{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "mailchimp-marketing", "name": "Mailchimp Marketing API", "vendor": "Intuit Mailchimp", "vendorUrl": "https://mailchimp.com", "kind": "http-api", "category": "lifecycle-marketing", "summary": "Intuit Mailchimp's Marketing API manages audiences, contacts, tags, segments, events, campaigns, automations and reports for a Mailchimp account. It is a REST API at `https://api.mailchimp.com/3.0/` that takes an API key or an OAuth 2 token.", "url": "https://www.anchorterminal.com/tools/mailchimp-marketing", "markdownUrl": "https://www.anchorterminal.com/tools/mailchimp-marketing.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mailchimp-marketing.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mailchimp-marketing.json", "repo": "https://github.com/mailchimp/mailchimp-marketing-typescript-sdk", "license": "Proprietary service under Mailchimp's Standard Terms of Use and API Use Policy. The generated client libraries declare Apache-2.0 in their package metadata", "transports": [ "http" ], "remoteUrl": "https://api.mailchimp.com/3.0", "packages": [ { "registry": "npm", "name": "@mailchimp/mailchimp_marketing" }, { "registry": "pypi", "name": "mailchimp-marketing" } ], "auth": "mixed", "authNotes": "Self-serve API key, or an OAuth 2 token for another user's account. A user with Manager permissions or above creates a key under Profile, Extras, API keys, and it is shown once. A key has full account access, bounded only by its creator's user level, with no read-only or per-endpoint option. Keys created from 22 June 2026 expire after one year, per the help centre. OAuth uses the authorisation code grant with no scopes, no refresh token and tokens that do not expire. Registering an OAuth app is done in the account, and a Marketplace listing needs OAuth. Both credentials go in HTTP Basic or `Authorization: Bearer`.", "pricing": "freemium", "pricingNotes": "The Free plan has 250 contacts and 500 sends a month (250 a day), one audience and one seat, with no time limit. Paid plans start at $13 a month for Essentials, $20 for Standard and $350 for Premium with USD selected, and rise with the contact count. API calls are not metered. The 14-day trial of a paid plan needs payment details. An agent's owner can start on the Free plan without a contract (https://mailchimp.com/pricing/marketing/, https://mailchimp.com/help/about-mailchimp-pricing-plans/).", "priceSummary": "$13 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the OpenAPI file or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 278434, "pypiWeekly": 111433, "asOf": "2026-10-08" }, "docsUrl": "https://mailchimp.com/developer/marketing/", "llmsTxt": "https://mailchimp.com/developer/marketing/llms.txt", "openapi": "https://api.mailchimp.com/schema/openapi/OpenAPI.json?expand", "capabilities": [ "marketing.profiles", "marketing.events", "marketing.segments", "marketing.campaigns", "marketing.journeys", "email.templates" ], "tags": [ "official", "hosted", "closed-source", "api-key", "oauth", "openapi", "llms-txt", "free-tier", "webhooks", "cli", "typescript", "python", "go", "java", "status-page", "soc2" ], "lastRelease": "2026-10-05", "graded": true, "anchor": { "graded": true, "score": 57.4, "grade": "C", "agentReady": false, "rank": 549, "ranked": true, "rankOf": 842, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 63, "payments": 25, "reliability": 60, "schema": 76, "security": 46, "transparency": 74 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 60, "points": 12, "reason": "Graded on the hosted REST API with the hosted lines. status.mailchimp.com lists an API component for each of 21 data centres and keeps event history by month (20). In the 90 days to 8 October 2026 it shows five events on the marketing side. Click tracking failed from about 11 am Eastern on 3 August to noon on 4 August and cannot be backfilled, campaign links returned 500 errors on 13 August, campaign reports showed 0 per cent on 4 August, contacts on some accounts did not enter flows on 22 July, and audience updates were delayed for about two and a half hours on 11 September. None names the API component. We count the day of lost click data as one major (10). The docs give 10 simultaneous connections per user, a 120-second timeout and 500 pending batches, with no per-minute figure (12). 429 is documented with its cause. No `Retry-After` header, backoff guidance or idempotency key was found in the docs, though the new client libraries retry 408, 429 and 5xx twice with exponential backoff and PUT on a member is an upsert (8). No SLA found (0). Version 3.0 is generally available, and the Audiences endpoints are beta (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 76, "points": 12.35, "reason": "An OpenAPI 3.1.1 file with all 297 operations is public on the API host, and the docs site serves a 1.2 MB copy (25). llms.txt at each level of the docs and a Markdown copy of every page at the URL plus `.md` (10). Every operation has a description, averaging about 60 characters. They say what a call does and seldom when not to use it, and four agent skills cover consent, OAuth, webhooks and bulk jobs (10). The smaller file carries 498 enums and required fields on request bodies. Merge fields and event properties are free-form objects (12). The API's own file has examples throughout and a `default` error response on every operation, and the docs have an error glossary. The docs-site copy lists only 200 and 204 responses (12). The version is in the path and has been 3.0 since 2016. The public changelog's newest entry is 19 August 2025, so key