Sinch Messaging APIs + MCP vs YCloud

Sinch Messaging APIs + MCP 50

We didn't confirm page-size or field controls on message lists (10 of 25). Pagination and filters not confirmed (10 of 20). Error responses with codes, and back-off advice for 5xx (15 of 20). No idempotency key or de-duplication found, and the 54 MCP tools carry no readOnlyHint or destructiveHint annotations (0 of 20). Official SDKs in Node, Python, Java and .NET. A send names an app, a recipient, a channel and a message object (15).

YCloud 83

List endpoints use a documented pagination guide with limits; send responses are small (18 of 25). Pagination and filters (18 of 20). Error bodies with code, target, docUrl and requestId, and Meta's own error preserved in whatsappApiError (20). externalId on supported sends and a warning that a repeated POST can send twice; no idempotency key header (12 of 20). A send needs a recipient and content; official SDKs for Node.js, Java, Go and PHP (15). 18 + 18 + 20 + 12 + 15 = 83.

Sinch Messaging APIs + MCP 55

The SMS API takes a service-plan Bearer token, and the Conversation API OAuth 2.0 client credentials from a project access key, with Basic also accepted. No per-key scopes found (25 of 30). No read-only mode or confirmation step. The MCP server's tool allow-list (--tags, or MCP_TAGS since 0.0.1-beta.7) can leave out whole groups such as provisioning, and its released version runs over stdio only (5 of 20). Inbound messages are untrusted text. Conversation API callbacks are signed with HMAC-SHA256 over the body, a nonce and a timestamp when a secret is set, and we found no prompt-injection guidance (5 of 15). Message and delivery lookups by API, no audit log found (10 of 15). The trust centre, re-read on 2 November, lists ISO 27001:2022, SOC 2 Type II, PCI and HIPAA, links security@sinch.com to report a vulnerability and posts dated notes on third-party vulnerabilities. No security.txt (404 on 2 November), no bug bounty and no advisories for the listed packages in OSV. Bandwidth's messaging listing takes 15 with a public bug bounty, so 10 of 20 here. 25 + 5 + 5 + 10 + 10 = 55.

YCloud 31

One API key in the X-API-Key header, never in the URL, rotated by creating a new key and revoking the old one; no scopes found (20 of 30). Trial accounts send only to pre-verified numbers; no read-only key or approval step (4 of 20). Inbound WhatsApp and SMS text arrives through webhooks, with no prompt-injection guidance (0 of 15). Every response carries a request ID; no operator request log was found in the docs (5 of 15). No certification is named on the pages read, the about page shows an unlabelled ISO image, and there is no security.txt or disclosure policy (2 of 20). 20 + 4 + 0 + 5 + 2 = 31.

Sinch Messaging APIs + MCP 77

Closed service with general terms. The contracting Sinch entity is named only in the order form (15). Privacy notice, a DPA, a sub-processor list and deletion on request, with no retention periods found (20 of 30). Dated notices in the release notes (Template Management API v1 stopped on 31 January 2026, the v1alpha and v1beta Batch endpoints end on 16 December 2026), but no general deprecation policy found (10 of 20). The sub-processor list, re-read on 2 November, gives each provider's hosting location by service and region (for example AWS for the Conversation API in the USA and Brazil) and promises 30 days' notice of a new one, as Bandwidth's list is read (20). 15 + 20 + 10 + 20 = 65.

YCloud 53

Closed service with terms of 3 September 2026 that don't name the contracting entity; the about page names YCloud International Pte. Ltd. The Node SDK is MIT (12 of 30). The privacy policy (3 April 2026) gives no retention periods, mentions no DPA and says the primary servers are in Singapore (8 of 30). The terms promise reasonable notice of changes only to those who subscribe to it; v1 is kept as legacy (7 of 20). No sub-processor list; the data location is named (5 of 20). 12 + 8 + 7 + 5 = 32.

