# TCXC Open Voice Shield

> Not Open vSwitch (also "OVS"), not FraudCentral's VoiceShield and not Veridas Voice Shield: TCXC
> Open Voice Shield is TelecomsXChange's voice call fraud analysis service at ovs.telecomsxchange.com.

> Open Voice Shield is one extra hop on the SIP trunk a voice operator already runs, doing four jobs
> on every call. Fraud prevention: each call is recorded, transcribed and scored by a language model,
> which returns a probability, a category, the impersonated entity, numbered red flags, a TCPA
> compliance note and a block / review / allow recommendation, with the recording and transcript as
> evidence. Voice AI gateway: the same hop connects an ordinary SIP call to a voice AI agent (OpenAI
> or xAI) over TLS, or lets an agent place calls. CLI verification: a check proves whether a route
> delivers the caller ID as sent. Call quality and route integrity: estimated MOS, jitter and packet
> loss per leg, plus false answer supervision detection. Nothing to install; a flagged caller's next
> call can be blocked or diverted automatically.

Operated by TelecomsXChange. Canonical site: https://ovs.telecomsxchange.com/
Last updated: 2026-10-29

## The four jobs
- [Fraud prevention](https://ovs.telecomsxchange.com/features#verdict): every analyzed call gets a verdict (block, review
  or allow) with probability 0 to 100, category, impersonated entity, red flags, TCPA note, summary,
  stereo recording, speaker-labelled transcript, SIP ladder and packet capture. Any call can be
  re-analyzed with a different frontier model.
- [Voice AI gateway](https://ovs.telecomsxchange.com/voice-agent-gateway): a switch, SBC or PBX sends a plain SIP call
  over UDP or TCP; the platform handles TLS, encrypted media, the provider webhook and the agent
  session. Agent calls are recorded, transcribed and scored like any other; a test call can be made
  by one of the customer's agents; a live call can be transferred to an agent or a person.
- [CLI verification](https://ovs.telecomsxchange.com/docs/cli-verification): a check calls one of the customer's
  destinations, with a chosen caller ID, to a number the platform holds in the requested country and
  reports what arrived: match, modified (format, prefix or digits), withheld, missing or
  not_received, with the call's timing and estimated audio quality. On demand or on a schedule with
  an alert; uncovered countries can be requested.
- [Host a number](https://ovs.telecomsxchange.com/host-a-number): anyone who owns a working number (mobile, landline or
  toll-free) in any country, Africa, the Middle East and Asia most wanted, can point it at the
  platform's SIP ingress and earn US$0.15 for every caller-ID check that reaches it. Self-serve:
  enrol, point, prove it with one call from any phone; credited to the account balance. Guide at
  https://ovs.telecomsxchange.com/docs/host-a-number; MCP tools host_number, test_hosted_number, list_hosted_numbers.
- [Call quality and route integrity](https://ovs.telecomsxchange.com/fas-detection): estimated MOS (E-model), jitter and
  packet loss per leg on every call, and route alerts for false answer supervision, both early
  answer (ringback after 200 OK) and delayed playback (the callee leg switched to a recording
  mid-call). Route alerts are distinct from the caller verdict.

## How it connects
- [How it works](https://ovs.telecomsxchange.com/how-it-works): the call path, INVITE to verdict.
- [SIP integration](https://ovs.telecomsxchange.com/docs/sip-integration): an IP-authenticated trunk to the account's
  ingress, port 5060 over UDP or TCP, no registration, no credentials, G.711 (PCMU, PCMA) or G.722.
  Prefix routing onward to the operator's own destination, which is monitored with SIP OPTIONS.
- [Any SIP switch](https://ovs.telecomsxchange.com/docs/connect-any-sip-switch): guides for common switches, SBCs and
  CPaaS platforms are listed under Pages.
- Depth of analysis is the customer's choice per destination: relay only, record, or full analysis;
  all traffic or 1 in N calls; three AI modes (Economy, Power, Max) set the model class and the
  per-call analysis fee; data retention is set by the customer.
- Data location: the hosted service runs in Canada and recordings and media captures are stored
  there by default; an account can choose the United States instead, for storage and for the media
  relay that carries its calls, and Europe or any other region our cloud runs in can be enabled on
  request (https://ovs.telecomsxchange.com/docs/data-location), while call records, transcripts and
  analyses stay in the platform database in Canada whatever the choice.
- Verdicts are delivered by email, to the customer's own Slack channel, and by a signed
  `call.analyzed` webhook within minutes of hangup. Automation rules on the ANI block the flagged
  caller's next call with SIP 403 or divert it, including to a voice AI agent.
- Also in the portal: live ports and a line inspector with per-leg media statistics, a web dialer
  that places a real test call through the customer's route, fraud cases with assignment and audit,
  evidence export bundles, expiring share links, branded PDF reports, support tickets.

## Who it is for
NOC engineers, contact-centre operations, carrier and wholesale voice teams, CPaaS / CCaaS / UCaaS
platforms, and telecom anti-fraud and compliance teams who already run SIP trunks. The one-page
case, written to be forwarded, is at https://ovs.telecomsxchange.com/why-open-voice-shield. A dated, attributed
comparison with VeriSwitch SmartShield is at https://ovs.telecomsxchange.com/veriswitch-smartshield-alternative, and with
FraudCentral's VoiceShield (a different product that shares a word) at https://ovs.telecomsxchange.com/fraudcentral-voiceshield-alternative.

## What it is not
Not a B2BUA replacement, not an SBC or firewall, not a campaign dialler. The fraud verdict is
produced after the call completes; enforcement applies to the flagged number's next call, not the
current one. The TCPA note is a reading of the conversation, not a legal determination, and no
software grants a TCPA safe harbor. No accuracy, precision or recall figure is published.

## Commercials
Self-serve at https://ovs.telecomsxchange.com/signup, no card, $5 of credit. Prepaid: per second of analyzed calling
plus one analysis fee per call, set by the AI mode; bundled plans with included minutes; no seats,
no minimum. Details at https://ovs.telecomsxchange.com/pricing. Volume pricing, security reviews, invoicing terms and
private connectivity by email at support@telecomsxchange.com (https://ovs.telecomsxchange.com/contact); that is the only
public address. Pilots are granted on request. A low balance alert (on for every account at US$50, threshold and switch under Billing) sends one e-mail and a post to the account's notification channels when the balance drops under the threshold, once per drop.

## For AI agents
An agent can configure and run an account: add and monitor a destination, set routing, point the
webhook at its own endpoint, create alert rules, ask for a test call (fixed speech or one of the
customer's own agents), run a CLI check, and read the verdict, transcript, quality figures and
report. A person stays in three places on purpose: signing in to connect the agent, confirming each
test call the agent asks for, and entering secrets and verifying numbers in the portal.
- Guide, with the MCP flow and the REST flow in curl: https://ovs.telecomsxchange.com/docs/agents
- MCP server (Streamable HTTP, JSON-RPC 2.0, stateless): https://ovs.telecomsxchange.com/api/mcp. GET returns the tool
  list, install one-liners for Claude Code, Cursor, VS Code, the Claude API and Managed Agents, and
  how to authenticate. initialize, tools/list, get_started and report_links are open; every account
  tool needs OAuth or Authorization: Bearer with an API key the person created on the portal's
  Developers page. There is no signup or login tool, and credentials are never tool arguments:
  input schemas are closed and secret-like arguments are refused.
- OAuth 2.1 for MCP clients: the first tool that needs an account answers 401 with a
  WWW-Authenticate challenge; discovery at https://ovs.telecomsxchange.com/.well-known/oauth-protected-resource and
  https://ovs.telecomsxchange.com/.well-known/oauth-authorization-server (dynamic client registration, S256 PKCE,
  rotating refresh tokens); the consent page signs the person in or creates the account.
- Test calls through the connector: place_test_call returns status awaiting_confirm and a
  confirm_url (a portal page); nothing rings until the person confirms there, within 10 minutes;
  cancel_test_call withdraws a request; get_test_call reports awaiting_confirm, queued, running,
  done, failed, cancelled or expired. POST /api/customer/test-calls with an API key, from a script,
  places the call directly.
