ActiveCampaign vs Sequenzy

ActiveCampaign 5

There is no changelog. On 8 October the updatedAt stamps on 46 of the 185 reference pages fell on 12, 13, 17 and 31 August and 2 September 2026 (per the 8 October check, not re-read on 4 November). The 8 October check recorded them as page revisions, not changelog entries, and no API change was recorded on those pages. Page dates that record no change don't set recency (as wrike, coinbase-mcp and agentweb), and the clients are years old, so no dated API change is readable (0). Page stamps aren't releases, so the 90-day line is 0. No public changelog. A community site and a developer relations email address are published, and we did not see reply times (5). The official PHP and Node.js clients are v1 wrappers last changed in December 2017 and March 2018 (0). No current package to assess (0). 0 + 0 + 5 + 0 + 0 = 5.

Sequenzy 78

sequenzy 2.1.56, @sequenzy/mcp 0.0.246 and @sequenzy/cli 0.0.202 were all published on 6 November 2026 (30). 18 SDK, 105 MCP and 93 CLI releases in the 90 days from 8 August, and dated changelog entries on most days (20). A closed service with a public changelog and support answered by the cofounders per the about page. GitHub issues weren't read, as the GitHub API refused our requests for its rate limit (12 of 15). Listed in the official MCP registry as io.github.polnikale/sequenzy-mcp, but the entry is at 0.0.36 against npm's 0.0.246, and the TypeScript SDK is current (10 of 15). MIT packages released daily, the MCP server and CLI still at 0.0.x (6 of 10). Total 78.

ActiveCampaign 33

One API key per user in an Api-Token header, with no scopes. The MCP server is authorised by signing in and approving, with no scopes documented. Key rotation was not found in the reviewed documentation (15 of 30). No read-only key or mode. The listed MCP tools include no delete tool and none that schedules a campaign, though add_contact_to_automation can start messages, and the definitions name a permission resource for each operation (8 of 20). The API returns contact data, notes and message content written by outsiders, and no prompt-injection guidance was found (0 of 15). No audit log or per-call visibility was found in the developer docs. The help centre refused our reader, so this is unchecked (0 of 15). The security page states SOC 2, HIPAA and GDPR compliance, a red team and a trust centre with the SOC 2 report. No security.txt, bug bounty or disclosure policy was found (10 of 20). All per the 8 October check, not re-read on 4 November. robots.txt disallows /security/bounty, so whether a bounty page exists wasn't read.

Sequenzy 67

Workspace and account API keys with fine-grained permission scopes, presets and explicit *:delete rights, revocable in settings, plus an OAuth service_auth flow for agents with user confirmation (30). Read-only and drafts-only presets let an agent prepare mail without sending, and account keys keep the user's workspace role (20). The agent inbox and reply tracking give the agent inbound mail, and no prompt-injection guidance was found in the MCP, permissions or inbox docs (4 of 15). The DPA lists administrative audit logs and MCP events report replies and bounces; no per-call API log for the customer was found (8 of 15). A responsible disclosure address on the security page, no security.txt (404), bug bounty or certification (5 of 20). Total 67.

ActiveCampaign 68

Each reference page is public Markdown with an OpenAPI 3.1 definition for its operation. No single downloadable specification was found (20 of 25). llms.txt and Markdown pages (10). Pages revised in August 2026, such as contact upsert and contact search, say when to use each endpoint and when not to. Older pages are short, and the MCP page gives one line a tool with no input schemas (14 of 20). Query parameters are typed with enums on status and sort order, but the segment body is described as flexible JSON to be checked against the segment builder (10 of 15). Request examples on most pages. The errors page lists five status codes and one 422 body, and 400 responses in the definitions are empty objects (9 of 15). The version is in the path (v3, Segments 2.0.0). No changelog was found, and developers.activecampaign.com/changelog returns 404 (5 of 15). All per the 8 October check, not re-read on 4 November, since the terms bar automated access to the developer site.

