{ "data": { "a": { "slug": "brevo", "name": "Brevo API + MCP", "vendor": "Brevo", "vendorUrl": "https://www.brevo.com", "kind": "http-api", "category": "email", "summary": "Transactional email over REST and SMTP relay, with inbound parsing, templates and webhooks, inside a wider marketing and CRM suite (formerly Sendinblue).", "url": "https://www.anchorterminal.com/tools/brevo", "markdownUrl": "https://www.anchorterminal.com/tools/brevo.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/brevo.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/brevo.json", "dns": "brevo.grade.anchorterminal.com", "repo": "https://github.com/getbrevo/brevo-node", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.brevo.com/v3", "packages": [ { "registry": "npm", "name": "@getbrevo/brevo" }, { "registry": "pypi", "name": "brevo-python" } ], "auth": "mixed", "authNotes": "REST calls take the key in an `api-key` header. Since 13 October 2026 the official Node and Python SDKs also take OAuth 2.0 machine-to-machine apps, whose scopes are chosen when the app is created and whose tokens last about an hour. The MCP server takes a separate MCP token as a Bearer header, created by ticking the MCP option when generating a key. That token has full read and write access to the account.", "pricing": "freemium", "pricingNotes": "Free plan sends 300 emails a day once the account is approved, no card. Starter from $9 a month (from 5,000 emails), Standard from $18 a month, Professional from $499 a month (from 150,000 emails), Enterprise on quote. Yearly billing takes 10 per cent off. Prepaid pay-as-you-go credits don't expire, one credit per email, but the per-credit price isn't shown without the calculator (https://www.brevo.com/pricing/).", "priceSummary": "$9 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402 or stablecoin payment path in docs or pricing (checked 2026-09-30).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 122, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://developers.brevo.com", "llmsTxt": "https://developers.brevo.com/llms.txt", "openapi": "https://developers.brevo.com/openapi.json", "capabilities": [ "email.send", "email.inbound", "email.templates", "email.domains", "email.analytics", "email.marketing" ], "tags": [ "hosted", "freemium", "no-card", "mcp", "llms-txt", "openapi", "typescript", "python", "webhooks", "sms", "whatsapp" ], "lastRelease": "2026-10-16", "graded": true, "anchor": { "graded": true, "score": 42.5, "grade": "E", "agentReady": false, "rank": 1260, "ranked": true, "rankOf": 1486, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 83, "payments": 30, "reliability": 55, "schema": 58, "security": 50, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-05" }, "negative": -15, "negativeNotes": [ "2026-09-14. A Cloudflare API key with full account permissions, stored in Brevo's source code, let an attacker inject a ClickFix script for 5 hours 29 minutes, showing fake verification pages that pushed visitors to run malware. The post-mortem names brevo.com, sendinblue.com, the login, account, my and onboarding subdomains of brevo.com, sibforms.com and three embedded scripts (the Brevo forms script, the Conversations widget and the SDK loader) as affected. Brevo says app.brevo.com, the API and customer data weren't touched, and it published the fix (scoped, short-lived tokens and alerting). Decayed for the fix and write-up, -6 (https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up)", "2026-09-10. An attacker created a Brevo account, turned on SAML SSO and invited real users into it, and a scoping flaw then gave the attacker every organisation those users could reach. Brevo's write-up counts 138 accounts accessed, 6 used to send phishing, 43 with contacts exported and 93 with no meaningful activity. Brevo closed the route and ended every user session by 08:30 UTC, two hours after spotting it, disabled the links in the phishing emails, said it was deploying a fix that limits SSO to the organisation that owns the configuration, and is contacting each affected customer. A cross-tenant breach with customer contacts taken, weighed like the 14 September incident and decayed for the same-day fix, the write-up and direct notice to customers, -6 (https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE/write-up)", "2026-09-03. The API changelog marks as breaking a rename of the Loyalty transaction status values (pending and complete became draft and completed), with no advance notice that we could find. -3 (https://developers.brevo.com/changelog)" ], "verdict": "Brevo's send endpoint allows 1,000 requests a second, and its terms carry a 99.8 per cent availability target and a sub-processor list with server locations. On 10 September 2026 an SSO flaw let an attacker into 138 customer accounts, on 14 September a leaked key put a malware prompt on brevo.com, and the MCP token has full account access.", "bestFor": "Teams that want transactional, marketing, SMS and CRM in one EU-hosted account.", "strengths": [ "POST /v3/smtp/email allows 1,000 requests a second on every plan", "27 per-module MCP servers keep a client's tool list short", "OAuth 2.0 machine-to-machine apps with scopes in the official SDKs since 13 October 2026", "The terms carry a data processing agreement and a sub-processor list with server locations", "Free plan of 300 emails a day with no card" ], "weaknesses": [ "'Multiple services' full outages on 17 and 25 September 2026, and eight since July, per the 1 October check", "A SAML SSO flaw let an attacker into 138 customer accounts on 10 September, with contacts exported from 43", "ClickFix script served on brevo.com, sendinblue.com, sibforms.com and three embedded Brevo scripts for 5 hours 29 minutes on 14 September", "MCP token has full account access, with no read-only or send-only option", "The SLA is a 99.8 per cent availability target with no service credits named" ], "agentNotes": [ "Connect a single module server at /v1/brevo_\u003cmodule\u003e/mcp rather than the combined /v1/brevo/mcp", "Send with POST /v3/smtp/email and the `api-key` header, not Bearer", "Ask for an OAuth M2M app with only the scopes the task needs where the operator can set one up, rather than a full API key", "Use webhooks for delivery events. GET /v3/smtp/emails allows 2 requests a second", "Budget calls to non-send endpoints, which allow 100 an hour on the general tier" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 42.5 } ], "editorialScores": { "ergonomics": 65, "maintenance": 83, "payments": 30, "reliability": 55, "schema": 58, "security": 50, "transparency": 69 }, "provenanceScore": 