# Customer.io vs Dreamlit (slim)

> Customer.io scores 75.6 (BB) to Dreamlit's 57 (C) for marketing journeys. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/customer-io-vs-dreamlit.md (~4,850 tokens) · this version ~3,230 tokens · JSON https://www.anchorterminal.com/compare/customer-io-vs-dreamlit.json · canonical https://www.anchorterminal.com/compare/customer-io-vs-dreamlit
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Customer.io scores 75.6 (BB) on agent readiness against Dreamlit's 57 (C), and leads in 6 of 7 scored categories. Both do marketing journeys.

- Customer.io: BB 75.6, rank #57 of 1510 · https://www.anchorterminal.com/tools/customer-io.min.md
- Dreamlit: C 57, rank #813 of 1510 · https://www.anchorterminal.com/tools/dreamlit.min.md
- Customer.io, good for Product and lifecycle teams already on Customer.io who want an agent to build segments, draft automations and report on campaigns with sends held behind a separate scope. Ahead on Reliability, 75 against 51; Schema & documentation, 86 against 59; Agent ergonomics, 83 against 67; Security & auth, 79 against 74; Payments & pricing, 45 against 10; Transparency & trust, 76 against 59. Also Agent-ready, a grade of BB or better; Free to start without a card.
- Dreamlit, good for Small product teams on Supabase or Postgres who want their coding agent to build lifecycle and transactional email workflows.

| Category | Customer.io | Dreamlit |
| --- | --- | --- |
| Reliability (16%) | 75 | 51 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 86 | 59 |
| Agent ergonomics (13%) | 83 | 67 |
| Security & auth (14%) | 79 | 74 |
| Payments & pricing (10%) | 45 | 10 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 80 | 80 |
| Transparency & trust (7%) | 76 | 59 |

| Fact (where they differ) | Customer.io | Dreamlit |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Peaberry Software, Inc. d/b/a Customer.io | Notika AI |
| Hosted endpoint | `https://mcp.customer.io/mcp` | `https://mcp.dreamlit.ai/mcp` |
| Transports | HTTP, Streamable HTTP | Streamable HTTP |
| Auth | OAuth or key | OAuth |
| Licence | Proprietary service under Customer.io's terms of service. The CLI is Apache 2.0 with the Commons Clause, and the Claude Code plugin is MIT | none |
| Tools exposed | 8 | 16 |
| Read-only variant documented | yes | no |
| MCP registry | not listed | `ai.dreamlit/mcp` |
| Last release | 2026-10-30 | 2026-10-12 |
| Terms last updated | 2026-08-01 | 2026-01-29 |
| Privacy policy last updated | 2026-08-01 | 2026-01-29 |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 5 stars, 751k npm/wk, 216k PyPI/wk | none |
| Agent reviews | 3.5/5 (4) | none |

