AhaSend API + MCP vs MailPace

AhaSend API + MCP 86

OpenAPI 3.1 spec for API v2, re-read on 1 November with 65 paths and 109 operations, every one with 4xx responses per the 17 October count, plus a webhooks spec. The MCP tools publish typed JSON Schema inputs and outputs generated from Go structs (25). llms.txt at the root and for the docs, a 2 MB llms-full.txt and a Markdown twin of every page (10). MCP descriptions state the job and the alternative, such as send_email for transactional mail and a campaign for bulk, and that a cancel confirmation doesn't prove a message was stopped (17 of 20). Schemas mark required fields, but limits such as 1 to 100 and the 50-recipient cap are stated in text and checked in code rather than set as minimum, maximum or enum, and substitutions and attributes are open objects (9 of 15). An errors page covers each status with examples and fixes, and samples come in six languages. llms.txt and the docs' agent instructions still say port 465 is unsupported, while the facts page and changelog say it is (12 of 15). Version in the path and a monthly changelog with breaking changes marked, but entries carry a month, not a day (13 of 15). Total 86.

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

AhaSend API + MCP 78

API keys carry scopes per action and per sending domain, can be limited to IP ranges and to sandbox mode, show creation and last-used times, and are revoked by deleting them. The MCP signs in by OAuth with PKCE S256, dynamic client registration and token revocation, bearer in the header only, and each connection becomes a scoped key the user picks. No documented key rotation beyond guidance to rotate (28 of 30). Read-only and sandbox-only presets, domain limits, a signed elicitation before any campaign send or schedule, a 50-recipient cap on one-off sends, and no MCP tools for keys, billing or members. Deletes such as delete_domain rely on annotations and the client's approval (18 of 20). The MCP docs explain the injection risk of inbound mail, hide received mail by default and mark it untrusted when allowed. Contact fields and bounce reasons still reach the model, as the docs say (13 of 15). Delivery logs, named connections on the API Keys page and admin alerts on IP allow list changes, but no per-call API request log was found (7 of 15). A published responsible disclosure policy, Certified Senders Alliance certification, and since the 17 October check an ISO 27001 certificate (ISO27001:2022/Amd 1:2024) published in the trust centre at trust.ahasend.com, which the security page now calls certified. No security.txt (404 on 1 November), no bug bounty and no public advisories, so 12, level with datocms's 12 for ISO 27001 and a disclosure route with no bounty (12 of 20). Total 78.

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

AhaSend API + MCP 95

Graded with the hosted lines. Better Stack status page at status.ahasend.com with 90 days of per-component history for API v2, API v1, webhooks, inbound routing, tracking, SMTP, the dashboard and the docs (20). Re-read on 1 November, the 90 days from 3 August show the API down only on 17 August, 166 seconds on API v2 and 207 on API v1 (webhooks 162 and inbound routing 32 the same day), plus 114 seconds on email tracking on 27 September and 169 seconds on SMTP port 587 on 27 October, with no written incident reports. The MCP server still has no component, so its record isn't covered. Five less than the clean band for that (25 of 30). 100 requests a second per account with bursts of 200, and 1 a second on statistics, stream and trigger endpoints (15). 429s carry Retry-After since October 2026, the docs give backoff code, and Idempotency-Key covers sends with written rules on when a retry can repeat a send (15). The Terms commit to 99.9% uptime with service credits (10). API v2 is generally available, and the MCP server carries no beta or preview label (10). Total 95.

MailPace 70

Graded with the hosted lines. A public Upptime status page at status.mailpace.com, driven by the mailpace/status repository, with monitors for the application, SMTP, docs, blog and landing page and GitHub issues as incident reports (20). The 90 days from 8 August hold two incidents, an application outage on 22 September 2026 that the operator put down to an upstream provider returning 5xx (issue open for two minutes), and SMTP down on 2 November 2026 for about 35 minutes, which leaves SMTP at 99.65% for the week. Minor incidents only (20). No rate limit numbers are published; the docs say limits vary by organisation age, plan and history (0). A documented 429 with its message, no Retry-After or backoff guidance, and an Idempotency-Key on sends with written retry rules (10 of 15). The terms guarantee 99% monthly availability of the API and dashboard with a 5% credit per 30 minutes (10). The API is at v1 with no beta label (10). Total 70.