expiry from 22 June 2026, webhook signing and the new client libraries are not in it, and the specification's version label is 0.1.0-dev (7)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "Graded on the API, since the MCP server only searches docs. `fields` and `exclude_fields` trim responses on 130 operations (20). `count` up to 1,000 with `offset` on 59 operations and per-endpoint filters. No cursor, so deep pages get slow against the 120-second timeout (16). Errors are `application/problem+json` with `title`, `status`, `detail`, `instance` and a per-field `errors` list, and `X-Trigger-Error` returns a named error on demand (17). No idempotency key. PUT on a member upserts by email hash, `is_syncing` keeps loaded events from triggering automations, and scheduled campaigns can be unscheduled (8). One root URL and few required fields, but a contact is addressed by an MD5 hash of the lowercase email. Nine official client libraries and a CLI, with the TypeScript package missing from npm and PyPI still on the 2022 library on the day (12)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 46, "points": 8.05, "reason": "API keys are named, several to an account, revocable, and bounded by the creating user's level. A key has full account access, and the docs say there is no read-only key and no per-endpoint limit. Keys made from 22 June 2026 expire after one year per the help centre. OAuth 2 uses the authorisation code grant with no scopes, and its tokens never expire. Credentials travel in a header, not the URL (20). No read-only mode. `send-checklist`, `actions/test`, `actions/unschedule` and `actions/cancel-send` exist, with no approval step before a send or a permanent contact delete (6). The API returns contact fields, conversation messages and survey answers, which are untrusted text, and no guidance on prompt injection was found (2). `/authorized-apps` lists the OAuth apps on an account and each response carries a request id. No API call log or audit log was found in the docs we read (4). A responsible disclosure programme with no rewards, a security.txt with a contact and no Expires field, SOC 2 reports, ISO 27001, regular penetration tests and optional two-factor sign-in. No public advisory feed found (14)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 25, "points": 3.13, "reason": "No x402, MPP or L402 (0). Plan prices are public without a login, from $13 a month for Essentials, $20 for Standard and $350 for Premium with USD selected, rising with contacts through a selector. Nothing is priced per API call (10). The Free plan has 250 contacts and 500 sends a month with no time limit. We could not confirm that signup asks for no card, and the 14-day trial of a paid plan needs payment details, so 15 of 20. A person signs up in a browser and creates a key or approves OAuth (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "reason": "Release 1.0.3 of the TypeScript, Python and Go client libraries is dated 5 October 2026, three days before this check (30). Dated releases in the last 90 days are the client libraries on 5 October, the CLI's 0.0.212 and 0.0.213 on 18 September, Ruby 0.0.218 on 18 September and Rust 0.0.221 on 21 September, all from one generator launch that began on 9 September. The API changelog has no entry in that time, so 15 of 20. A public changelog whose newest entry is 19 August 2025, an API help address, and a help centre article saying support is not trained for in-depth API questions. We saw no public issue replies (5 of 15). Nine official client libraries generated from the current specification, with TypeScript not on npm and PyPI at 3.0.80 from November 2022 on the day (8 of 15). Each repository has a workflow that compiles and tests, whose results we could not see, and release 1.0.3 of the TypeScript library removed the `LICENSE` and `NOTICE` files added on 18 September (5)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 74, "points": 6.48, "note": "editorial 55, provenance 92", "reason": "Closed service with published terms, an API Use Policy and a named contracting entity. The client libraries declare Apache-2.0 in package metadata (15). A data processing addendum effective 26 September 2024 covers deletion or return on termination without a stated period, and the Intuit Global Privacy Statement of 9 March 2026 is the privacy document. The terms let Mailchimp use inputs and outputs of its AI functions, customer data included, for machine learning, with a preference in account settings. No retention periods for marketing data were found (18). No deprecation policy was found. The API Use Policy says the APIs can change by a posting or an email. Dated notices exist, such as key expiry from 22 June 2026 in the help centre (8). A sub-processor list with locations is public and was last updated on 29 February 2024, and the security page places Mailchimp's own servers in United States data centres (14)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the API, since the MCP server only searches docs. `fields` and `exclude_fields` trim responses on 130 operations (20). `count` up to 1,000 with `offset` on 59 operations and per-endpoint filters. No cursor, so deep pages get slow against the 120-second timeout (16). Errors are `application/problem+json` with `title`, `status`, `detail`, `instance` and a per-field `errors` list, and `X-Trigger-Error` returns a named error on demand (17). No idempotency key. PUT on a member upserts by email hash, `is_syncing` keeps loaded events from triggering automations, and scheduled campaigns can be unscheduled (8). One root URL and few required fields, but