Telnyx API + MCP vs YCloud

Telnyx API + MCP 65

x402 exists on Telnyx's own API at /v2/x402/credit_account (USDC on Base), with MPP at /v2/machine-payments/account-credit (Stripe Link or Tempo USDC), but both top up account credit rather than pay per message. Telnyx's x402 skill says x402 sits behind an account feature flag (403 when it's off) and that per-payment minimum and maximum limits are configurable and stated in 422 errors; the MPP skill names no flag (25 of 40). Per-part SMS and MMS rates and carrier passthrough fees are published without a login, also as pricing.md (20). No free credit, a new account starts at zero (0). An agent can sign up through /v2/bot_challenge and /v2/bot_signup, confirm by a magic link sent to a mailbox it can read, mint a key at /v2/api_keys and fund the account by MPP or x402 with no browser (20).

YCloud 35

No x402, MPP or L402 (0). Plan prices public, WhatsApp at Meta's rate with no markup and email at $0.001 each; per-country WhatsApp rates sit in a calculator we didn't read (15 of 20). The Free plan includes the messaging API with no card (20). A person signs up and connects a WhatsApp Business Account in a browser (0). 0 + 15 + 20 + 0 = 35.

Telnyx API + MCP 72

Closed service with clear terms (15). Privacy policy (last updated effective 1 March 2026, read on 17 October, not re-read on 1 November) covering retention as long as reasonably necessary, a Telnyx DPA referenced from the sub-processor page, and about 50 sub-processors. We didn't find stated retention periods for message records (25 of 30). No deprecation policy or dated deprecation notices found, and the release notes read on 1 November carry none (0 of 20). Each sub-processor is listed with its entity, address, products and data categories, with change alerts, per the 6 October check (15 of 20).

YCloud 53

Closed service with terms of 3 September 2026 that don't name the contracting entity; the about page names YCloud International Pte. Ltd. The Node SDK is MIT (12 of 30). The privacy policy (3 April 2026) gives no retention periods, mentions no DPA and says the primary servers are in Singapore (8 of 30). The terms promise reasonable notice of changes only to those who subscribe to it; v1 is kept as legacy (7 of 20). No sub-processor list; the data location is named (5 of 20). 12 + 8 + 7 + 5 = 32.

Telnyx API + MCP 45

Bearer API keys created and revoked in the portal, with no per-key scopes found. Claude connectors can authorise through the portal instead, and the OAuth authorisation-server metadata, re-read on 1 November, still lists 32 product scopes such as messaging.read, messaging.write and numbers.write, but no document says how a client picks them or that a token is held to them, so the line stays at plain revocable keys (20). No read-only key mode found. The hosted MCP's invoke_api_endpoint carries destructiveHint true but can send messages or buy numbers with no confirmation step on Telnyx's side (0 of 20). Inbound SMS and WhatsApp bodies are untrusted text. Messaging webhooks are signed, and we found no prompt-injection guidance (5 of 15). Message and detail records by API, with no account audit log found (10 of 15). SOC 2 Type II and ISO 27001 per Telnyx's compliance file, and telnyx-node has a SECURITY.md with a reporting route. security.txt returned 404 at both locations on 1 November and no bug bounty found (10 of 20). 20 + 0 + 5 + 10 + 10 = 45.

YCloud 31

One API key in the X-API-Key header, never in the URL, rotated by creating a new key and revoking the old one; no scopes found (20 of 30). Trial accounts send only to pre-verified numbers; no read-only key or approval step (4 of 20). Inbound WhatsApp and SMS text arrives through webhooks, with no prompt-injection guidance (0 of 15). Every response carries a request ID; no operator request log was found in the docs (5 of 15). No certification is named on the pages read, the about page shows an unlabelled ISO image, and there is no security.txt or disclosure policy (2 of 20). 20 + 4 + 0 + 5 + 2 = 31.

Telnyx API + MCP 83

telnyx-node v7.29.0 and telnyx-python v4.190.0 both tagged on 2026-10-28 (30). 17 telnyx-node releases in the 90 days to 1 November, from v7.13.0 on 4 August to v7.29.0, and 20 telnyx-python tags in the same window, with dated release notes up to 30 October 2026, messaging entries among them on 26 October (MM7 gateway for MMS) and 29 October (automatic SMS chunking) (20). Closed service with public release notes and a support channel. We couldn't read GitHub issue replies (8 of 15). Current official SDKs. The MCP is in the official registry as io.github.team-telnyx/telnyx, though that entry still stops at 6.29.3 from March 2026 (15). Release automation runs in CI (10). 30 + 20 + 8 + 15 + 10 = 83.

YCloud 74

@ycloud-cpaas/ycloud-sdk-node 1.17.2 on 3 November 2026 (30). Releases 1.17.0 (23 October), 1.17.1 (26 October) and 1.17.2 in the window (20). Closed service with a ticket desk; GitHub issue replies weren't sampled (6 of 15). Current official SDKs in four languages, generated from the spec; no MCP server in the docs or registry (15). The Node SDK repository has no CI workflow in the clone we read (3 of 10). 30 + 20 + 6 + 15 + 3 = 74.

Telnyx API + MCP 90

List endpoints take page size and number, with no field selection. The hosted MCP lists 6 tools on 1 November (3 meta-tools that load endpoint schemas on demand and 3 read-only MCP App launchers), but we scored the API (15 of 25). Filters on message and number lists (20). JSON errors with a code, title and detail, and a documented code list (20). POST /v2/messages now declares an optional Idempotency-Key header in its reference, and so do the seven other send endpoints in the OpenAPI file (long code, short code, number pool, alphanumeric sender ID, group MMS, RCS and WhatsApp). Scheduled sends (POST /v2/messages/schedule) and account writes such as messaging profiles and number orders take none. That is the coverage the Telnyx Voice API listing earns 20 for, where command_id is on 38 of 40 call commands. Only successful responses are replayed, for up to 24 hours, a key still in progress returns 409 and a key reused with a different request returns 422. The Node SDK carries it from v7.27.0 (21 October 2026), where 17 October found none (20). A send needs from or a messaging profile, to and text. Official SDKs in Node, Python and more (15). 15 + 20 + 20 + 20 + 15 = 90.

YCloud 83

List endpoints use a documented pagination guide with limits; send responses are small (18 of 25). Pagination and filters (18 of 20). Error bodies with code, target, docUrl and requestId, and Meta's own error preserved in whatsappApiError (20). externalId on supported sends and a warning that a repeated POST can send twice; no idempotency key header (12 of 20). A send needs a recipient and content; official SDKs for Node.js, Java, Go and PHP (15). 18 + 18 + 20 + 12 + 15 = 83.