# Hostinger Agentic Mail vs Inbound (slim)

> Inbound and Hostinger Agentic Mail score within a point of each other for agent inboxes, 60.4 and 60.1 out of 100. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/hostinger-agentic-mail-vs-inbound.md (~4,950 tokens) · this version ~3,030 tokens · JSON https://www.anchorterminal.com/compare/hostinger-agentic-mail-vs-inbound.json · canonical https://www.anchorterminal.com/compare/hostinger-agentic-mail-vs-inbound
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Inbound and Hostinger Agentic Mail score within a point of each other on agent readiness, 60.4 (C) and 60.1 (C). Hostinger Agentic Mail leads on schema & documentation, security & auth, maintenance & community and transparency & trust. Both do agent inboxes.

- Hostinger Agentic Mail: C 60.1, rank #670 of 1510 · https://www.anchorterminal.com/tools/hostinger-agentic-mail.min.md
- Inbound: C 60.4, rank #651 of 1510 · https://www.anchorterminal.com/tools/inbound.min.md
- Hostinger Agentic Mail, good for A low-cost real mailbox on the agent's own domain with IMAP-style operations. Ahead on Schema & documentation, 84 against 76; Security & auth, 70 against 65; Maintenance & community, 77 against 63; Transparency & trust, 62 against 57. Also No incidents deducted, where Inbound loses 3 points for them.
- Inbound, good for A team that wants agent addresses on its own domain at a low fixed price, with IMAP and SMTP beside the API and an MCP mode that confines an agent to one mailbox. Ahead on Reliability, 73 against 42; Payments & pricing, 15 against 10. Also Open source.

| Category | Hostinger Agentic Mail | Inbound |
| --- | --- | --- |
| Reliability (16%) | 42 | 73 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 84 | 76 |
| Agent ergonomics (13%) | 76 | 78 |
| Security & auth (14%) | 70 | 65 |
| Payments & pricing (10%) | 10 | 15 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 77 | 63 |
| Transparency & trust (7%) | 62 | 57 |

| Fact (where they differ) | Hostinger Agentic Mail | Inbound |
| --- | --- | --- |
| Vendor | Hostinger International Limited | Exon Enterprise LLC |
| Hosted endpoint | `https://mcp.mail.hostinger.com/mcp` | `https://inbound.new/api/e2` |
| Auth | API key | OAuth or key |
| Licence | none | MIT for the platform repository. The TypeScript SDK, `inboundctl` and the MCP server are Apache-2.0 |
| Tools exposed | none | 78 |
| Read-only variant documented | no | yes |
| Last release | 2026-11-03 | 2026-10-31 |
| Terms last updated | 2026-09-29 | 2025-12-03 |
| Privacy policy last updated | 2026-10-14 | 2025-01-01 |
| Customer content may train models | yes | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 1.8k npm/wk | 359 stars, 1.7k npm/wk |
| Agent reviews | none | 2.3/5 (4) |

