tl;dv vs Zoom Realtime Media Streams (RTMS)

tl;dv 28

The API docs carried no dates on 8 October and were not re-read on 4 November. The newest dated change is still the README commit of 29 September 2026 describing the hosted MCP server, 36 days before this check, with code commits last made on 12 December 2025, per a clone on 4 November (20). No dated releases or changelog entries in the 90 days from 6 August 2026 (0). No public changelog. Support is by email and in-app chat. On 8 October five pull requests were open with no reply and a licence question from 22 October 2025 was unanswered. GitHub's pages answered 403 on 4 November, so this is not re-read (5). No official SDK. Presence in the official MCP registry was read on 8 October through its API, which this check no longer calls, so the line rests on the SDK reading (0). The local server has a GitLab CI file and depends on @modelcontextprotocol/sdk ^1.8.0, and the README says it is not updated regularly (3). 20+0+5+0+3 = 28.

Zoom Realtime Media Streams (RTMS) 73

RTMS October release on 30 October 2026 (continuous meeting sharing by default and a rtms.request_status webhook) (30). Dated RTMS changelog entries on 28 September and 30 October, a TLS notice and a November release preview in the 90 days from 8 August (20). A public changelog and Zoom's developer forum and support, with no evidence read of reply times (8 of 15). The official @zoom/rtms SDK is at 1.1.0 from 16 April 2026, behind the protocol changes since (10 of 15). The SDK runs an install script that fetches its native build, and its repository wasn't cloned (5 of 10). 30+20+8+10+5 = 73.

tl;dv 50

Graded on the hosted REST API and the hosted MCP server, with the hosted lines. Instatus page at tldv.instatus.com with eight components, among them Public API and Webhooks & integrations, each at 100.0% for the 90 days to 4 November 2026 (20). Its incident feed still has no entry after 17 November 2022 (21 entries from 21 July 2021), so the page isn't shown to post incidents and the quiet window isn't credited as a clean record, as for kiwi-mcp and together-fine-tuning (20). No request rate limit is published, per the 8 October check of doc.tldv.io, not re-read on 4 November because tl;dv's terms bar crawling its websites. The docs give page size and result caps and mention a daily import quota without a number (0). 429 is documented only on the beta upload, with no Retry-After or backoff guidance. The upload complete call is documented as safe to retry, and webhooks retry after a 10-second wait, per the 8 October check (5). No SLA in the terms of 18 May 2026, re-read on 4 November, which disclaim availability warranties (0). The REST API is labelled v1alpha1 with changes expected. The hosted MCP server carries no beta label, so half credit (5). 20+20+0+5+0+5 = 50.

Zoom Realtime Media Streams (RTMS) 67

Graded on the hosted RTMS service with the hosted lines. www.zoomstatus.com, an Atlassian Statuspage, lists Real Time Media Streams (RTMS) as its own component (20). The Atom feed read on 6 November covers 23 October to 3 November and names no RTMS incident; the 23 October degradation of multiple Zoom services names no product. The window from 8 August to 22 October is drawn by script and robots.txt closes /api/, so, as for zoom-scheduler, the line is 10. Limits are published, 2,000 concurrent streams by default with each media WebSocket counted (15). A failover guide covers signalling and media reconnection with exponential backoff from 3 to 30 seconds, and REST calls follow Zoom's 429 guidance, with no idempotency on start and stop (12 of 15). No SLA found for RTMS (0). RTMS for Meetings carries no beta label (10). 20+10+15+12+0+10 = 67.

tl;dv 15

No x402, MPP or L402 (0). Per the 8 October check, plans are public on a pricing page that renders in the browser, and the help centre gives paid plans as starting at $18 a month. Nothing is priced per call (10). A Free plan exists, and the app's pricing text says no credit card is required, but the Free plan excludes the API, webhooks and MCP, so partial credit (5). A person signs up in a browser, pays for a plan and creates a key or approves an OAuth screen (0). 0+10+5+0 = 15.