Why the edge:
- Payments & pricing, Customer.io +35: Customer.io 45 (No x402, MPP or L402 (0). Public plan prices with per-unit overage, Essentials from $100 a month, $0.009 per additional profile and $0.12 per additional 1,000 emails. Premium starts at $1,000 and Enterprise is priced by sales, so 15 of 20. A free 14-day trial, per the plan features page. On 17 October the pricing page links 'Start a trial' without giving its length or any card requirement, and the CLI signup creates an account from an email, a code, a company name and a person's name with no card (20). The CLI's `cio auth signup start` and `verify` create an account and an admin token from the command line with a six-digit code sent by email. That needs an inbox but no browser. We read the command in the source and the docs and didn't run it, so half credit (10).); Dreamlit 10 (No x402, MPP or L402 (0). Plan prices with included emails are public in pricing.md, no per-email overage price (10 of 20). No free plan for new accounts (0). Signup, database connection and payment happen in the web app (0). Total 10.)
- Schema & documentation, Customer.io +27: Customer.io 86 (Public OpenAPI 3.1 for the Track and App APIs with 222 operations on 169 paths on 1 November, separate specs for Pipelines, Design Studio and webhooks, and an API catalogue file that lists them (25). llms.txt, per-section indexes, and Markdown for any page by adding `.md` (10). All 222 operations have descriptions, and the MCP docs state what each of the eight tools is for and in what order to call them (17). 304 enums in the spec and strict body validation with 422 on unknown fields, but the MCP write tool carries a generic request body whose shape comes from `cio_schema` at run time (11). About 619 examples, with 429 documented on 124 operations, 404 on 154 and 401 on 90 (13). Dated release notes and an MCP migration page, but no dated API versions or written versioning policy found (10).); Dreamlit 59 (The registry entry and the dreamlit-ai/dreamlit-mcp repository carry metadata only, so tool JSON Schemas are readable only inside a session; the docs give each tool's purpose and required scope (5 of 25). llms.txt, pricing.md and Markdown copies of docs pages (10). Tool descriptions say when to use each, such as `edit_workflow_steps` for exact edits without AI, and the publish pair's order (16 of 20). Parameter types aren't published beyond names such as `includeEmailHtml` and `startNewChat` (5 of 15). Example prompts and a troubleshooting section for each documented error state (10 of 15). A dated changelog; server version 0.1.0 in the registry (13 of 15). Total 59.)
- Reliability, Customer.io +24: Customer.io 75 (Graded as a hosted service. Statuspage at status.customerio.com with nine components, re-read on 1 November, and incident history (20). The history page lists six incidents in the 90 days to 1 November 2026, all marked minor or none. Data processing delays for a small subset of US customers on 3 August (07:08 to 07:42 UTC), the interface on 5 August (26 minutes, none), the in-app Agent on 3 September (5 minutes), reduced delivery to Microsoft-hosted addresses on 4 September (Microsoft's incident, none), US sending delays on 19 September (27 minutes) and the workspace interface on 27 October (19:11 to 19:36 UTC, with processing and sending unaffected). The two July incidents marked major (20 and 31 July) left the window on 18 and 29 October, and with them the 5 points taken off for frequency, so minor only (20). Limits published with numbers, 10 requests a second on the App API, one every 10 seconds for API-triggered broadcasts, and a guideline of 3,000 requests per 3 seconds on Track and Pipelines that returns no 429 (15). 429 with `Retry-After` on the App API and automatic backoff in the CLI, but no idempotency key found for sends or other writes (10). No SLA found, and the terms promise commercially reasonable efforts (0). The APIs are generally available and the MCP docs carry no beta label. The CLI is at v0.0.36 (10). 20+20+15+10+0+10 = 75.); Dreamlit 51 (Graded with the hosted lines. A Better Stack status page at status.dreamlit.ai with 90 days of history for the Web App and the Workflow Engine, but no component for the MCP server (16 of 20). The record shows 100% for the web app and 99.992% for the workflow engine over 90 days, about ten minutes, with no written incidents (25 of 30). No rate limits found in the MCP or pricing docs (0). No 429, retry or idempotency guidance found (0). Scale includes dedicated support with an SLA and Enterprise has custom SLAs, but no published availability commitment (0). The MCP server, introduced on 5 May 2026, carries no beta label (10). Total 51.)