a contact is addressed by an MD5 hash of the lowercase email. Nine official client libraries and a CLI, with the TypeScript package missing from npm and PyPI still on the 2022 library on the day (12).", "maintenance": "Release 1.0.3 of the TypeScript, Python and Go client libraries is dated 5 October 2026, three days before this check (30). Dated releases in the last 90 days are the client libraries on 5 October, the CLI's 0.0.212 and 0.0.213 on 18 September, Ruby 0.0.218 on 18 September and Rust 0.0.221 on 21 September, all from one generator launch that began on 9 September. The API changelog has no entry in that time, so 15 of 20. A public changelog whose newest entry is 19 August 2025, an API help address, and a help centre article saying support is not trained for in-depth API questions. We saw no public issue replies (5 of 15). Nine official client libraries generated from the current specification, with TypeScript not on npm and PyPI at 3.0.80 from November 2022 on the day (8 of 15). Each repository has a workflow that compiles and tests, whose results we could not see, and release 1.0.3 of the TypeScript library removed the `LICENSE` and `NOTICE` files added on 18 September (5).", "payments": "No x402, MPP or L402 (0). Plan prices are public without a login, from $13 a month for Essentials, $20 for Standard and $350 for Premium with USD selected, rising with contacts through a selector. Nothing is priced per API call (10). The Free plan has 250 contacts and 500 sends a month with no time limit. We could not confirm that signup asks for no card, and the 14-day trial of a paid plan needs payment details, so 15 of 20. A person signs up in a browser and creates a key or approves OAuth (0).", "reliability": "Graded on the hosted REST API with the hosted lines. status.mailchimp.com lists an API component for each of 21 data centres and keeps event history by month (20). In the 90 days to 8 October 2026 it shows five events on the marketing side. Click tracking failed from about 11 am Eastern on 3 August to noon on 4 August and cannot be backfilled, campaign links returned 500 errors on 13 August, campaign reports showed 0 per cent on 4 August, contacts on some accounts did not enter flows on 22 July, and audience updates were delayed for about two and a half hours on 11 September. None names the API component. We count the day of lost click data as one major (10). The docs give 10 simultaneous connections per user, a 120-second timeout and 500 pending batches, with no per-minute figure (12). 429 is documented with its cause. No `Retry-After` header, backoff guidance or idempotency key was found in the docs, though the new client libraries retry 408, 429 and 5xx twice with exponential backoff and PUT on a member is an upsert (8). No SLA found (0). Version 3.0 is generally available, and the Audiences endpoints are beta (10).", "schema": "An OpenAPI 3.1.1 file with all 297 operations is public on the API host, and the docs site serves a 1.2 MB copy (25). llms.txt at each level of the docs and a Markdown copy of every page at the URL plus `.md` (10). Every operation has a description, averaging about 60 characters. They say what a call does and seldom when not to use it, and four agent skills cover consent, OAuth, webhooks and bulk jobs (10). The smaller file carries 498 enums and required fields on request bodies. Merge fields and event properties are free-form objects (12). The API's own file has examples throughout and a `default` error response on every operation, and the docs have an error glossary. The docs-site copy lists only 200 and 204 responses (12). The version is in the path and has been 3.0 since 2016. The public changelog's newest entry is 19 August 2025, so key expiry from 22 June 2026, webhook signing and the new client libraries are not in it, and the specification's version label is 0.1.0-dev (7).", "security": "API keys are named, several to an account, revocable, and bounded by the creating user's level. A key has full account access, and the docs say there is no read-only key and no per-endpoint limit. Keys made from 22 June 2026 expire after one year per the help centre. OAuth 2 uses the authorisation code grant with no scopes, and its tokens never expire. Credentials travel in a header, not the URL (20). No read-only mode. `send-checklist`, `actions/test`, `actions/unschedule` and `actions/cancel-send` exist, with no approval step before a send or a permanent contact delete (6). The API returns contact fields, conversation messages and survey answers, which are untrusted text, and no guidance on prompt injection was found (2). `/authorized-apps` lists the OAuth apps on an account and each response carries a request id. No API call log or audit log was found in the docs we read (4). A responsible disclosure programme with no rewards, a security.txt with a contact and no Expires field, SOC 2 reports, ISO 27001, regular penetration tests and optional two-factor sign-in. No public advisory feed found (14).", "transparency": "Closed service with published terms, an API Use Policy and a named contracting entity. The client libraries declare Apache-2.0 in package metadata (15). A data processing addendum effective 26 September 2024 covers deletion or return on termination without a stated period, and the Intuit Global Privacy Statement of 9 March 2026 is the privacy document. The terms let Mailchimp use inputs and outputs of its AI functions, customer data included, for machine learning, with a preference in account settings. No retention periods for marketing data were found (18). No deprecation policy was