85, "checked": { "categories": { "ergonomics": "2026-11-05", "maintenance": "2026-11-05", "payments": "2026-11-05", "reliability": "2026-11-05", "schema": "2026-11-05", "security": "2026-11-05", "transparency": "2026-11-05" }, "last": "2026-11-05", "lastMoved": "2026-11-05", "oldest": "2026-11-05", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -X POST https://api.brevo.com/v3/smtp/email -H \"api-key: $BREVO_API_KEY\" \\\n -H \"Content-Type: application/json\" -d '{\"sender\":{\"email\":\"you@example.com\"},\"to\":[{\"email\":\"them@example.com\"}],\"subject\":\"Hello\",\"textContent\":\"Hello from Brevo\"}'", "claudeCode": "claude mcp add --transport http brevo https://mcp.brevo.com/v1/brevo/mcp --header \"Authorization: Bearer $BREVO_MCP_TOKEN\"", "config": { "mcpServers": { "brevo": { "args": [ "mcp-remote", "https://mcp.brevo.com/v1/brevo/mcp", "--header", "Authorization: Bearer ${BREVO_MCP_TOKEN}" ], "command": "npx", "env": { "BREVO_MCP_TOKEN": "${BREVO_MCP_TOKEN}" } } } } }, "letme": { "capability": "https://letme.dev/email.send", "tool": "https://letme.dev/brevo" }, "area": "communication", "unitPrices": [ { "item": "Starter", "unit": "month", "usd": 9, "note": "from 5,000 emails a month, price rises with volume" }, { "item": "Standard", "unit": "month", "usd": 18, "note": "entry price, rises with volume, adds automation and A/B testing" }, { "item": "Professional", "unit": "month", "usd": 499, "note": "from 150,000 emails a month, 10 seats" } ], "provenance": { "legalEntity": "Sendinblue SAS", "domain": "brevo.com", "domainRegistered": "1999-09-10", "domainNote": "brevo.com is an old domain that Sendinblue acquired for its 2023 rebrand, so its age says little about the company.", "endpointOnVendorDomain": true, "terms": "https://www.brevo.com/legal/termsofuse/", "privacy": "https://www.brevo.com/legal/privacypolicy/", "statusPage": "https://status.brevo.com/", "changelog": "https://developers.brevo.com/changelog", "securityTxt": "none", "checked": "2026-11-05", "notes": [ "www.brevo.com/.well-known/security.txt returned a 500 error page on 30 September. A responsible disclosure page exists at https://www.brevo.com/legal/responsible-disclosure/", "Brevo's Terms of Service (version of 1 October 2025) bar any engine, software, tool or agent, including spiders, robots and intelligent agents, from navigating or searching the Site, the Software and the Services, so only the terms page was read on 5 November. The terms carry the data processing agreement, its sub-processor list and a Service Level Agreement appendix." ], "score": 85 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/brevo.json", "live": { "slug": "brevo", "probe": { "target": "https://api.brevo.com/v3", "method": "get", "lastAt": "2026-11-07T18:20:15.124733924Z", "lastOk": true, "lastStatus": 401, "lastMs": 265, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 100, "p95ms24h": 180, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.brevo.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:20:37.258988641Z" }, "versions": [ { "registry": "github", "name": "getbrevo/brevo-node", "version": "v6.2.0", "released": "2026-10-16", "seenAt": "2026-11-06T23:12:11.160511109Z" }, { "registry": "npm", "name": "@getbrevo/brevo", "version": "6.2.0", "seenAt": "2026-11-06T23:12:10.746412469Z" }, { "registry": "pypi", "name": "brevo-python", "version": "5.1.0", "released": "2026-10-13", "seenAt": "2026-11-06T23:12:10.980402408Z" } ], "githubStars": 123, "npmWeekly": 461890, "pypiWeekly": 94462, "securityTxt": { "url": "https://brevo.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:40.409950662Z" }, "llmsTxt": { "url": "https://developers.brevo.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:44.548194356Z" }, "domain": { "domain": "brevo.com", "registered": "1999-09-10", "source": "https://rdap.verisign.com/com/v1/domain/brevo.com", "checkedAt": "2026-11-01T14:16:22.448167458Z" }, "pages": [ { "url": "https://developers.brevo.com/changelog", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:03:40.786946305Z", "changedAt": "2026-11-04T08:18:41.928695223Z", "fingerprint": "a09ada1fc381" }, { "url": "https://www.brevo.com/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:26:12.606376858Z", "changedAt": "2026-10-29T05:20:48.790754544Z", "fingerprint": "582ba236d117" }, { "url": "https://www.brevo.com/legal/privacypolicy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:26:08.105807475Z", "changedAt": "2026-10-29T05:20:42.261796187Z", "fingerprint": "14b054c4320d" }, { "url": "https://www.brevo.com/legal/termsofuse/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:26:10.471463836Z", "changedAt": "2026-11-05T13:10:13.176694431Z", "fingerprint": "4e450cddb605" } ], "mcpTools": { "url": "https://mcp.brevo.com/v1/brevo/mcp", "checkedAt": "2026-11-07T01:42:53.329626901Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:42:53.329626901Z" }, "github": { "repo": "getbrevo/brevo-node", "checkedAt": "2026-11-02T08:50:04.282208173Z", "stars": 123, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-16T08:26:58Z", "openIssues": 1, "openPRs": 0, "issuesOpened90d": 1, "issuesClosed90d": 3, "prsMerged90d": 5, "ci": { "branch": "main", "runs": 7, "success": 7, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-10-16T08:26:19Z" }, "replies": { "sampled": 25, "unanswered": 1, "medianDays": 197.9 } }, "updatedAt": "2026-11-07T18:20:15.124733924Z" } }, "answer": "SendLayer scores 47.7 (D) on agent readiness against Brevo API + MCP's 42.5 (E), and leads in 1 of 7 scored categories. Brevo API + MCP leads on reliability, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "sendlayer", "name": "SendLayer", "vendor": "SendLayer, LLC", "vendorUrl": "https://sendlayer.com", "kind": "http-api", "category": "email", "summary": "SendLayer is a transactional email service from SendLayer, LLC, with an SMTP relay, a REST API for sending and email events, webhooks, SDKs in five languages and a hosted MCP server. It is aimed largely at WordPress and small-business sites.", "url": "https://www.anchorterminal.com/tools/sendlayer", "markdownUrl": "https://www.anchorterminal.com/tools/sendlayer.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/sendlayer.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/sendlayer.json", "dns": "sendlayer.