- Every test call, in every mode, opens with a recorded announcement that it is an automated test
  call from Open Voice Shield, placed on behalf of one of its account holders, and that it is
  recorded. The caller ID is the platform's own number or one of the account's verified numbers
  (list_verified_numbers; a person verifies a number in the portal, where the platform calls it and
  speaks a six-digit code). scam_sample and agent calls ring verified numbers only; route_test may
  ring any number.
- Kept in the portal: a destination's password or provider key and the webhook signing secret
  (add_destination and set_webhook take none), Slack channels (Connectors page; list_channels gives
  their ids for alert rules), verified numbers and API keys.
- claude.ai and Claude Desktop: a person adds the connector at
  https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=Open%20Voice%20Shield&connectorUrl=https://ovs.telecomsxchange.com%2Fapi%2Fmcp
- Agent card (A2A): https://ovs.telecomsxchange.com/.well-known/agent.json
- Test calls are billed like any call; the signup credit covers many of them.

## Pages
- [Home](https://ovs.telecomsxchange.com/): What Open Voice Shield is (anti-vishing, robocall and scam call protection as one hop on a SIP trunk, for carriers and for small and medium businesses), how a call flows through it, and what the per-call verdict contains.
- [Features](https://ovs.telecomsxchange.com/features): Carrier-grade voice fraud prevention software and an AI telecom fraud management system for SIP operators, feature by feature. The complete shipped feature set, grouped by call path, verdict, route integrity, response, evidence, account and billing. Analysis is multilingual: the spoken language is detected automatically and analyzed the same. Every analyzed call also records transport quality, estimated MOS, jitter and packet loss per leg, from the same media capture.
- [Why Open Voice Shield](https://ovs.telecomsxchange.com/why-open-voice-shield): The one-page case for Open Voice Shield, written to be forwarded inside a buyer's organization. The problem is per call (TCPA damages of $500 to $1,500 per illegal call with no cap; false answer supervision billing minutes nobody spoke), the product is one SIP hop that returns a fraud verdict with evidence, a route alert and per-leg estimated call quality for every call, and acts on the next call from that number. How it differs from CLI reputation and STIR/SHAKEN (signalling-time, no conversation), call analytics and QA tools (no SIP hop, no enforcement), CDR-based fraud management (patterns after the fact, no words) and manual route testing (a few calls a day). What is proven (a documented measurement method, with method, corpus and raw results shared on request, docs, a film of the real product) and what is not claimed (no accuracy figure, and no measured figures published). Price: per analyzed minute plus one analysis fee per call, $0.08 for a three-minute call on the default plan, $5 credit at signup, no seats. Three teams and the job each does. A PDF one-pager is downloadable.
- [How it works](https://ovs.telecomsxchange.com/how-it-works): The concrete call path: INVITE, IP authorization, media relay and capture, onward routing, and the post-hangup decode, transcription and analysis.
- [Pricing](https://ovs.telecomsxchange.com/pricing): What Open Voice Shield charges, in US dollars. Pro is $500 a month for 50,000 analyzed calls of any length ($0.01 a call), with packs of 50,000 more calls for $500 any time in the month. Pay-as-you-go has no monthly fee and bills analyzed minutes at one per-minute rate with the analysis included. CLI verification checks are $0.25 a check plus the short call they place. An on-premises licence on the operator's own infrastructure is scoped and priced with sales.
- [Documentation](https://ovs.telecomsxchange.com/docs): Index of the Open Voice Shield documentation, getting started, SIP integration, concepts, API reference, troubleshooting and security.
- [Getting started](https://ovs.telecomsxchange.com/docs/getting-started): End-to-end setup: account, ingress address and firewall, IP whitelist, destination, plan, trunk configuration, test call and reading the first verdict.
- [SIP integration](https://ovs.telecomsxchange.com/docs/sip-integration): Vendor-neutral SIP trunk guide: ingress host and port, UDP/TCP, IP authentication with no registration, G.711 codecs, the RTP port range, destination selection, prefix routing, tech prefix, destination monitoring with SIP OPTIONS (up/down, last check, round trip), response codes and a test call.
- [CLI verification](https://ovs.telecomsxchange.com/docs/cli-verification): Guide to caller ID (CLI) verification on Open Voice Shield. A check places a call through the customer's destination, with the caller ID they choose, to a verification number the platform holds in the requested country; the number reports what caller ID arrived and the platform compares it with what was sent. Verdicts: match, modified (format, prefix or digits changed), withheld (anonymous), missing (no caller ID), not_received (the call never reached the number). Each check also carries the call's post-dial delay, answer time, SIP ladder and estimated audio quality. Checks can be repeated on a schedule; a failed result raises the "Caller ID check failed" alert. Countries not yet covered can be requested from the same page. Available in the portal, the REST API (POST /customer/cli-checks) and the MCP tool verify_cli.
- [Host a number](https://ovs.telecomsxchange.com/docs/host-a-number): Guide to hosting a number on Open Voice Shield. A customer enrols a phone number they own (E.164, country, kind mobile|landline|toll_free) in the portal or with POST /customer/hosted-numbers. They point the number at the platform's SIP ingress (host, port 5060, UDP or TCP, request URI user = the number's digits, G.711 PCMU/PCMA) and allow the platform's source address. They start the pointing test (POST /customer/hosted-numbers/{id}/test) and call the number once from any phone within the test window; the platform answers with a short announcement, records the caller ID the carrier delivered, and the number becomes active. Other customers' caller-ID checks then lease the number; the platform answers each check's call, reads the INVITE's From header as the delivered caller ID, and credits the owner US$0.15 per check that reached the number (ledger type cli_host_credit). Statuses: pointing, testing, active, paused, unreachable (three checks in a row with no call), suspended. Owners may verify their own routes against their own number and are not credited for it. MCP tools: host_number, test_hosted_number, list_hosted_numbers.
- [Connect an SBC to a voice agent](https://ovs.telecomsxchange.com/docs/connect-sbc-to-voice-agent): Vendor-neutral guide for sending calls from any SIP switch, SBC or PBX to an AI voice agent through Open Voice Shield. Requirements on the switch are the same as for any route (an INVITE with SDP over UDP or TCP, plain symmetric RTP, G.711). Steps: whitelist the switch's public IP on the Network page; add a Voice AI destination (provider OpenAI with the project id, or xAI with the agent number and its digest credential); for OpenAI register the destination's webhook URL in the OpenAI project for the GPT-Live incoming-call event and store the signing secret and a project API key on the destination, set voice and instructions; route a prefix or the default route at the destination; place a call. The platform originates TLS and SRTP to the agent, hosts the webhook, holds the agent session, gives the switch one plain route hop and a Contact on the platform, records and analyzes the call and meters the agent leg per second. Troubleshooting: 400 from the agent means a wrong project id; a silent agent means it is waiting for the caller, add a greeting instruction; the destination shows the last webhook event and what the agent heard and said.
- [Connect Asterisk](https://ovs.telecomsxchange.com/docs/connect-asterisk): Asterisk connection guide: a chan_pjsip endpoint, AOR and identify for the ingress, IP whitelisting, a Dial() dialplan that routes every call and a RAND(1,10) dialplan that samples one call in ten.
- [Connect 3CX](https://ovs.telecomsxchange.com/docs/connect-3cx): 3CX connection guide: a Generic SIP Trunk (IP Based) for sip.ovs.telecomsxchange.com port 5060 with authentication "Do not require - IP based", G.711 first, IP whitelisting, an outbound rule that sends calls through it with the existing trunk as the fallback route, sampling by extension group or prefix, and inbound DIDs relayed back to the same trunk.
- [Connect FreeSWITCH](https://ovs.telecomsxchange.com/docs/connect-freeswitch): FreeSWITCH connection guide: a sofia external gateway with register false, IP whitelisting, a bridge that routes every call and a mod_distributor list that samples one call in ten.
- [Connect Kamailio](https://ovs.telecomsxchange.com/docs/connect-kamailio): Kamailio connection guide: configure your routing script to set $du towards the ingress and t_relay initial INVITEs, whitelist your server's IP, and sample a random share with cfgutils rand_event.
- [Connect OpenSIPS](https://ovs.telecomsxchange.com/docs/connect-opensips): OpenSIPS connection guide: set $du towards the ingress and t_relay initial INVITEs, whitelist your server's IP, and sample deterministically on a hash of the Call-ID using core string transformations.
