Dreamlit vs Mailchimp Marketing API

Dreamlit 74

OAuth to one workspace with four scopes, and project-scoped personal access tokens with chosen scopes, shown once (30). A read-only grant is possible, publishing needs its own scope, confirm_publish runs only after the user approves the prepared payload, and a dedicated least-privilege database user reads the customer's data (20). The docs warn that AI clients can be tricked by untrusted prompts and tell users to review edit, publish and unpublish calls (8 of 15). The security page lists access logs for database operations and for the platform, and analytics expose run rows; no customer-facing log of MCP calls was described (8 of 15). The security page claims penetration testing and a bug bounty programme without a link, SOC 2 is coming soon, no security.txt (404), and the MCP repository's SECURITY.md routes reports to support (8 of 20). Total 74.

Mailchimp Marketing API 46

API keys are named, several to an account, revocable, and bounded by the creating user's level. A key has full account access, and the docs say there is no read-only key and no per-endpoint limit. Keys made from 22 June 2026 expire after one year per the help centre. OAuth 2 uses the authorisation code grant with no scopes, and its tokens never expire. Credentials travel in a header, not the URL (20). No read-only mode. send-checklist, actions/test, actions/unschedule and actions/cancel-send exist, with no approval step before a send or a permanent contact delete (6). The API returns contact fields, conversation messages and survey answers, which are untrusted text, and no guidance on prompt injection was found (2). /authorized-apps lists the OAuth apps on an account and each response carries a request id. No API call log or audit log was found in the docs we read (4). A responsible disclosure programme with no rewards, a security.txt with a contact and no Expires field, SOC 2 reports, ISO 27001, regular penetration tests and optional two-factor sign-in. No public advisory feed found (14).

Dreamlit 51

Graded with the hosted lines. A Better Stack status page at status.dreamlit.ai with 90 days of history for the Web App and the Workflow Engine, but no component for the MCP server (16 of 20). The record shows 100% for the web app and 99.992% for the workflow engine over 90 days, about ten minutes, with no written incidents (25 of 30). No rate limits found in the MCP or pricing docs (0). No 429, retry or idempotency guidance found (0). Scale includes dedicated support with an SLA and Enterprise has custom SLAs, but no published availability commitment (0). The MCP server, introduced on 5 May 2026, carries no beta label (10). Total 51.

Mailchimp Marketing API 72

Graded on the hosted REST API with the hosted lines. status.mailchimp.com lists an API component for each of 21 data centres and keeps event history by month, re-read on 4 November (20). In the 90 days from 6 August 2026 the marketing events are campaign links returning 500 errors on 13 August, delayed audience updates on 11 September, cropped images disappearing in campaigns from 9 October, and access issues on some app pages "for some Mailchimp users" on 27 to 29 October. Each hit one function or some users, none names the API component, and November has none, so minor only (20). The loss of click tracking from 3 to 4 August ended before the window. The three Transactional delays belong to the Mailchimp Transactional listing. The docs give 10 simultaneous connections per user, a 120-second timeout and 500 pending batches, with no per-minute figure (12 of 15, partly met). 429 is documented with its cause. The official Python library's README says it retries 408, 409, 429 and 5xx with exponential backoff, two retries by default. No Retry-After header, idempotency key or safe-retry guidance for writes was found in the docs, so backoff alone (10). No SLA found (0). Version 3.0 is generally available, and the Audiences endpoints are beta (10). 20 + 20 + 12 + 10 + 0 + 10 = 72.

Dreamlit 59

The registry entry and the dreamlit-ai/dreamlit-mcp repository carry metadata only, so tool JSON Schemas are readable only inside a session; the docs give each tool's purpose and required scope (5 of 25). llms.txt, pricing.md and Markdown copies of docs pages (10). Tool descriptions say when to use each, such as edit_workflow_steps for exact edits without AI, and the publish pair's order (16 of 20). Parameter types aren't published beyond names such as includeEmailHtml and startNewChat (5 of 15). Example prompts and a troubleshooting section for each documented error state (10 of 15). A dated changelog; server version 0.1.0 in the registry (13 of 15). Total 59.