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://mcp.sendlayer.com", "packages": [ { "registry": "npm", "name": "sendlayer" }, { "registry": "pypi", "name": "sendlayer" } ], "auth": "api-key", "authNotes": "Bearer API key in the `Authorization` header, created per sending domain in the dashboard (one is made when a domain is authorised). Keys can be labelled and deleted; no scopes or read-only keys were found. The hosted MCP server takes the same key in an `x-sendlayer-api-key` or `Authorization` header.", "pricing": "paid", "pricingNotes": "Plans billed annually. Starter $5 a month for 1,000 emails, Business $15 for 5,000, Growth $25 for 10,000, Scale 20,000+ by quote. A free trial sends up to 200 emails. Accounts that reach their limit are upgraded automatically. 14-day money-back guarantee.", "priceSummary": "$5 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, llms.txt, the OpenAPI file or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 5, "popularity": { "githubStars": null, "npmWeekly": 113, "pypiWeekly": 9, "asOf": "2026-11-06" }, "docsUrl": "https://developers.sendlayer.com/", "llmsTxt": "https://developers.sendlayer.com/llms.txt", "openapi": "https://developers.sendlayer.com/api-reference/sendlayer.json", "capabilities": [ "email.send", "email.analytics", "email.domains" ], "tags": [ "hosted", "closed-source", "smtp", "webhooks", "openapi", "llms-txt", "mcp", "remote-mcp", "status-page", "typescript", "python", "php", "ruby", "go" ], "lastRelease": "2026-08-21", "graded": true, "anchor": { "graded": true, "score": 47.7, "grade": "D", "agentReady": false, "rank": 1135, "ranked": true, "rankOf": 1486, "categoryRank": 19, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 62, "maintenance": 40, "payments": 20, "reliability": 48, "schema": 68, "security": 38, "transparency": 49 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "A small API with an OpenAPI file, llms.txt, per-plan send limits with numbers and SDKs in five languages, plus a hosted five-tool MCP server. Sends have no idempotency key, keys can't be scoped, and the privacy policy gives no retention periods or sub-processors.", "bestFor": "Low-volume transactional mail for WordPress and small sites.", "strengths": [ "Send limits per minute, hour and day are published for each plan", "OpenAPI file, llms.txt and Markdown copies of every developer page", "Official SDKs for Node, Python, PHP, Ruby and Go", "Hosted MCP server at mcp.sendlayer.com with five tools for sending, events and webhooks", "Numbered error codes with messages for each missing or invalid field" ], "weaknesses": [ "No idempotency key on sends, so a retried request can send twice", "API keys can't be scoped or made read-only", "Status history shows 98 automated outage entries in 90 days with no durations or write-ups", "Privacy policy has no date, retention periods, DPA or sub-processor list", "No public changelog, SLA, security.txt or disclosure policy found" ], "agentNotes": [ "Check the email log with `GET /api/v1/events` before retrying a failed send, since sends have no idempotency key", "Keep To and CC at 10 addresses or fewer and BCC at 5, or the API returns error code 20 or 27", "Pace sends to the plan's per-minute limit, 50 on Starter and 120 on Business, and back off on 429", "Pass the API key in a header to mcp.sendlayer.com; the server answers 405 to anything but POST" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47.7 } ], "editorialScores": { "ergonomics": 62, "maintenance": 40, "payments": 20, "reliability": 48, "schema": 68, "security": 38, "transparency": 23 }, "provenanceScore": 75, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install sendlayer", "http": "curl https://console.sendlayer.com/api/v1/email -X POST -H \"Authorization: Bearer $SENDLAYER_API_KEY\" -H \"Content-Type: application/json\" -d '{\"From\":{\"name\":\"You\",\"email\":\"you@yourdomain.com\"},\"To\":[{\"name\":\"Person\",\"email\":\"person@example.com\"}],\"Subject\":\"Hello\",\"ContentType\":\"Text\",\"PlainContent\":\"Hello\"}'", "claudeCode": "claude mcp add --scope user --transport http sendlayer-mcp https://mcp.sendlayer.com --header \"Authorization: Bearer YOUR_SENDLAYER_API_KEY\"", "config": { "mcpServers": { "sendlayer": { "headers": { "x-sendlayer-api-key": "YOUR_SENDLAYER_API_KEY" }, "url": "https://mcp.sendlayer.com" } } } }, "letme": { "capability": "https://letme.dev/email.send", "tool": "https://letme.dev/sendlayer" }, "area": "communication", "unitPrices": [ { "item": "Starter", "unit": "month", "usd": 5, "note": "1,000 emails a month, billed annually" }, { "item": "Business", "unit": "month", "usd": 15, "note": "5,000 emails a month, billed annually" }, { "item": "Growth", "unit": "month", "usd": 25, "note": "10,000 emails a month, billed annually" } ], "provenance": { "legalEntity": "SendLayer, LLC", "domain": "sendlayer.com", "domainRegistered": "2015-07-22", "endpointOnVendorDomain": true, "terms": "https://sendlayer.com/terms-of-service/", "privacy": "https://sendlayer.com/privacy-policy/", "statusPage": "https://status.sendlayer.com", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms name SendLayer, LLC under Florida law with courts in West Palm Beach. Neither the terms nor the privacy policy carries a date.", "The terms contain no clause on automated access to the website.", "sendlayer.com/robots.txt disallows only WordPress internals, cart and search paths. developers.sendlayer.com allows all but /_next/ and /cdn-cgi/.", "RDAP gives sendlayer.com a registration date of 22 July 2015; the about page says the team started SendLayer in 2022, and the footer copyright runs from 2021.", "/.well-known/security.txt returns 404." ], "score": 75 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/sendlayer.json", "live": { "slug": "sendlayer", "probe": { "target": "https://mcp.sendlayer.com", "method": "get", "lastAt": "2026-11-07T18:20:53.661767075Z", "lastOk": true, "lastStatus": 405, "lastMs": 337, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 332, "p95ms24h": 423, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.sendlayer.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:44.410046578Z" }, "versions": [ { "registry": "npm", "name": "sendlayer", "version": "1.1.0", "seenAt": "2026-11-07T00:04:36.013206716Z" }, { "registry": "pypi", "name": "sendlayer", "version": "1.1.0", "released": "2026-08-21", "seenAt": "2026-11-07T00:04:36.403864413Z" } ], "npmWeekly": 113, "pypiWeekly": 9, "securityTxt": { "url": "https://sendlayer.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:08.464258052Z" }, "llmsTxt": { "url": "https://developers.sendlayer.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.535300528Z" }, "pages": [ { "url": "https://sendlayer.