Dreamlit vs Klaviyo API + MCP

Dreamlit 59

The registry entry and the dreamlit-ai/dreamlit-mcp repository carry metadata only, so tool JSON Schemas are readable only inside a session; the docs give each tool's purpose and required scope (5 of 25). llms.txt, pricing.md and Markdown copies of docs pages (10). Tool descriptions say when to use each, such as edit_workflow_steps for exact edits without AI, and the publish pair's order (16 of 20). Parameter types aren't published beyond names such as includeEmailHtml and startNewChat (5 of 15). Example prompts and a troubleshooting section for each documented error state (10 of 15). A dated changelog; server version 0.1.0 in the registry (13 of 15). Total 59.

Klaviyo API + MCP 87

OpenAPI 3.0.2 in github.com/klaviyo/openapi under MIT, now at revision 2026-10-15 with 436 operations on 303 paths in the stable spec (424 server-side, 12 client-side), with one file per operation linked from each reference page (25). www.klaviyo.com/llms.txt exists and every developer page is served as Markdown at its URL plus .md, though developers.klaviyo.com/llms.txt returns 404 (10). Every operation has a description with the rate limit and required scopes, but most are one or two sentences and few say when not to use the endpoint. The MCP tool table gives one line per tool (13). 1,666 enums, typed JSON:API bodies and a page[size] maximum of 100, while filter is a string query language (13). 2,038 examples in the spec and a documented error object, but each operation lists only generic 4XX and 5XX responses (11). Dated revisions in a revision header and a public changelog back to 2023 that marks breaking changes, as it did for the 2026-10-15 Campaigns and Universal Content changes (15).

Dreamlit 51

Graded with the hosted lines. A Better Stack status page at status.dreamlit.ai with 90 days of history for the Web App and the Workflow Engine, but no component for the MCP server (16 of 20). The record shows 100% for the web app and 99.992% for the workflow engine over 90 days, about ten minutes, with no written incidents (25 of 30). No rate limits found in the MCP or pricing docs (0). No 429, retry or idempotency guidance found (0). Scale includes dedicated support with an SLA and Enterprise has custom SLAs, but no published availability commitment (0). The MCP server, introduced on 5 May 2026, carries no beta label (10). Total 51.

Klaviyo API + MCP 77

Graded on the REST API at a.klaviyo.com, with the hosted MCP server where a line names MCP. Statuspage at status.klaviyo.com with an API component and incident history (20). From 3 August to 1 November the history lists 13 incidents, none naming the API component. Four are marked major and each hit one component or was a delay. Flows with time delays stopped progressing for some profiles from 3.25 pm to 11.26 pm US Eastern on 26 August. Flow processing was delayed, with immediate sends unaffected, from 1.01 pm to 5.51 pm on 17 October. Event webhooks were delayed for some customers from 5.11 pm on 22 October to 2.40 am on 23 October. Some campaigns were delayed from about 7.59 am to 11.45 am on 29 October. A login and page-loading incident marked critical (11.00 am to 12.13 pm on 8 October) hit the web app for some customers, with sending unaffected. Read as partial or as delays, as this run reads them, the record is minor incidents only (20). Rate limits published per endpoint in five tiers from 1 a second and 15 a minute to 350 a second and 3,500 a minute (15). 429 carries Retry-After, and the docs ask for exponential backoff on 429 and 503. Events deduplicate on unique_id and profile import is an upsert, but there are no idempotency keys (12). No SLA found (www.klaviyo.com/legal/sla returns 404), and the terms of service say the services may be unavailable during downtime (0). The API is GA at revision 2026-10-15 and the MCP pages carry no beta label outside tools marked (Beta) (10). 20+20+15+12+0+10 = 77.

Dreamlit 59

A closed service under terms that name Notika AI (d/b/a Dreamlit AI) (15 of 30). The privacy policy keeps workflow execution history and delivery events for up to a year, while the security docs say Dreamlit retains no copy of customer data and cleans up after processing, which don't agree (15 of 30). No deprecation policy or dated notices found (0). The privacy policy points to a current subprocessor list and SCCs in a DPA, and names the United States and other countries as locations (12 of 20). Total 42.