found. The API Use Policy says the APIs can change by a posting or an email. Dated notices exist, such as key expiry from 22 June 2026 in the help centre (8). A sub-processor list with locations is public and was last updated on 29 February 2024, and the security page places Mailchimp's own servers in United States data centres (14)." }, "sources": [ { "what": "Marketing API docs index (llms.txt)", "url": "https://mailchimp.com/developer/marketing/llms.txt", "seen": "2026-10-08" }, { "what": "API structure and root URL", "url": "https://mailchimp.com/developer/marketing/api-concepts/api-structure.md", "seen": "2026-10-08" }, { "what": "authentication", "url": "https://mailchimp.com/developer/marketing/api-concepts/authentication.md", "seen": "2026-10-08" }, { "what": "API keys", "url": "https://mailchimp.com/developer/marketing/api-concepts/authentication/api-keys.md", "seen": "2026-10-08" }, { "what": "OAuth 2", "url": "https://mailchimp.com/developer/marketing/api-concepts/authentication/oauth-2.md", "seen": "2026-10-08" }, { "what": "methods, pagination and partial responses", "url": "https://mailchimp.com/developer/marketing/api-concepts/methods-and-parameters.md", "seen": "2026-10-08" }, { "what": "rate limits and timeouts", "url": "https://mailchimp.com/developer/marketing/api-concepts/rate-limits-and-timeouts.md", "seen": "2026-10-08" }, { "what": "errors", "url": "https://mailchimp.com/developer/marketing/api-concepts/errors.md", "seen": "2026-10-08" }, { "what": "batch operations", "url": "https://mailchimp.com/developer/marketing/api-concepts/batch-operations.md", "seen": "2026-10-08" }, { "what": "webhooks and signing", "url": "https://mailchimp.com/developer/marketing/api-concepts/webhooks.md", "seen": "2026-10-08" }, { "what": "Audiences endpoints (beta) and their terms", "url": "https://mailchimp.com/developer/marketing/api-concepts/audiences-endpoints-beta.md", "seen": "2026-10-08" }, { "what": "quick start with install commands", "url": "https://mailchimp.com/developer/marketing/build/start-developing/send-your-first-api-request.md", "seen": "2026-10-08" }, { "what": "client libraries", "url": "https://mailchimp.com/developer/marketing/build/start-developing/client-libraries-and-sdks.md", "seen": "2026-10-08" }, { "what": "CLI", "url": "https://mailchimp.com/developer/marketing/build/start-developing/cli.md", "seen": "2026-10-08" }, { "what": "docs MCP server guide", "url": "https://mailchimp.com/developer/marketing/build/ai-tools/mcp-server.md", "seen": "2026-10-08" }, { "what": "docs MCP endpoint, initialize and tools/list", "url": "https://mailchimp.com/developer/_mcp/server", "seen": "2026-10-08" }, { "what": "agent skills", "url": "https://mailchimp.com/developer/marketing/build/ai-tools/agent-skills.md", "seen": "2026-10-08" }, { "what": "OpenAPI 3.1.1 file on the API host", "url": "https://api.mailchimp.com/schema/openapi/OpenAPI.json?expand", "seen": "2026-10-08" }, { "what": "OpenAPI 3.1.0 copy on the docs site", "url": "https://mailchimp.com/developer/openapi/api-reference.json", "seen": "2026-10-08" }, { "what": "unauthenticated ping, error format", "url": "https://api.mailchimp.com/3.0/ping", "seen": "2026-10-08" }, { "what": "developer release notes", "url": "https://mailchimp.com/developer/release-notes/", "seen": "2026-10-08" }, { "what": "status page", "url": "https://status.mailchimp.com/", "seen": "2026-10-08" }, { "what": "status event history, August 2026 (also 202607, 202609 and 202610)", "url": "https://status.mailchimp.com/event/202608/", "seen": "2026-10-08" }, { "what": "pricing, with USD selected", "url": "https://mailchimp.com/pricing/marketing/?currency=USD", "seen": "2026-10-08" }, { "what": "plan limits help article", "url": "https://mailchimp.com/help/about-mailchimp-pricing-plans/", "seen": "2026-10-08" }, { "what": "API keys help article, key expiry", "url": "https://mailchimp.com/help/about-api-keys/", "seen": "2026-10-08" }, { "what": "Standard Terms of Use", "url": "https://mailchimp.com/legal/terms/", "seen": "2026-10-08" }, { "what": "API Use Policy", "url": "https://mailchimp.com/legal/api_use/", "seen": "2026-10-08" }, { "what": "data processing addendum", "url": "https://mailchimp.com/legal/data-processing-addendum/", "seen": "2026-10-08" }, { "what": "sub-processor list", "url": "https://mailchimp.com/legal/subprocessors/", "seen": "2026-10-08" }, { "what": "Intuit Global Privacy Statement", "url": "https://www.intuit.com/privacy/statement/", "seen": "2026-10-08" }, { "what": "security page and responsible disclosure", "url": "https://mailchimp.com/about/security/", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://mailchimp.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "robots.txt, no Content-Signal line", "url": "https://mailchimp.com/robots.txt", "seen": "2026-10-08" }, { "what": "TypeScript client library repository, history and workflow", "url": "https://github.com/mailchimp/mailchimp-marketing-typescript-sdk", "seen": "2026-10-08" }, { "what": "Python client library repository", "url": "https://github.com/mailchimp/mailchimp-marketing-python-sdk", "seen": "2026-10-08" }, { "what": "Go client library repository", "url": "https://github.com/mailchimp/mailchimp-marketing-go-sdk", "seen": "2026-10-08" }, { "what": "CLI repository", "url": "https://github.com/mailchimp/mailchimp-marketing-cli", "seen": "2026-10-08" }, { "what": "npm registry, documented package name (404)", "url": "https://registry.npmjs.org/@mailchimp%2fmailchimp-marketing", "seen": "2026-10-08" }, { "what": "npm registry, older package and release dates", "url": "https://registry.npmjs.org/@mailchimp%2fmailchimp_marketing", "seen": "2026-10-08" }, { "what": "PyPI package metadata and release dates", "url": "https://pypi.org/pypi/mailchimp-marketing/json", "seen": "2026-10-08" }, { "what": "crates.io entry", "url": "https://crates.io/api/v1/crates/mailchimp_marketing", "seen": "2026-10-08" }, { "what": "RubyGems entry", "url": "https://rubygems.org/api/v1/gems/mailchimp-marketing.json", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=mailchimp", "seen": "2026-10-08" }, { "what": "RDAP for mailchimp.com", "url": "https://rdap.verisign.com/com/v1/domain/mailchimp.