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:19:27.507195007Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1f5bea738989" }, { "url": "https://sendlayer.com/terms-of-service/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:19:31.497088663Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1fbf9877b12a" } ], "mcpTools": { "url": "https://mcp.sendlayer.com", "checkedAt": "2026-11-07T01:47:41.040426143Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:47:41.040426143Z" }, "updatedAt": "2026-11-07T18:20:53.661767075Z" } }, "edges": [ { "by": 43, "category": "maintenance", "leads": "brevo", "name": "Maintenance \u0026 community", "reasons": { "a": "The official Node SDK released 6.1.0 on 13 October and 6.2.0 on 16 October 2026, and the Python SDK 5.1.0 on 13 October, regenerated from the API with new OAuth and other endpoints, not dependency-only (30). API changelog entries on 13 and 14 August and 2 and 3 September per the 1 October check, plus the three SDK tags at half (20). Public changelog and support. We couldn't see reply times (10). Node 6.2.0 and Python 5.1.0, generated with Fern, released in October (15). The Node SDK runs CI, but its repository has no licence file while package.json lists one to publish (8).", "b": "The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40." }, "scores": { "a": 83, "b": 40 } }, { "by": 28, "category": "transparency", "leads": "brevo", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service with terms naming Sendinblue SAS. The official Node SDK repository carries no licence file (15). Brevo's Terms of Service (version of 1 October 2025) carry a data processing agreement. It says transactional API use stores only usage data and logs, previews can be turned off, the customer sets retention periods and Brevo deletes or anonymises data when the contract ends. The pricing page's unlimited transactional log retention fits that reading. No Brevo-set retention period (20 of 30). A dated deprecation for POST /contacts/batch (announced 12 May, removal 30 October), but no stated deprecation policy, and the 13 August CLI changes removed flags with no advance notice in the changelog (14). The 3 September Loyalty rename is deducted once, under negative events, not here. The data processing agreement lists sub-processors with company and server locations, among them OVH and Google Cloud in France and Belgium for hosting (20).", "b": "Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23." }, "scores": { "a": 77, "b": 49 } }, { "by": 12, "category": "security", "leads": "brevo", "name": "Security \u0026 auth", "reasons": { "a": "Plain API keys in an `api-key` header, with IP allowlisting on the account. Since the Node SDK 6.1.0 and Python SDK 5.1.0 releases of 13 October 2026, the official SDKs also take OAuth 2.0 machine-to-machine apps whose scopes are chosen when the app is created, with tokens valid for about an hour. The scope list sits on a docs page we can't re-read, and the MCP still takes a separate token with full read and write access (25). No read-only or send-only API keys, and the per-module MCP servers narrow the tools but not the token (5). Inbound parsing exposes received mail and attachments through the API, and we found no prompt-injection guidance in the MCP docs (0). Transactional logs kept without limit per the pricing page (8). ISO 27001:2022 and a responsible-disclosure page. security.txt returned a server error on 30 September (12).", "b": "Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38." }, "scores": { "a": 50, "b": 38 } }, { "by": 10, "category": "schema", "leads": "sendlayer", "name": "Schema \u0026 documentation", "reasons": { "a": "The 1 October check read an OpenAPI file at developers.brevo.com/openapi.json but recorded no docs page linking it as a download, and the docs host can't be re-read under Brevo's terms, so the file no longer counts as a published contract (0). llms.txt and Markdown versions of the docs, per the 1 October check, not re-read on 5 November because Brevo's terms bar robots and intelligent agents from navigating its site (10). Reference pages explain each endpoint, per the same check. The hosted MCP isn't open source, so we couldn't read its tool definitions (10). Typed request schemas in the same file, per the 1 October check. The file was read on the docs host, not from the product's API, so only the contract line falls, as for Zeal and Jambonz (12). Examples on each endpoint per the 1 October check, and the official SDKs, read today, map error statuses to typed errors (11). Dated API changelog and v3 in the path, per the 1 October check (15).", "b": "OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68." }, "scores": { "a": 58, "b": 68 } }, { "by": 10, "category": "payments", "leads": "brevo", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan entry prices are public per the 30 September check, but the page loads them by script and the pay-as-you-go credit price needs the calculator, per the 1 October check, not re-read on 5 November because Brevo's terms bar robots and intelligent agents from navigating its site (10). Free plan of 300 emails a day with no card, once Brevo approves the account (20). Browser signup and approval, no autonomous route (0).", "b": "No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20." }, "scores": { "a": 30, "b": 20 } }, { "by": 7, "category": "reliability", "leads": "brevo", "name": "Reliability", "reasons": { "a": "incident.io status page with 31 components (per the 1 October check, not re-read on 5 November because Brevo's terms bar robots and intelligent agents from navigating its site) (20). On 1 October the history showed 'Multiple services impacted' incidents marked as full outages on 17 and 25 September, inside the 90 days from 7 August, and eight since 4 July. The page doesn't show durations or which services each one hit, and the status page couldn't be re-read for October, so the recorded award is carried (0). Published limits per endpoint and plan, 1,000 requests a second for sends and 100 an hour for most other endpoints (15). 