Sinch Messaging APIs + MCP 81

OpenAPI YAML for the Conversation API, linked from its reference page (25). llms.txt with Markdown pages (10). Reference pages describe each endpoint and channel, with little on when not to use one (12 of 20). Typed JSON with message types per channel, not checked for enums (10 of 15). Examples and error codes in the references (12 of 15). /v1 paths and Conversation release notes, with no versioning policy found (12 of 15).

YCloud 90

OpenAPI 3.0 file for API v2 (45 paths) and a legacy v1 file, public on docs.ycloud.com (25). llms.txt and Markdown pages (10). Guides say when to use queued or direct WhatsApp sends and what a send response doesn't prove (17 of 20). 238 enums in the spec (14 of 15). Curl examples, webhook payload examples per event, and an error catalogue with an action for each code (15). v1 and v2 are separate; no API changelog in the docs, and the SDK changelog records releases (9 of 15). 25 + 10 + 17 + 14 + 15 + 9 = 90.

Sinch Messaging APIs + MCP 83

Dated Conversation API release notes, the latest dated entry on 14 October 2026, and @sinch/sdk-core 1.8.0, sinch (Python) 2.4.0 and sinch-sdk-java 2.4.0 tagged on 28 October 2026 (30). Release notes on 19 August, 2 October and 14 October, plus SDK tags (Node 1.6.0, 1.7.0, 1.8.0, Python 2.2.0, 2.3.0, 2.4.0, Java 2.2.0, 2.3.0, 2.4.0) in the 90 days (20). Closed service with Conversation release notes. The MCP repository tagged 0.0.1-beta.7 on 30 October 2026, its first tag since 0.0.1-alpha6 on 14 April (10 of 15). Official SDKs current in Node, Python, Java and .NET (15). The MCP repository runs lint, build and tests in CI (8 of 10). 30 + 20 + 10 + 15 + 8 = 83.

YCloud 74

@ycloud-cpaas/ycloud-sdk-node 1.17.2 on 3 November 2026 (30). Releases 1.17.0 (23 October), 1.17.1 (26 October) and 1.17.2 in the window (20). Closed service with a ticket desk; GitHub issue replies weren't sampled (6 of 15). Current official SDKs in four languages, generated from the spec; no MCP server in the docs or registry (15). The Node SDK repository has no CI workflow in the clone we read (3 of 10). 30 + 20 + 6 + 15 + 3 = 74.

Sinch Messaging APIs + MCP 73

Statuspage at status.sinch.com with components and history (20). Read from its own history and incident pages on 2 November (the 1 October count from IsDown, a third-party copy of the page, is struck). From 4 August to 2 November the incidents touching the SMS, Conversation and Verification APIs each name one region, one channel, one carrier or a subset of accounts. The REST API in the US had intermittent errors and delayed deliveries from 16 to 17 August (Messaging APIs, REST - US only), Conversation API WhatsApp in Brazil degraded on 4 September and Verification's Okta integration on 27 August. On 26 October a planned change took the customer dashboard down and blocked sending for a subset of accounts through a balance error (12:58 to 15:11 UTC). The other majors on the page are calling in AP-Southeast-1 and Campaigns stats. Partial incidents read as minor, so minor only (20). The Conversation API publishes 800 requests a second per project and a 500,000-message queue per app drained at 20 a second by default (15). Exceeding the limits returns 429, and 5xx errors come with exponential back-off advice, but there's no Retry-After (8 of 15). No SLA found (0). The SMS and Conversation APIs are generally available. The MCP server is a developer preview (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.

YCloud 79

Read with the hosted lines. status.ycloud.com lists components including REST API, Webhook, Inbox and WhatsApp Official API, with history (20). From 8 August to 6 November its feed records two incidents labelled major, an inbox outage on 15 September (about 1 hour 49 minutes) and elevated dashboard errors on 5 November (44 minutes); neither names the REST API, so they're read as incidents outside the API (20). Limits with numbers per endpoint, account and sender (15). 429s carry Retry-After with RateLimit headers on most responses, and the docs give backoff and an externalId for safe resends where the schema supports it (14 of 15). No SLA; the terms say availability can't be guaranteed (0). API v2 is generally available (10). 20 + 20 + 15 + 14 + 0 + 10 = 79.