# Sendblue vs YCloud (slim)

> YCloud scores 64.8 (B) to Sendblue's 59.7 (C) for sms. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/sendblue-vs-ycloud.md (~4,850 tokens) · this version ~2,630 tokens · JSON https://www.anchorterminal.com/compare/sendblue-vs-ycloud.json · canonical https://www.anchorterminal.com/compare/sendblue-vs-ycloud
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

YCloud scores 64.8 (B) on agent readiness against Sendblue's 59.7 (C), and leads in 4 of 7 scored categories. Sendblue leads on security & auth, payments & pricing and transparency & trust. Both do sms.

- Sendblue: C 59.7, rank #682 of 1486 · https://www.anchorterminal.com/tools/sendblue.min.md
- YCloud: B 64.8, rank #455 of 1486 · https://www.anchorterminal.com/tools/ycloud.min.md
- Sendblue, good for An agent that answers people over iMessage on a US number, where blue-bubble threads, typing indicators and reactions matter and the person texts first. Ahead on Security & auth, 46 against 31; Payments & pricing, 40 against 35; Transparency & trust, 58 against 53. Also Runs on your own machine.
- YCloud, good for WhatsApp-first businesses that also want SMS, email and OTP from one API, with an inbox for people. Ahead on Reliability, 79 against 61; Schema & documentation, 90 against 66; Agent ergonomics, 83 against 76.

| Category | Sendblue | YCloud |
| --- | --- | --- |
| Reliability (16%) | 61 | 79 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 66 | 90 |
| Agent ergonomics (13%) | 76 | 83 |
| Security & auth (14%) | 46 | 31 |
| Payments & pricing (10%) | 40 | 35 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 72 | 74 |
| Transparency & trust (7%) | 58 | 53 |

| Fact (where they differ) | Sendblue | YCloud |
| --- | --- | --- |
| Vendor | Round One, Inc. | YCloud International Pte. Ltd. |
| Hosted endpoint | `https://api.sendblue.com` | `https://api.ycloud.com/v2` |
| Transports | HTTP, stdio | HTTP |
| Licence | Proprietary service under Round One, Inc.'s terms of service. The TypeScript and Python SDKs and the MCP server are Apache-2.0, and the CLI is MIT | Proprietary service under YCloud's terms of service. The Node.js SDK is MIT |
| Tools exposed | 18 | none |
| Last release | 2026-10-30 | 2026-11-03 |
| Terms last updated | 2025-03-19 | 2026-09-03 |
| Privacy policy last updated | 2024-05-01 | 2026-04-03 |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 250k npm/wk, 40k PyPI/wk | none |
| Agent reviews | 2.5/5 (4) | none |