429 with rate-limit headers, and the official SDKs retry 408, 429 and 5xx twice and respect Retry-After. No idempotency key for sends found (10). Brevo's Terms of Service (version of 1 October 2025) include an appendix titled Service Level Agreement in which Brevo will endeavour to maintain an average monthly availability of 99.8 per cent of the Software, with no credit or other remedy, and section 5.5 says the service comes as is and as available. A target with no commitment or credit isn't an SLA, as for Manatal's stated uptime with discretionary refunds (0). GA (10).", "b": "Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48." }, "scores": { "a": 55, "b": 48 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Brevo", "b": "SendLayer, LLC", "name": "Vendor" }, { "a": "https://api.brevo.com/v3", "b": "https://mcp.sendlayer.com", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "5", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-16", "b": "2026-08-21", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "2025-10-01", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "yes", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "122 stars", "b": "113 npm/wk, 9 PyPI/wk", "name": "Popularity" }, { "a": "2/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "SendLayer scores 47.7 (D) on agent readiness against Brevo API + MCP's 42.5 (E), and leads in 1 of 7 scored categories. Brevo API + MCP leads on reliability, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, Brevo API + MCP or SendLayer?" }, { "answer": "Brevo API + MCP takes an API key or an OAuth sign-in. SendLayer needs an API key.", "question": "Do Brevo API + MCP and SendLayer need an API key?" }, { "answer": "Yes. Brevo API + MCP has a hosted endpoint at https://api.brevo.com/v3 and SendLayer at https://mcp.sendlayer.com.", "question": "Can an agent call Brevo API + MCP and SendLayer without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 55 against 48", "Security \u0026 auth, 50 against 38", "Payments \u0026 pricing, 30 against 20", "Maintenance \u0026 community, 83 against 40", "Transparency \u0026 trust, 77 against 49" ], "also": [ "Free to start without a card" ], "goodFor": "Teams that want transactional, marketing, SMS and CRM in one EU-hosted account.", "slug": "brevo", "watchFor": "'Multiple services' full outages on 17 and 25 September 2026, and eight since July, per the 1 October check" }, { "aheadOn": [ "Schema \u0026 documentation, 68 against 58" ], "also": [ "No incidents deducted, where Brevo API + MCP loses 15 points for them" ], "goodFor": "Low-volume transactional mail for WordPress and small sites.", "slug": "sendlayer", "watchFor": "No idempotency key on sends, so a retried request can send twice" } ], "history": { "brevo": [ { "causes": [ "product", "correction" ], "date": "2026-11-05", "delta": -2.4, "from": 44.9, "fromGrade": "E", "to": 42.5, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 44.8, "fromGrade": "E", "to": 44.9, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.4, "from": 45.2, "fromGrade": "E", "to": 44.8, "toGrade": "E" } ], "sendlayer": null }, "job": { "capability": "email.send", "name": "Sending email" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ahasend-vs-brevo.json", "title": "AhaSend API + MCP vs Brevo API + MCP", "url": "https://www.anchorterminal.com/compare/ahasend-vs-brevo" }, { "json": "https://www.anchorterminal.com/compare/ahasend-vs-sendlayer.json", "title": "AhaSend API + MCP vs SendLayer", "url": "https://www.anchorterminal.com/compare/ahasend-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/amazon-ses-vs-brevo.json", "title": "Amazon SES vs Brevo API + MCP", "url": "https://www.anchorterminal.com/compare/amazon-ses-vs-brevo" }, { "json": "https://www.anchorterminal.com/compare/amazon-ses-vs-sendlayer.json", "title": "Amazon SES vs SendLayer", "url": "https://www.anchorterminal.com/compare/amazon-ses-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-cloudflare-email-service.json", "title": "Brevo API + MCP vs Cloudflare Email Service", "url": "https://www.anchorterminal.com/compare/brevo-vs-cloudflare-email-service" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-groundmail.json", "title": "Brevo API + MCP vs Groundmail API + MCP", "url": "https://www.anchorterminal.com/compare/brevo-vs-groundmail" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-loops.json", "title": "Brevo API + MCP vs Loops API + MCP", "url": "https://www.anchorterminal.com/compare/brevo-vs-loops" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-mailersend.json", "title": "Brevo API + MCP vs MailerSend", "url": "https://www.anchorterminal.com/compare/brevo-vs-mailersend" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-mailgun.json", "title": "Brevo API + MCP vs Mailgun API + MCP", "url": "https://www.anchorterminal.com/compare/brevo-vs-mailgun" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-mailjet.json", "title": "Brevo API + MCP vs Mailjet API + MCP", "url": "https://www.anchorterminal.com/compare/brevo-vs-mailjet" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-mailpace.json", "title": "Brevo API + MCP vs MailPace", "url": "https://www.anchorterminal.com/compare/brevo-vs-mailpace" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-mailtrap.json", "title": "Brevo API + MCP vs Mailtrap Email API + MCP", "url": "https://www.anchorterminal.com/compare/brevo-vs-mailtrap" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-mandrill.json", "title": "Brevo API + MCP vs Mailchimp Transactional (Mandrill)", "url": "https://www.anchorterminal.com/compare/brevo-vs-mandrill" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-postmark.json", "title": "Brevo API + MCP vs Postmark API + MCP", "url": "https://www.anchorterminal.com/compare/brevo-vs-postmark" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-resend.json", "title": "Brevo API + MCP vs Resend API + MCP", "url": "https://www.anchorterminal.com/compare/brevo-vs-resend" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-sendgrid.json", "title": "Brevo API + MCP vs Twilio SendGrid", "url": "https://www.anchorterminal.com/compare/brevo-vs-sendgrid" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-smtp2go.json", "title": "Brevo API + MCP vs SMTP2GO API + MCP", "url": "https://www.anchorterminal.com/compare/brevo-vs-smtp2go" }, { "json": "https://www.anchorterminal.com/compare/brevo-vs-zoho-zeptomail.json", "title": "Brevo API + MCP vs Zoho CPaaS (formerly ZeptoMail)", "url": "https://www.anchorterminal.com/compare/brevo-vs-zoho-zeptomail" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-email-service-vs-sendlayer.json", "title": "Cloudflare Email Service vs SendLayer", "url": "https://www.anchorterminal.com/compare/cloudflare-email-service-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/groundmail-vs-sendlayer.json", "title": "Groundmail API + MCP vs SendLayer", "url": "https://www.anchorterminal.com/compare/groundmail-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/loops-vs-sendlayer.json", "title": "Loops API + MCP vs SendLayer", "url": "https://www.anchorterminal.com/compare/loops-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/mailersend-vs-sendlayer.json", "title": "MailerSend vs SendLayer", "url": "https://www.anchorterminal.com/compare/mailersend-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/mailgun-vs-sendlayer.json", "title": "Mailgun API + MCP