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: whether signing up for the Free plan asks for a payment card", "unchecked: paid prices above the starting contact tier, which the pricing page draws by script from a contact selector. The $13, $20 and $350 starting prices are the page's values with USD selected", "unchecked: which API functions each plan allows. The docs say access depends on the plan without a table", "unchecked: any API call log or audit log inside the account, which is behind a login", "unchecked: GitHub stars, open issues and workflow results for the client library repositories, which were read by shallow clone only", "unchecked: whether the Java and C# packages named in the quick start are on Maven Central and NuGet. npm, PyPI, crates.io, RubyGems and Packagist were checked", "unchecked: the detail pages of the status events, so scope and cause beyond the summaries are not known", "unchecked: SOC 2 and ISO reports, which sit in the Intuit compliance portal", "Security incidents in the last 12 months were not searched for beyond the vendor's own pages, because web search was not available", "The developer docs say API keys don't expire. The help centre says keys generated from 22 June 2026 expire after one year. We took the help centre's dated statement as current", "The llms.txt header gives the MCP server as https://mailchimp.com/_mcp/server and the docs pages give https://mailchimp.com/developer/_mcp/server. Only the second was tested, and it answered", "The official MCP registry has no Mailchimp entry under a vendor namespace. Third-party servers use the name", "The privacy field points at Intuit's Global Privacy Statement because Mailchimp publishes no privacy policy of its own, as on the Mailchimp Transactional listing", "Docs pages carry lines addressed to AI clients that point at llms.txt and the MCP server. Recorded as a fact, with no deduction" ] }, "negative": -2, "negativeNotes": [ "8 October 2026. The quick start tells users to run `npm install @mailchimp/mailchimp-marketing`, and the npm registry answers 404 for that name. Its `pip install mailchimp-marketing` installs version 3.0.80 from November 2022, which has no `MailchimpClient` class as the quick start's code needs. The Go, Ruby, Rust and PHP names resolve, so 2 for a claim the listing can't meet in two of nine languages (https://mailchimp.com/developer/marketing/build/start-developing/send-your-first-api-request.md, https://registry.npmjs.org/@mailchimp%2fmailchimp-marketing)." ], "verdict": "A public OpenAPI 3.1 file covers all 297 operations, every docs page has a Markdown copy, and responses can be trimmed with `fields`. An API key carries full account access with no read-only option. The quick start's TypeScript package was not on npm on 8 October 2026, and the changelog's newest entry is 19 August 2025.", "bestFor": "Small businesses already on Mailchimp that want an agent to sync contacts, tag and segment them, record events, draft and schedule campaigns and read reports.", "strengths": [ "OpenAPI 3.1 file for all 297 operations at `https://api.mailchimp.com/schema/openapi/OpenAPI.json`, with an error response on every operation", "`fields` and `exclude_fields` trim responses on 130 operations, and `count` pages up to 1,000 records", "Every docs page has a Markdown copy at the URL plus `.md`, with llms.txt indexes and four published agent skills", "Errors are `application/problem+json` with `title`, `status`, `detail` and `instance`, and an `X-Trigger-Error` header lets a client test its handling", "Free plan with 250 contacts and 500 sends a month, and a status page with an API component for each of 21 data centres" ], "weaknesses": [ "An API key has full account access. The docs say there is no read-only key and no way to limit a key to chosen endpoints", "OAuth 2 tokens carry no scopes and never expire, and no approval step before `actions/send` was found", "The quick start's `npm install @mailchimp/mailchimp-marketing` answered 404 on npm, and `pip install mailchimp-marketing` installs a 2022 library with a different client class", "The only stated limit is 10 simultaneous connections per user. No `Retry-After` header, idempotency key or SLA was found", "The developer changelog's newest entry is 19 August 2025, and the docs say keys never expire while the help centre says new keys expire after one year", "Click tracking was lost for about 25 hours on 3 and 4 August 2026 and cannot be backfilled, per the status page" ], "agentNotes": [ "Send the key or OAuth token as `Authorization: Bearer` to `https://api.mailchimp.com/3.0/`. Treat it as full account access and keep it server-side", "Address a contact by the MD5 hash of the lowercase email address, and use PUT on `/lists/{list_id}/members/{subscriber_hash}` so a retry does not create a duplicate", "Ask a person before POST `/campaigns/{campaign_id}/actions/send`. Read `/campaigns/{campaign_id}/send-checklist` and use `actions/test` first", "Keep to 10 concurrent requests per user, and send