Sendblue vs Wati

Sendblue 76

Message lists take limit from 1 to 100, and the MCP server adds a jq_filter on every tool, a read-only filter and a three-tool dynamic mode (20 of 25). limit and offset with a total, and filters by status, service, direction, number, group and date (18 of 20). Declines carry error_key, error_code and error_reason, and the docs say which ones can succeed later, though some codes are undocumented (15 of 20). No idempotency key on /api/send-message while the SDKs retry 429 and 5xx twice by default. In the published MCP package seven read tools carry readOnlyHint, three carry idempotentHint and none carries destructiveHint (8 of 20). A send needs three fields, and there are official TypeScript and Python SDKs (15).

Wati 48

The MCP catalogue lists 73 WATI tools plus Astra groups, some loaded on demand through list_skills and activate_skill (10 of 25). Page and page size with filters on lists, and bounded search (17 of 20). Error handling is documented per status, but bodies can be JSON, plain text or empty, so an agent can't rely on one shape (10 of 20). No idempotency keys; tag add and remove are idempotent, and the docs say to reconcile rather than retry sends (5 of 20). No official SDK; runnable examples in five languages, and region-specific hosts add setup (6 of 15). 10 + 17 + 10 + 5 + 6 = 48.

Sendblue 40

No x402, MPP or L402 (0). Plan prices are public, $0 and $100 a month per line with no per-message fee, while the outbound plan is priced through sales (10 of 20). The free plan needs no card (20). The CLI creates an account and API keys with no browser, but a person has to text a one-time code from a phone or supply an email code, so half (10 of 20).

Wati 20

No x402, MPP or L402 (0). Public plan prices only, plus Meta's fees by reference (10 of 20). A 7-day free trial whose card rule isn't stated (10 of 20). A person signs up and connects a WhatsApp Business account (0). 0 + 10 + 10 + 0 = 20.

Sendblue 66

We graded the REST API. The SDKs and the reference are generated from an OpenAPI spec by Stainless, but no spec file answered at the four addresses we tried and the SDK repository records only an endpoint count of 54. The published MCP package has JSON Schema inputs on its 18 tools (12 of 25). llms.txt and a Markdown twin of every docs page at /index.md (10). The reference and llms.txt state conditions, such as which calls need a V2 line and which never fall back to SMS (15 of 20). Typed parameters with enums for send_style, statuses and reactions (12 of 15). Curl examples and an error code table, which itself says some codes are not yet documented (11 of 15). Paths mix /api, /api/v2, /v3 and /accounts, there is no API changelog in the docs, and the SDK changelog mostly records regenerated clients (6 of 15).

Wati 79

No standalone spec file was found, but every reference page embeds the OpenAPI 3.0.4 contract for its operation, with the documentation version 2.6 (20 of 25). llms.txt and Markdown pages (10). Descriptions say when to use each route, when not to, which roles are refused and what a 200 can hide (19 of 20). Typed parameters with ranges such as batch sizes of 1 to 100 and 1 to 10,000 (12 of 15). Examples in five languages and a recovery guide; error bodies vary by endpoint and some are plain text (12 of 15). Versioned documentation and a public roadmap, but no changelog (6 of 15). 20 + 10 + 19 + 12 + 12 + 6 = 79.

Sendblue 72

sendblue on npm is at 3.22.0 per the SDK changelog, dated 30 October 2026, with tags v3.20.0 (9 October), v3.20.1 (17 October), v3.21.0 (22 October), v3.21.1 (23 October) and v3.21.2 (30 October) since the last check. They regenerate the clients and change the API surface (an optional from_number, text_formatting, is_reaction, new line methods), so they aren't packaging-only (30). 20 SDK tags from v3.11.0 (17 August) to v3.21.2 (30 October), counted half as SDK tags, still well over three (20). No API changelog in the docs, support by email, and we couldn't read the GitHub issue trackers (6 of 15). Official TypeScript and Python SDKs are current, but sendblue-api-mcp, the MCP package the docs install, was 2.0.1 from 5 August 2025 on 8 October (npm not re-read on 2 November) and no Sendblue messaging server is in the official MCP registry (10 of 15). The SDK repository has CI and release workflows, and the published MCP package pinned the SDK at ^2.0.1 (6 of 10).

