Braze vs Sequenzy

Braze 73

Read with the hosted lines and scored on the REST API first, with the remote MCP server beside it. status.braze.com redirects to braze.statuspage.io, a Statuspage page with a REST APIs component for each of its clusters (20). Its history feed, read on 2 November (the 8 October reading came from the page's /api/ path, which robots.txt disallows, and is replaced), lists in the 90 days from 4 August one entry that reached the API, elevated error rates for some customers on US 01 and US 03 on 5 August from 11:30 to 12:55 ET, two clusters of many, so partial. The others were US07 dashboard latency on 2 September, the support portal during a Salesforce outage on 16 September and announced database maintenance windows on six clusters from 5 to 30 October. Minor incidents only, at the checklist value (20, was 18). REST limits are published per endpoint, 250,000 requests an hour by default and 250 a minute for broadcast sends. None were found for the MCP server (13 of 15). Every response carries X-RateLimit-Limit, -Remaining and -Reset. The limits page tells a client that gets a 429 to wait for X-RateLimit-Retry-After or the reset time, slow down and batch /users/track updates, and the errors page advises exponential backoff on 5XX, with no idempotency key for sends and no guidance on retrying writes safely, which this run scores 10, as for Retry-After and backoff guidance with no write guidance (10, was 9). No published SLA. The terms promise commercially reasonable efforts and leave service levels to the contract (0). The REST API is generally available and the MCP server has been since 17 September 2026, with 21 of its 71 tools limited to beta programmes (10). 20 + 20 + 13 + 10 + 0 + 10 = 73.

Sequenzy 38

Graded with the hosted lines. No status page was found; none is linked from the site, llms.txt or docs, and status.sequenzy.com doesn't resolve (0). With no history to read, the incident line takes 5. 429 responses carry RateLimit-Limit and RateLimit-Remaining headers for a per-minute policy, and some routes state numbers (20 requests a minute per workspace for AI copy), but no table of limits per key was found (8 of 15). 429s carry Retry-After, sends take an Idempotency-Key, a reused key with a different body returns IDEMPOTENCY_KEY_REUSED, and the MCP docs say a retry hint alone doesn't make a write safe to repeat (15). No SLA found (0). No beta label on the API or MCP server (10). Total 38.

Braze 10

Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page names four editions (Go, Select, Pro, Enterprise) priced by monthly active users and Action Credits, shows no figures and sends buyers to sales (0). It says there is no free plan. A 14-day trial is open at try.braze.com, and we couldn't read whether the form asks for a card, so half marks (10 of 20). A person signs up, creates a REST key in the dashboard or approves OAuth in a browser, and an admin must switch MCP access on first (0).

Sequenzy 40

No x402, MPP or L402 (0). Prices are public as volume tiers from $19 for 15,000 emails to $2,999 for 5 million, without a per-email overage rate (10 of 20). Free plan of 2,500 emails a month with no card (20). Agents can register through service_auth, but the user has to confirm a code in a Sequenzy browser page, and plan payment is through Stripe (10 of 20). Total 40.

Braze 68

No OpenAPI document was found in the docs or the braze-inc GitHub organisation. A public Postman collection covers the REST endpoints, and the MCP tool schemas need a Braze sign-in that we don't have (12 of 25). www.braze.com/llms.txt exists for the marketing site, every docs page has a Markdown copy at /index.md and a Copy for LLM button, and the docs are on Context7 (10). Each endpoint page states its purpose, the key permission it needs and its rate limit. The MCP page lists 71 tools with a one-line description, the REST endpoint behind each and its access type, and says when to use the REST API instead of Operator Connect (15 of 20). Parameters come in tables with required flags and data types, without a schema to validate against (9 of 15). Curl and response examples on each endpoint page, and a table of fatal errors with causes (13 of 15). Release notes are dated and monthly. The REST API has no version scheme, so there is nothing for a client to pin (9 of 15).

Sequenzy 95

OpenAPI 3.1 at docs.sequenzy.com/openapi.yaml with 349 paths and 475 operations, all described (25). llms.txt on both hosts, llms-full.txt, auth.md, agents.md and Markdown twins of the docs (10). Operation and tool descriptions give purpose, the scope each needs and the alternative, such as the deprecated generate-sequence alias (18 of 20). Typed inputs, and tools reject undeclared arguments with an error naming the supported ones (13 of 15). Errors on nearly every operation (401 on 442, 404 on 330, 400 on 290) with examples, and a structured error with code, howToFix and docsUrl for tools (14 of 15). Version in the path and spec, and a dated changelog (15). Total 95.

