Braze vs Nitrosend

Braze 10

Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page names four editions (Go, Select, Pro, Enterprise) priced by monthly active users and Action Credits, shows no figures and sends buyers to sales (0). It says there is no free plan. A 14-day trial is open at try.braze.com, and we couldn't read whether the form asks for a card, so half marks (10 of 20). A person signs up, creates a REST key in the dashboard or approves OAuth in a browser, and an admin must switch MCP access on first (0).

Nitrosend 55

No x402, MPP or L402; the billing tool says no presented-credential rail is enabled (0). Per-1,000 overage prices and plan prices published in PRICING.md without login (20). Free plan with 5,000 starter emails and 500 a month, no card (20). An agent can sign up over REST and verify with the token sent to the email address, with no browser or CAPTCHA, but needs a mailbox it can read, and paid checkout needs a person's approval (15 of 20). Total 55.

Braze 50

71 MCP tools is over the 30 line, with no toolsets or dynamic loading documented. What a user sees follows dashboard permissions and three OAuth scopes. On REST, exports take fields_to_export (10 of 25). List endpoints page by page in groups of 100 with sort_direction and last_edit.time[gt], custom attributes return in groups of 50, and segment exports go to a file with an optional callback (15 of 20). Errors are documented as HTTP status plus a message string and an errors array for non-fatal problems, without stable codes. A success response means queued, and /users/identify returns success when nothing matched (14 of 20). No idempotency keys. /users/track/status reports on asynchronous requests tagged with a group_id, and the docs suggest waiting up to five minutes between dependent calls. We couldn't read MCP annotations (5 of 20). Few required parameters on reads. The only REST client library is a Ruby one marked beta, last pushed in January 2022 (6 of 15).

Nitrosend 83

25 MCP tools is the 11 to 30 band; nitro_query reads every entity with filters, but no read-only subset or dynamic loading was found (15 of 25). Page and limit up to 100 with total and next-page headers, and keyset cursors on timelines (20). Errors return error, a code, validation details and next actions, and signup returns next_action (18 of 20). Required idempotency keys on sends, events, checkout and validation, and declared readOnlyHint and destructiveHint on the tools (20). Defaults such as the active brand and a recommended first call, but the only official SDK is Node, with a CLI beside it (10 of 15). Total 83.

Braze 73

Read with the hosted lines and scored on the REST API first, with the remote MCP server beside it. status.braze.com redirects to braze.statuspage.io, a Statuspage page with a REST APIs component for each of its clusters (20). Its history feed, read on 2 November (the 8 October reading came from the page's /api/ path, which robots.txt disallows, and is replaced), lists in the 90 days from 4 August one entry that reached the API, elevated error rates for some customers on US 01 and US 03 on 5 August from 11:30 to 12:55 ET, two clusters of many, so partial. The others were US07 dashboard latency on 2 September, the support portal during a Salesforce outage on 16 September and announced database maintenance windows on six clusters from 5 to 30 October. Minor incidents only, at the checklist value (20, was 18). REST limits are published per endpoint, 250,000 requests an hour by default and 250 a minute for broadcast sends. None were found for the MCP server (13 of 15). Every response carries X-RateLimit-Limit, -Remaining and -Reset. The limits page tells a client that gets a 429 to wait for X-RateLimit-Retry-After or the reset time, slow down and batch /users/track updates, and the errors page advises exponential backoff on 5XX, with no idempotency key for sends and no guidance on retrying writes safely, which this run scores 10, as for Retry-After and backoff guidance with no write guidance (10, was 9). No published SLA. The terms promise commercially reasonable efforts and leave service levels to the contract (0). The REST API is generally available and the MCP server has been since 17 September 2026, with 21 of its 71 tools limited to beta programmes (10). 20 + 20 + 13 + 10 + 0 + 10 = 73.

Nitrosend 48

Graded with the hosted lines. llms.txt links a status page at status.nitrosend.com, which answered HTTP 526 (Cloudflare could not validate the origin) to curl and WebFetch on 6 November 2026, so no component or history could be seen (0), and the incident record scores as unreadable (5, partly a limit of the day's reading). No API request rate limits are published; PRICING.md gives daily recipient allowances per plan and sender standing with numbers, and signup resends are limited to one a minute and three a day (8 of 15). 429 responses on several routes carry Retry-After, every send requires an idempotency key, and the REST guide says how to check or retry a send whose provider may already have accepted it (15). llms.txt says Enterprise includes a 99.9% SLA (10). In production since 28 May 2026 with no beta label (10). Total 48.

