answered 404 on 1 November, and no disclosure policy or bug bounty was found. OSV lists no advisory for @vonage/server-sdk, vonage, @vonage/messages or the MCP package (10 of 20).

Prelude 30

No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.

Vonage Messages API + MCP 37

No x402, MPP or L402 (0). Per the 2 October check of the pricing page, which answered a bot check on 1 November, Messenger is $0.0011 per delivered message, while SMS, MMS, RCS and WhatsApp rates appear per country through a selector or a downloadable sheet, with no login, and Viber is custom (17 of 20). Free trial with no card, per the pricing page, and €2 of test credit per the 30 September check (20). A person signs up in a browser (0).

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.

Vonage Messages API + MCP 49

Closed service. The legal hub, DPA and privacy pages are per the 2 October check, since www.vonage.com answered a bot check on 1 November. The API terms set the contracting entity by region in a schedule, and the terms body didn't render for our reader on 2 October either. The MCP server is Apache-2.0 (15). The legal hub links a Data Processing Addendum and HIPAA BAAs are sold as an add-on, but we found no retention periods, and the privacy policy page rendered only as a landing page (13 of 30). SDK deprecation warnings, but no dated deprecation policy found (0 of 20). No sub-processor list or data locations found on the legal hub, the security page or the DPA landing page (0).