Prelude vs Wati

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

Wati 48

The MCP catalogue lists 73 WATI tools plus Astra groups, some loaded on demand through list_skills and activate_skill (10 of 25). Page and page size with filters on lists, and bounded search (17 of 20). Error handling is documented per status, but bodies can be JSON, plain text or empty, so an agent can't rely on one shape (10 of 20). No idempotency keys; tag add and remove are idempotent, and the docs say to reconcile rather than retry sends (5 of 20). No official SDK; runnable examples in five languages, and region-specific hosts add setup (6 of 15). 10 + 17 + 10 + 5 + 6 = 48.

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

Wati 40

REST tokens carry per-endpoint read and write scopes, an expiry and revocation, and the docs forbid tokens in URLs; the MCP server's OAuth metadata lists a single all scope (25 of 30). Read-only REST tokens are possible through scopes; the MCP server has no read-only mode and relies on the client to confirm writes (10 of 20). Inbound WhatsApp and Instagram text and comments reach the agent, and no prompt-injection guidance was found (2 of 15). No operator request log found in the docs (3 of 15). The trust centre answered 403, security.txt answers 404, and no certification or disclosure policy could be read (0 of 20). 25 + 10 + 2 + 3 + 0 = 40.

Prelude 83

@prelude.so/sdk 0.16.0 published to npm on 16 October 2026, 21 days ago, carrying API updates (30). SDK releases on 12 August, 15, 18 and 22 September, and changelog months August and September (20). Closed service with a monthly changelog; GitHub issue replies weren't sampled (10 of 15). Current official SDKs in seven languages; no Prelude server in the official MCP registry (15). The SDK repository runs CI and publish workflows (8 of 10). 30 + 20 + 10 + 15 + 8 = 83.

Wati 62

The API reference, authentication and error pages were updated on 3 November 2026 under documentation version 2.6, read as the last published API change (30). No changelog; the MCP registry entry moved to 1.1.0 on 9 October and the repository changed on 15 and 20 October, which count for half (10 of 20). Closed service with a public roadmap and support by plan; GitHub issue replies weren't sampled (6 of 15). io.github.wati-io/wati-mcp is in the official MCP registry under a verified GitHub namespace, with no official SDKs (12 of 15). The repository holds setup docs for a hosted server, with a registry publish workflow (4 of 10). 30 + 10 + 6 + 12 + 4 = 62.

Prelude 93

OpenAPI for the 27 SDK endpoints is public at the URL in the SDK repository's .stats.yml, and every reference page embeds its endpoint's OpenAPI (25). llms.txt and Markdown pages (10). Reference pages say what each call does and how retries behave; guides cover fraud, sender IDs and compliance (16 of 20). Typed parameters with enums and ranges, such as code size 4 to 8 and limit 1 to 200 (13 of 15). Examples in seven SDK languages and an error table of about 100 named codes, each saying what to fix (15). Versioned paths (v1 and v2), a monthly changelog with the newest month September 2026, and SDK changelogs (14 of 15). 25 + 10 + 16 + 13 + 15 + 14 = 93.

Wati 79

No standalone spec file was found, but every reference page embeds the OpenAPI 3.0.4 contract for its operation, with the documentation version 2.6 (20 of 25). llms.txt and Markdown pages (10). Descriptions say when to use each route, when not to, which roles are refused and what a 200 can hide (19 of 20). Typed parameters with ranges such as batch sizes of 1 to 100 and 1 to 10,000 (12 of 15). Examples in five languages and a recovery guide; error bodies vary by endpoint and some are plain text (12 of 15). Versioned documentation and a public roadmap, but no changelog (6 of 15). 20 + 10 + 19 + 12 + 12 + 6 = 79.

Prelude 65

Read with the hosted lines. status.prelude.so has components for Verify, Auth, Watch, Intel, Notify and the dashboard, with history (20). From 8 August to 6 November its feed records one major incident, increased error rates and latencies across the APIs on 16 and 17 August, posted after it was resolved with no duration stated, and minor ones such as Verify latency on 9 and 10 August, SMS degradation in China and on Orange France and delayed webhooks on 23 October (10). No numeric API rate limits were found; only the MCP server's limits and per-window Verify retry limits are documented (7 of 15). A 429 carries Retry-After and X-Should-Retry, and repeating the create call inside the window performs a retry rather than a new verification (13 of 15). The pricing page lists a 99.95 SLA on Enterprise with no SLA document found (5 of 10). Verify and Notify v2 are generally available (10). 20 + 10 + 7 + 13 + 5 + 10 = 65.

Wati 55

Read with the hosted lines. status.wati.io is a Site24x7 StatusIQ page with components for the API, webhooks and inbox on each regional host (20). Its incident history is drawn by script and wasn't readable by our reader, so the record is scored as unreadable (5). Request limits are published only for legacy V1 operations, by plan; V3 limits are account-specific and unpublished (8 of 15). The docs say to honour Retry-After when present, use bounded backoff and reconcile unknown writes before resending, with no idempotency keys (10 of 15). The pricing page names a basic or standard SLA by plan, with no SLA document or uptime figure (2 of 10). The V3 API is the documented default (10). 20 + 5 + 8 + 10 + 2 + 10 = 55.

Prelude 30

No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.

Wati 20

No x402, MPP or L402 (0). Public plan prices only, plus Meta's fees by reference (10 of 20). A 7-day free trial whose card rule isn't stated (10 of 20). A person signs up and connects a WhatsApp Business account (0). 0 + 10 + 10 + 0 = 20.