AhaSend API + MCP vs SendLayer

AhaSend API + MCP 95

Graded with the hosted lines. Better Stack status page at status.ahasend.com with 90 days of per-component history for API v2, API v1, webhooks, inbound routing, tracking, SMTP, the dashboard and the docs (20). Re-read on 1 November, the 90 days from 3 August show the API down only on 17 August, 166 seconds on API v2 and 207 on API v1 (webhooks 162 and inbound routing 32 the same day), plus 114 seconds on email tracking on 27 September and 169 seconds on SMTP port 587 on 27 October, with no written incident reports. The MCP server still has no component, so its record isn't covered. Five less than the clean band for that (25 of 30). 100 requests a second per account with bursts of 200, and 1 a second on statistics, stream and trigger endpoints (15). 429s carry Retry-After since October 2026, the docs give backoff code, and Idempotency-Key covers sends with written rules on when a retry can repeat a send (15). The Terms commit to 99.9% uptime with service credits (10). API v2 is generally available, and the MCP server carries no beta or preview label (10). Total 95.

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.

AhaSend API + MCP 84

ahasend-mcp v0.3.0 and the Go SDK v0.5.0 on 26 October 2026, after MCP v0.2.0 the same day and Go SDK v0.4.0 on 19 October, 6 days before this check (30). Counted from the tags, the 90 days from 3 August hold Go SDK v0.2.0 (20 August), v0.3.0 to v0.3.2, v0.4.0 and v0.5.0, CLI v0.3.0 and v0.3.1, MCP v0.1.0 to v0.3.0, and monthly changelog entries for August, September and October, which name @ahasend/sdk 0.5.0 (20). Closed service with a detailed monthly changelog, a Discord community and email support every day on Pro. GitHub issues couldn't be read, since the GitHub API and web pages were unavailable to this session (10 of 15). com.ahasend/mcp is active in the official MCP registry under its reverse-DNS namespace, though the entry is still 0.1.1 while the repository is at v0.3.0, and the Go and Node SDKs are current (15). ahasend-mcp CI runs golangci-lint and race-enabled tests on its Go 1.25 module and now pins the current ahasend-go v0.5.0, while the Go SDK's test matrix still lists Go 1.19 to 1.21 beside a lint job on Go 1.26 (9 of 10). Total 84.

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

AhaSend API + MCP 78

API keys carry scopes per action and per sending domain, can be limited to IP ranges and to sandbox mode, show creation and last-used times, and are revoked by deleting them. The MCP signs in by OAuth with PKCE S256, dynamic client registration and token revocation, bearer in the header only, and each connection becomes a scoped key the user picks. No documented key rotation beyond guidance to rotate (28 of 30). Read-only and sandbox-only presets, domain limits, a signed elicitation before any campaign send or schedule, a 50-recipient cap on one-off sends, and no MCP tools for keys, billing or members. Deletes such as delete_domain rely on annotations and the client's approval (18 of 20). The MCP docs explain the injection risk of inbound mail, hide received mail by default and mark it untrusted when allowed. Contact fields and bounce reasons still reach the model, as the docs say (13 of 15). Delivery logs, named connections on the API Keys page and admin alerts on IP allow list changes, but no per-call API request log was found (7 of 15). A published responsible disclosure policy, Certified Senders Alliance certification, and since the 17 October check an ISO 27001 certificate (ISO27001:2022/Amd 1:2024) published in the trust centre at trust.ahasend.com, which the security page now calls certified. No security.txt (404 on 1 November), no bug bounty and no public advisories, so 12, level with datocms's 12 for ISO 27001 and a disclosure route with no bounty (12 of 20). Total 78.

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

AhaSend API + MCP 74

Closed hosted service with Terms under Dutch law, last updated 13 October 2026. The MCP tools module, Go and Node SDKs are MIT and the CLI Apache-2.0, but the hosted MCP wrapper isn't in the public repository (20 of 30). Privacy notice with retention periods (account data erased within 14 days of a deletion request, IP logs 1 month, analytics 30 days), a public DPA with deletion within 90 days of termination, and configurable message retention from 0 to 30 days. llms.txt says paid plans can set content retention to 0 while the facts page says 0 needs approval, and the privacy notice names optional US hosting at Hetzner for a US SMTP relay that the October changelog says still works, against "all message data is stored in the EU" on the facts page (21 of 30). API v1 is marked legacy and new v1 keys stopped in October 2026, and DPA changes come by email 7 days ahead. The Terms allow changes without notice, and October 2026 shipped a breaking v2 change against the reference's compatibility promise (8 of 20). The DPA lists three sub-processors with countries, the security page names the five sites and says the website's nameservers are at Cloudflare, and the privacy notice names Stripe, PostHog and Cloudflare for AhaSend's own data (18 of 20). Total 67.

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

AhaSend API + MCP 40

No x402, MPP or L402 (0). Plan prices and overage tiers from $0.50 down to $0.12 per 1,000 published without login, including a Markdown pricing page (20). Free plan of 1,000 emails a month with no card and no expiry (20). Sign-up, email confirmation and domain verification happen in a browser, and the MCP needs a browser login (0). Total 40.

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.

AhaSend API + MCP 86

OpenAPI 3.1 spec for API v2, re-read on 1 November with 65 paths and 109 operations, every one with 4xx responses per the 17 October count, plus a webhooks spec. The MCP tools publish typed JSON Schema inputs and outputs generated from Go structs (25). llms.txt at the root and for the docs, a 2 MB llms-full.txt and a Markdown twin of every page (10). MCP descriptions state the job and the alternative, such as send_email for transactional mail and a campaign for bulk, and that a cancel confirmation doesn't prove a message was stopped (17 of 20). Schemas mark required fields, but limits such as 1 to 100 and the 50-recipient cap are stated in text and checked in code rather than set as minimum, maximum or enum, and substitutions and attributes are open objects (9 of 15). An errors page covers each status with examples and fixes, and samples come in six languages. llms.txt and the docs' agent instructions still say port 465 is unsupported, while the facts page and changelog say it is (12 of 15). Version in the path and a monthly changelog with breaking changes marked, but entries carry a month, not a day (13 of 15). Total 86.

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.