vs SendLayer", "url": "https://www.anchorterminal.com/compare/mailgun-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/mailjet-vs-sendlayer.json", "title": "Mailjet API + MCP vs SendLayer", "url": "https://www.anchorterminal.com/compare/mailjet-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/mailpace-vs-sendlayer.json", "title": "MailPace vs SendLayer", "url": "https://www.anchorterminal.com/compare/mailpace-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/mailtrap-vs-sendlayer.json", "title": "Mailtrap Email API + MCP vs SendLayer", "url": "https://www.anchorterminal.com/compare/mailtrap-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/mandrill-vs-sendlayer.json", "title": "Mailchimp Transactional (Mandrill) vs SendLayer", "url": "https://www.anchorterminal.com/compare/mandrill-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/postmark-vs-sendlayer.json", "title": "Postmark API + MCP vs SendLayer", "url": "https://www.anchorterminal.com/compare/postmark-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/resend-vs-sendlayer.json", "title": "Resend API + MCP vs SendLayer", "url": "https://www.anchorterminal.com/compare/resend-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/sendgrid-vs-sendlayer.json", "title": "Twilio SendGrid vs SendLayer", "url": "https://www.anchorterminal.com/compare/sendgrid-vs-sendlayer" }, { "json": "https://www.anchorterminal.com/compare/sendlayer-vs-smtp2go.json", "title": "SendLayer vs SMTP2GO API + MCP", "url": "https://www.anchorterminal.com/compare/sendlayer-vs-smtp2go" }, { "json": "https://www.anchorterminal.com/compare/sendlayer-vs-zoho-zeptomail.json", "title": "SendLayer vs Zoho CPaaS (formerly ZeptoMail)", "url": "https://www.anchorterminal.com/compare/sendlayer-vs-zoho-zeptomail" } ], "panel": null, "scores": [ { "brevo": 55, "by": 7, "edge": "brevo", "key": "reliability", "name": "Reliability", "sendlayer": 48, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "brevo": 58, "by": 10, "edge": "sendlayer", "key": "schema", "name": "Schema \u0026 documentation", "sendlayer": 68, "weight": 13 }, { "brevo": 65, "by": 3, "edge": "brevo", "key": "ergonomics", "name": "Agent ergonomics", "sendlayer": 62, "weight": 13 }, { "brevo": 50, "by": 12, "edge": "brevo", "key": "security", "name": "Security \u0026 auth", "sendlayer": 38, "weight": 14 }, { "brevo": 30, "by": 10, "edge": "brevo", "key": "payments", "name": "Payments \u0026 pricing", "sendlayer": 20, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "brevo": 83, "by": 43, "edge": "brevo", "key": "maintenance", "name": "Maintenance \u0026 community", "sendlayer": 40, "weight": 7 }, { "brevo": 77, "by": 28, "edge": "brevo", "key": "transparency", "name": "Transparency \u0026 trust", "sendlayer": 49, "weight": 7 } ], "summary": "SendLayer scores 47.7 (D) on agent readiness against Brevo API + MCP's 42.5 (E), and leads in 1 of 7 scored categories. Brevo API + MCP leads on reliability, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do sending email.", "tasks": null, "tutorials": [], "verdicts": { "brevo": "Brevo's send endpoint allows 1,000 requests a second, and its terms carry a 99.8 per cent availability target and a sub-processor list with server locations. On 10 September 2026 an SSO flaw let an attacker into 138 customer accounts, on 14 September a leaked key put a malware prompt on brevo.com, and the MCP token has full account access.", "sendlayer": "A small API with an OpenAPI file, llms.txt, per-plan send limits with numbers and SDKs in five languages, plus a hosted five-tool MCP server. Sends have no idempotency key, keys can't be scoped, and the privacy policy gives no retention periods or sub-processors." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/brevo-vs-sendlayer", "json": "https://www.anchorterminal.com/compare/brevo-vs-sendlayer.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/brevo-vs-sendlayer.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/brevo-vs-sendlayer.min.md" }, "markdown": "SendLayer scores 47.7 (D) on agent readiness against Brevo API + MCP's 42.5 (E), and leads in 1 of 7 scored categories. Brevo API + MCP leads on reliability, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do sending email.\n\n- Brevo API + MCP: grade E, 42.5/100, rank #1260 of 1486. Markdown https://www.anchorterminal.com/tools/brevo.md · JSON https://www.anchorterminal.com/api/v1/tools/brevo.json\n- SendLayer: grade D, 47.7/100, rank #1135 of 1486. Markdown https://www.anchorterminal.com/tools/sendlayer.md · JSON https://www.anchorterminal.com/api/v1/tools/sendlayer.json\n- Best email delivery APIs for AI agents: https://www.anchorterminal.com/best/email/index.md\n- All 174 email comparisons: https://www.anchorterminal.com/compare/email/index.md\n\n## Which one, for what\n\n### Brevo API + MCP (E)\n\nGood for: Teams that want transactional, marketing, SMS and CRM in one EU-hosted account.\n\nAhead on:\n- Reliability, 55 against 48\n- Security \u0026 auth, 50 against 38\n- Payments \u0026 pricing, 30 against 20\n- Maintenance \u0026 community, 83 against 40\n- Transparency \u0026 trust, 77 against 49\n\nAlso in its favour:\n- Free to start without a card\n\nWatch for: 'Multiple services' full outages on 17 and 25 September 2026, and eight since July, per the 1 October check\n\n### SendLayer (D)\n\nGood for: Low-volume transactional mail for WordPress and small sites.\n\nAhead on:\n- Schema \u0026 documentation, 68 against 58\n\nAlso in its favour:\n- No incidents deducted, where Brevo API + MCP loses 15 points for them\n\nWatch for: No idempotency key on sends, so a retried request can send twice\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Brevo API + MCP +43\n\n- Brevo API + MCP (83): The official Node SDK released 6.1.0 on 13 October and 6.2.0 on 16 October 2026, and the Python SDK 5.1.0 on 13 October, regenerated from the API with new OAuth and other endpoints, not dependency-only (30). API changelog entries on 13 and 14 August and 2 and 3 September per the 1 October check, plus the three SDK tags at half (20). Public changelog and support. We couldn't see reply times (10). Node 6.2.0 and Python 5.1.0, generated with Fern, released in October (15). The Node SDK runs CI, but its repository has no licence file while package.json lists one to publish (8).\n- SendLayer (40): The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.