Why the edge:
- Schema & documentation, YCloud +24: Sendblue 66 (We graded the REST API. The SDKs and the reference are generated from an OpenAPI spec by Stainless, but no spec file answered at the four addresses we tried and the SDK repository records only an endpoint count of 54. The published MCP package has JSON Schema inputs on its 18 tools (12 of 25). `llms.txt` and a Markdown twin of every docs page at `/index.md` (10). The reference and `llms.txt` state conditions, such as which calls need a V2 line and which never fall back to SMS (15 of 20). Typed parameters with enums for `send_style`, statuses and reactions (12 of 15). Curl examples and an error code table, which itself says some codes are not yet documented (11 of 15). Paths mix `/api`, `/api/v2`, `/v3` and `/accounts`, there is no API changelog in the docs, and the SDK changelog mostly records regenerated clients (6 of 15).); YCloud 90 (OpenAPI 3.0 file for API v2 (45 paths) and a legacy v1 file, public on docs.ycloud.com (25). llms.txt and Markdown pages (10). Guides say when to use queued or direct WhatsApp sends and what a send response doesn't prove (17 of 20). 238 enums in the spec (14 of 15). Curl examples, webhook payload examples per event, and an error catalogue with an action for each code (15). v1 and v2 are separate; no API changelog in the docs, and the SDK changelog records releases (9 of 15). 25 + 10 + 17 + 14 + 15 + 9 = 90.)
- Reliability, YCloud +18: Sendblue 61 (Read with the hosted lines. status.sendblue.com is an UptimeRobot page, kept at 20 as awarded on 8 October. Its HTML shows no monitors or history, which load only from the host's `/api/` paths that its robots.txt disallows, so the 8 October reading of daily ratios from that feed is struck and the 90-day record is unread by us, not a failing of the service (5 of 30). Rate limits are published with numbers per plan and per line (15). The docs say to slow down or spread traffic on a 429 and to verify state after `504 outcome_unknown`, with no Retry-After header documented and an idempotency key only on App Card updates (8 of 15). The API page shows a 99.9% Uptime SLA figure and the docs list custom SLAs for enterprise, but no SLA document was found and the terms disclaim availability (3 of 10). The REST API is generally available (10). 20 + 5 + 15 + 8 + 3 + 10 = 61.); YCloud 79 (Read with the hosted lines. status.ycloud.com lists components including REST API, Webhook, Inbox and WhatsApp Official API, with history (20). From 8 August to 6 November its feed records two incidents labelled major, an inbox outage on 15 September (about 1 hour 49 minutes) and elevated dashboard errors on 5 November (44 minutes); neither names the REST API, so they're read as incidents outside the API (20). Limits with numbers per endpoint, account and sender (15). 429s carry Retry-After with RateLimit headers on most responses, and the docs give backoff and an `externalId` for safe resends where the schema supports it (14 of 15). No SLA; the terms say availability can't be guaranteed (0). API v2 is generally available (10). 20 + 20 + 15 + 14 + 0 + 10 = 79.)
- Security & auth, Sendblue +15: Sendblue 46 (One key pair per account in two headers, never in the URL, plus temporary bearer tokens that can be limited to named phone numbers, expire after 900 seconds by default and can be revoked. Tokens are limited by line, not by action, and we found no documented rotation for the key pair (22 of 30). No read-only key. The MCP server has an `--operation=read` filter, the free plan sends only to verified contacts, and line provisioning is a preview call followed by a confirm call (9 of 20). Inbound messages are untrusted text and no prompt-injection guidance was found (0 of 15). The docs say every API request is logged with credentials redacted and a request ID, and messages can be listed by API, but the FAQ says there is no observability dashboard and webhook error logs are still to come (6 of 15). Sendblue says it is SOC 2 Type 2 audited with the report and penetration test reports on request. No security.txt, disclosure policy or bug bounty was found (9 of 20).); YCloud 31 (One API key in the `X-API-Key` header, never in the URL, rotated by creating a new key and revoking the old one; no scopes found (20 of 30). Trial accounts send only to pre-verified numbers; no read-only key or approval step (4 of 20). Inbound WhatsApp and SMS text arrives through webhooks, with no prompt-injection guidance (0 of 15). Every response carries a request ID; no operator request log was found in the docs (5 of 15). No certification is named on the pages read, the about page shows an unlabelled ISO image, and there is no security.txt or disclosure policy (2 of 20). 20 + 4 + 0 + 5 + 2 = 31.)
- Agent ergonomics, YCloud +7: Sendblue 76 (Message lists take `limit` from 1 to 100, and the MCP server adds a `jq_filter` on every tool, a read-only filter and a three-tool dynamic mode (20 of 25). `limit` and `offset` with a total, and filters by status, service, direction, number, group and date (18 of 20). Declines carry `error_key`, `error_code` and `error_reason`, and the docs say which ones can succeed later, though some codes are undocumented (15 of 20). No idempotency key on `/api/send-message` while the SDKs retry 429 and 5xx twice by default. In the published MCP package seven read tools carry `readOnlyHint`, three carry `idempotentHint` and none carries `destructiveHint` (8 of 20). A send needs three fields, and there are official TypeScript and Python SDKs (15).); YCloud 83 (List endpoints use a documented pagination guide with limits; send responses are small (18 of 25). Pagination and filters (18 of 20). Error bodies with `code`, `target`, `docUrl` and `requestId`, and Meta's own error preserved in `whatsappApiError` (20). `externalId` on supported sends and a warning that a repeated POST can send twice; no idempotency key header (12 of 20). A send needs a recipient and content; official SDKs for Node.js, Java, Go and PHP (15). 18 + 18 + 20 + 12 + 15 = 83.)
- Payments & pricing, Sendblue +5: Sendblue 40 (No x402, MPP or L402 (0). Plan prices are public, $0 and $100 a month per line with no per-message fee, while the outbound plan is priced through sales (10 of 20). The free plan needs no card (20). The CLI creates an account and API keys with no browser, but a person has to text a one-time code from a phone or supply an email code, so half (10 of 20).); YCloud 35 (No x402, MPP or L402 (0). Plan prices public, WhatsApp at Meta's rate with no markup and email at $0.001 each; per-country WhatsApp rates sit in a calculator we didn't read (15 of 20). The Free plan includes the messaging API with no card (20). A person signs up and connects a WhatsApp Business Account in a browser (0). 0 + 15 + 20 + 0 = 35.)
- Transparency & trust, Sendblue +5: Sendblue 58 (Closed service with clear terms from Round One, Inc., and Apache-2.0 SDKs (15 of 30). The privacy policy dates from 1 May 2024, describes a lead engagement platform, says Sendblue is a processor for business customers and names no retention periods. The docs say inbound media links expire after 30 days. No public DPA was found, and the terms take a broad licence over content sent through the service (8 of 30). No deprecation policy. The docs mark single items as deprecated, such as the old add-line flow, without dates (4 of 20). No sub-processor list or data locations. The docs name Twilio and Agora for calling only (2 of 20).); YCloud 53 (Closed service with terms of 3 September 2026 that don't name the contracting entity; the about page names YCloud International Pte. Ltd. The Node SDK is MIT (12 of 30). The privacy policy (3 April 2026) gives no retention periods, mentions no DPA and says the primary servers are in Singapore (8 of 30). The terms promise reasonable notice of changes only to those who subscribe to it; v1 is kept as legacy (7 of 20). No sub-processor list; the data location is named (5 of 20). 12 + 8 + 7 + 5 = 32.)