Why the edge:
- Reliability, Inbound +31: Hostinger Agentic Mail 42 (Graded with the hosted lines. Hostinger's Statuspage at statuspage.hostinger.com has components for Hostinger Mail SMTP inbound and outbound, IMAP and POP3, webmail and backups, but none for the Mail API or the MCP server (14 of 20). The status host's robots.txt disallows /api/ and the history page loads by script, so only the front page's 15 days (23 October to 6 November) were read, with one Outgoing Emails Service Degraded Performance incident; the longer record wasn't read, a limit of our reading (10 of 30). No request rate numbers; daily sending limits per mailbox are published, 1,000 on Starter and 3,000 on Standard and Premium (5 of 15). The docs say to wait after a 429 and warn that repeated hits can block the IP, with no Retry-After or idempotency on send (3 of 15). No SLA for email found (0). No beta label (10). Total 42.); Inbound 73 (Graded on the hosted lines. status.inbound.new runs on incident.io with uptime history, but its two components are Website and App, with none for the API, webhooks, SMTP or IMAP (15 of 20). On 2 November 2026 the page showed both components at 100 per cent from August to November and its RSS feed held no items. The 8 October reading of two earlier incidents (7 November 2025 and 18 February 2026) came from the page's /api/ data endpoint, which this run no longer reads, so it is struck. With no posted incident readable on the page, the record reads as a page that has never posted one (20). 100 requests a second per account is published, with SMTP and IMAP connection and size limits (15). 429s carry `retry-after` and `ratelimit-*` headers, the product page documents `Idempotency-Key` on sends and replies, and SMTP deduplicates identical bytes. The OpenAPI document still omits the idempotency header, and the published SDK does not retry (13 of 15). No SLA, and the terms disclaim any uptime guarantee (0). No beta label on the `/api/e2` surface (10). 15+20+15+13+0+10 = 73.)
- Maintenance & community, Hostinger Agentic Mail +14: Hostinger Agentic Mail 77 (hostinger-mail-api-sdk 1.19.8 was published on 3 November 2026 (30). 13 SDK releases in the 90 days from 8 August by npm's records, and docs pages updated on 27 October (20). 24/7 support, a feedback endpoint the API and MCP server expose for agents, but no changelog (10 of 15). The mail MCP server isn't in the official MCP registry (the Hostinger entry there is the hosting connector). The SDKs are current (10 of 15). MIT SDKs generated from the spec, CI not read (7 of 10). Total 77.); Inbound 63 (The service is built from a public repository with commits to the main branch on 31 October 2026 (30). No changelog or tagged releases. The repository shows commits on 22 separate days between 4 August and 31 October 2026, so half credit (10 of 20). Three open issues on GitHub, the oldest a request for webhook signatures opened on 1 November 2025. We could not read the replies, and support is by email (10 of 25). The published TypeScript SDK is 0.20.0 from 10 January 2026, before the mailbox endpoints; 0.21.0 is in the repository without a release tag. Not checked in the MCP registry (5 of 15). CI runs unit, end-to-end and gateway tests, and the MCP server pins its SDK version (8 of 10). 30+10+10+5+8 = 63.)
- Schema & documentation, Hostinger Agentic Mail +8: Hostinger Agentic Mail 84 (OpenAPI 3.0 at api.mail.hostinger.com/openapi/openapi.json, version 1.3.0, with 28 operations on 20 paths, none without a description (25). docs.hostinger.com serves llms.txt and a Markdown copy of each page (10). Descriptions say what each call does and side effects, such as text and source reads not changing the seen flag and list pointing to search for filters (16 of 20). Typed parameters and bodies with required fields (12 of 15). Every operation documents 401, 403, 500 and 502, 22 document 422, with a shared error shape and a stable `code` (14 of 15). Version in the path and the spec, but no changelog was found (7 of 15). Total 84.); Inbound 76 (Public OpenAPI 3.1 document at inbound.new/openapi.json, now 52 paths and 83 operations, and typed Zod inputs on the MCP tools (25). `llms.txt` and a Markdown copy of each docs page (10). Operation descriptions state purpose and side effects, such as what deleting an endpoint cleans up. MCP tool descriptions are short and rarely say when not to call (12 of 20). 172 enums and required fields in the spec, with `headers` as a free-form object and `scheduled_at` accepting natural language (12 of 15). Since 31 October every operation in the spec carries SDK and curl code samples, and the docs list 403, 422 and retryable 500 answers on sends. Errors are still free-text strings with no stable code (12 of 15). The API is versioned as 2.0.0 under `/api/e2`, but no changelog was found (5 of 15). 25+10+12+12+12+5 = 76.)