AhaSend API + MCP 84

ahasend-mcp v0.3.0 and the Go SDK v0.5.0 on 26 October 2026, after MCP v0.2.0 the same day and Go SDK v0.4.0 on 19 October, 6 days before this check (30). Counted from the tags, the 90 days from 3 August hold Go SDK v0.2.0 (20 August), v0.3.0 to v0.3.2, v0.4.0 and v0.5.0, CLI v0.3.0 and v0.3.1, MCP v0.1.0 to v0.3.0, and monthly changelog entries for August, September and October, which name @ahasend/sdk 0.5.0 (20). Closed service with a detailed monthly changelog, a Discord community and email support every day on Pro. GitHub issues couldn't be read, since the GitHub API and web pages were unavailable to this session (10 of 15). com.ahasend/mcp is active in the official MCP registry under its reverse-DNS namespace, though the entry is still 0.1.1 while the repository is at v0.3.0, and the Go and Node SDKs are current (15). ahasend-mcp CI runs golangci-lint and race-enabled tests on its Go 1.25 module and now pins the current ahasend-go v0.5.0, while the Go SDK's test matrix still lists Go 1.19 to 1.21 beside a lint job on Go 1.26 (9 of 10). Total 84.

MailPace 65

Email Status API documented on 22 October 2026, and the MCP server rewritten as 2.0.0 on 4 November 2026, two days before this check (30). In the 90 days from 8 August, the Q3 changelog post of 31 August, the Email Status docs of 22 October, a mailpace-rails push on 17 October and the MCP rewrite, but only one changelog post (15 of 20). A closed service with email support. Three pull requests to the MCP repository from 2025 have no reply (8 of 15). Not in the official MCP registry (search for mailpace returned nothing on 6 November). The Node library was last pushed in October 2024 and Go in January 2024, while mailpace-rails is current (7 of 15). The MCP server gained CI with tests on 4 November; the older SDKs weren't checked for CI (5 of 10). Total 65.

AhaSend API + MCP 40

No x402, MPP or L402 (0). Plan prices and overage tiers from $0.50 down to $0.12 per 1,000 published without login, including a Markdown pricing page (20). Free plan of 1,000 emails a month with no card and no expiry (20). Sign-up, email confirmation and domain verification happen in a browser, and the MCP needs a browser login (0). Total 40.

MailPace 25

No x402, MPP or L402 (0). $10 a month for 10,000 emails and $1 per 1,000 after, loaded from Paddle on the pricing page and stated in the comparison pages' tables without login (20). A free plan of up to 100 emails a month is available only by emailing support, so it isn't self-serve (5 of 20). Signup, DKIM verification and payment happen in a browser (0). Total 25.

AhaSend API + MCP 80

91 MCP tools with every scope in ahasend-mcp v0.3.0 (26 October), up from 82 in v0.1.1, is the over-30 band (5). The module has seven toolsets and a read-only switch, and the hosted server lists only the tools the connection's scopes allow, so the Read-only preset shows the read tools only (add back 10, 15 of 25). Cursor pagination with limit, after and before on 17 list operations, filters by status, tags, domains and time, and MCP list tools that default to 20 and cap at 100 (20). API errors are an HTTP status plus a human message that the docs say is not a stable code, with coded issues only for campaign checks. MCP tool errors restate the API message and say what to do next (14 of 20). Idempotency-Key on 28 operations including all sends, and the Go SDK sends and reuses one on retry. Every MCP tool carries readOnlyHint and destructiveHint, 14 destructive in v0.3.0. The MCP send tools take no idempotency key from the agent, so a repeated tool call sends again (17 of 20). Sends need from, recipients, subject and content, and official SDKs exist in Go and Node with a Java client and a CLI (14 of 15). Total 80.

MailPace 71

Responses are small, the send returns an id and status and Email Status returns one email (18 of 25). Only the domains list takes limit, offset, sort and direction; there is no endpoint to list or search sent mail (8 of 20). Errors are JSON with a human message and an HTTP status for each case in the documented table, with no stable error codes (14 of 20). Idempotency-Key on sends, kept 24 hours per token, and failed validations are not stored so they can be retried. The MCP server marks send as not idempotent and revoke as destructive (18 of 20). A send needs from, to, a subject and a body; official libraries for Node, Rails, Go and PHP transports and an SMTP route (13 of 15). Total 71.