Twilio API + MCP vs YCloud

Twilio API + MCP 85

API keys come as standard, main or restricted. Restricted keys are generally available, take up to 100 endpoint permissions each (page modified 3 August 2026, re-read on 1 November), and can be created and revoked in the console or by API. No documented option to send a secret in a query string (30). A restricted key can leave out number purchase or log reads, but no Twilio MCP asks before a send (15 of 20). Inbound SMS and WhatsApp bodies are untrusted text. Webhooks are signed with X-Twilio-Signature, and the alpha MCP README warns about injection through other MCP servers (10 of 15). The Monitor Events API keeps an audit trail of account changes, and every message has a log resource, per the 1 October check, not re-read on 1 November (15). The security page, re-read on 1 November, lists a vulnerability disclosure programme, a HackerOne bug bounty, SOC 2 Type II and ISO 27001, 27017 and 27018. No security.txt (www.twilio.com/.well-known/security.txt still returns 404 on 1 November), and OSV lists no advisories for the twilio npm package (15 of 20).

YCloud 31

One API key in the X-API-Key header, never in the URL, rotated by creating a new key and revoking the old one; no scopes found (20 of 30). Trial accounts send only to pre-verified numbers; no read-only key or approval step (4 of 20). Inbound WhatsApp and SMS text arrives through webhooks, with no prompt-injection guidance (0 of 15). Every response carries a request ID; no operator request log was found in the docs (5 of 15). No certification is named on the pages read, the about page shows an unlabelled ISO image, and there is no security.txt or disclosure policy (2 of 20). 20 + 4 + 0 + 5 + 2 = 31.

Twilio API + MCP 81

Closed service with clear terms (last updated 16 July 2026, re-read on 1 November), Twilio Inc. or Twilio Ireland Limited by region. SDKs and the alpha MCP are MIT (15). Privacy notice, a DPA and a sub-processor list with change notifications. We didn't find a stated retention period for message logs on the pages we read (25 of 30). Dated deprecation notices in the changelog, though the Conference list default change, announced on 23 September for 30 September, came with seven days' notice (12 of 20). Sub-processors listed with processing locations (list last updated September 2026, re-read on 1 November), and Regional Twilio can keep customer content in Ireland or Australia (20). The privacy notice and DPA are per the 1 October check.

YCloud 53

Closed service with terms of 3 September 2026 that don't name the contracting entity; the about page names YCloud International Pte. Ltd. The Node SDK is MIT (12 of 30). The privacy policy (3 April 2026) gives no retention periods, mentions no DPA and says the primary servers are in Singapore (8 of 30). The terms promise reasonable notice of changes only to those who subscribe to it; v1 is kept as legacy (7 of 20). No sub-processor list; the data location is named (5 of 20). 12 + 8 + 7 + 5 = 32.

Twilio API + MCP 85

twilio-node 6.2.0 tagged on 2026-10-12, still the newest tag on 1 November, 20 days old (30). Releases 6.1.0 (2026-08-11), 6.1.1 (2026-09-10), 6.1.2 (2026-09-28) and 6.2.0 in the 90 days from 3 August (20). Closed service with a public changelog and paid support, which the changelog says gained live chat across the platform from 5 October. The twilio-labs/mcp repo's last commit and the last npm publish of @twilio-alpha/mcp (0.7.0) were on 2025-07-07, the commit re-read on 1 November and the npm publish per the 17 October check (10 of 15). Official SDKs current in seven languages, per the 1 October check (15). twilio-node needs Node 20 or later and runs CI on GitHub Actions (10).

YCloud 74

@ycloud-cpaas/ycloud-sdk-node 1.17.2 on 3 November 2026 (30). Releases 1.17.0 (23 October), 1.17.1 (26 October) and 1.17.2 in the window (20). Closed service with a ticket desk; GitHub issue replies weren't sampled (6 of 15). Current official SDKs in four languages, generated from the spec; no MCP server in the docs or registry (15). The Node SDK repository has no CI workflow in the clone we read (3 of 10). 30 + 20 + 6 + 15 + 3 = 74.

Twilio API + MCP 40

No x402, MPP or L402 found in the docs, pricing or MCP pages on 1 November (0). Per-segment US prices, carrier fees by carrier and direction, number rental and the $0.001 failed-message fee are published without a login, re-read on 1 November (20). A 30-day trial without a card, with free units including 100 SMS, per the trials page modified 20 October 2026 (20). A person signs up in a browser and verifies an email address and a phone number (0).

YCloud 35

No x402, MPP or L402 (0). Plan prices public, WhatsApp at Meta's rate with no markup and email at $0.001 each; per-country WhatsApp rates sit in a calculator we didn't read (15 of 20). The Free plan includes the messaging API with no card (20). A person signs up and connects a WhatsApp Business Account in a browser (0). 0 + 15 + 20 + 0 = 35.