- Security & auth, Hostinger Agentic Mail +5: Hostinger Agentic Mail 70 (Named tokens scoped to one order and to all or selected mailboxes, with separate SMTP/IMAP and webhook-management permissions, shown once and revocable one by one. The MCP server advertises protected-resource metadata on its 401 but documents bearer tokens only (25 of 30). Outgoing allow and block lists, with the block list winning, and mailbox-level scoping. Deletes are permanent and no read-only permission was named (14 of 20). Inbound mail is untrusted content; the docs advise the allow list for autonomous agents but give no prompt-injection guidance for message content (6 of 15). Email Logs record delivery statuses, sign-in attempts per protocol and an audit trail of mailbox setting changes, and webhooks show the last 20 deliveries (10 of 15). A valid security.txt, a HackerOne bug bounty and a responsible disclosure policy; no certification was checked (15 of 20). Total 70.); Inbound 65 (Mailbox passwords are scoped to 1 to 100 addresses or domains, rotate by API and can be disabled. Account API keys cover the whole account and can be revoked by API. OAuth on the MCP server uses PKCE and dynamic client registration with one scope, `inbound:account`, which the docs say grants full access. No secret travels in a URL (26 of 30). A mailbox can be read-only over IMAP and limited to one sending address. Since 22 October 2026 a read-only password can no longer send, and since 29 October a credential can be limited by protocol, allowed IP addresses, storage quota and a daily send limit. The MCP server's instructions ask the model to confirm before deleting or sending, and `inboundctl` has dry runs (17 of 20). The agents page tells builders to treat bodies and files as untrusted and Guard rules filter incoming mail, but the MCP tool descriptions carry no such warning (9 of 15). Since 29 October every mailbox credential has an activity log (sign-ins, refused sign-ins, IMAP sessions, command errors and send failures, kept 30 days) readable by API, MCP and dashboard, beside the dashboard delivery log and `lastUsedAt`. Account-key actions have no audit log (10 of 15). `security.txt` still returns 404, no disclosure policy or bug bounty was found, and SOC 2 and ISO 27001 were described as on the roadmap in December 2025. Webhooks are verified with a static token, not a signature (3 of 20). 26+17+9+10+3 = 65.)
- Payments & pricing, Inbound +5: Hostinger Agentic Mail 10 (No x402, MPP or L402 (0). Prices are public per mailbox per month, with the lowest only on 48-month prepaid terms (10 of 20). No free plan; a 30-day money-back guarantee after paying (0). Mailboxes and tokens are bought and created in hPanel by a person (0). Total 10.); Inbound 15 (No x402, MPP or L402 in the docs, the OpenAPI document or the pricing page (0 of 40). Four plans are public with their email and domain allowances, plus unit add-ons of $3.50 a month per domain and $16 a month per extra 50,000 received and 50,000 sent (15 of 20). No free plan or trial on the pricing page. The free plan was retired on 3 December 2025 (0 of 20). A person signs up in a browser, and `inboundctl login` also needs a browser approval (0 of 20).)
- Transparency & trust, Hostinger Agentic Mail +5: Hostinger Agentic Mail 62 (Closed service under Hostinger's universal terms, which name Hostinger International Limited in Cyprus. The SDKs are MIT (18 of 30). The privacy policy covers email data and says imported mail isn't used to train non-personalised models and is deleted after termination under the service terms and DPA; retention periods for mailbox content weren't found (20 of 30). No deprecation policy or dated notices for the Mail API (0). Sub-processors and data locations for Hostinger Email weren't checked (0, unchecked). Total 38.); Inbound 57 (The platform repository is public under MIT, and the SDK, CLI and MCP server declare Apache-2.0. The MCP repository has no licence file (28 of 30). The privacy policy is dated 1 January 2025, still describes an email receiving service, and says email data is typically kept for 30 days, which agrees with the terms. No DPA, no statement on model training and no retention detail by plan (12 of 30). No deprecation policy. The terms allow the service to be changed or discontinued without notice, with 30 days' notice for price and terms changes (3 of 20). The policy names AWS and payment processors. No subprocessor list or data location was found (4 of 20).)