Vaani Developer Platform vs Vapi API + MCP

Vaani Developer Platform 28

Graded on the hosted REST API at api.vaanivoice.ai. No status page. status.vaani.dev and status.vaanivoice.ai don't resolve, and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits are published. The docs give 2 concurrent calls on pay as you go and a per-organisation campaign concurrency cap, so partial credit (5). The SDK raises RateLimitError on 429 and the MCP client retries once after 600 ms, but no Retry-After, backoff guidance or idempotency key for call creation is documented (3). The pricing table lists a 99.50 per cent uptime SLA on both plans, but no SLA document or service credits were found and the terms supply the service "as-is" with no warranties, so half (5). The API is version 2.0.0 and isn't labelled beta (10). 0+5+5+3+5+10 = 28.

Vapi API + MCP 70

status.vapi.ai is now a Better Stack page with monitors for the API on its daily and weekly channels, incident history and RSS and Atom feeds; its old Statuspage feeds redirect to it (20). In the 90 days from 4 August the feed lists twelve incidents. Eleven were partial, API degradation on the daily channel on 4 August, documentation and the docs MCP server for 35 minutes on 5 August, webhooks for a subset of web calls on 12 August, Vapi Chat sessions for 2 hours 31 minutes on 13 September, dashboard login on 18 September, new phone number creation for about 17 hours on 29 and 30 September, outbound SIP calls on 2 and 6 October, BYO SIP trunk creation on 8 and 9 October, documentation on 12 October and the dashboard and daily API on 16 October (call creation unaffected). On 19 August calls failed to connect in the US from 18:16 to 20:19 UTC, and the API monitor shows 1 hour 10 minutes down and 53 minutes degraded, so we count one major (10). The 1 October check dated that incident to 12 August. Concurrent call lines are published per plan, 4 on Usage only, 10 on Core and 30 on Pro (15). A full account queues the call and subscriptionLimits.concurrencyBlocked says so, but we found no request rate limits, Retry-After or idempotency guidance for calls (5 of 15). The Pro package carries a 99 per cent uptime SLA and Premier 99.9 per cent, re-read on 2 November (10). The API is generally available (10). 20 + 10 + 15 + 5 + 10 + 10 = 70.

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

Vapi API + MCP 75

Closed platform with clear terms, and the MCP server is MIT (18 of 30). Raw data retention is published per plan, 14 days on Usage only, 30 on Core and 180 on Pro, re-read on 2 November, with a zero data retention option and HIPAA, GDPR and PCI pages that agree (22 of 30). Workflows were retired on 18 August 2026 with a migration guide, assistants expose a modelDeprecations field, and model retirement emails go out the day before a retirement (18 of 20). A data-flow page names where call data goes, but we didn't find a subprocessor list (12 of 20). 18 + 22 + 18 + 12 = 70.

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.

Vapi API + MCP 89

OpenAPI 3.1.0 at docs.vapi.ai/openapi/api-reference.json with 145 operations on 76 paths, linked from llms.txt. api.vapi.ai's robots.txt now disallows /api*, so the api.vapi.ai/api-json path the 1 October check read wasn't requested (25). llms.txt with Markdown copies of every page and a docs MCP server (10). Guides explain when to use squads, tools and fallback plans (15 of 20). The OpenAPI types every field, though assistant configuration is a large nested object (12 of 15). Examples throughout and a call-errors guide that explains ended reasons, with less on REST error bodies (12 of 15). A weekly changelog, now at docs.vapi.ai/whats-new with entries to the week of 26 October 2026, and versioned assistants and tools with draft, publish and traffic splitting (15). 25 + 10 + 15 + 12 + 12 + 15 = 89.

Vaani Developer Platform 59

vaani-research-mcp 0.1.1 on 2026-10-14 (30). In the last 90 days, vaani-sdk 0.3.1 on 28 September and three npm versions (0.0.0-stage, 0.1.0, 0.1.1) within 40 minutes on 14 October. No dated changelog, so half (10 of 20). A closed service with no public changelog, issue tracker or community channel found. Contact is hello@vaaniresearch.com and a booking link, and we didn't test whether they answer. The MCP repository on GitHub couldn't be read from this session (4 of 15, the closed-service reading). A current official Python SDK, released seven times since April 2026. The MCP server isn't in the official MCP registry (10 of 15). The SDK's sdist ships its tests and current httpx and pydantic dependencies, and the MCP package runs its tests before publishing, but no public CI was found and the SDK has no repository (5 of 10). 30+10+4+10+5 = 59.

Vapi API + MCP 88

The changelog's newest entry is the week of 26 October 2026, and @vapi-ai/web 3.1.0 was tagged on 30 October (30). Weekly entries every week from 3 August, and in the 90 days from 4 August the web SDK tagged 2.6.2, 2.6.3, 2.7.0, 2.7.1, 3.0.0, 3.0.1 and 3.1.0, the Python SDK 3.0.0 (12 October), the TypeScript SDK 2.0.1 and the MCP server 0.0.10 and 0.0.11 (20). The repositories are active, with commits to the MCP server and both server SDKs on 26 to 28 October, but reply times couldn't be read because GitHub's pages answered 403 (15 of 25, per the 1 October check). Server SDKs, web SDK and MCP server on npm and PyPI (15). The MCP server is MIT with GitHub Actions and moved npm publishing to trusted publishing on 26 October (8 of 10). 30 + 20 + 15 + 15 + 8 = 88.

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.

Vapi API + MCP 61

Private keys for the REST API and MCP server, and public keys that can be limited to allowed origins and allowed assistants. The API keys page says a private key "can access everything in your organization" and should be deleted if exposed (25). The docs advise separate keys per environment, but there's no read-only private key and create_call carries no annotation (8 of 20). Assistants listen to callers. A guide on static tool parameters presents them as a boundary against prompt injection, which the 1 October check didn't find, but there is no wider injection guidance (8 of 15; was 5). Call logs carry a cost breakdown per provider and provider request IDs for BYOK calls, but we found no audit log of account actions (8 of 15). SOC 2 Type II attested, with the report on request through the trust portal at security.vapi.ai, and HIPAA, GDPR and PCI pages. vapi.ai/.well-known/security.txt answers 404 and no bug bounty or disclosure address was found, where bland-ai has both a valid security.txt and a disclosure address (17). The June 2026 npm incident was written up in public (12 of 20). 25 + 8 + 8 + 8 + 12 = 61.

Vaani Developer Platform 22

No x402, MPP or L402 (0 of 40). The ₹1 ($0.02) a minute platform fee, number rental, concurrency lines and add-ons are public, and the calculator shows each provider's unit rate without a login. Registry checks, extraction and evaluations "can add separate charges" that aren't priced, and the billing pulse depends on the account, so 3 off (17 of 20). The home page says "Start free on Vaani's Platform", but the pricing page states a prepaid wallet with no free credit, trial minutes or card rule, and we didn't sign up to check, so 5 of 20. A person signs up with email verification at platform.vaani.dev and creates keys in the dashboard (0). 0+17+5+0 = 22.

Vapi API + MCP 35

No x402, MPP or L402 (0 of 40). The $0.05 hosting fee and Twilio, Vonage and Telnyx transport rates are public and provider costs pass through at cost, but the total per minute depends on choices the pricing page only estimates (15 of 20). $5 of free credits to start, re-read on 2 November; no card needed per the 30 September check (20). Access starts with a human signup (0). 0 + 15 + 20 + 0 = 35.