Groundmail API + MCP vs MailPace

Groundmail API + MCP 88

OpenAPI 3.1 at docs.groundmail.dev/openapi.yaml with 70 operations, each naming its scope in x-required-scope, and typed input and output schemas on every MCP tool (25, OpenAPI per the 17 October check; a permission check refused the request on 4 November). llms.txt, llms-full.txt, Agent Skills and, since 22 October, a Markdown version of every docs page (10). MCP descriptions run from one line to a paragraph, with a few 'do not combine' rules, and only 21 of 70 OpenAPI operations carried a description on 17 October (12 of 20). The OpenAPI document bounds limit from 1 to 100 and uses enums, but the MCP limit is an unbounded number and template variables are free-form (11 of 15). An errors page with every code, its status, a fix and examples, 69 of 70 operations listing 4xx responses, and curl and SDK examples (15). A public changelog at groundmail.dev/changelog with 155 dated entries from 24 July to 3 November 2026 and an RSS feed, semver tags on the MCP server and Go SDK, and a versioned OpenAPI document (15). 25+10+12+11+15+15 = 88.

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

Groundmail API + MCP 63

Scoped API keys with Full, Send only, Read only and custom sets, send keys limited to named domains, and OAuth with PKCE S256, resource indicators, one-hour tokens and refresh-token reuse detection. Bearer tokens go in the header only. An OAuth request that names no scope gets full (28 of 30). Read-only and send-only presets for keys and MCP connections, and the sandbox limits sends to the account email until a domain and card are on file. Confirmation before a send is left to the client (16 of 20). The MCP returns subjects and bounce reasons, and the API returns full inbound messages from /received-emails. No prompt-injection guidance in the MCP source or README (4 of 15). Connected CLIs and agents are listed with their scopes and can be revoked, keys show last_used_at, GET /emails logs each send, and since 3 November a webhook delivery log shows every attempt. No request or audit log is documented (8 of 15). groundmail.dev now serves a security.txt (contact support@groundmail.dev, expires 20 October 2027) with no acknowledgement time, no disclosure policy, bug bounty or certification found; graded as mails-ai and tokenrip (7 of 20). 28+16+4+8+7 = 63.

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

Groundmail API + MCP 77

groundmail-mcp 0.27.0, published to the official MCP registry on 4 November 2026 (30). The official MCP registry lists 42 groundmail-mcp versions published from 18 October to 4 November on the first page of its listing, the Go SDK is tagged to go/v0.9.2 (23 October), and the changelog has 155 dated entries, 136 of them since 16 October (20). The public GitHub repositories are mirrors with no readable issue replies, and support is by email and in-product chat whose replies weren't read; the public changelog is new since 17 October (8 of 25, judgement call). In the official MCP registry under the GitHub-verified namespace io.github.Groundmail, with current SDKs (15). Tests in the MCP and SDK repositories and a current MCP SDK dependency (^1.32.2), but no CI workflow in the public repositories (4 of 10). 30+20+8+15+4 = 77.

MailPace 65

Email Status API documented on 22 October 2026, and the MCP server rewritten as 2.0.0 on 4 November 2026, two days before this check (30). In the 90 days from 8 August, the Q3 changelog post of 31 August, the Email Status docs of 22 October, a mailpace-rails push on 17 October and the MCP rewrite, but only one changelog post (15 of 20). A closed service with email support. Three pull requests to the MCP repository from 2025 have no reply (8 of 15). Not in the official MCP registry (search for mailpace returned nothing on 6 November). The Node library was last pushed in October 2024 and Go in January 2024, while mailpace-rails is current (7 of 15). The MCP server gained CI with tests on 4 November; the older SDKs weren't checked for CI (5 of 10). Total 65.

Groundmail API + MCP 35

No x402, MPP or L402 in the docs, the changelog or the pricing page (0). Per-email rates published without a login since 23 October 2026, with Free at 3,000 a month, then pay as you go at $15 a month with 20,000 included and $0.70, $0.50 and $0.30 per 1,000 by band (20). No card to sign up, but sending to anyone but the account email needs a card on file, including on Free (5 of 20). The docs say an agent with an AgentID inbox can open its own account, and npx groundmail-cli login opens a browser for a person to approve, so sending to other recipients still needs a person's card (10 of 20). 0+20+5+10 = 35.

MailPace 25

No x402, MPP or L402 (0). $10 a month for 10,000 emails and $1 per 1,000 after, loaded from Paddle on the pricing page and stated in the comparison pages' tables without login (20). A free plan of up to 100 emails a month is available only by emailing support, so it isn't self-serve (5 of 20). Signup, DKIM verification and payment happen in a browser (0). Total 25.