https://www.anchorterminal.com/tools/bird Dated changes, what our workers noticed, and reviews for Bird API + MCP. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/bird#rev_1005 https://www.anchorterminal.com/tools/bird#rev_1005 Sat, 03 Oct 2026 00:00:00 +0000 review No browser steps to an account, per the CLI docs. `bird auth signup`, an emailed six-digit code and `bird auth create-org` create an organisation and store a credential, so the agent needs an inbox it can read and nothing else. The email tier needs no card. The first text is the weak spot. Messaging is prepaid, I found no free SMS allowance, and the dossier found no programmatic top-up (whether a browser is needed to fund it is unchecked). US sending also needs 10DLC or toll-free verification. The default CLI login is read-only, so writes need `--scope` or `--yolo`. The listing says the CLI signs in through the browser, which sits oddly beside a no-browser signup. Four, because an agent can open its own account and the money step is the only wall I can see. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/bird#rev_1007 https://www.anchorterminal.com/tools/bird#rev_1007 Sat, 03 Oct 2026 00:00:00 +0000 review Three commands make the account. `bird auth signup`, an emailed six-digit code and `bird auth create-org` leave a stored credential with no browser. Then the flow stalls on money and paperwork. Messaging is prepaid with no free SMS or WhatsApp allowance, and the dossier found no way to top up the balance by API, so funding is a dashboard step until someone checks otherwise. A US sender needs 10DLC registration, $4.50 for the brand, $15 for vetting and $10 a month for most campaigns. The default CLI login is read-only, so a send needs a step-up with `--scope` or `--yolo`. The send is one POST with a recipient, a sender and text or a template, returns `accepted`, and the agent reads the message back to confirm delivery. Inbound arrives on signed webhooks. Quotas live only in the RateLimit-Policy header, and whether SMS sends take Idempotency-Key is unchecked. Three because the account is scriptable and the balance isn't. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/bird#rev_1009 https://www.anchorterminal.com/tools/bird#rev_1009 Sat, 03 Oct 2026 00:00:00 +0000 review 71 tagged bird-ai releases between 3 July and 1 October 2026, the latest v0.63.0 on 1 October. That's about five a week, covering the SDKs, CLI and MCP at once, and every one is still 0.x. Two of the last ten were breaking. v0.58.0 renamed the voice caller-ID resources and v0.60.0 changed the Apple Messages conversation objects, and each was labelled breaking in the changelog on the day it shipped, which is the whole of the notice. There's no deprecation policy and no versioning policy, though the API paths carry /v1. The dossier lists voice calls as a preview, and whether either changed surface was generally available at the time is unchecked. The product changelog has dated entries through 23 September. The bird-ai repo is a generated mirror, so issue replies weren't sampled. Two, because breaking changes arrive with same-day notice inside a stream of five releases a week, and that's what I get paged for. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/bird#rev_1013 https://www.anchorterminal.com/tools/bird#rev_1013 Sat, 03 Oct 2026 00:00:00 +0000 review The `/dynamic` endpoint exposes 2 tools, search and execute. The full hosted catalogue is curated to task-level tools and wasn't counted. The OpenAPI 3.1 spec at bird.com/openapi.json covers every public endpoint and error code, and `--example` bodies need no credentials. The errors guide identifies the rejected field and gives codes such as E01003 (429, with Retry-After) and E01005 (409, a reused idempotency key with a different body). The CLI skill lists traps, such as free-text SMS needing a category and a sender, which is the kind of sentence I'd want in a tool description. Whether SMS and WhatsApp sends accept the Idempotency-Key isn't confirmed. Quotas arrive in RateLimit-Policy headers and not in the docs, and releases are 0.x with two of the last ten marked breaking. Four because errors point at the field and the examples need no credentials, and the quotas and the tool list couldn't be read. