Dropcontact API + MCP vs ZeroBounce

Dropcontact API + MCP 15

No changelog. The newest dated API change found is the API_ERROR option, on by default for accounts created since 1 June 2026, which answers 400 when every record in a request has an error. That is between 90 and 180 days ago (10). The rebuilt docs carry no dated entries, so none fall in the 90 days from 6 August (0). Email support on every plan and no public changelog (5 of 15). No official SDKs and no registry entry we could read (0). No packages to judge (0, an in-between 3 with nothing behind it before). 10 + 0 + 5 + 0 + 0 = 15.

ZeroBounce 70

Closed service. The JavaScript SDK 3.0.0 was published on 25 October 2026 (30). No API changelog; the dated changes found in 90 days are that release and status-page notices, fewer than three releases (10 of 20). Support by email and 24/7 chat per the docs, a public status page; replies not tested (10 of 15). Official SDKs in many languages and an MCP server (15). Package health not checked (5 of 10). 30+10+10+15+5 = 70.

Dropcontact API + MCP 85

Atlassian Statuspage at status.dropcontact.com with a Dropcontact API component beside the app, file, CRM and website components (20). Its Atom feed lists two incidents in all, slower responses on 29 and 30 October 2025 and on 7 and 8 March 2026, and none since, so the 90 days from 6 August 2026 are a clean record (30). 60 requests a second, 250 records a request and 15 kB a record (15). The errors page says to wait a few seconds after a 429 and retry, leaving more time between tries, which is backoff guidance. No idempotency key or safe-retry guidance for the enrich call (10). No SLA found (0). The REST API is generally available, and this benchmark reads a GA API beside an MCP server its vendor calls early as GA (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

ZeroBounce 75

Hosted lines. Statuspage at status.zerobounce.net with API, API-US, API-EU, Bulk API, website and Cloudflare components (20). The incident feed for 8 August to 6 November shows a 6-minute members platform disruption on 9 September, about 3 minutes of reduced EU API availability on 1 October, and a file upload issue on 26 October resolved within 6 minutes, all minor (20). Limits published per endpoint group with numbers and block lengths (15). 429 is documented with advice to throttle, but no Retry-After, and a block can last an hour or a day (10 of 15). No SLA found (0). Generally available (10). 20+20+15+10+0+10 = 75.

Dropcontact API + MCP 72

Closed service with terms (updated 5 August 2025) naming Dropcontact SAS, registered in Bobigny, no. 823 752 647 (15). The personal data charter (updated 5 August 2025) keeps prospecting data 3 years after the relationship plus 4 in intermediate storage, takes rights requests at data@dropcontact.io, says data may be collected from publicly accessible information and hosted in the EU with some subcontractors in the United States under standard contractual clauses, and a DPA is published. The pricing page says processing runs only on Dropcontact's own algorithms on EU servers with no reliance on non-compliant third-party providers, and that it uses no contact databases. It now also says mobile numbers come from signature extraction within internal email flows, with five years of history, which the charter doesn't mention (22 of 30). One dated change for new accounts (1 June 2026) and no deprecation policy (8 of 20). EU hosting and US subcontractors stated, no named subprocessor list found (10 of 20). 15 + 22 + 8 + 10 = 55.

ZeroBounce 63

Closed service under terms naming Hertza L.L.C. (ZeroBounce) of Nevada; SDKs and MCP server open source (15 of 30). The data protection page says uploaded data is never kept more than 30 days, the privacy policy of 30 June 2026 keeps account data 'as long as needed', and EU and UK DPAs are published (22 of 30). An API migration page, with no dated deprecation policy (6 of 20). A sub-processor list naming each provider and the data exchanged (16 of 20). 15+22+6+16 = 59.

Dropcontact API + MCP 59

One API key per account in the X-Access-Token header, no scopes found. OAuth or the key as a bearer token on the MCP (20 of 30). Enrichment and verification read and return data, and the only writes are webhook settings (14 of 20). Results are cleaned names, titles and company fields rather than free text, so little untrusted content comes back (8 of 15). Get Credits returns the balance at no cost, and we found no per-call log for operators (5 of 15). security.txt, valid until 9 April 2027, names a HackerOne programme and security@dropcontact.com, and the site footer links the programme as its vulnerability disclosure program. The HackerOne page wasn't re-read. No SOC 2 or ISO 27001 found (12 of 20). No 2025 or 2026 record in the CVE list names Dropcontact. 20 + 14 + 8 + 5 + 12 = 59.

ZeroBounce 65

Several named keys besides a Master key, regeneration, deactivation and IP whitelists (25), less 10 because the documented calls carry the key in the api_key query string (15 of 30). Validation only reads, though file and list endpoints can delete uploads (12 of 20). Results are structured status codes with little free text (10 of 15). API usage and dashboard statistics endpoints (10 of 15). SOC 2 Type 2, ISO/IEC 27001:2022, continuous testing with Intigriti and penetration testing with BitSentinel; no public disclosure policy found (18 of 20). 15+12+10+10+18 = 65.

Dropcontact API + MCP 64

The MCP has a handful of tools (enrich from a name and company or a LinkedIn URL, validate an email, check credits, then fetch the result by request ID), and REST takes up to 250 contacts a call. No field selection (20 of 25). No search, so little to page or filter. forceResults=true returns the records already enriched (10 of 20). The errors page gives each message with a fix, and per-record keys such as only_contact_data say what to add (20). Asynchronous jobs keyed by request_id and pay on success, but no idempotency key, and webhooks can arrive out of order or twice (8 of 20). Few required fields and no official SDKs (6 of 15). 20 + 10 + 20 + 8 + 6 = 64.

ZeroBounce 69

A compact JSON result per address, batch validation and a file API for lists (18 of 25). Little to paginate; file status and results by file id (10 of 20). Status and sub-status codes say why an address failed, and the error page explains 400, 404 and 429 (14 of 20). Unknown results are free and safe to retry; repeated validations are charged again (12 of 20). Many official SDK wrappers and an MCP server, with few required parameters (15). 18+10+14+12+15 = 69.

Dropcontact API + MCP 40

No x402, MPP or L402 (0). Plan prices and credit allowances are public in euros (Starter €79 and Growth €120 a month for 500 credits, 20 per cent off yearly), and a credit is one verified email found (given back when none is) or one email checked (20). 50 free credits at signup with no card (20). A person signs up in a browser and creates the key in the app (0). 0 + 20 + 20 + 0 = 40.

ZeroBounce 35

No x402, MPP or L402 (0). Per-credit prices public, from $39 for 2,000 validations (20). Freemium of 100 validations a month for business or premium domains; a card requirement isn't stated, and free webmail addresses don't qualify (15 of 20). A person signs up in a browser (0). 0+20+15+0 = 35.