Sequenzy 95

OpenAPI 3.1 at docs.sequenzy.com/openapi.yaml with 349 paths and 475 operations, all described (25). llms.txt on both hosts, llms-full.txt, auth.md, agents.md and Markdown twins of the docs (10). Operation and tool descriptions give purpose, the scope each needs and the alternative, such as the deprecated generate-sequence alias (18 of 20). Typed inputs, and tools reject undeclared arguments with an error naming the supported ones (13 of 15). Errors on nearly every operation (401 on 442, 404 on 330, 400 on 290) with examples, and a structured error with code, howToFix and docsUrl for tools (14 of 15). Version in the path and spec, and a dated changelog (15). Total 95.

ActiveCampaign 20

No x402, MPP or L402 (0). The 8 October plan prices were read from a data file the pricing page loads, which this run doesn't use, and the pricing page wasn't re-read on 4 November because the terms bar automated access, so no published price is counted (0). A 14-day trial with no card, and a free developer sandbox on request (per the 8 October check, not re-read on 4 November) (20). A person signs up in a browser and copies the key from account settings (0). 0 + 0 + 20 + 0 = 20.

Sequenzy 40

No x402, MPP or L402 (0). Prices are public as volume tiers from $19 for 15,000 emails to $2,999 for 5 million, without a per-email overage rate (10 of 20). Free plan of 2,500 emails a month with no card (20). Agents can register through service_auth, but the user has to confirm a code in a Sequenzy browser page, and plan payment is through Stripe (10 of 20). Total 40.

ActiveCampaign 52

List endpoints take limit up to 100 and contacts take meta=only for a count, but there is no field selection. The MCP server lists 50 tools with no documented toolsets (12 of 25). limit, offset, orders, filters and id_greater on contacts, less 4 because unsupported filter and order keys are silently ignored (16 of 20). Five documented status codes and a 422 errors array of titles without codes. Campaign state changes report failures as 200 with succeeded 0 and a localised message (10 of 20). No idempotency keys. Upsert by email and bulk import with per-row status give safe retries for contacts, and no MCP tool annotations are documented (8 of 20). Few required parameters. The official PHP and Node.js clients wrap the v1 API and last changed in 2017 and 2018, so no current official SDK was found (6 of 15). Docs per the 8 October check, not re-read on 4 November; the PHP client's last commit (7 December 2017) was confirmed from a clone.

Sequenzy 69

The MCP tool reference lists about 306 tools, the over-30 band, and no toolsets, tool search or dynamic loading was found (5 of 25). List endpoints paginate and filter, and contact timelines use cursors (20). Errors carry a code, a human message, a fix and a docs link, with retryAfterSeconds when the API sent Retry-After (20). Idempotency keys on sends and event imports; MCP readOnlyHint and destructiveHint annotations weren't found in the published reference (14 of 20). Sensible defaults with a selected workspace; one official SDK (TypeScript) plus a CLI (10 of 15). Total 69.

ActiveCampaign 52

Graded on the v3 REST API with the hosted lines. ActiveCampaign's terms (updated 19 October 2026) bar robots and data-gathering methods on its websites, so its pages, its own-domain status page included, weren't re-read on 4 November. The 8 October component and incident readings came from the status page's JSON endpoints, which this run doesn't use, and no readable record remains, so the status-page line is 0 and the incident line 5 (unread). 5 requests a second per account (15). 429 with Retry-After and RateLimit headers; no idempotency keys, though upsert by email makes contact writes repeatable (12). SLA of 99.5 per cent for enterprise subscriptions (10). The v3 API is generally available and the MCP pages carry no beta label (10). The last four lines are per the 8 October check, not re-read on 4 November. 0 + 5 + 15 + 12 + 10 + 10 = 52.

Sequenzy 38

Graded with the hosted lines. No status page was found; none is linked from the site, llms.txt or docs, and status.sequenzy.com doesn't resolve (0). With no history to read, the incident line takes 5. 429 responses carry RateLimit-Limit and RateLimit-Remaining headers for a per-minute policy, and some routes state numbers (20 requests a minute per workspace for AI copy), but no table of limits per key was found (8 of 15). 429s carry Retry-After, sends take an Idempotency-Key, a reused key with a different body returns IDEMPOTENCY_KEY_REUSED, and the MCP docs say a retry hint alone doesn't make a write safe to repeat (15). No SLA found (0). No beta label on the API or MCP server (10). Total 38.