Dreamlit vs Iterable

Dreamlit 51

Graded with the hosted lines. A Better Stack status page at status.dreamlit.ai with 90 days of history for the Web App and the Workflow Engine, but no component for the MCP server (16 of 20). The record shows 100% for the web app and 99.992% for the workflow engine over 90 days, about ten minutes, with no written incidents (25 of 30). No rate limits found in the MCP or pricing docs (0). No 429, retry or idempotency guidance found (0). Scale includes dedicated support with an SLA and Enterprise has custom SLAs, but no published availability commitment (0). The MCP server, introduced on 5 May 2026, carries no beta label (10). Total 51.

Iterable 71

Graded on the REST API, with the hosted lines. Statuspage site at status.iterable.com, whose page lists global components such as Global API Success and per-cluster components such as User Updates (20). The 8 October incident reading came from the page's JSON API, which its robots.txt closes, so it is struck and the window was re-read from /history.atom on 4 November. The 90 days from 6 August hold four incidents, each partial by its own text, Twilio SMS drops for a subset of customers on 1 September, EU platform slowness and gateway errors on 10 September (about 9:25 to 11:13 EDT), timeouts on the user update endpoints on 22 September, and delayed sends for some SparkPost US customers on 28 October. The 16 July critical incident has left the window. Minor only (20, from 15). 53 of 159 operations state a numeric limit in the specification re-read on 4 November (15). Only 7 operations document 429, two of them with rateLimitReset in the body. No Retry-After header or idempotency key was found in the specification, and backoff guidance on the support centre couldn't be read (6, an earlier partial kept). No SLA was found in the Master Services Agreement (last updated 8 June 2026) or the product-specific terms (0). The REST API is generally available. The MCP server is beta (10). 20+20+15+6+0+10 = 71.

Dreamlit 74

OAuth to one workspace with four scopes, and project-scoped personal access tokens with chosen scopes, shown once (30). A read-only grant is possible, publishing needs its own scope, confirm_publish runs only after the user approves the prepared payload, and a dedicated least-privilege database user reads the customer's data (20). The docs warn that AI clients can be tricked by untrusted prompts and tell users to review edit, publish and unpublish calls (8 of 15). The security page lists access logs for database operations and for the platform, and analytics expose run rows; no customer-facing log of MCP calls was described (8 of 15). The security page claims penetration testing and a bug bounty programme without a link, SOC 2 is coming soon, no security.txt (404), and the MCP repository's SECURITY.md routes reports to support (8 of 20). Total 74.

Iterable 55

API keys come in five types and each operation lists the types it accepts. A read-only type works on 30 operations, and the key travels only in a header. Rotation and expiry are unchecked because the key guide couldn't be read (22). The read-only key type, and an MCP server that starts with PII, writes and sends all off and stores those settings per key. Neither surface has a confirmation step, and the README leaves review of each call to the person (16). Profiles, events and templates hold customer-written text. The README warns about irreversible actions but gives no injection guidance (3). No audit log or per-call record for the operator was found in the pages we could read (0). The responsible disclosure policy, re-read on 4 November, says Iterable responds 'usually one to three business days' and that there is no public bug bounty. No security.txt, SOC 2 Type 2, ISO 27001 and HIPAA on the trust centre, and CodeQL on the open repositories (14). 22+16+3+0+14 = 55.

Dreamlit 59

A closed service under terms that name Notika AI (d/b/a Dreamlit AI) (15 of 30). The privacy policy keeps workflow execution history and delivery events for up to a year, while the security docs say Dreamlit retains no copy of customer data and cleans up after processing, which don't agree (15 of 30). No deprecation policy or dated notices found (0). The privacy policy points to a current subprocessor list and SCCs in a DPA, and names the United States and other countries as locations (12 of 20). Total 42.