large jobs to `/batches`. A 429 names no wait time, so back off and retry", "Add `fields=` to every list call and set `count` (default 10, maximum 1,000) with `offset`", "Set `is_syncing` to true when loading historical events so they do not trigger automations" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.4 } ], "editorialScores": { "ergonomics": 73, "maintenance": 63, "payments": 25, "reliability": 60, "schema": 76, "security": 46, "transparency": 55 }, "provenanceScore": 92 }, "connect": { "http": "curl -sS \\\n \"https://api.mailchimp.com/3.0/ping\" \\\n --user \"anystring:${apikey}\"", "claudeCode": "claude mcp add --transport http fern_mcp_mailchimp-docs \\\n https://mailchimp.com/developer/_mcp/server", "config": { "mcpServers": { "mailchimp-docs": { "type": "http", "url": "https://mailchimp.com/developer/_mcp/server" } } } }, "letme": { "capability": "https://letme.dev/marketing.profiles", "tool": "https://letme.dev/mailchimp-marketing" }, "sameCompany": [ "mandrill" ], "notable": [ "The API's own OpenAPI 3.1.1 file lists 297 operations on 195 paths in 28 groups, among them 70 for lists, 60 for e-commerce, 22 for campaigns and 22 for reports (https://api.mailchimp.com/schema/openapi/OpenAPI.json?expand)", "A key grants full account access, and the docs say there is no way to issue a read-only key or restrict one to particular endpoints (https://mailchimp.com/developer/marketing/api-concepts/authentication/api-keys.md)", "The help centre says any key generated from 22 June 2026 expires one year after creation, while the developer docs still say keys don't expire (https://mailchimp.com/help/about-api-keys/)", "The limit is 10 simultaneous connections per user, not per key, with a 120-second timeout on each call and no way to raise the limit (https://mailchimp.com/developer/marketing/api-concepts/rate-limits-and-timeouts.md)", "Nine client libraries generated by Fern (TypeScript, Python, Go, Java, C#, PHP, Ruby, Swift, Rust) and a CLI named `mcapi` appeared on GitHub from 9 September 2026 (https://mailchimp.com/developer/marketing/build/start-developing/client-libraries-and-sdks.md)", "The quick start's `npm install @mailchimp/mailchimp-marketing` answered 404 on the npm registry on 8 October 2026. The older `@mailchimp/mailchimp_marketing` 3.0.80 from November 2022 is what npm serves (https://registry.npmjs.org/@mailchimp%2fmailchimp-marketing)", "The MCP server at https://mailchimp.com/developer/_mcp/server has one tool, `searchDocs`, and searches the documentation only. It does not act on an account (https://mailchimp.com/developer/marketing/build/ai-tools/mcp-server.md)", "The Audiences endpoints for contacts with only a phone number are beta, for evaluation or testing only under their own terms (https://mailchimp.com/developer/marketing/api-concepts/audiences-endpoints-beta.md)", "Each Markdown docs page opens with lines addressed to AI clients that point at llms.txt and the MCP server. We record that as a fact and did not act on it (https://mailchimp.com/developer/marketing/api-concepts/api-structure.md)" ], "area": "communication", "details": [ { "label": "API", "value": "REST over HTTPS at https://api.mailchimp.com/3.0/, JSON bodies, 297 operations (151 GET, 73 POST, 35 DELETE, 32 PATCH, 6 PUT). Actions that are not CRUD sit under `actions/`. TLS 1.2 or higher" }, { "label": "OpenAPI", "value": "OpenAPI 3.1.1 at https://api.mailchimp.com/schema/openapi/OpenAPI.json?expand (about 17 MB expanded, version label 0.1.0-dev). A 1.2 MB OpenAPI 3.1.0 copy at https://mailchimp.com/developer/openapi/api-reference.json has the same 297 operations without error responses or examples" }, { "label": "Credentials", "value": "API keys with full account access, named, several per account, revocable, bounded by the creator's user level. New keys expire after one year from 22 June 2026 per the help centre. OAuth 2 authorisation code grant with no scopes and tokens that do not expire" }, { "label": "Limits", "value": "10 simultaneous connections per user, 120-second timeout per call, `count` up to 1,000, 500 pending batch requests and 500 pending batch webhook events. No per-minute figure is published" }, { "label": "Errors", "value": "`application/problem+json` with `type`, `title`, `status`, `detail`, `instance` and a per-field `errors` list on validation failures. 429 for too many connections. The `X-Trigger-Error` header returns a named error on demand" }, { "label": "Sizing responses", "value": "`fields` and `exclude_fields` with dot notation on 130 operations, `count` and `offset` on 59. No cursor pagination" }, { "label": "Batch", "value": "POST `/batches` runs many operations in the background and returns a gzipped archive of results. Up to 20 batch webhooks" }, { "label": "Sending", "value": "`actions/send`, `actions/schedule`, `actions/unschedule`, `actions/test` and `actions/cancel-send` on campaigns, a `send-checklist` read, and the same send and schedule actions for SMS campaigns" }, { "label": "Events and flows", "value": "POST `/lists/{list_id}/members/{subscriber_hash}/events` records a named event, with `is_syncing` to skip automations. POST `/customer-journeys/journeys/{journey_id}/steps/{step_id}/actions/trigger` starts a flow step built in the app. Flows are not created by API" }, { "label": "Webhooks", "value": "Audience webhooks with optional HMAC-SHA256 signing in `X-Mailchimp-Signature`, a five-minute timestamp window, and up to 20 retries at 15 to 25 minute intervals before the webhook is disabled" }, { "label": "Client libraries", "value": "Nine Fern-generated libraries on GitHub since 9 September 