Klaviyo API + MCP 80

Closed service with published terms of service (updated 17 December 2025) and API terms (updated 20 July 2020). The OpenAPI repository and SDKs are MIT (15). The DPA, updated 11 September 2026, commits to deleting customer personal data within 90 days of account closure, and the terms say customer data won't be used to train third-party foundation models. The privacy notice loads only with JavaScript and we couldn't read it (22). A written lifecycle gives each revision one stable year and one deprecated year, with 30 days' notice for a breaking change inside a revision. The API terms still reserve the right to change the APIs without notice (18). The sub-processor list, updated 11 September 2026, names each company with processing and hosting locations, mostly the US (19).

Dreamlit 10

No x402, MPP or L402 (0). Plan prices with included emails are public in pricing.md, no per-email overage price (10 of 20). No free plan for new accounts (0). Signup, database connection and payment happen in the web app (0). Total 10.

Klaviyo API + MCP 25

No x402, MPP or L402 in the developer docs or the pricing page (0). Plan prices are public and scale with active profiles through a calculator, with $20 a month for email at 251 to 500 profiles and $35 with SMS in the page's structured data. Nothing is priced per API call (10). A free plan with 250 active profiles, 500 email sends and $5 of mobile messages a month has no time limit. The pricing page doesn't say whether signup needs a card, so 15 of 20. A person has to sign up in a browser and create a key or approve OAuth (0).

Dreamlit 67

16 tools, the 11 to 30 band; tools follow the granted scopes, so a read-only grant sees fewer (20 of 25). Analytics take filters, sorting and pagination, and brand styles paginate (18 of 20). The docs describe the errors an agent will meet, such as authorization required, choose a project and browser hand-off, without codes (12 of 20). Publishing is prepare then confirm, and tests don't publish; no idempotency or annotations documented (10 of 20). Empty scope requests default to the v1 scopes and get_status gives a first call; no SDK or REST route (7 of 15). Total 67.

Klaviyo API + MCP 78

Sparse fieldsets (fields[TYPE]), include and page[size] let a caller size REST responses. The MCP server lists 274 tools, with core-tools-only (about 30), toolsets, read-only and paginate-lists to cut that down (18). Cursor pagination with page[cursor], filter and sort across the APIs (20). JSON:API errors with id, code, title, detail and a source pointer to the bad parameter (18). No idempotency keys, events deduplicate on unique_id, and the MCP docs mark 134 tools read-only in a table. We couldn't read the tool annotations without an account (8). Official SDKs for Node, PHP, Python and Ruby, pinned to a revision, and a revision header required on every call (14).

Dreamlit 74

OAuth to one workspace with four scopes, and project-scoped personal access tokens with chosen scopes, shown once (30). A read-only grant is possible, publishing needs its own scope, confirm_publish runs only after the user approves the prepared payload, and a dedicated least-privilege database user reads the customer's data (20). The docs warn that AI clients can be tricked by untrusted prompts and tell users to review edit, publish and unpublish calls (8 of 15). The security page lists access logs for database operations and for the platform, and analytics expose run rows; no customer-facing log of MCP calls was described (8 of 15). The security page claims penetration testing and a bug bounty programme without a link, SOC 2 is coming soon, no security.txt (404), and the MCP repository's SECURITY.md routes reports to support (8 of 20). Total 74.

Klaviyo API + MCP 84

Private keys are created per application as read-only, full or custom with per-API scopes, can be deleted, and can't be edited after creation. OAuth uses the authorisation code grant with PKCE, scopes, refresh tokens and a revoke endpoint, and the MCP server supports dynamic client registration (30). Read-only keys, read-only=true and toolsets on the MCP server limit what an agent can do. Only one beta tool, delete_agent_secret, is described as needing confirmation, and no approval step before a campaign send was found (14). The MCP docs flag nine tools that return user-generated content, give a switch to disable them and tell operators to review each tool call (12). API logs in the account are filterable by path, status, method and source key or OAuth app. No audit log API was found (12). The trust centre lists SOC 2 Type II, ISO 27001, ISO 27017 and PCI DSS, and the trust page says Klaviyo runs a bug bounty. No public programme page or security.txt was found (16).