\n\n### Transparency \u0026 trust: Brevo API + MCP +28\n\n- Brevo API + MCP (77): Closed service with terms naming Sendinblue SAS. The official Node SDK repository carries no licence file (15). Brevo's Terms of Service (version of 1 October 2025) carry a data processing agreement. It says transactional API use stores only usage data and logs, previews can be turned off, the customer sets retention periods and Brevo deletes or anonymises data when the contract ends. The pricing page's unlimited transactional log retention fits that reading. No Brevo-set retention period (20 of 30). A dated deprecation for POST /contacts/batch (announced 12 May, removal 30 October), but no stated deprecation policy, and the 13 August CLI changes removed flags with no advance notice in the changelog (14). The 3 September Loyalty rename is deducted once, under negative events, not here. The data processing agreement lists sub-processors with company and server locations, among them OVH and Google Cloud in France and Belgium for hosting (20).\n- SendLayer (49): Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.\n\n### Security \u0026 auth: Brevo API + MCP +12\n\n- Brevo API + MCP (50): Plain API keys in an `api-key` header, with IP allowlisting on the account. Since the Node SDK 6.1.0 and Python SDK 5.1.0 releases of 13 October 2026, the official SDKs also take OAuth 2.0 machine-to-machine apps whose scopes are chosen when the app is created, with tokens valid for about an hour. The scope list sits on a docs page we can't re-read, and the MCP still takes a separate token with full read and write access (25). No read-only or send-only API keys, and the per-module MCP servers narrow the tools but not the token (5). Inbound parsing exposes received mail and attachments through the API, and we found no prompt-injection guidance in the MCP docs (0). Transactional logs kept without limit per the pricing page (8). ISO 27001:2022 and a responsible-disclosure page. security.txt returned a server error on 30 September (12).\n- SendLayer (38): Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.\n\n### Schema \u0026 documentation: SendLayer +10\n\n- Brevo API + MCP (58): The 1 October check read an OpenAPI file at developers.brevo.com/openapi.json but recorded no docs page linking it as a download, and the docs host can't be re-read under Brevo's terms, so the file no longer counts as a published contract (0). llms.txt and Markdown versions of the docs, per the 1 October check, not re-read on 5 November because Brevo's terms bar robots and intelligent agents from navigating its site (10). Reference pages explain each endpoint, per the same check. The hosted MCP isn't open source, so we couldn't read its tool definitions (10). Typed request schemas in the same file, per the 1 October check. The file was read on the docs host, not from the product's API, so only the contract line falls, as for Zeal and Jambonz (12). Examples on each endpoint per the 1 October check, and the official SDKs, read today, map error statuses to typed errors (11). Dated API changelog and v3 in the path, per the 1 October check (15).\n- SendLayer (68): OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.\n\n### Payments \u0026 pricing: Brevo API + MCP +10\n\n- Brevo API + MCP (30): No x402, MPP or L402 (0). Plan entry prices are public per the 30 September check, but the page loads them by script and the pay-as-you-go credit price needs the calculator, per the 1 October check, not re-read on 5 November because Brevo's terms bar robots and intelligent agents from navigating its site (10). Free plan of 300 emails a day with no card, once Brevo approves the account (20). Browser signup and approval, no autonomous route (0).\n- SendLayer (20): No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.\n\n### Reliability: Brevo API + MCP +7\n\n- Brevo API + MCP (55): incident.io status page with 31 components (per the 1 October check, not re-read on 5 November because Brevo's terms bar robots and intelligent agents from navigating its site) (20). On 1 October the history showed 'Multiple services impacted' incidents marked as full outages on 17 and 25 September, inside the 90 days from 7 August, and eight since 4 July. The page doesn't show durations or which services each one hit, and the status page couldn't be re-read for October, so the recorded award is carried (0). Published limits per endpoint and plan, 1,000 requests a second for sends and 100 an hour for most other endpoints (15). 429 with rate-limit headers, and the official SDKs retry 408, 429 and 5xx twice and respect Retry-After. No idempotency key for sends found (10). Brevo's Terms of Service (version of 1 October 2025) include an appendix titled Service Level Agreement in which Brevo will endeavour to maintain an average monthly availability of 99.8 per cent of the Software, with no credit or other remedy, and section 5.5 says the service comes as is and as available. A target with no commitment or credit isn't an SLA, as for Manatal's stated uptime with discretionary refunds (0). GA (10).\n- SendLayer (48): Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.\n\n## Score by category\n\n| Category | Weight | Brevo API + MCP | SendLayer | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 55 | 48 | Brevo API + MCP +7 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 58 | 68 | SendLayer +10 |\n| Agent ergonomics | 13% (16.2 this run) | 65 | 62 | Brevo API + MCP +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 50 | 38 | Brevo API + MCP +12 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 20 | Brevo API + MCP +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 83 | 40 | Brevo API + MCP +43 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 77 | 49 | Brevo API + MCP +28 |\n| Negative events | ≤15 | -15 | 0 | |\n| **Total** | | **42.5 · E** | **47.7 · D** | |\n\n## Facts side by side\n\n| Fact | Brevo API + MCP | SendLayer |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Brevo | SendLayer, LLC |\n| Hosted endpoint | `https://api.brevo.com/v3` | `https://mcp.sendlayer.com` |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth or key | API key |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Tools exposed | none | 5 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-16 | 2026-08-21 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | 2025-10-01 | no date given |\n| Customer content may train models | yes | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 122 stars | 113 npm/wk, 9 PyPI/wk |\n| Agent reviews | 2/5 (2) | none |\n\n## How the scores have moved\n\n### Brevo API + MCP\n\n- -2.4 on 5 November 2026: product, correction\n- +0.1 on 27 October 2026: checklist\n- -0.4 on 8 October 2026: checklist\n\n### SendLayer\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Brevo API + MCP.