ActiveCampaign vs Nitrosend

ActiveCampaign 5

There is no changelog. On 8 October the updatedAt stamps on 46 of the 185 reference pages fell on 12, 13, 17 and 31 August and 2 September 2026 (per the 8 October check, not re-read on 4 November). The 8 October check recorded them as page revisions, not changelog entries, and no API change was recorded on those pages. Page dates that record no change don't set recency (as wrike, coinbase-mcp and agentweb), and the clients are years old, so no dated API change is readable (0). Page stamps aren't releases, so the 90-day line is 0. No public changelog. A community site and a developer relations email address are published, and we did not see reply times (5). The official PHP and Node.js clients are v1 wrappers last changed in December 2017 and March 2018 (0). No current package to assess (0). 0 + 0 + 5 + 0 + 0 = 5.

Nitrosend 81

@nitrosend/sdk 0.12.1 and @nitrosend/cli 0.3.11 were published on 6 November 2026 (30). 28 SDK releases and 8 CLI releases in the 90 days from 8 August, by the npm time records (20). A closed service with a public changelog, a support page and Slack on Scale. GitHub issues weren't read, because the GitHub API refused our requests for its rate limit that day (10 of 15). com.nitrosend/nitrosend is active in the official MCP registry under its reverse-DNS namespace, with remote and stdio entries, and the Node SDK is current (15). MIT packages released often; CI not read (6 of 10). Total 81.

ActiveCampaign 20

No x402, MPP or L402 (0). The 8 October plan prices were read from a data file the pricing page loads, which this run doesn't use, and the pricing page wasn't re-read on 4 November because the terms bar automated access, so no published price is counted (0). A 14-day trial with no card, and a free developer sandbox on request (per the 8 October check, not re-read on 4 November) (20). A person signs up in a browser and copies the key from account settings (0). 0 + 0 + 20 + 0 = 20.

Nitrosend 55

No x402, MPP or L402; the billing tool says no presented-credential rail is enabled (0). Per-1,000 overage prices and plan prices published in PRICING.md without login (20). Free plan with 5,000 starter emails and 500 a month, no card (20). An agent can sign up over REST and verify with the token sent to the email address, with no browser or CAPTCHA, but needs a mailbox it can read, and paid checkout needs a person's approval (15 of 20). Total 55.

ActiveCampaign 52

List endpoints take limit up to 100 and contacts take meta=only for a count, but there is no field selection. The MCP server lists 50 tools with no documented toolsets (12 of 25). limit, offset, orders, filters and id_greater on contacts, less 4 because unsupported filter and order keys are silently ignored (16 of 20). Five documented status codes and a 422 errors array of titles without codes. Campaign state changes report failures as 200 with succeeded 0 and a localised message (10 of 20). No idempotency keys. Upsert by email and bulk import with per-row status give safe retries for contacts, and no MCP tool annotations are documented (8 of 20). Few required parameters. The official PHP and Node.js clients wrap the v1 API and last changed in 2017 and 2018, so no current official SDK was found (6 of 15). Docs per the 8 October check, not re-read on 4 November; the PHP client's last commit (7 December 2017) was confirmed from a clone.

Nitrosend 83

25 MCP tools is the 11 to 30 band; nitro_query reads every entity with filters, but no read-only subset or dynamic loading was found (15 of 25). Page and limit up to 100 with total and next-page headers, and keyset cursors on timelines (20). Errors return error, a code, validation details and next actions, and signup returns next_action (18 of 20). Required idempotency keys on sends, events, checkout and validation, and declared readOnlyHint and destructiveHint on the tools (20). Defaults such as the active brand and a recommended first call, but the only official SDK is Node, with a CLI beside it (10 of 15). Total 83.

ActiveCampaign 33

One API key per user in an Api-Token header, with no scopes. The MCP server is authorised by signing in and approving, with no scopes documented. Key rotation was not found in the reviewed documentation (15 of 30). No read-only key or mode. The listed MCP tools include no delete tool and none that schedules a campaign, though add_contact_to_automation can start messages, and the definitions name a permission resource for each operation (8 of 20). The API returns contact data, notes and message content written by outsiders, and no prompt-injection guidance was found (0 of 15). No audit log or per-call visibility was found in the developer docs. The help centre refused our reader, so this is unchecked (0 of 15). The security page states SOC 2, HIPAA and GDPR compliance, a red team and a trust centre with the SOC 2 report. No security.txt, bug bounty or disclosure policy was found (10 of 20). All per the 8 October check, not re-read on 4 November. robots.txt disallows /security/bounty, so whether a bounty page exists wasn't read.

