Clawpost vs Robotomail

Clawpost 2

The last commit was on 1 April 2026, 219 days before this check (0). No releases or commits in the 90 days from 8 August (0). Issue and pull request activity couldn't be read through GitHub's API that day (0, unchecked). Not in the official MCP registry and no published package (0). Dependencies such as agents ^0.0.74 and the MCP SDK ^1.12.1 date from early 2026, and there's no CI (2 of 10). Total 2.

Robotomail 77

The latest changelog entries are 16 October 2026 (bounce types on message.bounced) and 17 October 2026 (one-click unsubscribe headers) (30). Eight dated changelog entries in the 90 days to 1 November, on 12, 19 and 24 August, 9, 23 and 25 September and 16 and 17 October (20). A closed service with a public changelog and email support that aims to answer within one working day. We didn't test support or read the GitHub issue trackers (10 of 15). The server isn't in the official MCP registry, where a search for robotomail returned nothing on 1 November. The five SDKs are at v0.2.0 (25 September) but aren't on npm, PyPI, RubyGems or crates.io (10 of 15). The SDK repositories have CI workflows with pinned actions and a contract check against the OpenAPI file, and the CLI has one dependency. We didn't read the CI results (7 of 10).

Clawpost 8

Graded with the lines for self-hosted software, since each deployer runs their own Worker. No published package; it deploys from the repository with a Deploy to Cloudflare button, Bun and Wrangler, and states the Cloudflare products it needs (8 of 20). No CI workflow or test suite in the repository (0). Open issues couldn't be read, because GitHub's API refused our requests for its rate limit, so the line scores absent (0, unchecked). No tags, releases or changelog; package.json says 0.1.0 (0). Pre-1.0 (0). Total 8.

Robotomail 53

Graded as a hosted service, on the REST API. A public UptimeRobot page at stats.uptimerobot.com/5hwqjYveUl. Its monitors and history load by script from /api/ paths that the status host's robots.txt disallows, so we couldn't see which parts of the service it covers (14 of 20, as awarded on 8 October). The incident record is unread. The 8 October reading came from the same disallowed path and no longer counts, so the line takes the no-readable-history score (5, a limit of our reading, not a finding against Robotomail). Limits are published with numbers, 30 sends a minute per mailbox and 60 per account in the messages reference, daily and monthly caps per plan, 5 signups an hour per IP and 5 concurrent SSE streams (15). The error reference says every 429 carries Retry-After, the OpenAPI description says route-produced 429s don't, sends have no idempotency key, and the documented advice is to check sent mail before retrying (9 of 15). No SLA found on the pricing page or in the terms (0). The API is at /v1 with no beta label (10).

Clawpost 32

The README and SKILL.md say MIT, but no LICENSE file is committed (20 of 30). Self-hosted; the README says mail is stored in the deployer's D1 database with attachments in R2 and sent through Cloudflare Email Service or Resend. No retention or deletion guidance (15 of 30). No deprecation policy (0). No telemetry in the source read; the only outbound calls are to the configured mail provider, Cloudflare's API and the deployer's own webhooks (15 of 20). Total 50.

Robotomail 75

A closed service under published terms. The five SDKs are MIT. The CLI's npm record has no licence or repository field (17 of 30). The privacy policy and the terms agree on retention, with messages kept until deleted, mail server copies purged after 7 days and trial data removed within 24 hours to 7 days, and the policy says email content isn't read or used for advertising. No DPA is published and the policy gives its date as September 2026 without a day (20 of 30). The terms promise 30 days' notice before an endpoint or version is retired, with Deprecation and Sunset headers, and the changelog records the legacy free plan's retirement on 19 August after notice in July (18 of 20). The policy names Stripe, Resend and Cloudflare R2. It gives no locations and doesn't name where the mail server and database are hosted (9 of 20).

Clawpost 54

All 21 MCP tools take typed zod inputs, which the MCP SDK publishes as JSON Schema (25). SKILL.md and AGENTS.md give agent-readable setup in Markdown; no llms.txt (5 of 10). Descriptions are one line each, such as Send an email, with parameter descriptions but no when-not-to-use (8 of 20). Inputs are typed with defaults for limit and offset, but recipients are a comma-separated string and direction isn't an enum in the schema read (9 of 15). The README has request examples and a REST route table; error responses aren't documented (7 of 15). No versioning or changelog (0). Total 54.

Robotomail 90

OpenAPI 3.1 at /openapi.json with 40 operations on 27 paths, each with an operation ID (25). llms.txt, and a Markdown copy of the docs and site pages by adding .md or sending Accept: text/markdown. The pricing page's own .md URL answered 404 on 1 November and points to index.md#pricing (10). Operation descriptions state what each route does, which key type it needs and which gates apply, and llms.txt says when not to use the product. The MCP tool descriptions sit behind OAuth and were not read (15 of 20). Request schemas carry required fields, format: email and uuid, length limits, patterns and enums. The headers field on a send is a free object (13 of 15). An error reference and per-route error variants, with three inconsistencies we found, on Retry-After, on the SDK version (the docs say v0.1.0, the tags are v0.2.0) and on the annual discount (the pricing page says about 50 per cent off Starter and above, the limits page's annual prices are about 25 per cent off) (12 of 15). URL versioning at /v1 and a dated public changelog (15).

Clawpost 60

Free self-hosted software with nothing to buy from the author, which the rubric scores 20 + 20 + 20. Running it needs the deployer's own Cloudflare Workers Paid plan at $5 a month, which isn't Clawpost's charge. No payment protocol (0 of 40). Total 60.

Robotomail 35

No x402, MPP or L402 in the docs, llms.txt or the OpenAPI file (0 of 40). Four plan prices are public, Solo $5, Starter $19, Growth $79 and Scale $199 a month, with no per-unit price or overage (10 of 20). The Free plan needs no card and doesn't expire, but exchanges mail only with the owner's verified address, 10 each way a month, so it tests the loop without doing the job (15 of 20). POST /v1/signup returns an API key with no browser, and POST /v1/billing/upgrade returns a checkout link. The key does nothing until a person clicks the verification link, and a person pays at checkout (10 of 20).

Clawpost 42

One shared secret for REST and MCP, compared in constant time, with no scopes, expiry or per-client keys (10 of 30). Sender approval, drafts, and an optional allowlist of domains for routing changes limit what an agent can see and change; the key can still send to anyone (14 of 20). Mail from unapproved senders is hidden from all query tools by default, and list_pending returns metadata without bodies, documented as a prompt-injection guard (15). No log of API or tool calls beyond the stored messages (3 of 15). No security policy, advisories or disclosure route for this personal project (0). Total 42.

Robotomail 65

REST keys are revocable by API, stored as SHA-256 hashes, and can be limited to named mailboxes. The MCP server takes OAuth with PKCE, mail:read and mail:send scopes, 10-minute access tokens and per-app disconnect. Keys travel in the Authorization header only. A REST key can't be made read-only (27 of 30). An MCP grant with mail:read alone is read-only, and a mailbox can be paused. Sends go out at once, with no drafts or approval step (12 of 20). Inbound mail is untrusted content. A security guide tells developers to pass email as data, check recipients and require approval for sensitive actions, and says attachments aren't scanned. Nothing is filtered on the service side (11 of 15). The dashboard has a read-only Audit Feed of email activity and the API lists the last 20 delivery attempts per webhook. No log of API calls was found (8 of 15). security.txt is valid until 24 August 2027 and reports go to the support address. No bug bounty, SOC 2 or ISO 27001 statement found (7 of 20).