Brevo API + MCP vs SendLayer

Brevo API + MCP 83

The official Node SDK released 6.1.0 on 13 October and 6.2.0 on 16 October 2026, and the Python SDK 5.1.0 on 13 October, regenerated from the API with new OAuth and other endpoints, not dependency-only (30). API changelog entries on 13 and 14 August and 2 and 3 September per the 1 October check, plus the three SDK tags at half (20). Public changelog and support. We couldn't see reply times (10). Node 6.2.0 and Python 5.1.0, generated with Fern, released in October (15). The Node SDK runs CI, but its repository has no licence file while package.json lists one to publish (8).

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

Brevo API + MCP 77

Closed service with terms naming Sendinblue SAS. The official Node SDK repository carries no licence file (15). Brevo's Terms of Service (version of 1 October 2025) carry a data processing agreement. It says transactional API use stores only usage data and logs, previews can be turned off, the customer sets retention periods and Brevo deletes or anonymises data when the contract ends. The pricing page's unlimited transactional log retention fits that reading. No Brevo-set retention period (20 of 30). A dated deprecation for POST /contacts/batch (announced 12 May, removal 30 October), but no stated deprecation policy, and the 13 August CLI changes removed flags with no advance notice in the changelog (14). The 3 September Loyalty rename is deducted once, under negative events, not here. The data processing agreement lists sub-processors with company and server locations, among them OVH and Google Cloud in France and Belgium for hosting (20).

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

Brevo API + MCP 50

Plain API keys in an api-key header, with IP allowlisting on the account. Since the Node SDK 6.1.0 and Python SDK 5.1.0 releases of 13 October 2026, the official SDKs also take OAuth 2.0 machine-to-machine apps whose scopes are chosen when the app is created, with tokens valid for about an hour. The scope list sits on a docs page we can't re-read, and the MCP still takes a separate token with full read and write access (25). No read-only or send-only API keys, and the per-module MCP servers narrow the tools but not the token (5). Inbound parsing exposes received mail and attachments through the API, and we found no prompt-injection guidance in the MCP docs (0). Transactional logs kept without limit per the pricing page (8). ISO 27001:2022 and a responsible-disclosure page. security.txt returned a server error on 30 September (12).

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

Brevo API + MCP 58

The 1 October check read an OpenAPI file at developers.brevo.com/openapi.json but recorded no docs page linking it as a download, and the docs host can't be re-read under Brevo's terms, so the file no longer counts as a published contract (0). llms.txt and Markdown versions of the docs, per the 1 October check, not re-read on 5 November because Brevo's terms bar robots and intelligent agents from navigating its site (10). Reference pages explain each endpoint, per the same check. The hosted MCP isn't open source, so we couldn't read its tool definitions (10). Typed request schemas in the same file, per the 1 October check. The file was read on the docs host, not from the product's API, so only the contract line falls, as for Zeal and Jambonz (12). Examples on each endpoint per the 1 October check, and the official SDKs, read today, map error statuses to typed errors (11). Dated API changelog and v3 in the path, per the 1 October check (15).

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.

Brevo API + MCP 30

No x402, MPP or L402 (0). Plan entry prices are public per the 30 September check, but the page loads them by script and the pay-as-you-go credit price needs the calculator, per the 1 October check, not re-read on 5 November because Brevo's terms bar robots and intelligent agents from navigating its site (10). Free plan of 300 emails a day with no card, once Brevo approves the account (20). Browser signup and approval, no autonomous route (0).

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.

Brevo API + MCP 55

incident.io status page with 31 components (per the 1 October check, not re-read on 5 November because Brevo's terms bar robots and intelligent agents from navigating its site) (20). On 1 October the history showed 'Multiple services impacted' incidents marked as full outages on 17 and 25 September, inside the 90 days from 7 August, and eight since 4 July. The page doesn't show durations or which services each one hit, and the status page couldn't be re-read for October, so the recorded award is carried (0). Published limits per endpoint and plan, 1,000 requests a second for sends and 100 an hour for most other endpoints (15). 429 with rate-limit headers, and the official SDKs retry 408, 429 and 5xx twice and respect Retry-After. No idempotency key for sends found (10). Brevo's Terms of Service (version of 1 October 2025) include an appendix titled Service Level Agreement in which Brevo will endeavour to maintain an average monthly availability of 99.8 per cent of the Software, with no credit or other remedy, and section 5.5 says the service comes as is and as available. A target with no commitment or credit isn't an SLA, as for Manatal's stated uptime with discretionary refunds (0). GA (10).

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.