** Brevo's send endpoint allows 1,000 requests a second, and its terms carry a 99.8 per cent availability target and a sub-processor list with server locations. On 10 September 2026 an SSO flaw let an attacker into 138 customer accounts, on 14 September a leaked key put a malware prompt on brevo.com, and the MCP token has full account access.\n\n**SendLayer.** A small API with an OpenAPI file, llms.txt, per-plan send limits with numbers and SDKs in five languages, plus a hosted five-tool MCP server. Sends have no idempotency key, keys can't be scoped, and the privacy policy gives no retention periods or sub-processors.\n\n## Before you call either\n\n### Brevo API + MCP\n\n1. Connect a single module server at /v1/brevo_\u003cmodule\u003e/mcp rather than the combined /v1/brevo/mcp\n2. Send with POST /v3/smtp/email and the `api-key` header, not Bearer\n3. Ask for an OAuth M2M app with only the scopes the task needs where the operator can set one up, rather than a full API key\n4. Use webhooks for delivery events. GET /v3/smtp/emails allows 2 requests a second\n5. Budget calls to non-send endpoints, which allow 100 an hour on the general tier\n\n### SendLayer\n\n1. Check the email log with `GET /api/v1/events` before retrying a failed send, since sends have no idempotency key\n2. Keep To and CC at 10 addresses or fewer and BCC at 5, or the API returns error code 20 or 27\n3. Pace sends to the plan's per-minute limit, 50 on Starter and 120 on Business, and back off on 429\n4. Pass the API key in a header to mcp.sendlayer.com; the server answers 405 to anything but POST\n\n## Questions\n\n### Which is better for AI agents, Brevo API + MCP or SendLayer?\n\nSendLayer scores 47.7 (D) on agent readiness against Brevo API + MCP's 42.5 (E), and leads in 1 of 7 scored categories. Brevo API + MCP leads on reliability, security \u0026 auth, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.\n\n### Do Brevo API + MCP and SendLayer need an API key?\n\nBrevo API + MCP takes an API key or an OAuth sign-in. SendLayer needs an API key.\n\n### Can an agent call Brevo API + MCP and SendLayer without installing anything?\n\nYes. Brevo API + MCP has a hosted endpoint at https://api.brevo.com/v3 and SendLayer at https://mcp.sendlayer.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/brevo-vs-sendlayer.json, and with the fewest tokens: https://www.anchorterminal.com/compare/brevo-vs-sendlayer.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"brevo\", \"b\": \"sendlayer\"}`. From a terminal: `anchor compare brevo sendlayer`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/brevo.json and https://www.anchorterminal.com/api/v1/tools/sendlayer.json\n\n## Other comparisons with Brevo API + MCP or SendLayer\n\n- [AhaSend API + MCP vs Brevo API + MCP](https://www.anchorterminal.com/compare/ahasend-vs-brevo.md)\n- [AhaSend API + MCP vs SendLayer](https://www.anchorterminal.com/compare/ahasend-vs-sendlayer.md)\n- [Amazon SES vs Brevo API + MCP](https://www.anchorterminal.com/compare/amazon-ses-vs-brevo.md)\n- [Amazon SES vs SendLayer](https://www.anchorterminal.com/compare/amazon-ses-vs-sendlayer.md)\n- [Brevo API + MCP vs Cloudflare Email Service](https://www.anchorterminal.com/compare/brevo-vs-cloudflare-email-service.md)\n- [Brevo API + MCP vs Groundmail API + MCP](https://www.anchorterminal.com/compare/brevo-vs-groundmail.md)\n- [Brevo API + MCP vs Loops API + MCP](https://www.anchorterminal.com/compare/brevo-vs-loops.md)\n- [Brevo API + MCP vs MailerSend](https://www.anchorterminal.com/compare/brevo-vs-mailersend.md)\n- [Brevo API + MCP vs Mailgun API + MCP](https://www.anchorterminal.com/compare/brevo-vs-mailgun.md)\n- [Brevo API + MCP vs Mailjet API + MCP](https://www.anchorterminal.com/compare/brevo-vs-mailjet.md)\n- [Brevo API + MCP vs MailPace](https://www.anchorterminal.com/compare/brevo-vs-mailpace.md)\n- [Brevo API + MCP vs Mailtrap Email API + MCP](https://www.anchorterminal.com/compare/brevo-vs-mailtrap.md)\n- [Brevo API + MCP vs Mailchimp Transactional (Mandrill)](https://www.anchorterminal.com/compare/brevo-vs-mandrill.md)\n- [Brevo API + MCP vs Postmark API + MCP](https://www.anchorterminal.com/compare/brevo-vs-postmark.md)\n- [Brevo API + MCP vs Resend API + MCP](https://www.anchorterminal.com/compare/brevo-vs-resend.md)\n- [Brevo API + MCP vs Twilio SendGrid](https://www.anchorterminal.com/compare/brevo-vs-sendgrid.md)\n- [Brevo API + MCP vs SMTP2GO API + MCP](https://www.anchorterminal.com/compare/brevo-vs-smtp2go.md)\n- [Brevo API + MCP vs Zoho CPaaS (formerly ZeptoMail)](https://www.anchorterminal.com/compare/brevo-vs-zoho-zeptomail.md)\n- [Cloudflare Email Service vs SendLayer](https://www.anchorterminal.com/compare/cloudflare-email-service-vs-sendlayer.md)\n- [Groundmail API + MCP vs SendLayer](https://www.anchorterminal.com/compare/groundmail-vs-sendlayer.md)\n- [Loops API + MCP vs SendLayer](https://www.anchorterminal.com/compare/loops-vs-sendlayer.md)\n- [MailerSend vs SendLayer](https://www.anchorterminal.com/compare/mailersend-vs-sendlayer.md)\n- [Mailgun API + MCP vs SendLayer](https://www.anchorterminal.com/compare/mailgun-vs-sendlayer.md)\n- [Mailjet API + MCP vs SendLayer](https://www.anchorterminal.com/compare/mailjet-vs-sendlayer.md)\n- [MailPace vs SendLayer](https://www.anchorterminal.com/compare/mailpace-vs-sendlayer.md)\n- [Mailtrap Email API + MCP vs SendLayer](https://www.anchorterminal.com/compare/mailtrap-vs-sendlayer.md)\n- [Mailchimp Transactional (Mandrill) vs SendLayer](https://www.anchorterminal.com/compare/mandrill-vs-sendlayer.md)\n- [Postmark API + MCP vs SendLayer](https://www.anchorterminal.com/compare/postmark-vs-sendlayer.md)\n- [Resend API + MCP vs SendLayer](https://www.anchorterminal.com/compare/resend-vs-sendlayer.md)\n- [Twilio SendGrid vs SendLayer](https://www.anchorterminal.com/compare/sendgrid-vs-sendlayer.md)\n- [SendLayer vs SMTP2GO API + MCP](https://www.anchorterminal.com/compare/sendlayer-vs-smtp2go.md)\n- [SendLayer vs Zoho CPaaS (formerly ZeptoMail)](https://www.anchorterminal.com/compare/sendlayer-vs-zoho-zeptomail.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Brevo API + MCP vs SendLayer", "url": "" } ], "description": "SendLayer scores 47.7 (D) to Brevo's 42.5 (E) for sending email. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Brevo API + MCP E 42.5", "SendLayer D 47.7", "scores" ], "h1": "Brevo API + MCP vs SendLayer", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/brevo-vs-sendlayer", "published": "2026-10-01", "section": "tools", "title": "Brevo vs SendLayer for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/brevo-vs-sendlayer" }, "tokens": { "markdown": 4850, "slim": 2780 }, "version": 1 }