- [Connect a Ribbon SBC](https://ovs.telecomsxchange.com/docs/connect-ribbon-sbc): Ribbon SBC connection guide: on an SBC Edge, build a SIP Server Table and Signaling Group towards the ingress, route calls to it with a pass-through Transformation Table, whitelist the egress IP, and sample via weighted routes or a prefix subset; SBC Core does the equivalent with its trunk-group CLI.
- [Connect PortaSwitch](https://ovs.telecomsxchange.com/docs/connect-portaone): PortaSwitch connection guide: define Open Voice Shield as a vendor with a Calls to vendor via SIP connection whose remote gateway is the ingress, IP-based with G.711 first, attach a vendor tariff, include the routes in a routing plan, and sample via weighted routes or a rated prefix subset.
- [Connect an AudioCodes SBC](https://ovs.telecomsxchange.com/docs/connect-audiocodes): AudioCodes SBC connection guide: on a Mediant, create a Proxy Set for the ingress, wrap it in a Server-type IP Group with an IP Profile pinning G.711 and plain RTP, add an IP-to-IP Routing rule, whitelist the egress IP, and sample via weighted routes or a prefix-matched rule.
- [Connect Twilio](https://ovs.telecomsxchange.com/docs/connect-twilio): Twilio connection guide: point an Elastic SIP Trunking Origination URI or a TwiML Dial at the ingress for inbound, send outbound through the relay to the trunk's Termination SIP URI with the egress address in an IP Access Control List, and sample via weighted Origination URIs or one if in code.
- [Connect Telnyx](https://ovs.telecomsxchange.com/docs/connect-telnyx): Telnyx connection guide: create a SIP Connection with FQDN authentication towards the ingress and route numbers to it for inbound, send outbound through the relay to sip.telnyx.com with the egress address on an IP-authenticated connection carrying an Outbound Voice Profile, and sample in code or with a number subset.
- [Connect Jambonz](https://ovs.telecomsxchange.com/docs/connect-jambonz): Jambonz connection guide: add a Carrier whose outbound SIP gateway is the ingress, or dial through it with a sip target in the dial verb; whitelist your own server's egress address on the Network page, and sample with one if in the webhook application or a dedicated Carrier.
- [Connect any SIP switch](https://ovs.telecomsxchange.com/docs/connect-any-sip-switch): Vendor-neutral connection guide: the two universal requirements (an INVITE with SDP sent to a next hop, symmetric plain RTP), the trunk parameters any switch asks for, SBC and dialler equivalents, and weighted-route sampling.
- [Concepts](https://ovs.telecomsxchange.com/docs/concepts): End-to-end life of a call, relay, record, decode, transcribe with speaker separation, analyze, and a field-by-field guide to the analysis output and how an operations team should act on it.
- [AI modes](https://ovs.telecomsxchange.com/docs/ai-modes): How the AI mode selector works, Economy, Power and Max each map to a class of transcription and analysis models with a per-call analysis fee; the account picks a tier on the Dashboard strip or the Billing card (or PUT /customer/ai-mode), switching applies to new calls instantly, in-flight calls keep their tier, and every call record and ledger line names the tier it was billed under.
- [Slack alerts](https://ovs.telecomsxchange.com/docs/slack-alerts): How Slack alerts work in Open Voice Shield. Each customer connects their own Slack workspace under Connectors, either with Add to Slack (OAuth v2 with the single incoming-webhook scope; the customer picks the channel in Slack's own screen and returns to Connectors) or by pasting an incoming-webhook URL from their own Slack app. A rule under Alerts then delivers by email, to Slack, or both (email_enabled and channel_ids on the rule). The Slack message is Block Kit: verdict and probability in the headline with the verdict colour, summary, category, entity, dialed number, caller ID, estimated MOS, customer reference, up to five red flags, the TCPA comment and an Open the call button; a quality alert leads with the MOS. Transcript and attachments stay email-only. Delivery runs in the alerts job with idempotency per call, rule and channel, a per-channel throttle, retries for transient errors and a Failing state for permanent refusals. Webhook URLs are sealed at rest and never returned by the API. Platform admins register one Slack app under Email (SMTP) to enable Add to Slack for every customer.
- [Invoices](https://ovs.telecomsxchange.com/docs/billing-invoices): How monthly usage invoices work on Open Voice Shield, one invoice per calendar month is generated automatically, emailed to the account and kept in the portal under Billing > Invoices; each invoice lists the month's charges (call minutes, AI analysis fees, plan and overage), a subtotal, GST/HST for Canadian customers by province (customers outside Canada are tax exempt) and a total; usage is debited from the prepaid balance as it happens and any tax is debited when the invoice is issued; the invoice page prints or saves to PDF from the browser. A low balance alert, on for every account at US$50, sends one e-mail (and a post to the account's notification channels) when the prepaid balance drops under the threshold, once per drop; the threshold and the switch are under Billing > Low balance alert.
- [Data location](https://ovs.telecomsxchange.com/docs/data-location): How data location works on Open Voice Shield. The hosted service runs in Canada and recordings and media captures are stored there by default. Under Account > Data location an account can choose the United States instead, and Europe or any other region our cloud runs in can be enabled on request, for two independent things: where its recordings and captures are stored (Canada, Central Canada in Montréal, or the United States, US East in Northern Virginia) and which region's media relay carries its calls (the United States once a relay is live there). The storage choice applies to calls from the moment it is saved and recordings already stored stay where they are; the relay choice applies to new calls; the SIP ingress address does not change. Call records, transcripts, analyses, the ledger and the audit log stay in the platform database in Canada whatever the choice. API: GET and PUT /customer/data-location (data_region and media_region, "ca" or "us", plus a regions list with storage_available and media_available); GET /auth/me carries data_region and media_region.
- [API reference](https://ovs.telecomsxchange.com/docs/api-reference): Generated REST API reference: authentication with a bearer token or an API key, and every customer-facing endpoint with its parameters, payloads, response objects and error codes.
- [For AI agents](https://ovs.telecomsxchange.com/docs/agents): The agent guide. Discovery is /llms.txt, /.well-known/agent.json (an A2A agent card) and /api/openapi.json. The MCP server at /api/mcp (Streamable HTTP, JSON-RPC 2.0, stateless) authenticates with OAuth 2.0 (dynamic client registration; initialize, tools/list, get_started and report_links are open, every account tool answers 401 with WWW-Authenticate and the client signs the person in or up on the consent page) or with Authorization: Bearer and an API key the person created on the portal's Developers page. Credentials are never tool arguments, input schemas are closed and secret-like arguments are refused; a destination's password or provider key, the webhook signing secret and Slack channels are set in the portal. Tools: get_started, me, account_balance, add_destination, list_destinations, check_destination, add_routing_rule, whitelist_ip, set_webhook (URL only), test_webhook, list_channels, add_alert_rule, list_alert_rules, list_verified_numbers, place_test_call, get_test_call, cancel_test_call, cli_coverage, verify_cli, get_cli_check, list_hosted_numbers, host_number, test_hosted_number, list_calls, get_call, get_transcript, report_links. place_test_call through the connector only requests a call: it returns status awaiting_confirm and a confirm_url, and nothing rings until the person confirms on that portal page within 10 minutes; poll get_test_call (awaiting_confirm, queued, running, done, failed, cancelled, expired). Every test call opens with a recorded announcement that it is an automated test call from Open Voice Shield placed on behalf of an account holder and that it is recorded. The caller ID is the platform's own number or one of the account's verified numbers (a person verifies a number in the portal: the platform calls it and speaks a six-digit code); scam_sample and agent speech ring verified numbers only, route_test any number. The REST flow for scripts is signup (POST /api/auth/signup with accept_terms: true after the person has read the Terms of Service at /terms, no card, $5 of credit), API key (POST /api/auth/api-keys), destination, routing rule, IP whitelist, signed webhook, alert rules, Slack, then POST /api/customer/test-calls, which with an API key places the call directly under the same caller-ID and verified-number rules; GET /api/calls/{id}, /transcript and /report.pdf carry the verdict. Test calls dial real numbers and are billed like any call.
- [Troubleshooting](https://ovs.telecomsxchange.com/docs/troubleshooting): Symptom-first troubleshooting: the three different 403s, other SIP rejections, one-way audio, a call with no verdict, a call stuck in ringing, missing recordings, alert e-mail and webhook delivery, and unauthorized API responses.
