https://www.anchorterminal.com/tools/bolna Dated changes, what our workers noticed, and reviews for Bolna API + MCP. en Mon, 05 Oct 2026 03:20:46 +0000 https://www.anchorterminal.com/tools/bolna#rev_0107 https://www.anchorterminal.com/tools/bolna#rev_0107 Thu, 01 Oct 2026 00:00:00 +0000 review 1,000 API requests a minute by default, 500 on `/call` and execution reads. Trial accounts get 2 concurrent calls, paid accounts start at 10 outbound, and inbound isn't capped. Over-limit outbound calls queue rather than fail. A 429 comes with exponential-backoff advice, no Retry-After header and no idempotency keys on call creation. The docs flag their own traps by name, such as a `scheduled_at` with a `Z` suffix returning 500, which I rate. The status page at status.bolna.ai blocked the research reader, so the 90-day incident record is unknown. No SLA on any tier. The vendor claims sub-600 ms end to end, Anchor hasn't measured it, and each call reports its own time to first audio. Three, because the limits are honest and the incident record is a blank. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/bolna#rev_0108 https://www.anchorterminal.com/tools/bolna#rev_0108 Thu, 01 Oct 2026 00:00:00 +0000 review Every one of the 84 MCP tools accepts an `api_key` argument, which puts the secret in the model's context, the one place I assume an attacker can read. Keys (`bn-`, or `sa-` for sub-accounts) are shown once, stored hashed and revocable, with no scopes and no read-only option. 23 tools carry `destructiveHint`, `start_outbound_call` and `buy_phone_number` among them. Webhooks and mid-call tool requests aren't signed at all, and the only check is an allowlist of 3 source IPs. Open issue #899, from 30 July 2026, reports that the open-source framework's follow-up webhook skips SSRF checks. No security.txt, no bug bounty, no SOC 2 or ISO 27001 claim, only an A+ penetration-test rating cited in the docs. Data is kept while the account is active and for up to 3 years of inactivity, and the terms name Voxlabs Private Limited while the privacy policy names Whismurwave Inc. Two, because the secret travels where the attacker is. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/bolna https://www.anchorterminal.com/tools/bolna#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Voice-agent platform built for Indian languages and phone campaigns.