Wati 62

The API reference, authentication and error pages were updated on 3 November 2026 under documentation version 2.6, read as the last published API change (30). No changelog; the MCP registry entry moved to 1.1.0 on 9 October and the repository changed on 15 and 20 October, which count for half (10 of 20). Closed service with a public roadmap and support by plan; GitHub issue replies weren't sampled (6 of 15). io.github.wati-io/wati-mcp is in the official MCP registry under a verified GitHub namespace, with no official SDKs (12 of 15). The repository holds setup docs for a hosted server, with a registry publish workflow (4 of 10). 30 + 10 + 6 + 12 + 4 = 62.

Sendblue 61

Read with the hosted lines. status.sendblue.com is an UptimeRobot page, kept at 20 as awarded on 8 October. Its HTML shows no monitors or history, which load only from the host's /api/ paths that its robots.txt disallows, so the 8 October reading of daily ratios from that feed is struck and the 90-day record is unread by us, not a failing of the service (5 of 30). Rate limits are published with numbers per plan and per line (15). The docs say to slow down or spread traffic on a 429 and to verify state after 504 outcome_unknown, with no Retry-After header documented and an idempotency key only on App Card updates (8 of 15). The API page shows a 99.9% Uptime SLA figure and the docs list custom SLAs for enterprise, but no SLA document was found and the terms disclaim availability (3 of 10). The REST API is generally available (10). 20 + 5 + 15 + 8 + 3 + 10 = 61.

Wati 55

Read with the hosted lines. status.wati.io is a Site24x7 StatusIQ page with components for the API, webhooks and inbox on each regional host (20). Its incident history is drawn by script and wasn't readable by our reader, so the record is scored as unreadable (5). Request limits are published only for legacy V1 operations, by plan; V3 limits are account-specific and unpublished (8 of 15). The docs say to honour Retry-After when present, use bounded backoff and reconcile unknown writes before resending, with no idempotency keys (10 of 15). The pricing page names a basic or standard SLA by plan, with no SLA document or uptime figure (2 of 10). The V3 API is the documented default (10). 20 + 5 + 8 + 10 + 2 + 10 = 55.

Sendblue 46

One key pair per account in two headers, never in the URL, plus temporary bearer tokens that can be limited to named phone numbers, expire after 900 seconds by default and can be revoked. Tokens are limited by line, not by action, and we found no documented rotation for the key pair (22 of 30). No read-only key. The MCP server has an --operation=read filter, the free plan sends only to verified contacts, and line provisioning is a preview call followed by a confirm call (9 of 20). Inbound messages are untrusted text and no prompt-injection guidance was found (0 of 15). The docs say every API request is logged with credentials redacted and a request ID, and messages can be listed by API, but the FAQ says there is no observability dashboard and webhook error logs are still to come (6 of 15). Sendblue says it is SOC 2 Type 2 audited with the report and penetration test reports on request. No security.txt, disclosure policy or bug bounty was found (9 of 20).

Wati 40

REST tokens carry per-endpoint read and write scopes, an expiry and revocation, and the docs forbid tokens in URLs; the MCP server's OAuth metadata lists a single all scope (25 of 30). Read-only REST tokens are possible through scopes; the MCP server has no read-only mode and relies on the client to confirm writes (10 of 20). Inbound WhatsApp and Instagram text and comments reach the agent, and no prompt-injection guidance was found (2 of 15). No operator request log found in the docs (3 of 15). The trust centre answered 403, security.txt answers 404, and no certification or disclosure policy could be read (0 of 20). 25 + 10 + 2 + 3 + 0 = 40.