- [Security](https://ovs.telecomsxchange.com/docs/security): The operational security detail: IP-authenticated SIP ingress, portal accounts, API keys bound to a user, passkeys, tenant isolation, the audit log, storage and retention, shared call links and signed webhooks.
- [Contact](https://ovs.telecomsxchange.com/contact): How to reach the team behind Open Voice Shield, what to put in the first email, and the four reasons an operator asks for a human before signing up.
- [About](https://ovs.telecomsxchange.com/about): Who builds and operates Open Voice Shield: TelecomsXChange Canada Inc., the company that sells the service and issues its invoices. The brand relationship, what the team does, and the publishing rules the site holds itself to: published prices, published limits, no accuracy figure, MOS always described as estimated, and no number that has not been measured.
- [Anti-vishing](https://ovs.telecomsxchange.com/anti-vishing): The anti-vishing page. Vishing (voice phishing) is social engineering by phone call: a caller impersonates a bank, the IT help desk, a government agency, a supplier or the boss and talks a person into giving up credentials, one-time codes, card details or a payment. Manual advice (hang up, call back on a known number, never share codes) depends on the person and fails under pressure; caller-ID reputation and STIR/SHAKEN judge the number, not the conversation. Open Voice Shield is an anti-vishing solution that works on the phone line itself: one SIP hop for a carrier's network or a business's phone system, every call in or out recorded, transcribed and scored minutes after hangup (probability, category, impersonated entity, red flags quoting the call, block/review/allow), or while the call is still up in realtime mode, set up on request at a higher cost, alerts by e-mail, Slack or webhook, the next call from a flagged number blocked or diverted automatically, and the recording, transcript and PDF report kept as evidence. Prepaid per analyzed minute plus a per-call fee, $5 credit at signup, nothing to install.
- [Blog](https://ovs.telecomsxchange.com/blog): Index of the Open Voice Shield blog, posts on voice-fraud detection, route integrity and call analysis, written by the TelecomsXChange engineering team.
- [An AI agent onboarded itself](https://ovs.telecomsxchange.com/blog/an-ai-agent-onboarded-itself): Blog post about making Open Voice Shield fully operable by AI agents, and the first run. What was built: discovery files (llms.txt, an A2A agent card at /.well-known/agent.json, the OpenAPI contract), a Model Context Protocol server at /api/mcp (Streamable HTTP, JSON-RPC 2.0, stateless, 20 tools that wrap the REST endpoints with the caller's own credentials), API test calls (POST /customer/test-calls: the platform originates a SIP call through the customer's destination, plays a neutral announcement or a known scam sample, and the call is recorded and analyzed like any other), and API keys accepted as bearer tokens. The run: an AI coding agent, given only the site, signed up (no card, $5 of credit), minted a key, added a carrier destination with a tech prefix, a routing rule, a webhook and an alert rule, then dialled the author's mobile. The first attempt was refused by the carrier with 503 because the default test caller ID is not a real assigned number; the agent looked up a number the account owns, retried, the phone rang in 3.2 s, was answered in 8.3 s, and the analysis came back within a minute: 5 percent, allow, no red flags, estimated MOS 4.4 on both legs, transcript with both sides, PDF report. Guardrails: real numbers ring real phones, prepaid balance, per-key audit, no accuracy figure is published. Updated 29 September 2026: the MCP server no longer has signup, login or create_api_key tools or an api_key argument; the person signs in through OAuth or the client sends an API key as a bearer header, a test call asked for through the server rings only after a person confirms it in the portal, every test call opens with a recorded announcement that it is an automated, recorded test call, and the caller ID is the platform's own number or one of the account's verified numbers.
- [Build a 24x7 voice NOC agent](https://ovs.telecomsxchange.com/blog/build-a-24x7-voice-noc-agent): Blog post on the agentic capabilities added to Open Voice Shield in September 2026 and a quick start for a voice NOC agent. What shipped: an MCP server at /api/mcp with tools that wrap the REST API, each with an output schema taken from the OpenAPI document; OAuth 2.1 with dynamic client registration, S256 PKCE and a consent page that signs the person in or up (passkeys included), with a 401 challenge on the first tool that needs an account, or an API key as a bearer header (credentials are never tool arguments); API test calls that dial a number through the customer's own destination and play a neutral announcement or a known scam sample, recorded and analyzed like any call. Updated 29 September 2026: every test call opens with a recorded announcement that it is an automated test call, presents the platform's own number or a verified number, and, asked for through the MCP server, rings only after a person confirms it in the portal; install links for Claude, Cursor, VS Code, Claude Code, the Claude API and Claude Managed Agents. How it works: discovery, the tool loop, typed results with per-leg estimated MOS, jitter, loss, post-dial and answer delay, route alerts and the verdict. Quick start: an account with a destination and an API key, a hosted agent definition with the server and a permission policy, a vault credential, an hourly script that places the test calls over the REST API with the key, the agent instruction that compares each test call with the route's own seven-day baseline and waits for a second call to agree before alerting, and the same loop without an agent platform. Honest limits: it measures the test calls it placed, thresholds are starting points, no false-alarm rate is published.
- [Claude Sonnet 5.5](https://ovs.telecomsxchange.com/blog/claude-sonnet-5-5-now-supported): Blog post (28 September 2026) announcing Claude Sonnet 5.5 support on Open Voice Shield, the SIP-trunk call fraud analysis platform. Anthropic released Claude Sonnet 5.5 on 28 September 2026 at $2 per million input tokens and $10 per million output tokens, the same list price as Claude Sonnet 5. On Open Voice Shield it is selectable the same day: the platform now reads the model list from the Anthropic API (and the chat models from the OpenAI API) and merges it into the admin pickers, so any new release appears without a software update; Claude Opus 5.5 ($4/$20) and GPT-5.5 arrived the same way. An operator picks the model under admin, AI settings, Anthropic, sets it per AI tier (Economy, Power, Max), or re-analyzes any past call with it to compare verdicts side by side. Customers see no change in the verdict shape (probability, category, impersonated entity, numbered red flags quoting the call, TCPA note, block/review/allow) or in fees. Measured on the platform's small labelled set of 17 scam and legitimate call transcripts: Sonnet 5.5 returned the expected verdict on 16 (it scored a grandparent-emergency script review at 50 rather than block), Opus 5.5 on all 17; median answer 5.5 s for Sonnet 5.5 and 9.4 s for Opus 5.5, with two Sonnet 5.5 outliers over two minutes; about 1.7 cents per analysis on Sonnet 5.5 and 3.8 cents on Opus 5.5 because the model's own reasoning tokens are billed as output. The set ranks models and is not an accuracy claim.
- [CLI verification](https://ovs.telecomsxchange.com/blog/cli-verification-testing): Blog post explaining CLI (caller ID) verification testing in general and how Open Voice Shield does it. Defines CLI, CLIP/CLIR, ANI and P-Asserted-Identity; explains why caller ID changes on international calls (normalisation, rewriting, privacy flags, stripping, calls that never reach the far end) and why dialling your own phone is a weak test; gives the procedure and the meaning of each verdict. A check places a call through the customer's SIP destination, with the caller ID they choose, to a verification number the platform holds in the requested country; the number reports the caller ID that arrived and the platform compares it with what was sent. Verdicts are match, modified (format, prefix or digits), withheld, missing and not received, each with the call's post-dial delay, answer time, SIP ladder and estimated MOS. Explains why caller ID changes in transit (normalisation, rewriting, privacy flags, stripping, routes that never reach the far end), why dialling your own phone is a weak test, how schedules and the Caller ID check failed alert work, how to request coverage for a country, and the REST and MCP interfaces.
- [Media and data residency](https://ovs.telecomsxchange.com/blog/data-location-canada-or-united-states): Blog post announcing Data location on Open Voice Shield, the SIP call fraud analysis platform. Defines data residency for call media (recordings and packet captures) versus call records, transcripts and analyses. The hosted service runs in Canada and stores media there by default; from Account > Data location each account can choose the United States for two independent things, where recordings are stored and which region's media relay carries its calls. The storage choice applies to calls from the moment it is saved and recordings already stored stay where they are; the relay choice applies to new calls; the SIP ingress address never changes; call records, transcripts and analyses stay in the platform database in Canada whatever the choice. Explains why operators want it (privacy law such as PIPEDA and the GDPR, customer contracts and procurement, media latency for traffic that lives in the US), how the two lanes work, how to choose, what changes when, and the API (GET and PUT /customer/data-location). Region names only, no cloud vendors.
