Wati vs YCloud

Wati 48

The MCP catalogue lists 73 WATI tools plus Astra groups, some loaded on demand through list_skills and activate_skill (10 of 25). Page and page size with filters on lists, and bounded search (17 of 20). Error handling is documented per status, but bodies can be JSON, plain text or empty, so an agent can't rely on one shape (10 of 20). No idempotency keys; tag add and remove are idempotent, and the docs say to reconcile rather than retry sends (5 of 20). No official SDK; runnable examples in five languages, and region-specific hosts add setup (6 of 15). 10 + 17 + 10 + 5 + 6 = 48.

YCloud 83

List endpoints use a documented pagination guide with limits; send responses are small (18 of 25). Pagination and filters (18 of 20). Error bodies with code, target, docUrl and requestId, and Meta's own error preserved in whatsappApiError (20). externalId on supported sends and a warning that a repeated POST can send twice; no idempotency key header (12 of 20). A send needs a recipient and content; official SDKs for Node.js, Java, Go and PHP (15). 18 + 18 + 20 + 12 + 15 = 83.

Wati 55

Read with the hosted lines. status.wati.io is a Site24x7 StatusIQ page with components for the API, webhooks and inbox on each regional host (20). Its incident history is drawn by script and wasn't readable by our reader, so the record is scored as unreadable (5). Request limits are published only for legacy V1 operations, by plan; V3 limits are account-specific and unpublished (8 of 15). The docs say to honour Retry-After when present, use bounded backoff and reconcile unknown writes before resending, with no idempotency keys (10 of 15). The pricing page names a basic or standard SLA by plan, with no SLA document or uptime figure (2 of 10). The V3 API is the documented default (10). 20 + 5 + 8 + 10 + 2 + 10 = 55.

YCloud 79

Read with the hosted lines. status.ycloud.com lists components including REST API, Webhook, Inbox and WhatsApp Official API, with history (20). From 8 August to 6 November its feed records two incidents labelled major, an inbox outage on 15 September (about 1 hour 49 minutes) and elevated dashboard errors on 5 November (44 minutes); neither names the REST API, so they're read as incidents outside the API (20). Limits with numbers per endpoint, account and sender (15). 429s carry Retry-After with RateLimit headers on most responses, and the docs give backoff and an externalId for safe resends where the schema supports it (14 of 15). No SLA; the terms say availability can't be guaranteed (0). API v2 is generally available (10). 20 + 20 + 15 + 14 + 0 + 10 = 79.

Wati 20

No x402, MPP or L402 (0). Public plan prices only, plus Meta's fees by reference (10 of 20). A 7-day free trial whose card rule isn't stated (10 of 20). A person signs up and connects a WhatsApp Business account (0). 0 + 10 + 10 + 0 = 20.

YCloud 35

No x402, MPP or L402 (0). Plan prices public, WhatsApp at Meta's rate with no markup and email at $0.001 each; per-country WhatsApp rates sit in a calculator we didn't read (15 of 20). The Free plan includes the messaging API with no card (20). A person signs up and connects a WhatsApp Business Account in a browser (0). 0 + 15 + 20 + 0 = 35.

Wati 62

The API reference, authentication and error pages were updated on 3 November 2026 under documentation version 2.6, read as the last published API change (30). No changelog; the MCP registry entry moved to 1.1.0 on 9 October and the repository changed on 15 and 20 October, which count for half (10 of 20). Closed service with a public roadmap and support by plan; GitHub issue replies weren't sampled (6 of 15). io.github.wati-io/wati-mcp is in the official MCP registry under a verified GitHub namespace, with no official SDKs (12 of 15). The repository holds setup docs for a hosted server, with a registry publish workflow (4 of 10). 30 + 10 + 6 + 12 + 4 = 62.

YCloud 74

@ycloud-cpaas/ycloud-sdk-node 1.17.2 on 3 November 2026 (30). Releases 1.17.0 (23 October), 1.17.1 (26 October) and 1.17.2 in the window (20). Closed service with a ticket desk; GitHub issue replies weren't sampled (6 of 15). Current official SDKs in four languages, generated from the spec; no MCP server in the docs or registry (15). The Node SDK repository has no CI workflow in the clone we read (3 of 10). 30 + 20 + 6 + 15 + 3 = 74.

Wati 79

No standalone spec file was found, but every reference page embeds the OpenAPI 3.0.4 contract for its operation, with the documentation version 2.6 (20 of 25). llms.txt and Markdown pages (10). Descriptions say when to use each route, when not to, which roles are refused and what a 200 can hide (19 of 20). Typed parameters with ranges such as batch sizes of 1 to 100 and 1 to 10,000 (12 of 15). Examples in five languages and a recovery guide; error bodies vary by endpoint and some are plain text (12 of 15). Versioned documentation and a public roadmap, but no changelog (6 of 15). 20 + 10 + 19 + 12 + 12 + 6 = 79.

YCloud 90

OpenAPI 3.0 file for API v2 (45 paths) and a legacy v1 file, public on docs.ycloud.com (25). llms.txt and Markdown pages (10). Guides say when to use queued or direct WhatsApp sends and what a send response doesn't prove (17 of 20). 238 enums in the spec (14 of 15). Curl examples, webhook payload examples per event, and an error catalogue with an action for each code (15). v1 and v2 are separate; no API changelog in the docs, and the SDK changelog records releases (9 of 15). 25 + 10 + 17 + 14 + 15 + 9 = 90.

Wati 40

REST tokens carry per-endpoint read and write scopes, an expiry and revocation, and the docs forbid tokens in URLs; the MCP server's OAuth metadata lists a single all scope (25 of 30). Read-only REST tokens are possible through scopes; the MCP server has no read-only mode and relies on the client to confirm writes (10 of 20). Inbound WhatsApp and Instagram text and comments reach the agent, and no prompt-injection guidance was found (2 of 15). No operator request log found in the docs (3 of 15). The trust centre answered 403, security.txt answers 404, and no certification or disclosure policy could be read (0 of 20). 25 + 10 + 2 + 3 + 0 = 40.

YCloud 31

One API key in the X-API-Key header, never in the URL, rotated by creating a new key and revoking the old one; no scopes found (20 of 30). Trial accounts send only to pre-verified numbers; no read-only key or approval step (4 of 20). Inbound WhatsApp and SMS text arrives through webhooks, with no prompt-injection guidance (0 of 15). Every response carries a request ID; no operator request log was found in the docs (5 of 15). No certification is named on the pages read, the about page shows an unlabelled ISO image, and there is no security.txt or disclosure policy (2 of 20). 20 + 4 + 0 + 5 + 2 = 31.