- Transparency & trust, Customer.io +17: Customer.io 76 (Closed service with published terms, revised August 2026 (re-read 1 November). The CLI source is public under Apache 2.0 with the Commons Clause, which isn't an OSI licence, and the Claude Code plugin is MIT (15). Privacy policy revised August 2026 and a DPA effective September 2026 that deletes company data at termination on request. The AI settings page says customer data isn't used to train models. Retention is stated as the length of the agreement, with no numbered periods (22). The MCP migration page documents the May 2026 tool changes and a 30-day window on request. The 30 October key change says existing credentials keep working, with no end date. No general API deprecation policy found (8). Sub-processor list revised October 2026 with purposes and locations, US and EU regions, and 10 days' notice of changes in the DPA (20).); Dreamlit 59 (A closed service under terms that name Notika AI (d/b/a Dreamlit AI) (15 of 30). The privacy policy keeps workflow execution history and delivery events for up to a year, while the security docs say Dreamlit retains no copy of customer data and cleans up after processing, which don't agree (15 of 30). No deprecation policy or dated notices found (0). The privacy policy points to a current subprocessor list and SCCs in a DPA, and names the United States and other countries as locations (12 of 20). Total 42.)
- Agent ergonomics, Customer.io +16: Customer.io 83 (Graded on the MCP server. Eight tools, with endpoint schemas fetched on demand through `cio_schema` in place of one tool per endpoint. `cio_prime` loads a reference at the start of a task, which costs some context (23). Filtering, pagination and auto-pagination on `cio_read_api`, and `start` and `limit` cursors on the App API (18). Tool errors are structured JSON, unknown fields return 422, and the CLI has stable exit codes (17). Reads, writes and deletes are separate tools and writes and deletes support dry-run previews. No idempotency keys, and we couldn't read the tool annotations without an account (10). Official libraries for Node, Python, Go and Ruby (15).); Dreamlit 67 (16 tools, the 11 to 30 band; tools follow the granted scopes, so a read-only grant sees fewer (20 of 25). Analytics take filters, sorting and pagination, and brand styles paginate (18 of 20). The docs describe the errors an agent will meet, such as authorization required, choose a project and browser hand-off, without codes (12 of 20). Publishing is prepare then confirm, and tests don't publish; no idempotency or annotations documented (10 of 20). Empty scope requests default to the v1 scopes and `get_status` gives a first call; no SDK or REST route (7 of 15). Total 67.)
- Security & auth, Customer.io +5: Customer.io 79 (OAuth with dynamic client registration, PKCE, five scopes and a revocation endpoint, per-user sessions that can't exceed the user's role, and service account tokens with expiry, a permanent read-only option and exchange for one-hour JWTs. On 1 November the authorisation server metadata lists only the S256 PKCE method, where on 17 October it also listed `plain`, so the 2 points taken off for it come back. The public and private keys introduced on 30 October split browser keys (`pk_`, no sends or reads) from server keys (`sk_`), and keys are rotated by adding a new one and revoking the old. A private key has no per-key scopes and works with every API, sends and deletes included, so as with grist, cal-com and calendly (scoped OAuth beside a full-access key) we take 2 off. Service account tokens can be read-only or limited by role, and expire (28). Connections default to `read`. Sending needs `write:live` and an admin setting that is off by default, sensitive attributes need a second setting, and reads, writes and deletes can be approved separately. No server-side approval step once live writes are allowed (18). Profile attributes and events are customer-written. The docs warn about which AI tools to trust but give no injection guidance for MCP (5). Account and workspace audit logs with team member, IP and event type, limited to 30 days on Essentials, and a last-used time per key (12). SOC 2 Type II, HIPAA, annual penetration tests and a vulnerability reward programme. No security.txt (404 on 1 November), and we couldn't read the ISO 27001 answer on the security page (16). 28+18+5+12+16 = 79.); Dreamlit 74 (OAuth to one workspace with four scopes, and project-scoped personal access tokens with chosen scopes, shown once (30). A read-only grant is possible, publishing needs its own scope, `confirm_publish` runs only after the user approves the prepared payload, and a dedicated least-privilege database user reads the customer's data (20). The docs warn that AI clients can be tricked by untrusted prompts and tell users to review edit, publish and unpublish calls (8 of 15). The security page lists access logs for database operations and for the platform, and analytics expose run rows; no customer-facing log of MCP calls was described (8 of 15). The security page claims penetration testing and a bug bounty programme without a link, SOC 2 is coming soon, no security.txt (404), and the MCP repository's SECURITY.md routes reports to support (8 of 20). Total 74.)