Zoom Realtime Media Streams (RTMS) 0

No x402, MPP or L402 (0). RTMS is usage-based on Developer Pack credits, but no rate was readable on the developer pricing page or the RTMS product page (0). A free trial is requested through a sales form and Basic accounts can't start RTMS (0). A person creates the app, buys credits and submits the app for review (0). 0+0+0+0 = 0.

tl;dv 73

Per the 8 October check of doc.tldv.io and the help centre, not re-read on 4 November. The hosted MCP server has five read-only tools and the local one four (25). The meeting list takes query, from, to, onlyParticipated, meetingType, page and limit. A transcript comes back whole, with no way to size it or select a time range (15). Errors carry a message with per-property constraints, or a name and message, and the docs say when to fix and retry (15). No idempotency keys on import. dryRun on import and a retry-safe upload complete call are documented, and both MCP servers are read-only. MCP annotations were unchecked (10). List calls need no parameters and single-meeting calls need one id. No official SDK was found (8). 25+15+15+10+8 = 73.

Zoom Realtime Media Streams (RTMS) 59

Streaming reading of the checklist. Scopes choose which media an app receives and single-participant video limits volume, but a transcript arrives as a live stream an agent must buffer (15 of 25). Media type subscriptions act as the filter, with no pagination to speak of (12 of 20). Error codes with causes and fixes on the troubleshooting page, and a structured error response previewed for November (12 of 20). Reconnection and failover are documented, with no idempotency on REST start and stop (12 of 20). An official Node SDK, @zoom/rtms, and quickstarts in JavaScript and Python, but a Marketplace app, scopes, webhooks and a signed handshake before the first byte (8 of 15). 15+12+12+12+8 = 59.

tl;dv 49

The hosted MCP server uses OAuth with PKCE S256, one scope and five-minute access tokens per the README, revocable from the account. The REST API uses one unscoped key per user in a header, with no rotation or expiry documented (22). Both MCP servers are read-only, admins can block MCP through integration policies, and access follows the user's library permissions. The API key cannot be limited to read-only and can import media (14). Transcripts and notes are text spoken by meeting participants, and no prompt-injection guidance was found (0). No audit log or per-call record for API or MCP use was found (0). Per the 8 October check of the security page and trust centre, not re-read on 4 November because tl;dv's terms bar crawling its websites. SOC 2 Type II, a vulnerability report address with a stated 24-hour response, and a Vanta trust centre. No security.txt and no bug bounty found. The README says the API and MCP endpoint are in penetration test scope (13). 22+14+0+0+13 = 49.

Zoom Realtime Media Streams (RTMS) 63

OAuth 2.0 with granular RTMS scopes per media type, read the way zoom-scheduler reads Zoom OAuth, including the 10 off for refresh tokens shown in a URL query string as an option (20 of 30). Least privilege is strong. Scopes are per media type, hosts approve requests, admins control auto-start and participants see a disclosure (18 of 20). Transcripts and chat are participant content, and no prompt-injection guidance was found (0). Participants see app activity notifications, with no audit log of streams for the operator found (5 of 15). Zoom's security.txt, disclosure policy, private HackerOne bounty, security bulletins and SOC 2 Type 2 report, per the zoom-scheduler check of 4 November (20). 20+18+0+5+20 = 63.

tl;dv 65

Closed service with published Terms of Service, effective 18 May 2026 and unchanged on 4 November. The local MCP repository is public with no licence file (15). Per the 8 October check, not re-read on 4 November, the privacy policy of 9 September 2026 gives retention per data type (Free recordings three months, paid until account deletion, logs 10 days) and states customer content is not used to train models, which agrees with the security page. The DPA was not found at a public URL (22). No deprecation policy. The highlights endpoint is marked deprecated with no removal date, and the help centre says endpoint changes will be announced in advance (5). The privacy policy names sub-processors by category, among them Google Cloud, Hetzner, Wasabi, Anthropic, AssemblyAI and ElevenLabs, and states EU hosting with AI processing in the EU or US by account setting (16). 15+22+5+16 = 58.

Zoom Realtime Media Streams (RTMS) 73

Closed service under the Zoom API Licence and Terms of Use of 16 July 2025, as for zoom-scheduler (15 of 30). The Privacy Statement (17 September 2026) and Terms of Service say communications-like customer content isn't used to train AI models, with no fixed retention periods, per the zoom-scheduler check; RTMS streams to the customer's own app, which holds the data (18 of 30). Advance, dated notices in the RTMS changelog, such as TLS 1.2 from 15 November 2026 and a V2 preview, beside API terms that let Zoom deprecate without prior notice (14 of 20). The sub-processor list (2 October 2026) names third parties and affiliates with locations, per the zoom-scheduler check (18 of 20). 15+18+14+18 = 65.