- [Delayed-playback FAS](https://ovs.telecomsxchange.com/blog/delayed-playback-fas-route-testing): Blog post: what delayed-playback false answer supervision (FAS) is, the economics behind it, why dial-test campaigns structurally miss it, and how sampling live calls through an analysis hop that transcribes each leg on its own channel surfaces the mid-call switch as a route alert.
- [Divert to a voice agent](https://ovs.telecomsxchange.com/blog/divert-fraud-callers-to-an-ai-voice-agent): Blog post about a new Open Voice Shield automation action: when an analyzed call crosses a fraud threshold, the caller's number is put under control and their next calls are diverted at the SIP layer to a Voice AI destination (an AI voice agent, for now on xAI's voice agents) instead of the customer's own destination. The agent's persona is the operator's choice, for example an elderly person who goes along with the caller. Every diverted call is still relayed, recorded, transcribed and analyzed, so the fraudster's time is spent talking to a machine and the operator keeps a recording, a transcript and a verdict. The post notes that current AI voices still sound synthetic and a practised fraudster may notice; the foundation is in place and the results will decide.
- [GPT-Live-1 voice agents](https://ovs.telecomsxchange.com/blog/gpt-live-1-voice-agents): Blog post announcing support for OpenAI's GPT-Live-1 voice agents as a destination on Open Voice Shield. GPT-Live-1 is full-duplex: it listens and speaks at the same time, backchannels, waits when the caller pauses, allows interruptions, and keeps talking while a separate reasoning model it delegates to looks things up. OpenAI and early users report far fewer unwanted interruptions and faster turn-taking than the earlier turn-based Realtime model. Setup on the platform is one destination of kind Voice AI with the OpenAI project id; OpenAI asks a webhook to accept each call and the platform hosts that webhook per destination, holds a control connection to the session for the whole call, encrypts the agent leg with SRTP while the caller keeps plain RTP, and records, transcribes and scores the call like any other. Works from the web dialer and from a carrier softswitch over plain SIP. The agent's model, voice, instructions and reasoning model are set on the destination.
- [Not a strategy](https://ovs.telecomsxchange.com/blog/hang-up-and-call-back-is-not-a-strategy): Blog post arguing that the standard anti-vishing advice for businesses (hang up and call back on a known number, never share codes, train staff, run simulations) is good advice and a weak control, because it depends on one person's judgment under pressure and leaves no record, no alert and no way to stop the second attempt. Sets out what a control on the phone line looks like: every call recorded, transcribed and scored minutes after hangup; an alert with the red flags quoted; the flagged number's next call blocked or diverted automatically; the recording, transcript and PDF report kept as evidence; and what a security team can then measure (flagged calls a week, repeat callers stopped, time to alert). Open Voice Shield provides this as one SIP hop on a business phone system or a carrier trunk.
- [Detect vishing automatically](https://ovs.telecomsxchange.com/blog/how-to-detect-vishing-calls-automatically): Technical blog post on how vishing (voice phishing) calls are detected automatically by Open Voice Shield. The call is relayed through one SIP hop and recorded with the caller and callee on separate channels; after hangup each channel is transcribed separately (reliable speaker attribution) and a language model scores the transcript against a fixed schema: probability 0 to 100, category (bank or card scam, government or IT impersonation, tech-support scam, debt collection, prize scam, robocall, telemarketing, legitimate), the entity the caller claimed to be, numbered red flags quoting the call, a TCPA note, a summary and block/review/allow. A block above 70 requires a hard marker in the transcript: a request for money, cards, codes or credentials, a threat, a deadline, impersonation or remote access; absence of identification alone is not evidence. Delivery by API, signed webhook, e-mail and Slack; an automation rule blocks or diverts the flagged number's next call; evidence kept (recording, transcript, SIP log, PDF). Limits: after the call, not during; no accuracy figure published; adversarial evasion not measured. Any SIP switch or phone system can send calls through it.
- [How to prevent vishing](https://ovs.telecomsxchange.com/blog/how-to-prevent-vishing): Blog post on how to prevent vishing (voice phishing), in three layers. For people, eight rules: caller ID is a claim not proof, never read out a one-time code (the FTC says anyone who asks for one is a scammer), hang up and call back on a number you found yourself (in the UK, 159 reaches your bank and cannot be spoofed), no bank moves money to a safe account, no real organization takes gift cards, crypto or cash by courier, never give remote access to someone who called you, agree a family code word against voice cloning, and slow down. For businesses: procedures that stop the money (call back before changing supplier bank details, two-person approval for payments, no password or MFA reset for an inbound caller without out-of-band checks, nobody reads out a code), short realistic training with blameless reporting, and a control on the phone line itself: Open Voice Shield records, transcribes and scores every call, alerts, blocks the flagged number's next call and keeps the evidence, after hangup in standard mode or during the call in realtime mode on request. For phone operators: STIR/SHAKEN and number reputation judge the number, not the conversation; screening the conversation across the network protects every subscriber and can be sold as an add-on. Also what does not work on its own: trusting caller ID, telling people to be careful, call-blocking apps, training alone.
- [Introducing Open Voice Shield](https://ovs.telecomsxchange.com/blog/introducing-open-voice-shield): Launch post: what Open Voice Shield is, the problem it addresses, how a call travels through it, what a verdict contains, route-integrity (FAS) checks alongside caller scoring, sampling as the on-ramp, who it is for, the pricing model and how to start.
- [The Omarchy bar plugin](https://ovs.telecomsxchange.com/blog/omarchy-bar-plugin): Blog post announcing omarchy-voice-shield, an open-source (MIT) bar plugin that puts Open Voice Shield on the Omarchy Linux desktop. Describes what the bar pill shows (a shield glyph that stays quiet, badging today's high-risk verdict count or the number of calls currently up) and what the panel shows (calls today, active calls, ports, high-risk count; risk distribution; seven days of volume with high-risk counts on their own scale; minutes, spend and balance; a card per live call with ringing versus connected state, route prefix, transport and progress toward the per-call cap; recent verdicts; and a test-call composer). Explains the decisions that make a fraud feed safe to leave on screen: phone numbers masked by default because a bar panel is visible during screen shares, two-press dialling with a five-second arming window so a stray click cannot place a call, the dialled number passed by environment rather than argv because /proc/PID/cmdline is world-readable, and a switch that removes the dialer entirely for shared or kiosk desktops. Also covers the failure model (the fetch helper always exits zero and returns a diagnosable JSON error state, and a transient failure keeps the last good reading on screen), notification priming so a shell restart does not replay the verdict backlog, a steady-state cost of two API calls a minute, and why the volume and high-risk series are drawn as separate strips on independent scales rather than stacked. The plugin is published in the official Omarchy plugin directory as tcxc.voice-shield, listed 17 September 2026 and marked verified there. Install is omarchy plugin add with the repository URL; the plugin reads an API key from ~/.config/omarchy/ovs.json and talks to the customer REST API.
- [Open-weight models](https://ovs.telecomsxchange.com/blog/open-weight-models-openrouter-groq): Blog post announcing two integrations on Open Voice Shield. Analysis can now run on large open-weight models through OpenRouter (gpt-oss 120B, Llama 3.3 70B, Mistral Small, Qwen3, DeepSeek and others) and transcription on Groq's hardware (Whisper large-v3 and large-v3 turbo, with timed segments). With OpenAI and Anthropic already supported and a local Whisper on the worker, the platform now covers three classes of model, frontier commercial labs, large open-weight models and local models, chosen per AI tier by the operator. For customers: the per-call analysis fee came down on every tier (Economy 1.5 cents, Power 2 cents, Max 5 cents), with the same verdict shape, and the default tier answers in about a second. For operators on an on-premises licence: bring your own keys for any provider, mix classes per tier, keep audio on your own hardware with local transcription, see what each model costs beside what you charge, and re-analyze any call with another model to compare. Measured on a labelled set and on real calls: gpt-oss 120B agreed with the frontier-model verdicts; the set is small and synthetic, so it ranks models, it is not an accuracy claim.