Braze 50

71 MCP tools is over the 30 line, with no toolsets or dynamic loading documented. What a user sees follows dashboard permissions and three OAuth scopes. On REST, exports take fields_to_export (10 of 25). List endpoints page by page in groups of 100 with sort_direction and last_edit.time[gt], custom attributes return in groups of 50, and segment exports go to a file with an optional callback (15 of 20). Errors are documented as HTTP status plus a message string and an errors array for non-fatal problems, without stable codes. A success response means queued, and /users/identify returns success when nothing matched (14 of 20). No idempotency keys. /users/track/status reports on asynchronous requests tagged with a group_id, and the docs suggest waiting up to five minutes between dependent calls. We couldn't read MCP annotations (5 of 20). Few required parameters on reads. The only REST client library is a Ruby one marked beta, last pushed in January 2022 (6 of 15).

Sequenzy 69

The MCP tool reference lists about 306 tools, the over-30 band, and no toolsets, tool search or dynamic loading was found (5 of 25). List endpoints paginate and filter, and contact timelines use cursors (20). Errors carry a code, a human message, a fix and a docs link, with retryAfterSeconds when the API sent Retry-After (20). Idempotency keys on sends and event imports; MCP readOnlyHint and destructiveHint annotations weren't found in the published reference (14 of 20). Sensible defaults with a selected workspace; one official SDK (TypeScript) plus a CLI (10 of 15). Total 69.

Braze 83

Closed service under a Main Subscription Agreement last updated 13 October 2025, with SDK source public (15). The data retention page keeps profile data for the life of the account, up to 90 days in internal systems, two years before personal data is removed from the Data Lake and six months in backups. The DPA (revision 28 August 2025) commits to export, deletion and a certificate of deletion at termination, and the privacy policy is dated 23 June 2026. The retention page was last revised on 1 April 2024 (25 of 30). A deprecations log with dates exists and the local MCP server is marked deprecated, but no notice period for REST endpoints or MCP tools was found (9 of 20). The sub-processor list of 1 June 2026 gives each entity's service and location with 30 days' notice of additions, and the security datasheet names the AWS regions for US, EU, Australia, Indonesia, Japan and South Korea hosting (20).

Sequenzy 67

A closed service. The SDK, MCP server and CLI are MIT on npm. The terms (30 June 2026) don't name the contracting entity in their text or a governing jurisdiction; the footer names Nic Tech Solutions, LLC (15 of 30). Privacy policy of 16 September 2026 and a public DPA agree on processing, and the terms say data is deleted within 30 days of termination (24 of 30). Deprecated endpoints are marked and kept as compatibility aliases; no written deprecation policy with notice periods (10 of 20). The DPA names its core sub-processors with their purpose; data locations aren't stated (15 of 20). Total 64.

Braze 77

The MCP server uses OAuth with PKCE S256, dynamic client registration, short-lived access tokens with refresh and the scopes mcp:tools, mcp:resources and mcp:operator, checked against an allowlist of redirect URIs. REST keys are limited to named endpoint permissions and optional IP allowlists and travel in a Bearer header. MCP tokens can be revoked only for the whole company at once (29 of 30). MCP access mirrors the user's dashboard permissions, needs a Use MCP Server permission that is off by default in each workspace, and has no tools that return user-level personal data. There is no confirmation step, Operator Connect acts without per-step approval, and Braze advises against a client's auto mode (15 of 20). Campaign content, catalogue items and attribute names can carry text written by others. The docs tell users to review proposed actions and give no prompt-injection guidance (5 of 15). The security event report records OAuth connections and REST key creation and removal, with export to S3, and an API usage dashboard shows traffic. Edits by individual MCP update tools don't appear in campaign edit history (9 of 15). security.txt valid to 1 January 2031 pointing to a HackerOne programme, ISO 27001, SOC 2 Type II and an annual third-party penetration test. We couldn't read whether the programme pays bounties (19 of 20).

Sequenzy 67

Workspace and account API keys with fine-grained permission scopes, presets and explicit *:delete rights, revocable in settings, plus an OAuth service_auth flow for agents with user confirmation (30). Read-only and drafts-only presets let an agent prepare mail without sending, and account keys keep the user's workspace role (20). The agent inbox and reply tracking give the agent inbound mail, and no prompt-injection guidance was found in the MCP, permissions or inbox docs (4 of 15). The DPA lists administrative audit logs and MCP events report replies and bounces; no per-call API log for the customer was found (8 of 15). A responsible disclosure address on the security page, no security.txt (404), bug bounty or certification (5 of 20). Total 67.