Braze 68

No OpenAPI document was found in the docs or the braze-inc GitHub organisation. A public Postman collection covers the REST endpoints, and the MCP tool schemas need a Braze sign-in that we don't have (12 of 25). www.braze.com/llms.txt exists for the marketing site, every docs page has a Markdown copy at /index.md and a Copy for LLM button, and the docs are on Context7 (10). Each endpoint page states its purpose, the key permission it needs and its rate limit. The MCP page lists 71 tools with a one-line description, the REST endpoint behind each and its access type, and says when to use the REST API instead of Operator Connect (15 of 20). Parameters come in tables with required flags and data types, without a schema to validate against (9 of 15). Curl and response examples on each endpoint page, and a table of fatal errors with causes (13 of 15). Release notes are dated and monthly. The REST API has no version scheme, so there is nothing for a client to pin (9 of 15).

Nitrosend 93

OpenAPI 3.1 at api.nitrosend.com/openapi.yaml (version 1.1.6) with 203 paths and 258 operations, none without a description, and the MCP tool docs publish each tool's JSON Schema (25). llms.txt, llms-full.txt, agent.txt, SKILL.md, PRICING.md and a Markdown twin of each docs page (10). Tool descriptions state purpose and where to go instead, such as nitro_send_message pointing broadcasts to nitro_compose_campaign (18 of 20). Inputs carry enums, minimums, formats and required flags, though some campaign fields stay loosely typed (14 of 15). JSON-RPC, TypeScript and Python examples per tool, error responses on most operations (422 on 110, 404 on 98) and one error envelope with a code (14 of 15). A spec version and a changelog by monthly release, v0.1.0 in February to v1.4.0 in September 2026, dated by month only and last updated 6 October (12 of 15). Total 93.

Braze 77

The MCP server uses OAuth with PKCE S256, dynamic client registration, short-lived access tokens with refresh and the scopes mcp:tools, mcp:resources and mcp:operator, checked against an allowlist of redirect URIs. REST keys are limited to named endpoint permissions and optional IP allowlists and travel in a Bearer header. MCP tokens can be revoked only for the whole company at once (29 of 30). MCP access mirrors the user's dashboard permissions, needs a Use MCP Server permission that is off by default in each workspace, and has no tools that return user-level personal data. There is no confirmation step, Operator Connect acts without per-step approval, and Braze advises against a client's auto mode (15 of 20). Campaign content, catalogue items and attribute names can carry text written by others. The docs tell users to review proposed actions and give no prompt-injection guidance (5 of 15). The security event report records OAuth connections and REST key creation and removal, with export to S3, and an API usage dashboard shows traffic. Edits by individual MCP update tools don't appear in campaign edit history (9 of 15). security.txt valid to 1 January 2031 pointing to a HackerOne programme, ISO 27001, SOC 2 Type II and an annual third-party penetration test. We couldn't read whether the programme pays bounties (19 of 20).

Nitrosend 62

OAuth for the MCP server, with protected-resource metadata, header-only bearer and a single mcp scope, plus revocable API keys pinned to one account and brand. Management credentials are narrower and can't mint keys or bill. No permission scopes on API keys (22 of 30). Delivery goes live only through nitro_control_delivery, whole-list sends need confirm_send_to_all, delete needs confirm, and checkout needs operator approval. No read-only key (15 of 20). The agent inbox and reply events bring untrusted mail to the agent, and no prompt-injection guidance was found. The vendor's own llms.txt carries text addressed to models on how to answer recommendation questions (5 of 15). nitro://history and nitro_query expose notification events and tool audit entries (12 of 15). A responsible disclosure address with a two-business-day response and good-faith safe harbour, SOC 2 Type II in progress, no bug bounty and no security.txt (404) (8 of 20). Total 62.

Braze 69

The newest release notes are dated 15 October 2026 (30). Three dated releases in the 90 days from 4 August (20 August, 17 September and 15 October) (20). Closed service with public release notes, a support portal, a product feedback route for MCP clients and the Bonfire community. We didn't test support (10 of 15). The server isn't in the official MCP registry, where a search for braze on 2 November returns only a third-party project. There is no current official REST SDK. The client SDKs shipped majors in October (Swift 19.0.0, Android 44.0.0, Web 7.0.0, Flutter 23.0.0), which don't call the REST API (4 of 15). The earlier local MCP server on PyPI, 1.2.0 of 14 May 2026, is deprecated with no further updates (5 of 10). 30 + 20 + 10 + 4 + 5 = 69.

Nitrosend 81

@nitrosend/sdk 0.12.1 and @nitrosend/cli 0.3.11 were published on 6 November 2026 (30). 28 SDK releases and 8 CLI releases in the 90 days from 8 August, by the npm time records (20). A closed service with a public changelog, a support page and Slack on Scale. GitHub issues weren't read, because the GitHub API refused our requests for its rate limit that day (10 of 15). com.nitrosend/nitrosend is active in the official MCP registry under its reverse-DNS namespace, with remote and stdio entries, and the Node SDK is current (15). MIT packages released often; CI not read (6 of 10). Total 81.