2026, release 1.0.3 of TypeScript, Python and Go on 5 October 2026. Rust 0.0.221 and Ruby 0.0.218 are on their registries. The TypeScript package was not on npm, and PyPI held the 2022 library 3.0.80, on 8 October 2026" }, { "label": "CLI", "value": "`mcapi`, written in Rust, one subcommand per endpoint, key in `MCAPI_TOKEN`, releases 0.0.212 and 0.0.213 on 18 September 2026" }, { "label": "Agent tools", "value": "A docs-search MCP server with one read-only tool, llms.txt at each level of the docs, and four agent skills (`set-consent-correctly`, `set-up-oauth`, `subscribe-to-webhooks`, `run-bulk-jobs`) installed with `npx skills add https://mailchimp.com/developer`" }, { "label": "Plans", "value": "Free 250 contacts and 500 sends a month. Essentials up to 50,000 contacts with sends at 10 times the contact limit. Standard up to 100,000 with 12 times. Premium by quote above 250,000. What the API can do depends on the plan" }, { "label": "Certifications", "value": "SOC 2 reports and ISO 27001 per mailchimp.com/about/security, with reports in the Intuit compliance portal. A responsible disclosure programme with no rewards" }, { "label": "Status", "value": "status.mailchimp.com with Admin and API components for data centres US1 to US21 and event history by month" } ], "unitPrices": [ { "item": "Essentials plan, up to 500 contacts", "unit": "month", "usd": 13, "note": "starting price with USD selected, rises with contacts" }, { "item": "Standard plan, up to 500 contacts", "unit": "month", "usd": 20, "note": "starting price with USD selected, rises with contacts" }, { "item": "Premium plan, starting price", "unit": "month", "usd": 350, "note": "starting price with USD selected, rises with contacts" } ], "provenance": { "legalEntity": "The Rocket Science Group LLC d/b/a Mailchimp", "domain": "mailchimp.com", "domainRegistered": "2001-06-29", "endpointOnVendorDomain": true, "terms": "https://mailchimp.com/legal/terms/", "privacy": "https://www.intuit.com/privacy/statement/", "statusPage": "https://status.mailchimp.com", "changelog": "https://mailchimp.com/developer/release-notes/", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Standard Terms of Use, updated and effective 10 October 2025, name The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave. NE, Atlanta, Georgia. API use is also governed by the API Use Policy at https://mailchimp.com/legal/api_use/, updated 1 August 2023, which the terms incorporate.", "The privacy field points at the Intuit Global Privacy Statement, last updated 9 March 2026. mailchimp.com/legal/privacy redirects to it, the terms name it as the privacy document for the service, and it names The Rocket Science Group LLC d/b/a Mailchimp. Mailchimp publishes no separate privacy policy.", "The API answers at api.mailchimp.com. An unauthenticated request to `/3.0/ping` returned 401 as `application/problem+json` on 8 October 2026.", "mailchimp.com/.well-known/security.txt holds one Contact line that points at the responsible disclosure section of the security page, with no Expires field. The value follows the reading on the Mailchimp Transactional listing.", "The changelog covers the Marketing and Transactional APIs together. Its newest entry is dated 19 August 2025, and its newest Marketing entry 7 August 2025.", "RDAP for mailchimp.com gives a registration date of 2001-06-29 (Verisign)." ], "score": 92, "checks": [ { "check": "Legal entity named", "value": "The Rocket Science Group LLC d/b/a Mailchimp", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "mailchimp.com, registered 2001-06-29 (25 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.mailchimp.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 4.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.mailchimp.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://mailchimp.com/legal/terms/", "state": "read", "readAt": "2026-10-08", "words": 15561, "points": 4.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "Either you or Mailchimp may seek to have a Claim resolved in small claims court in your county of residence or the small claims court in closest proximity to your residence, and you may also bring a claim in small claims court of Fulton County, Georgia.", "says": "Disputes go to the courts of Fulton County, Georgia" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "and (iii) in any calendar month, the total liability of Mailchimp and our third-party providers, licensors, distributors, or suppliers to you arising out of or relating to the Agreement—whether in contract, tort (including negligence), breach of statutory duty, or otherwise—will be no more than what you paid us for th…" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "You or Mailchimp may terminate the Agreement at any time and for any reason." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "We may change any of the Terms by posting revised Terms on our Mailchimp Site.", "says": "Changes are posted, with no other notice named" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You will not receive a refund (unless you are within the 60 day money-back guarantee period)." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "We may use your Inputs and Outputs, including Customer Data, for machine learning purposes in order to develop and improve the AI Model, the Services, and similar products and features, and you instruct us to process Customer Data for such purposes.", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "Mailchimp may modify, suspend, discontinue, or further limit use of the AI Model at any time (without any notice to you).", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may suspend the Service to you at any time, with or without cause." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "The State of Georgia laws and the Federal Arbitration Act will govern all disputes arising out of or relating to the Service and the Agreement, regardless of conflict of laws rules." } ], "notes": [ { "date": "2026-10-08", "text": "Mailchimp's total liability in any calendar month is capped at what the member paid for the service in the preceding month.", "quote": "arising out of or relating to the Agreement—whether in contract, tort (including negligence), breach of statutory duty, or otherwise—will be no more than what you paid us for the Service the preceding month." }, { "date": "2026-10-08", "text": "Using the AI functions grants Mailchimp an irrevocable, transferable and sublicensable licence over all inputs and outputs.", "quote": "a worldwide, non-exclusive, irrevocable, transferable, royalty-free, fully paid-up, sublicensable (through multiple-tiers) license to access, use, modify, display, publicly perform, distribute, copy, create derivatives from (including derivative works of) and process any and all Inputs and Outputs" }, { "date": "2026-10-08", "text": "After an account is terminated Mailchimp may permanently delete the account and all its data, including campaigns.", "quote": "Once your account is terminated, you acknowledge and agree that we may permanently delete your account and all the data associated with it, including your Campaigns." } ] }, { "kind": "privacy", "url": "https://www.intuit.com/privacy/statement/", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-03-09", "words": 11644, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: March 9, 2026", "says": "Last updated 2026-03-09" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "and the Intuit group companies (collectively “Intuit,” “we,” “us,” or “our”), collect, use, share, or otherwise process information that we collect through our services." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Unless you specifically ask us to delete your personal information, we retain your personal information as long as it is necessary to comply with our data retention requirements and provide you with services and the benefits of the Intuit Platform and successfully run our business.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "…not the controller, for example, where Intuit processes personal information as a processor or service provider on behalf of our customers, including when we process personal information on behalf of customers of our professional tax software products." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Intuit and Mailchimp do not sell Personal Information under the CCPA.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "If you have concerns about personal information that we process on behalf of a customer, or wish to exercise your privacy rights regarding such personal information, please contact the customer directly." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "You can contact the Intuit Data Protection Officer here.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "and (ii) third party service providers and partners, are the European Commission’s Standard Contractual Clauses as issued on 4 June 2021 under Article 46(2) using module 1 (controller to controller), module 2 (controller to processor), module 3 (processor to processor) and module 4 (processor to controller) transfers,…", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "Improve and develop our products and services by analyzing how they are used and interacted with, by training our artificial intelligence models and other machine learning models", "costsPoints": true }, { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "Intuit may share personal information with advertising networks and other providers to tailor advertising and offers presented to you based on your interactions with the Intuit Platform’s products, services, and offerings." } ], "notes": [ { "date": "2026-10-08", "text": "Data a user shares or brings from third parties is used across the whole Intuit Platform and its products, beyond the single product in use.", "quote": "Intuit uses that data together to power experiences across the Intuit Platform and products, not just within the individual offering(s) you’re using." }, { "date": "2026-10-08", "text": "Session replay tools record user sessions, including clicks, mouse movements, scrolls and keystrokes.", "quote": "The replays include users’ clicks, mobile app touches, mouse movements, scrolls and keystrokes/key touches during those sessions." }, { "date": "2026-10-08", "text": "Data obtained through Google Workspace APIs is not used to develop, improve or train generalised AI or ML models.", "quote": "Please note any data obtained through Google Workspace APIs is not used to develop, improve, or train any generalized AI and/or ML models." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mailchimp-marketing.json", "live": { "slug": "mailchimp-marketing", "probe": { "target": "https://api.mailchimp.com/3.0", "method": "get", "lastAt": "2026-10-09T11:46:33.12385218Z", "lastOk": true, "lastStatus": 401, "lastMs": 330, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 305, "p95ms24h": 473, "samples24h": 44, "samples30d": 44, "days": [ { "date": "2026-10-09", "probes": 44, "ok": 44 } ] }, "vendorStatus": { "page": "https://status.mailchimp.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:08.512261949Z" }, "updatedAt": "2026-10-09T11:46:33.12385218Z" } } }