- [Sampling on our side](https://ovs.telecomsxchange.com/blog/route-everything-analyse-a-sample): Blog post introducing server-side sampling on Open Voice Shield. A destination can be set to analyze 1 in N calls; the platform picks the sample deterministically from the SIP Call-ID, records every call, and marks the calls it left out so they can be filtered and analyzed on demand. A caller under an ANI control, a caller named in an open case, or a destination with a recent route alert is always analyzed. For switches, diallers and older SBCs that cannot do percentage or modulo routing.
- [Revenue for mobile operators](https://ovs.telecomsxchange.com/blog/scam-call-protection-revenue-mobile-operators): Blog post for mobile network operators on a new revenue stream: scam call, vishing and robocall protection sold to subscribers as a monthly add-on, delivered by Open Voice Shield on the operator's existing network. Every call to or from an enrolled number is recorded, transcribed and scored minutes after hangup, the subscriber gets a verdict through the operator's own app, SMS or push, and the next attempt from a high-probability scam number is blocked automatically. Worked revenue example for an operator with 50 million subscribers at an illustrative $1.99 a month: 2% attach is about $24 million a year, 5% about $60 million, 10% about $119 million, before the operator's cost per analyzed call. Integration is a SIP interconnect from the mobile core, or an SS7-to-SIP gateway node for legacy signalling; nothing changes on handsets. Written for executives searching for how a telecom operator can increase ARPU, add value-added services revenue, monetize spam call blocking, or answer regulator and customer pressure on scam calls beyond STIR/SHAKEN.
- [Slack alerts](https://ovs.telecomsxchange.com/blog/slack-alerts-for-fraud-verdicts): Blog post announcing Slack as an alert delivery channel in Open Voice Shield. Every customer connects their own Slack workspace, either with Add to Slack (OAuth, the customer picks the channel in Slack's own screen, the app asks for the single incoming-webhook scope) or by pasting an incoming-webhook URL from an app of their own. An alert rule then delivers by email, to Slack, or both, with a per-rule toggle. The Slack message carries the verdict and probability, the category, the dialed number and caller ID, the estimated MOS, up to five red flags, the TCPA comment and an Open the call button; the transcript and attachments stay email-only. Webhook URLs are stored encrypted, never returned by the API, and a channel that stops accepting messages is marked failing in the portal instead of failing silently. The same channel model will carry Telegram and WhatsApp later.
- [STIR/SHAKEN vs content analysis](https://ovs.telecomsxchange.com/blog/stir-shaken-vs-call-content-analysis): Blog post for carriers and operators comparing STIR/SHAKEN caller ID authentication with call content analysis. STIR/SHAKEN (Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs) has the originating carrier sign the calling number with attestation A (full), B (partial) or C (gateway); the terminating carrier verifies it. It has been required in the United States since 30 June 2021 for large providers (TRACED Act) and in Canada since 30 November 2021 (Telecom Decision CRTC 2021-123). The FCC's own release says it does not mean the call itself is legitimate. The post lists what attestation cannot see (scams from numbers the caller holds, signatures lost on non-IP segments, gateway-attested international traffic, the conversation itself), compares the two approaches in a table, and explains how a carrier keeps attestation and adds TCXC Open Voice Shield as one SIP hop that records, transcribes and scores calls block, review or allow.
- [TCPA penalties](https://ovs.telecomsxchange.com/blog/tcpa-violation-cost): Blog post: the statutory arithmetic of TCPA liability: $500 per illegal call or text, $1,500 when the violation is willful or knowing, FCC forfeitures that can reach tens of thousands of dollars per violation, no total cap, and how analyzing live traffic surfaces the compliance risk call by call while a campaign is still small.
- [Three ways operators use it](https://ovs.telecomsxchange.com/blog/three-ways-operators-use-open-voice-shield): Blog post describing the three patterns voice operators use Open Voice Shield for. One, a security eye on a single client: route that client's traffic through the platform by prefix, every call comes back scored, and an automation rule blocks the caller with SIP 403 once the fraud probability crosses a threshold. Two, random call checks across the customer base: send a slice of traffic through on pay-as-you-go, read the verdicts the same afternoon, find robocall campaigns, fake card-services desks and pressure scripts before a complaint or a regulator does, then switch it off. Three, proof when someone asks: every analyzed call keeps its stereo recording, transcript, SIP ladder and packet capture; one click exports an analyst bundle with a report, and a password-protected, expiring share link puts it in front of a carrier, a client or a regulator.
- [A VeriSwitch SmartShield alternative](https://ovs.telecomsxchange.com/blog/veriswitch-smartshield-alternative): Blog post for operators evaluating a VeriSwitch SmartShield alternative. It lists six things to check (deployment and what is analyzed, what comes back as evidence, visibility during the call, enforcement on the number, TCPA compliance insights, price and time to first result) and shows how Open Voice Shield answers each, with links to the full comparison page at /veriswitch-smartshield-alternative. Facts about SmartShield come from veriswitch.com/smartshield, checked 14 September 2026.
- [Vishing examples](https://ovs.telecomsxchange.com/blog/vishing-examples-scripts-red-flags): Blog post with seven worked vishing (voice phishing) examples: the card-services fraud desk asking for the card number and CVV under a deadline; the Microsoft technical department asking for remote access and a gift-card fee; the IRS officer with an arrest warrant settled by gift card; the bank fraud team asking for the online-banking login and a one-time code; the Medicare new-card enrolment collecting the Medicare number and bank details; the grandparent emergency with bail money by courier and a secrecy demand; the prize department asking for a fee before delivery. For each: the opening lines, the red flag quoted, the pressure tactic, and how Open Voice Shield scores it (category, probability band, block). Scripts are synthetic, written from real patterns, and are part of the platform's labelled set. Ends with the common shape (impersonation + a request for value + urgency) and how detection on the phone line catches the shape whatever the wording.
- [Anti-vishing for SMBs](https://ovs.telecomsxchange.com/blog/vishing-protection-for-small-business): Blog post on anti-vishing solutions for small and medium businesses: voice phishing (vishing) detection, protection and prevention on the business phone line and how Open Voice Shield covers the phone channel that email security, web security and database hardening leave open. A scammer calls or texts staff pretending to be the bank, the IT help desk, a supplier changing bank details or the owner in a hurry, and talks them into handing over credentials, codes or payments. Open Voice Shield is one SIP hop on the business's phone line: every call in or out is recorded, transcribed and scored within minutes of hangup (fraud probability, category, impersonated entity, numbered red flags, block/review/allow), an alert goes to e-mail or Slack, an automation rule blocks or diverts the next call from a flagged number, and every call keeps its recording, transcript, SIP log and a PDF report as evidence. Integration: the SIP trunk or hosted PBX sends calls through Open Voice Shield and on to the carrier, and inbound calls come from the carrier through Open Voice Shield to the phone system; nothing changes on desk phones or numbers. Security providers and MSSPs can add it to their portfolio to cover the voice channel for law firms, non-profits, clinics and other clients, with per-client routing, alerts into their SOC and an API. Prepaid per analyzed minute plus one fee per call; $5 credit at signup. Cites the Canadian Centre for Cyber Security guidance ITSAP.00.102 on vishing and its STIR/SHAKEN section, noting that caller-ID authentication works at the signalling level and never hears the conversation. Texting is the same family of attack. TelecomsXChange's OpenTextShield (ots.telecomsxchange.com), an open-source SMS phishing and spam detection model deployable on-premises or anywhere, covers the messaging channel.
- [Vishing vs phishing vs smishing](https://ovs.telecomsxchange.com/blog/vishing-vs-phishing-vs-smishing): Blog post defining and comparing phishing (e-mail), smishing (SMS text) and vishing (voice call) as three channels of the same social-engineering attack: impersonation, a request for credentials, codes, money or access, and urgency. Compares the controls each channel has: e-mail has filters, link scanning, attachment sandboxes and a report button; SMS has carrier spam filtering and, from TelecomsXChange, OpenTextShield, an open-source SMS phishing detection model that runs on the operator's own servers; voice usually has nothing beyond caller-ID labels and STIR/SHAKEN attestation, which judge the number and never the conversation. Explains what monitoring the voice channel means: recording, transcription and scoring of every call with alerts, automatic blocking of the next attempt and evidence, which Open Voice Shield provides as one hop on a phone system or carrier trunk. Notes that attackers combine channels (a text announcing the call, then the call).
