Twilio API + MCP vs Wati

Twilio API + MCP 85

API keys come as standard, main or restricted. Restricted keys are generally available, take up to 100 endpoint permissions each (page modified 3 August 2026, re-read on 1 November), and can be created and revoked in the console or by API. No documented option to send a secret in a query string (30). A restricted key can leave out number purchase or log reads, but no Twilio MCP asks before a send (15 of 20). Inbound SMS and WhatsApp bodies are untrusted text. Webhooks are signed with X-Twilio-Signature, and the alpha MCP README warns about injection through other MCP servers (10 of 15). The Monitor Events API keeps an audit trail of account changes, and every message has a log resource, per the 1 October check, not re-read on 1 November (15). The security page, re-read on 1 November, lists a vulnerability disclosure programme, a HackerOne bug bounty, SOC 2 Type II and ISO 27001, 27017 and 27018. No security.txt (www.twilio.com/.well-known/security.txt still returns 404 on 1 November), and OSV lists no advisories for the twilio npm package (15 of 20).

Wati 40

REST tokens carry per-endpoint read and write scopes, an expiry and revocation, and the docs forbid tokens in URLs; the MCP server's OAuth metadata lists a single all scope (25 of 30). Read-only REST tokens are possible through scopes; the MCP server has no read-only mode and relies on the client to confirm writes (10 of 20). Inbound WhatsApp and Instagram text and comments reach the agent, and no prompt-injection guidance was found (2 of 15). No operator request log found in the docs (3 of 15). The trust centre answered 403, security.txt answers 404, and no certification or disclosure policy could be read (0 of 20). 25 + 10 + 2 + 3 + 0 = 40.

Twilio API + MCP 80

Message lists take PageSize and return next_page_uri, with no field selection (15 of 25). Lists filter by To, From and DateSent (20). Numbered error codes with causes and fixes (20). No idempotency key on message creation. A 429 is documented as safe to retry, and webhooks carry an I-Twilio-Idempotency-Token for de-duplication (10 of 20). A send needs To, a From or MessagingServiceSid, and a Body, MediaUrl or ContentSid. Official SDKs in seven languages (15). The Message resource page was re-read on 1 November; the webhook token and SDK count are per the 1 October check.

Wati 48

The MCP catalogue lists 73 WATI tools plus Astra groups, some loaded on demand through list_skills and activate_skill (10 of 25). Page and page size with filters on lists, and bounded search (17 of 20). Error handling is documented per status, but bodies can be JSON, plain text or empty, so an agent can't rely on one shape (10 of 20). No idempotency keys; tag add and remove are idempotent, and the docs say to reconcile rather than retry sends (5 of 20). No official SDK; runnable examples in five languages, and region-specific hosts add setup (6 of 15). 10 + 17 + 10 + 5 + 6 = 48.

Twilio API + MCP 81

Closed service with clear terms (last updated 16 July 2026, re-read on 1 November), Twilio Inc. or Twilio Ireland Limited by region. SDKs and the alpha MCP are MIT (15). Privacy notice, a DPA and a sub-processor list with change notifications. We didn't find a stated retention period for message logs on the pages we read (25 of 30). Dated deprecation notices in the changelog, though the Conference list default change, announced on 23 September for 30 September, came with seven days' notice (12 of 20). Sub-processors listed with processing locations (list last updated September 2026, re-read on 1 November), and Regional Twilio can keep customer content in Ireland or Australia (20). The privacy notice and DPA are per the 1 October check.

Wati 52

Closed service with clear terms from Clare.AI Limited (8 December 2025); the MCP repository is MIT (15 of 30). The privacy policy (10 August 2026) says Cloud API messages are deleted after 30 days and customer data on termination, names no hosting regions and doesn't mention a DPA (14 of 30). Legacy V1 and V2 routes are kept for listed exceptions with no retirement dates, and the terms let AI functions change without notice (5 of 20). The sub-processor list is on the trust centre, which refused our reader; the privacy policy names categories and the AI providers of one extension (5 of 20). 15 + 14 + 5 + 5 = 39.

