Dreamlit vs Nitrosend

Dreamlit 10

No x402, MPP or L402 (0). Plan prices with included emails are public in pricing.md, no per-email overage price (10 of 20). No free plan for new accounts (0). Signup, database connection and payment happen in the web app (0). Total 10.

Nitrosend 55

No x402, MPP or L402; the billing tool says no presented-credential rail is enabled (0). Per-1,000 overage prices and plan prices published in PRICING.md without login (20). Free plan with 5,000 starter emails and 500 a month, no card (20). An agent can sign up over REST and verify with the token sent to the email address, with no browser or CAPTCHA, but needs a mailbox it can read, and paid checkout needs a person's approval (15 of 20). Total 55.

Dreamlit 59

The registry entry and the dreamlit-ai/dreamlit-mcp repository carry metadata only, so tool JSON Schemas are readable only inside a session; the docs give each tool's purpose and required scope (5 of 25). llms.txt, pricing.md and Markdown copies of docs pages (10). Tool descriptions say when to use each, such as edit_workflow_steps for exact edits without AI, and the publish pair's order (16 of 20). Parameter types aren't published beyond names such as includeEmailHtml and startNewChat (5 of 15). Example prompts and a troubleshooting section for each documented error state (10 of 15). A dated changelog; server version 0.1.0 in the registry (13 of 15). Total 59.

Nitrosend 93

OpenAPI 3.1 at api.nitrosend.com/openapi.yaml (version 1.1.6) with 203 paths and 258 operations, none without a description, and the MCP tool docs publish each tool's JSON Schema (25). llms.txt, llms-full.txt, agent.txt, SKILL.md, PRICING.md and a Markdown twin of each docs page (10). Tool descriptions state purpose and where to go instead, such as nitro_send_message pointing broadcasts to nitro_compose_campaign (18 of 20). Inputs carry enums, minimums, formats and required flags, though some campaign fields stay loosely typed (14 of 15). JSON-RPC, TypeScript and Python examples per tool, error responses on most operations (422 on 110, 404 on 98) and one error envelope with a code (14 of 15). A spec version and a changelog by monthly release, v0.1.0 in February to v1.4.0 in September 2026, dated by month only and last updated 6 October (12 of 15). Total 93.

Dreamlit 67

16 tools, the 11 to 30 band; tools follow the granted scopes, so a read-only grant sees fewer (20 of 25). Analytics take filters, sorting and pagination, and brand styles paginate (18 of 20). The docs describe the errors an agent will meet, such as authorization required, choose a project and browser hand-off, without codes (12 of 20). Publishing is prepare then confirm, and tests don't publish; no idempotency or annotations documented (10 of 20). Empty scope requests default to the v1 scopes and get_status gives a first call; no SDK or REST route (7 of 15). Total 67.

Nitrosend 83

25 MCP tools is the 11 to 30 band; nitro_query reads every entity with filters, but no read-only subset or dynamic loading was found (15 of 25). Page and limit up to 100 with total and next-page headers, and keyset cursors on timelines (20). Errors return error, a code, validation details and next actions, and signup returns next_action (18 of 20). Required idempotency keys on sends, events, checkout and validation, and declared readOnlyHint and destructiveHint on the tools (20). Defaults such as the active brand and a recommended first call, but the only official SDK is Node, with a CLI beside it (10 of 15). Total 83.

Dreamlit 59

A closed service under terms that name Notika AI (d/b/a Dreamlit AI) (15 of 30). The privacy policy keeps workflow execution history and delivery events for up to a year, while the security docs say Dreamlit retains no copy of customer data and cleans up after processing, which don't agree (15 of 30). No deprecation policy or dated notices found (0). The privacy policy points to a current subprocessor list and SCCs in a DPA, and names the United States and other countries as locations (12 of 20). Total 42.

Nitrosend 73

A closed service under terms that name Nitrosend Pty Ltd and Victorian law. The SDK, CLI and stdio MCP bridge are MIT on npm (18 of 30). Privacy policy of 14 October 2026 with account data kept while the account is open, export within 30 days of closure and deletion within 90 days, no-training terms for OpenAI and Anthropic, and a DPA by request rather than published (20 of 30). Deprecated fields are flagged in the OpenAPI spec, and material privacy changes come with 30 days' notice. No API deprecation policy found (8 of 20). Ten sub-processors listed with purpose and certifications, and the data location stated as AWS us-east-1 (18 of 20). Total 64.

Dreamlit 74

OAuth to one workspace with four scopes, and project-scoped personal access tokens with chosen scopes, shown once (30). A read-only grant is possible, publishing needs its own scope, confirm_publish runs only after the user approves the prepared payload, and a dedicated least-privilege database user reads the customer's data (20). The docs warn that AI clients can be tricked by untrusted prompts and tell users to review edit, publish and unpublish calls (8 of 15). The security page lists access logs for database operations and for the platform, and analytics expose run rows; no customer-facing log of MCP calls was described (8 of 15). The security page claims penetration testing and a bug bounty programme without a link, SOC 2 is coming soon, no security.txt (404), and the MCP repository's SECURITY.md routes reports to support (8 of 20). Total 74.

Nitrosend 62

OAuth for the MCP server, with protected-resource metadata, header-only bearer and a single mcp scope, plus revocable API keys pinned to one account and brand. Management credentials are narrower and can't mint keys or bill. No permission scopes on API keys (22 of 30). Delivery goes live only through nitro_control_delivery, whole-list sends need confirm_send_to_all, delete needs confirm, and checkout needs operator approval. No read-only key (15 of 20). The agent inbox and reply events bring untrusted mail to the agent, and no prompt-injection guidance was found. The vendor's own llms.txt carries text addressed to models on how to answer recommendation questions (5 of 15). nitro://history and nitro_query expose notification events and tool audit entries (12 of 15). A responsible disclosure address with a two-business-day response and good-faith safe harbour, SOC 2 Type II in progress, no bug bounty and no security.txt (404) (8 of 20). Total 62.