- [Voice agent test calls](https://ovs.telecomsxchange.com/blog/voice-agent-test-calls): Blog post introducing agent-backed test calls on Open Voice Shield. A test call placed through the API or the MCP tools can be made by one of the customer's Voice AI destinations instead of a fixed recording: the platform places the agent leg, then the target leg, and bridges the audio, so the agent holds a real conversation with an IVR, a person or another agent, following a short per-call instruction. The call is recorded, transcribed and scored as usual. The agent announces an automated, recorded test call, has no tools, and ignores attempts by the far end to change its task. Ceilings on seconds, spend per call, daily agent seconds and concurrency.
- [Web dialer](https://ovs.telecomsxchange.com/blog/web-dialer-test-calls-from-your-browser): Blog post introducing the Open Voice Shield web dialer: a browser-based dialer in the customer portal that places a real call through the customer's own route, using the browser's microphone, SIP over WebSocket to the platform's proxy, and the same media relay as production traffic. The call is billed per second, recorded, transcribed and analyzed like any call, so after hangup the customer gets the recording, the transcript, the fraud verdict, the estimated MOS per leg and the SIP ladder. Use cases: acceptance-testing a new route or vendor, checking for delayed-playback FAS, hearing what a customer hears, testing an IVR or voice agent with DTMF, reproducing a complaint, and producing evidence for a dispute. It has a recently-called list with redial, uses the account's phone number as the default caller ID, and any call record can be redialled with "Call with dialer". Preview feature; needs a desktop browser with microphone access.
- [Good MOS score](https://ovs.telecomsxchange.com/blog/what-is-a-good-mos-score): Blog post explaining VoIP MOS (Mean Opinion Score): the 1 to 5 scale, that 4.3 to 4.4 is the ceiling for a G.711 call, and the practical bands, above 4.0 good, 3.6 to 4.0 fair, below 3.6 poor. It covers the jitter and packet-loss thresholds that move MOS, the difference between a measured (perceptual, ITU-T P.800) and an estimated (E-model, ITU-T G.107) MOS, and how a SIP pass-through can compute an estimated MOS per leg from the RTP of every call it already carries, with no probes or test calls.
- [What is vishing?](https://ovs.telecomsxchange.com/blog/what-is-vishing): Blog post defining vishing (voice phishing) for a general audience. Vishing is fraud by phone call: the caller impersonates someone trusted (a bank's fraud team, a government agency, IT support, a delivery company, a relative or the boss) to get money, a one-time code, a password, card details or remote access. CISA defines it as the social engineering approach that uses voice communication. The post breaks a vishing call into four parts (the pretext, the problem, the pressure, the ask), explains caller-ID spoofing, the text-then-call pattern and voice cloning, lists the common kinds (bank fraud team, government and tax, tech support, family emergency, delivery and utility, boss or supplier, IT help desk), gives sourced 2025 figures (FBI IC3 tech support and government impersonation losses, FTC imposter losses, Canadian Anti-Fraud Centre, Scamwatch phone losses), lists the red flags, compares vishing with phishing and smishing, and points to prevention, what to do after a call, and Open Voice Shield for businesses and phone operators: every call recorded, transcribed and scored after hangup in standard mode, or during the call in realtime mode on request.
- [What to do after a vishing call](https://ovs.telecomsxchange.com/blog/what-to-do-after-a-vishing-call): Blog post for someone who has just given information or money to a phone scammer (a vishing call). What to do first, by what was shared: card details (call the number on the card, dispute the charges), bank details or a transfer (call the bank's fraud line, ask to reverse the payment, change the online banking password), a one-time code or a password (change it, sign out other devices, turn on two-factor authentication), remote access to a computer (disconnect, uninstall, scan, change passwords from another device, tell the bank), a Social Security number (IdentityTheft.gov) or SIN, gift cards, wire transfers and cryptocurrency (contact the company at once). Where to report: ReportFraud.ftc.gov, IC3.gov and IdentityTheft.gov in the US; the Canadian Anti-Fraud Centre (1-888-495-8501, reportcyberandfraud.canada.ca); Report Fraud in the UK (reportfraud.police.uk, 0300 123 2040, replaced Action Fraud in December 2025) and 159 to reach your bank; Scamwatch and ReportCyber in Australia. How to handle the second call (fake police, fake bank, paid recovery services), what a business does when an employee is vished, and how Open Voice Shield keeps the recording, transcript and red flags as evidence and blocks the number's next call.
- [xAI voice agents and G.722](https://ovs.telecomsxchange.com/blog/xai-voice-agents-and-g722-support): Blog post announcing two related additions to Open Voice Shield. One, Voice AI destinations that reach xAI's voice agents over SIP: the proxy connects to sip.voice.x.ai on port 5061 over TLS with certificate verification, sends the agent's number as the request URI with a leading plus, and answers the agent's digest challenge or relies on an IP allow-list configured on the xAI side. A Voice AI destination can be dialled from the web dialer, used as the target of a divert automation rule, and every call to it is recorded, transcribed and analyzed like any other call. Two, G.722 wideband audio support in the analysis pipeline: calls answered in G.722 (RTP payload type 9, 16 kHz audio, 64 kbit/s) used to record but fail analysis as an unsupported codec; they are now decoded with the ITU-T reference implementation, folded into the stereo recording, transcribed and scored, and the call record shows the codec. Mixed calls with one G.711 leg and one G.722 leg work too. The stored recording keeps the pipeline's 8 kHz format for now.
- [Brand assets](https://ovs.telecomsxchange.com/brand): The Open Voice Shield logo files (mark, horizontal lockup, app tile) in SVG and PNG for light and dark backgrounds, the brand colours, and usage rules, for partners, press and integrators.
- [FAQ](https://ovs.telecomsxchange.com/faq): Direct answers to the integration questions a NOC engineer asks before pointing a trunk at Open Voice Shield.
- [FAS detection](https://ovs.telecomsxchange.com/fas-detection): What false answer supervision with delayed playback is, why short test calls miss it, and how per-channel transcription of sampled live traffic raises a route alert distinct from the caller verdict.
- [FraudCentral VoiceShield alternative](https://ovs.telecomsxchange.com/fraudcentral-voiceshield-alternative): Comparison and disambiguation page. TCXC Open Voice Shield (this site) is not FraudCentral's VoiceShield. As published on fraudcentral.io (read 30 September 2026), FraudCentral's VoiceShield is an intelligent proxy between a switch and its carrier that analyzes live voice interactions without interrupting or rerouting calls, for known scam and traceback campaigns, robocalls, telemarketing and TCPA issues; it is informational monitoring only, with alerts by e-mail and Discord webhook, no blocking, up to 20 calls per second, $495 a month with 2,500 transcriptions and a 7-day trial; FraudCentral's blocking product is VoiceGuard (media-IP blocking, RoboDNO, $500 to $1,000 a month by calls per second). Open Voice Shield is one SIP hop that records every call on separate channels, transcribes it and returns a verdict with numbered red flags, a TCPA note and the recording and transcript as evidence; a flagged number's next call is blocked or diverted automatically, a live call can be cut or diverted, and realtime scoring during the call is available on request; it is prepaid per analyzed minute plus a per-call fee with $5 of credit at signup and no monthly minimum; it also does caller-ID verification, call quality scoring, false answer supervision detection and a voice-AI-agent gateway, with a REST API and an MCP server. Where FraudCentral fits better: an intermediate carrier that wants media-IP blocking across all traffic at high calls-per-second, or a flat monthly monitor with no per-call charge.
- [Glossary](https://ovs.telecomsxchange.com/glossary): Glossary of voice fraud and call quality terms, each with its own anchor (/glossary#fas and so on): ACD, ANI, ASR (answer-seizure ratio and automatic speech recognition), CDR, CLI, CLI verification, FAS (early-answer and delayed-playback), IRSF, jitter, MOS (E-model estimate), packet loss, PDD, robocall, SBC, SIP trunk, smishing, caller ID spoofing, STIR/SHAKEN (attestation A, B and C), TCPA, toll fraud, vishing, voice cloning and wangiri. Each definition says where TCXC Open Voice Shield applies and, for IRSF, wangiri and voice cloning, that it does not detect them.