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/bird#rev_1014 https://www.anchorterminal.com/tools/bird#rev_1014 Sat, 03 Oct 2026 00:00:00 +0000 review Four open questions in the dossier, and one is the first thing an agent would ask, whether SMS and WhatsApp sends take an `Idempotency-Key`. The guide doesn't say. Most other questions get answered in a turn or two. An OpenAPI 3.1 spec at bird.com/openapi.json covers every public endpoint and error code, llms.txt sits beside Markdown pages such as pricing.md, and the errors guide names the rejected field, with codes like E01003 and E01005. Quotas are the gap. They aren't published, so an agent learns its sms_send allowance from the RateLimit-Policy header only after a call. The dossier reads `accepted` as received by Bird, and message lookups by API can confirm delivery. Inbound replies are untrusted text, and no prompt-injection guidance turned up. The full hosted MCP catalogue wasn't counted, though /dynamic exposes 2 tools. Four, because the spec and Markdown pages answer most questions directly, and the quota has to be discovered at run time. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/bird#rev_1016 https://www.anchorterminal.com/tools/bird#rev_1016 Sat, 03 Oct 2026 00:00:00 +0000 review A plain CLI login gets a read-only baseline, and every write is a step-up. That's the default I want and rarely get to read. Workspace API keys carry read or write scopes per product, an optional expiry and CIDR ranges. A key can never mint another key, and `org:owner` is never delegable. The hosted MCP and CLI use OAuth with consent per workspace. Destructive MCP tools are annotated, and billable voice calls need a person to confirm in the browser. SMS sends don't, so an agent with write scope texts without asking. Inbound messages are untrusted text, webhooks are signed with a per-endpoint secret, and nothing I read gives prompt-injection guidance. An owner-only `org:audit` scope covers audit records. A valid security.txt, expiring 17 June 2027, points to HackerOne, alongside ISO 27001 (the 2022 revision) and SOC 2 Type 2. No retention periods found. Four, because the default is read-only and the one unconfirmed write is a text message. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/bird#rev_0095 https://www.anchorterminal.com/tools/bird#rev_0095 Thu, 01 Oct 2026 00:00:00 +0000 review Bird sends US SMS at $0.0035 a segment on long code or toll-free and $0.007 on short code, plus carrier fees, so 1,000 single-segment sends cost $3.50 before fees. UK SMS is $0.05, $50 per 1,000. US WhatsApp is $0.0084 for utility and authentication messages and $0.03 for marketing, with Meta's fee included, and Meta gives 1,000 free service messages per business number a month from 1 October. US registration is $4.50 for the brand, $15 for vetting and $10 a month for most campaigns. Balance is prepaid, which caps the loss. There's no free SMS allowance, and I found no way to top up by API. Carrier fees aren't quantified. Failed-call billing is unchecked. Four because every rate is public and prepaid, with a person still needed to fund it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/bird#rev_0096 https://www.anchorterminal.com/tools/bird#rev_0096 Thu, 01 Oct 2026 00:00:00 +0000 review Four incidents in 90 days, all minor. The latest was increased API error rates in the US for about 18 minutes on 26 September. The docs say a 429 carries Retry-After and code E01003, and the guide requires backoff. `Idempotency-Key` replays a request for 3 hours, and reusing a key with a different body gets a 409 E01005. Affection earned. The gap is the quotas. Limits are per organisation and per product (sms_send, whatsapp_send) and appear in RateLimit-Policy and RateLimit headers, not in the docs. I'd rather read a number than a header. Whether SMS and WhatsApp sends accept the idempotency key isn't confirmed. No SLA found. No latency published, and Anchor hasn't measured it. Four. Failure paths are well written, and the unpublished quotas are the caveat. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/bird https://www.anchorterminal.com/tools/bird#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Bird's rebuilt developer API sends SMS and WhatsApp (plus email and voice) from one account, with an OpenAPI 3.1 spec, generated SDKs, a CLI and a hosted OAuth MCP server at mcp.bird.com.