Iterable 70

Closed service with a published Master Services Agreement, and MIT licences on the MCP server and API client (18). The agreement deletes customer confidential information within 30 days of expiry and the privacy notice sets out retention by data type, but the notice is dated 14 July 2023 and no public DPA was found (18). No API deprecation policy was found. The website terms let Iterable change or discontinue the services at any time, and the specification marks some fields deprecated without dates (3). Sub-processor list updated August 2026 with processing locations, and US and EU data centres (18). The privacy notice still reads 'Last Updated: 07.14.23' and the sub-processor list 'August 2026' on 4 November. 18+18+3+18 = 57.

Dreamlit 67

16 tools, the 11 to 30 band; tools follow the granted scopes, so a read-only grant sees fewer (20 of 25). Analytics take filters, sorting and pagination, and brand styles paginate (18 of 20). The docs describe the errors an agent will meet, such as authorization required, choose a project and browser hand-off, without codes (12 of 20). Publishing is prepare then confirm, and tests don't publish; no idempotency or annotations documented (10 of 20). Empty scope requests default to the v1 scopes and get_status gives a first call; no SDK or REST route (7 of 15). Total 67.

Iterable 57

API list calls take page and pageSize, and the MCP server shows 31 of its 118 tools by default, with three flags that add the rest (15). nextPageUrl paging on campaigns, catalogues, journeys and templates, state and sort filters on campaigns, and limit on events, but list member reads are capped at 5 requests a minute (14). Errors carry a code from a 26-value enum, a message and params, with reset seconds on some 429s (15). No idempotency keys. User updates merge and catalogue PUT replaces, so those retries are safe, but sends aren't. The MCP tools have no readOnlyHint or destructiveHint, and an issue asking for them has been open since 4 June 2026 (6). Most calls need few parameters. The one server-side SDK is the TypeScript client, which its README calls experimental (7). Per the 8 October check, and the MCP repository has no commit since 1.9.0 on 30 September. 15+14+15+6+7 = 57.

Dreamlit 10

No x402, MPP or L402 (0). Plan prices with included emails are public in pricing.md, no per-email overage price (10 of 20). No free plan for new accounts (0). Signup, database connection and payment happen in the web app (0). Total 10.

Iterable 0

No x402, MPP or L402 (0). No public prices. iterable.com/pricing redirects to the home page, which asks for a demo (0). No free tier or trial was found (0). A person has to buy through sales and create a key in the app (0). 0+0+0+0 = 0.

Dreamlit 59

The registry entry and the dreamlit-ai/dreamlit-mcp repository carry metadata only, so tool JSON Schemas are readable only inside a session; the docs give each tool's purpose and required scope (5 of 25). llms.txt, pricing.md and Markdown copies of docs pages (10). Tool descriptions say when to use each, such as edit_workflow_steps for exact edits without AI, and the publish pair's order (16 of 20). Parameter types aren't published beyond names such as includeEmailHtml and startNewChat (5 of 15). Example prompts and a troubleshooting section for each documented error state (10 of 15). A dated changelog; server version 0.1.0 in the registry (13 of 15). Total 59.

Iterable 65

Public Swagger 2.0 specification at api.iterable.com/api-docs, which the API explorer page links as 'Raw API specification (JSON)', with 159 operations and 209 schemas on 4 November (25). iterable.com/llms.txt exists but describes the company and links the documentation without carrying it, and no Markdown docs were found (4). All 159 operations have a summary and 147 a description, several with cautions such as the 60-second wait after a user update and the suppression list rule on campaign creation (14). Required fields are marked and there are 35 enums, while dataFields and template content stay free-form objects (11). The specification has 21 examples. 400 and 401 appear on nearly every operation, and the error body has a 26-value code enum (8). The specification is labelled version 1.8 with no version in the path. Release notes sit on the support centre, which answered a Cloudflare check again on 4 November, so only 3 of 15 here (an earlier partial kept). The specification was re-read on 4 November, and the description, enum and example counts are per the 8 October check. 25+4+14+11+8+3 = 65.