- [Host a number](https://ovs.telecomsxchange.com/host-a-number): Host a number on Open Voice Shield. A person or company that owns a working phone number (mobile, landline or toll-free) in any country, especially Africa, the Middle East and Asia, can point it at the platform's SIP ingress and earn US$0.15 for every caller-ID verification check that reaches it. Enrolment is self-serve in the portal: enrol the number, point it at the SIP address shown (host, port 5060, UDP or TCP, G.711), press "I've pointed it" and call the number once from any phone; the platform answers with a short announcement, reads the caller ID the carrier delivered, and the number goes live. Checks are about 12 seconds long, never overlap on one number, and only happen while a check holds it. Earnings are credited to the account balance and paid out on request. A number that stops answering is paused automatically until its owner tests it again. Also available through the REST API and the MCP tools host_number, test_hosted_number and list_hosted_numbers.
- [Privacy](https://ovs.telecomsxchange.com/privacy): The privacy policy of TCXC Open Voice Shield, operated by TelecomsXChange Canada Inc. (Burlington, Ontario), a service that records, transcribes and analyzes voice calls for telecom operators. Two roles: the operator who routes calls controls call content and is responsible for consent and recording notices (see the Terms of Service), and TelecomsXChange processes it on the operator's behalf; TelecomsXChange controls portal account data. What is recorded per call and per account; call content is used to provide the service and, internally, to check and improve analysis quality, never sold, shared for others' purposes or used to train third-party models. Storage in Canada by default, the United States per account; subprocessors named (OpenAI or Groq for speech-to-text, Anthropic, OpenAI or OpenRouter for analysis, AWS, Twilio, Stripe, Mailgun, Slack), some in the United States. Recordings kept 30 days by default, other records until erased on request, ledger and invoices at least six years. Sections on processing outside Canada, security incidents, automated processing, sensitive information, the e-mail we send (with unsubscribe), cookies, children, rights under Canadian, Quebec and GDPR law, and a named privacy officer. Governed by the laws of Ontario and Canada.
- [Security](https://ovs.telecomsxchange.com/security): The implemented security controls: SIP ingress authentication, account credentials, tenant isolation, webhook and payment integrity, storage, shared links and rate limiting.
- [TCPA compliance](https://ovs.telecomsxchange.com/tcpa-compliance): TCPA compliance software for contact centres, CPaaS, UCaaS and carriers, on the call itself rather than the list. How Open Voice Shield helps prevent TCPA penalties: every analyzed call carries a plain-language telemarketing-compliance note minutes after hangup, automation rules block or divert a flagged caller, alert emails carry the recording and transcript as evidence, and exposure is caught on the first sampled calls instead of after thousands, against statutory damages of $500 to $1,500 per illegal call with no total cap.
- [Terms](https://ovs.telecomsxchange.com/terms): The Terms of Service of TCXC Open Voice Shield, operated by TelecomsXChange Canada Inc. Business customers only. The customer is responsible for the lawfulness of every call it routes or causes to be placed, including consent to recording and interception, announcements, calling and caller-ID rules, blocking or diverting calls, emergency calls and sensitive data. Verdicts are automated opinions, not advice or a guarantee. The customer controls call content and TelecomsXChange processes it on the customer's behalf, with data processing terms in section 8. Prepaid balance is non-refundable except billing errors. Liability is capped at US$100 and the customer indemnifies TelecomsXChange. Governed by the laws of Ontario, Canada.
- [VeriSwitch SmartShield alternative](https://ovs.telecomsxchange.com/veriswitch-smartshield-alternative): Comparison page. Open Voice Shield is an alternative to VeriSwitch SmartShield (a carrier call-fraud detection product that analyzes live calls on the A-leg non-intrusively with AI/ML and provides TCPA compliance insights, as published on veriswitch.com/smartshield, checked 14 September 2026). Open Voice Shield is one SIP hop in the media path that relays and records every call, shows the signalling ladder and per-leg media counters while the call is up, and after hang-up returns a transcript, a fraud verdict with red flags, a TCPA note, per-leg audio quality and a route-integrity check; automation blocks or diverts the number's next call, including diverting it to an AI voice agent. It is self-serve with published per-minute pricing and a free credit, operable through a REST API and an MCP server. SmartShield may fit better for a carrier that wants purely passive analysis with no change to routing.
- [Voice agent gateway](https://ovs.telecomsxchange.com/voice-agent-gateway): Positioning page. Open Voice Shield acts as a gateway between legacy SIP equipment (UDP or TCP signalling, plain RTP, no TLS, no SRTP, no webhooks) and modern AI voice agents (OpenAI GPT-Live-1 and Realtime, xAI). The switch sends an ordinary call to the ingress; the platform does TLS signalling and SRTP media towards the agent, hosts the incoming-call webhook the agent provider requires, holds the agent's session for the life of the call, presents the switch a plain one-hop dialog that any B2BUA can acknowledge and hang up, records and analyzes the call, and meters the agent leg per second. Verified end to end with a carrier softswitch that has no TLS or SRTP support. For carriers, ITSPs, contact centres and PBX operators. Agent transfers (REFER) are not executed on the switch's behalf yet.
- [What's new](https://ovs.telecomsxchange.com/whats-new): The release ledger of Open Voice Shield, newest first, one dated entry per customer-visible change with a link to the guide or post that explains it. October 2026: the Pro plan, $500 a month for 50,000 analyzed calls with packs of 50,000 more for $500. September 2026: data location (recordings and captures in Canada by default, the United States per account), the SIP trace as a sequence diagram on the call detail, white paper v1.2, the one-page case with a PDF, the voice NOC agent quick start, the agent interface (MCP server with typed output schemas, OAuth 2.1 sign-in with passkeys, API test calls with natural-voice samples, install links for Claude, Cursor, VS Code, Claude Code, the Claude API and Claude Managed Agents), early-answer FAS detection, the PDF call report, Slack alerts and the Connectors page, DTMF in the web dialer, G.722 decoding, Voice AI destinations over TLS, per-call estimated MOS, jitter and packet loss per leg with quality alerts, the live line inspector, support tickets, brand assets. August 2026: monthly invoices with GST/HST, AI modes (Economy, Power, Max), the web dialer, the TCPA penalty-prevention page, connect guides for eleven switches, SBCs and CPaaS platforms, evidence attached to alert emails, pay-as-you-go pricing, the public site and documentation, passkeys, multi-user accounts, fraud cases, automation rules, SIP log and pcap, public call sharing, pilot periods, live call monitoring and the production launch on 25 August 2026.
- [White paper](https://ovs.telecomsxchange.com/whitepaper): White paper v2.0 (26 September 2026). Threat model; the call path with per-destination handling (full analysis, record only, relay only, 1-in-N sampling with the rest recorded, or sampling at the door with SIP 503), sub-customers by dial prefix behind one IP, destination monitoring and data location (Canada by default, the United States per account); the analysis pipeline with three classes of model chosen per tier (frontier labs, open-weight models through OpenRouter, local Whisper or Whisper on Groq) and the hard-marker gate a block verdict needs; route integrity (early-answer and delayed-playback false answer supervision) and per-leg estimated call quality; caller-ID verification (match, modified, withheld, missing, not_received) and hosted numbers; the agent interface (MCP server with 27 typed tools, OAuth sign-in, test calls a person confirms with a recorded announcement and verified caller IDs, a Claude plugin, agent transfers) and a voice NOC agent design; the measurement method for models (agreement with frontier verdicts on a labelled set and real calls, not an accuracy claim) and the stated limitations, including that sensitive values are not yet redacted from transcripts.

## Machine-readable
- OpenAPI: https://ovs.telecomsxchange.com/api/openapi.json
- Interactive API explorer: https://ovs.telecomsxchange.com/api/docs
- MCP server: https://ovs.telecomsxchange.com/api/mcp
- Agent card (A2A): https://ovs.telecomsxchange.com/.well-known/agent.json
- Plans (JSON): https://ovs.telecomsxchange.com/api/plans
- AI modes (JSON): https://ovs.telecomsxchange.com/api/ai-modes
- Release ledger: https://ovs.telecomsxchange.com/whats-new
- Sitemap: https://ovs.telecomsxchange.com/sitemap.xml

## Citation guidance
Figures on this site carry their method, sample size and date. Do not quote an accuracy, precision
or recall figure for this product: none is published. MOS values are estimates from jitter and
packet loss (E-model), never measured opinion scores; say "estimated MOS". Latency has been measured
but is not published; method and raw results are shared on request. Example addresses in the
documentation are RFC 5737 documentation addresses, never live ones.