Mailchimp Marketing API 76

An OpenAPI 3.1.1 file with all 297 operations is public on the API host, and the docs site serves a 1.2 MB copy (25). llms.txt at each level of the docs and a Markdown copy of every page at the URL plus .md (10). Every operation has a description, averaging about 60 characters. They say what a call does and seldom when not to use it, and four agent skills cover consent, OAuth, webhooks and bulk jobs (10). The smaller file carries 498 enums and required fields on request bodies. Merge fields and event properties are free-form objects (12). The API's own file has examples throughout and a default error response on every operation, and the docs have an error glossary. The docs-site copy lists only 200 and 204 responses (12). The version is in the path and has been 3.0 since 2016. The public changelog's newest entry is 19 August 2025, so key expiry from 22 June 2026, webhook signing and the new client libraries are not in it, and the specification's version label is 0.1.0-dev (7).

Dreamlit 10

No x402, MPP or L402 (0). Plan prices with included emails are public in pricing.md, no per-email overage price (10 of 20). No free plan for new accounts (0). Signup, database connection and payment happen in the web app (0). Total 10.

Mailchimp Marketing API 25

No x402, MPP or L402 (0). Plan prices are public without a login, from $13 a month for Essentials, $20 for Standard and $350 for Premium with USD selected, rising with contacts through a selector. Nothing is priced per API call (10). The Free plan has 250 contacts and 500 sends a month with no time limit. We could not confirm that signup asks for no card, and the 14-day trial of a paid plan needs payment details, so 15 of 20. A person signs up in a browser and creates a key or approves OAuth (0).

Dreamlit 59

A closed service under terms that name Notika AI (d/b/a Dreamlit AI) (15 of 30). The privacy policy keeps workflow execution history and delivery events for up to a year, while the security docs say Dreamlit retains no copy of customer data and cleans up after processing, which don't agree (15 of 30). No deprecation policy or dated notices found (0). The privacy policy points to a current subprocessor list and SCCs in a DPA, and names the United States and other countries as locations (12 of 20). Total 42.

Mailchimp Marketing API 74

Closed service with published terms, an API Use Policy and a named contracting entity. The client libraries declare Apache-2.0 in package metadata (15). A data processing addendum effective 26 September 2024 covers deletion or return on termination without a stated period, and the Intuit Global Privacy Statement of 9 March 2026 is the privacy document. The terms let Mailchimp use inputs and outputs of its AI functions, customer data included, for machine learning, with a preference in account settings. No retention periods for marketing data were found (18). No deprecation policy was found. The API Use Policy says the APIs can change by a posting or an email. Dated notices exist, such as key expiry from 22 June 2026 in the help centre (8). A sub-processor list with locations is public and was last updated on 29 February 2024, and the security page places Mailchimp's own servers in United States data centres (14).

Dreamlit 80

The latest changelog entry is 12 October 2026, custom repeating schedules (30). Eight dated entries between 10 August and 12 October (20). Priority support on Pro, dedicated support on Scale and a public changelog (10 of 15). ai.dreamlit/mcp is in the official MCP registry under its domain namespace (15). The metadata repository has validate and publish workflows; there's no package to check (5 of 10). Total 80.

Mailchimp Marketing API 68

Release 1.0.3 of the TypeScript, Python and Go client libraries, the first tag in each, is dated 5 October 2026, 30 days before this check (30). The TypeScript library's 1.0.03 of 13 October changes only version strings and the lockfile, so it counts half and doesn't set recency. Dated releases in the 90 days from 6 August include the CLI's 0.0.212 and 0.0.213 and Swift 1.0.0 on 18 September, Java 1.0.0 and C# 1.0.0 and 1.0.1 on 21 September, and 1.0.3 across the libraries on 5 October (20). The API changelog has no entry in that time. A public changelog whose newest entry is 19 August 2025, an API help address, and a help centre article saying support is not trained for in-depth API questions. We saw no public issue replies (5 of 15). Nine official client libraries generated from the current specification, with the TypeScript package absent from npm on 8 October (8 of 15, partly met). Each repository has a workflow that compiles and tests, whose results we could not see, and release 1.0.3 removed the LICENSE and NOTICE files added on 18 September (5 of 10, partly met). 30 + 20 + 5 + 8 + 5 = 68.