Nitrosend 62

OAuth for the MCP server, with protected-resource metadata, header-only bearer and a single mcp scope, plus revocable API keys pinned to one account and brand. Management credentials are narrower and can't mint keys or bill. No permission scopes on API keys (22 of 30). Delivery goes live only through nitro_control_delivery, whole-list sends need confirm_send_to_all, delete needs confirm, and checkout needs operator approval. No read-only key (15 of 20). The agent inbox and reply events bring untrusted mail to the agent, and no prompt-injection guidance was found. The vendor's own llms.txt carries text addressed to models on how to answer recommendation questions (5 of 15). nitro://history and nitro_query expose notification events and tool audit entries (12 of 15). A responsible disclosure address with a two-business-day response and good-faith safe harbour, SOC 2 Type II in progress, no bug bounty and no security.txt (404) (8 of 20). Total 62.

ActiveCampaign 68

Each reference page is public Markdown with an OpenAPI 3.1 definition for its operation. No single downloadable specification was found (20 of 25). llms.txt and Markdown pages (10). Pages revised in August 2026, such as contact upsert and contact search, say when to use each endpoint and when not to. Older pages are short, and the MCP page gives one line a tool with no input schemas (14 of 20). Query parameters are typed with enums on status and sort order, but the segment body is described as flexible JSON to be checked against the segment builder (10 of 15). Request examples on most pages. The errors page lists five status codes and one 422 body, and 400 responses in the definitions are empty objects (9 of 15). The version is in the path (v3, Segments 2.0.0). No changelog was found, and developers.activecampaign.com/changelog returns 404 (5 of 15). All per the 8 October check, not re-read on 4 November, since the terms bar automated access to the developer site.

Nitrosend 93

OpenAPI 3.1 at api.nitrosend.com/openapi.yaml (version 1.1.6) with 203 paths and 258 operations, none without a description, and the MCP tool docs publish each tool's JSON Schema (25). llms.txt, llms-full.txt, agent.txt, SKILL.md, PRICING.md and a Markdown twin of each docs page (10). Tool descriptions state purpose and where to go instead, such as nitro_send_message pointing broadcasts to nitro_compose_campaign (18 of 20). Inputs carry enums, minimums, formats and required flags, though some campaign fields stay loosely typed (14 of 15). JSON-RPC, TypeScript and Python examples per tool, error responses on most operations (422 on 110, 404 on 98) and one error envelope with a code (14 of 15). A spec version and a changelog by monthly release, v0.1.0 in February to v1.4.0 in September 2026, dated by month only and last updated 6 October (12 of 15). Total 93.

ActiveCampaign 60

Closed service with terms of service updated 19 October 2026 and a separate API licence agreement, which lets ActiveCampaign revoke the licence at any time for any reason (15). Privacy policy updated 1 October 2026 and a DPA template that binds only once signed in the account. Retention is stated as the lifetime of the account or as long as necessary, with no period. The terms say Contact Data is used to supply the services and "to train, detect issues with our Services", which is not explained further (16 of 30). No deprecation policy. The overview says v1 has no sunset planned and promises advance notice, and deprecated contact fields are flagged without dates (6 of 20). Sub-processor list updated 25 September 2026 with locations in the United States, European Union and Australia (18 of 20). Terms re-read on 4 November; the other pages per the 8 October check, not re-read on 4 November.

Nitrosend 73

A closed service under terms that name Nitrosend Pty Ltd and Victorian law. The SDK, CLI and stdio MCP bridge are MIT on npm (18 of 30). Privacy policy of 14 October 2026 with account data kept while the account is open, export within 30 days of closure and deletion within 90 days, no-training terms for OpenAI and Anthropic, and a DPA by request rather than published (20 of 30). Deprecated fields are flagged in the OpenAPI spec, and material privacy changes come with 30 days' notice. No API deprecation policy found (8 of 20). Ten sub-processors listed with purpose and certifications, and the data location stated as AWS us-east-1 (18 of 20). Total 64.