Hostinger Agentic Mail vs Robotomail

Hostinger Agentic Mail 10

No x402, MPP or L402 (0). Prices are public per mailbox per month, with the lowest only on 48-month prepaid terms (10 of 20). No free plan; a 30-day money-back guarantee after paying (0). Mailboxes and tokens are bought and created in hPanel by a person (0). Total 10.

Robotomail 35

No x402, MPP or L402 in the docs, llms.txt or the OpenAPI file (0 of 40). Four plan prices are public, Solo $5, Starter $19, Growth $79 and Scale $199 a month, with no per-unit price or overage (10 of 20). The Free plan needs no card and doesn't expire, but exchanges mail only with the owner's verified address, 10 each way a month, so it tests the loop without doing the job (15 of 20). POST /v1/signup returns an API key with no browser, and POST /v1/billing/upgrade returns a checkout link. The key does nothing until a person clicks the verification link, and a person pays at checkout (10 of 20).

Hostinger Agentic Mail 62

Closed service under Hostinger's universal terms, which name Hostinger International Limited in Cyprus. The SDKs are MIT (18 of 30). The privacy policy covers email data and says imported mail isn't used to train non-personalised models and is deleted after termination under the service terms and DPA; retention periods for mailbox content weren't found (20 of 30). No deprecation policy or dated notices for the Mail API (0). Sub-processors and data locations for Hostinger Email weren't checked (0, unchecked). Total 38.

Robotomail 75

A closed service under published terms. The five SDKs are MIT. The CLI's npm record has no licence or repository field (17 of 30). The privacy policy and the terms agree on retention, with messages kept until deleted, mail server copies purged after 7 days and trial data removed within 24 hours to 7 days, and the policy says email content isn't read or used for advertising. No DPA is published and the policy gives its date as September 2026 without a day (20 of 30). The terms promise 30 days' notice before an endpoint or version is retired, with Deprecation and Sunset headers, and the changelog records the legacy free plan's retirement on 19 August after notice in July (18 of 20). The policy names Stripe, Resend and Cloudflare R2. It gives no locations and doesn't name where the mail server and database are hosted (9 of 20).

Hostinger Agentic Mail 42

Graded with the hosted lines. Hostinger's Statuspage at statuspage.hostinger.com has components for Hostinger Mail SMTP inbound and outbound, IMAP and POP3, webmail and backups, but none for the Mail API or the MCP server (14 of 20). The status host's robots.txt disallows /api/ and the history page loads by script, so only the front page's 15 days (23 October to 6 November) were read, with one Outgoing Emails Service Degraded Performance incident; the longer record wasn't read, a limit of our reading (10 of 30). No request rate numbers; daily sending limits per mailbox are published, 1,000 on Starter and 3,000 on Standard and Premium (5 of 15). The docs say to wait after a 429 and warn that repeated hits can block the IP, with no Retry-After or idempotency on send (3 of 15). No SLA for email found (0). No beta label (10). Total 42.

Robotomail 53

Graded as a hosted service, on the REST API. A public UptimeRobot page at stats.uptimerobot.com/5hwqjYveUl. Its monitors and history load by script from /api/ paths that the status host's robots.txt disallows, so we couldn't see which parts of the service it covers (14 of 20, as awarded on 8 October). The incident record is unread. The 8 October reading came from the same disallowed path and no longer counts, so the line takes the no-readable-history score (5, a limit of our reading, not a finding against Robotomail). Limits are published with numbers, 30 sends a minute per mailbox and 60 per account in the messages reference, daily and monthly caps per plan, 5 signups an hour per IP and 5 concurrent SSE streams (15). The error reference says every 429 carries Retry-After, the OpenAPI description says route-produced 429s don't, sends have no idempotency key, and the documented advice is to check sent mail before retrying (9 of 15). No SLA found on the pricing page or in the terms (0). The API is at /v1 with no beta label (10).

Hostinger Agentic Mail 84

OpenAPI 3.0 at api.mail.hostinger.com/openapi/openapi.json, version 1.3.0, with 28 operations on 20 paths, none without a description (25). docs.hostinger.com serves llms.txt and a Markdown copy of each page (10). Descriptions say what each call does and side effects, such as text and source reads not changing the seen flag and list pointing to search for filters (16 of 20). Typed parameters and bodies with required fields (12 of 15). Every operation documents 401, 403, 500 and 502, 22 document 422, with a shared error shape and a stable code (14 of 15). Version in the path and the spec, but no changelog was found (7 of 15). Total 84.

Robotomail 90

OpenAPI 3.1 at /openapi.json with 40 operations on 27 paths, each with an operation ID (25). llms.txt, and a Markdown copy of the docs and site pages by adding .md or sending Accept: text/markdown. The pricing page's own .md URL answered 404 on 1 November and points to index.md#pricing (10). Operation descriptions state what each route does, which key type it needs and which gates apply, and llms.txt says when not to use the product. The MCP tool descriptions sit behind OAuth and were not read (15 of 20). Request schemas carry required fields, format: email and uuid, length limits, patterns and enums. The headers field on a send is a free object (13 of 15). An error reference and per-route error variants, with three inconsistencies we found, on Retry-After, on the SDK version (the docs say v0.1.0, the tags are v0.2.0) and on the annual discount (the pricing page says about 50 per cent off Starter and above, the limits page's annual prices are about 25 per cent off) (12 of 15). URL versioning at /v1 and a dated public changelog (15).

Hostinger Agentic Mail 70

Named tokens scoped to one order and to all or selected mailboxes, with separate SMTP/IMAP and webhook-management permissions, shown once and revocable one by one. The MCP server advertises protected-resource metadata on its 401 but documents bearer tokens only (25 of 30). Outgoing allow and block lists, with the block list winning, and mailbox-level scoping. Deletes are permanent and no read-only permission was named (14 of 20). Inbound mail is untrusted content; the docs advise the allow list for autonomous agents but give no prompt-injection guidance for message content (6 of 15). Email Logs record delivery statuses, sign-in attempts per protocol and an audit trail of mailbox setting changes, and webhooks show the last 20 deliveries (10 of 15). A valid security.txt, a HackerOne bug bounty and a responsible disclosure policy; no certification was checked (15 of 20). Total 70.

Robotomail 65

REST keys are revocable by API, stored as SHA-256 hashes, and can be limited to named mailboxes. The MCP server takes OAuth with PKCE, mail:read and mail:send scopes, 10-minute access tokens and per-app disconnect. Keys travel in the Authorization header only. A REST key can't be made read-only (27 of 30). An MCP grant with mail:read alone is read-only, and a mailbox can be paused. Sends go out at once, with no drafts or approval step (12 of 20). Inbound mail is untrusted content. A security guide tells developers to pass email as data, check recipients and require approval for sensitive actions, and says attachments aren't scanned. Nothing is filtered on the service side (11 of 15). The dashboard has a read-only Audit Feed of email activity and the API lists the last 20 delivery attempts per webhook. No log of API calls was found (8 of 15). security.txt is valid until 24 August 2027 and reports go to the support address. No bug bounty, SOC 2 or ISO 27001 statement found (7 of 20).