Sinch Messaging APIs + MCP vs Wati

Sinch Messaging APIs + MCP 77

Closed service with general terms. The contracting Sinch entity is named only in the order form (15). Privacy notice, a DPA, a sub-processor list and deletion on request, with no retention periods found (20 of 30). Dated notices in the release notes (Template Management API v1 stopped on 31 January 2026, the v1alpha and v1beta Batch endpoints end on 16 December 2026), but no general deprecation policy found (10 of 20). The sub-processor list, re-read on 2 November, gives each provider's hosting location by service and region (for example AWS for the Conversation API in the USA and Brazil) and promises 30 days' notice of a new one, as Bandwidth's list is read (20). 15 + 20 + 10 + 20 = 65.

Wati 52

Closed service with clear terms from Clare.AI Limited (8 December 2025); the MCP repository is MIT (15 of 30). The privacy policy (10 August 2026) says Cloud API messages are deleted after 30 days and customer data on termination, names no hosting regions and doesn't mention a DPA (14 of 30). Legacy V1 and V2 routes are kept for listed exceptions with no retirement dates, and the terms let AI functions change without notice (5 of 20). The sub-processor list is on the trust centre, which refused our reader; the privacy policy names categories and the AI providers of one extension (5 of 20). 15 + 14 + 5 + 5 = 39.

Sinch Messaging APIs + MCP 83

Dated Conversation API release notes, the latest dated entry on 14 October 2026, and @sinch/sdk-core 1.8.0, sinch (Python) 2.4.0 and sinch-sdk-java 2.4.0 tagged on 28 October 2026 (30). Release notes on 19 August, 2 October and 14 October, plus SDK tags (Node 1.6.0, 1.7.0, 1.8.0, Python 2.2.0, 2.3.0, 2.4.0, Java 2.2.0, 2.3.0, 2.4.0) in the 90 days (20). Closed service with Conversation release notes. The MCP repository tagged 0.0.1-beta.7 on 30 October 2026, its first tag since 0.0.1-alpha6 on 14 April (10 of 15). Official SDKs current in Node, Python, Java and .NET (15). The MCP repository runs lint, build and tests in CI (8 of 10). 30 + 20 + 10 + 15 + 8 = 83.

Wati 62

The API reference, authentication and error pages were updated on 3 November 2026 under documentation version 2.6, read as the last published API change (30). No changelog; the MCP registry entry moved to 1.1.0 on 9 October and the repository changed on 15 and 20 October, which count for half (10 of 20). Closed service with a public roadmap and support by plan; GitHub issue replies weren't sampled (6 of 15). io.github.wati-io/wati-mcp is in the official MCP registry under a verified GitHub namespace, with no official SDKs (12 of 15). The repository holds setup docs for a hosted server, with a registry publish workflow (4 of 10). 30 + 10 + 6 + 12 + 4 = 62.

Sinch Messaging APIs + MCP 40

No x402, MPP or L402 (0). US SMS prices are published per sender type ($0.0078 a message on 10DLC and toll-free, $0.009 on short code, re-read on 2 November), and other countries and WhatsApp through a country selector without a login (20). Trial credit of 2 units of local currency and a test number, with a payment method needed only to upgrade, per Sinch's community and Voice account pages (20). A person signs up in a browser (0). 0 + 20 + 20 + 0 = 40.

Wati 20

No x402, MPP or L402 (0). Public plan prices only, plus Meta's fees by reference (10 of 20). A 7-day free trial whose card rule isn't stated (10 of 20). A person signs up and connects a WhatsApp Business account (0). 0 + 10 + 10 + 0 = 20.

Sinch Messaging APIs + MCP 73

Statuspage at status.sinch.com with components and history (20). Read from its own history and incident pages on 2 November (the 1 October count from IsDown, a third-party copy of the page, is struck). From 4 August to 2 November the incidents touching the SMS, Conversation and Verification APIs each name one region, one channel, one carrier or a subset of accounts. The REST API in the US had intermittent errors and delayed deliveries from 16 to 17 August (Messaging APIs, REST - US only), Conversation API WhatsApp in Brazil degraded on 4 September and Verification's Okta integration on 27 August. On 26 October a planned change took the customer dashboard down and blocked sending for a subset of accounts through a balance error (12:58 to 15:11 UTC). The other majors on the page are calling in AP-Southeast-1 and Campaigns stats. Partial incidents read as minor, so minor only (20). The Conversation API publishes 800 requests a second per project and a 500,000-message queue per app drained at 20 a second by default (15). Exceeding the limits returns 429, and 5xx errors come with exponential back-off advice, but there's no Retry-After (8 of 15). No SLA found (0). The SMS and Conversation APIs are generally available. The MCP server is a developer preview (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.

Wati 55

Read with the hosted lines. status.wati.io is a Site24x7 StatusIQ page with components for the API, webhooks and inbox on each regional host (20). Its incident history is drawn by script and wasn't readable by our reader, so the record is scored as unreadable (5). Request limits are published only for legacy V1 operations, by plan; V3 limits are account-specific and unpublished (8 of 15). The docs say to honour Retry-After when present, use bounded backoff and reconcile unknown writes before resending, with no idempotency keys (10 of 15). The pricing page names a basic or standard SLA by plan, with no SLA document or uptime figure (2 of 10). The V3 API is the documented default (10). 20 + 5 + 8 + 10 + 2 + 10 = 55.

Sinch Messaging APIs + MCP 55

The SMS API takes a service-plan Bearer token, and the Conversation API OAuth 2.0 client credentials from a project access key, with Basic also accepted. No per-key scopes found (25 of 30). No read-only mode or confirmation step. The MCP server's tool allow-list (--tags, or MCP_TAGS since 0.0.1-beta.7) can leave out whole groups such as provisioning, and its released version runs over stdio only (5 of 20). Inbound messages are untrusted text. Conversation API callbacks are signed with HMAC-SHA256 over the body, a nonce and a timestamp when a secret is set, and we found no prompt-injection guidance (5 of 15). Message and delivery lookups by API, no audit log found (10 of 15). The trust centre, re-read on 2 November, lists ISO 27001:2022, SOC 2 Type II, PCI and HIPAA, links security@sinch.com to report a vulnerability and posts dated notes on third-party vulnerabilities. No security.txt (404 on 2 November), no bug bounty and no advisories for the listed packages in OSV. Bandwidth's messaging listing takes 15 with a public bug bounty, so 10 of 20 here. 25 + 5 + 5 + 10 + 10 = 55.

Wati 40

REST tokens carry per-endpoint read and write scopes, an expiry and revocation, and the docs forbid tokens in URLs; the MCP server's OAuth metadata lists a single all scope (25 of 30). Read-only REST tokens are possible through scopes; the MCP server has no read-only mode and relies on the client to confirm writes (10 of 20). Inbound WhatsApp and Instagram text and comments reach the agent, and no prompt-injection guidance was found (2 of 15). No operator request log found in the docs (3 of 15). The trust centre answered 403, security.txt answers 404, and no certification or disclosure policy could be read (0 of 20). 25 + 10 + 2 + 3 + 0 = 40.