Twilio API + MCP 85

twilio-node 6.2.0 tagged on 2026-10-12, still the newest tag on 1 November, 20 days old (30). Releases 6.1.0 (2026-08-11), 6.1.1 (2026-09-10), 6.1.2 (2026-09-28) and 6.2.0 in the 90 days from 3 August (20). Closed service with a public changelog and paid support, which the changelog says gained live chat across the platform from 5 October. The twilio-labs/mcp repo's last commit and the last npm publish of @twilio-alpha/mcp (0.7.0) were on 2025-07-07, the commit re-read on 1 November and the npm publish per the 17 October check (10 of 15). Official SDKs current in seven languages, per the 1 October check (15). twilio-node needs Node 20 or later and runs CI on GitHub Actions (10).

Wati 62

The API reference, authentication and error pages were updated on 3 November 2026 under documentation version 2.6, read as the last published API change (30). No changelog; the MCP registry entry moved to 1.1.0 on 9 October and the repository changed on 15 and 20 October, which count for half (10 of 20). Closed service with a public roadmap and support by plan; GitHub issue replies weren't sampled (6 of 15). io.github.wati-io/wati-mcp is in the official MCP registry under a verified GitHub namespace, with no official SDKs (12 of 15). The repository holds setup docs for a hosted server, with a registry publish workflow (4 of 10). 30 + 10 + 6 + 12 + 4 = 62.

Twilio API + MCP 75

Status page at status.twilio.com with per-product and per-carrier components (20). Its history pages, read on 1 November, list 562 incidents from 3 August to 31 October, 511 minor, 49 marked no impact and 2 major. Neither major was Programmable Messaging (Event Streams delivery stopped for 2 hours 17 minutes on 19 August, and Deepgram speech-to-text for ConversationRelay failed on 3 August), and most entries are single-carrier or single-country delivery problems. From 20:08 PDT on 7 October to 02:35 on 8 October, an internal block stopped Verify codes reaching users in several regions and Programmable SMS delivery failed intermittently across the affected regions, for 6 hours 27 minutes. Twilio marked it minor, but it was a Twilio-side failure on the send path for hours across regions, which we read as one major. On 1 September customers could get 502 errors on REST API calls and the Console from 09:24 PDT until Twilio reported normal operation at 10:40, 76 minutes, also marked minor. That is wide errors for over an hour on the API every send goes through, so we count a second major, as the 4 October Bird check read 75 minutes of wide API errors and as the Twilio Voice re-check reads the same incident. Since 17 October, possible 503 errors for messaging traffic hit some customers in the Australia region from 07:18 to 14:32 PDT on 28 October, one region and some customers, read as partial, and the Programmable Messaging API returned 500 errors for 53 seconds on 27 October. Two majors fall between the one-major and several-majors lines (5). Throughput is published per sender, 1 message a second on a US long code, 10 on a UK long code and 100 on a short code, and messages queue for 10 hours (36,000 seconds) by default, per the scaling guide re-read on 1 November (15). The scaling guide says to implement backoff and retries on queue overflow (error 30001), and the REST best-practices page, modified 20 July 2026, says a 429 means the request wasn't processed and can be safely retried, with exponential backoff (15). The Twilio APIs SLA, last updated 9 April 2026, commits 99.95 per cent to paying customers with service credits (10). Programmable Messaging is generally available (10). 20+5+15+15+10+10 = 75.

Wati 55

Read with the hosted lines. status.wati.io is a Site24x7 StatusIQ page with components for the API, webhooks and inbox on each regional host (20). Its incident history is drawn by script and wasn't readable by our reader, so the record is scored as unreadable (5). Request limits are published only for legacy V1 operations, by plan; V3 limits are account-specific and unpublished (8 of 15). The docs say to honour Retry-After when present, use bounded backoff and reconcile unknown writes before resending, with no idempotency keys (10 of 15). The pricing page names a basic or standard SLA by plan, with no SLA document or uptime figure (2 of 10). The V3 API is the documented default (10). 20 + 5 + 8 + 10 + 2 + 10 = 55.

Twilio API + MCP 40

No x402, MPP or L402 found in the docs, pricing or MCP pages on 1 November (0). Per-segment US prices, carrier fees by carrier and direction, number rental and the $0.001 failed-message fee are published without a login, re-read on 1 November (20). A 30-day trial without a card, with free units including 100 SMS, per the trials page modified 20 October 2026 (20). A person signs up in a browser and verifies an email address and a phone number (0).

Wati 20

No x402, MPP or L402 (0). Public plan prices only, plus Meta's fees by reference (10 of 20). A 7-day free trial whose card rule isn't stated (10 of 20). A person signs up and connects a WhatsApp Business account (0). 0 + 10 + 10 + 0 = 20.