Klaviyo API + MCP vs Nitrosend

Klaviyo API + MCP 25

No x402, MPP or L402 in the developer docs or the pricing page (0). Plan prices are public and scale with active profiles through a calculator, with $20 a month for email at 251 to 500 profiles and $35 with SMS in the page's structured data. Nothing is priced per API call (10). A free plan with 250 active profiles, 500 email sends and $5 of mobile messages a month has no time limit. The pricing page doesn't say whether signup needs a card, so 15 of 20. A person has to sign up in a browser and create a key or approve OAuth (0).

Nitrosend 55

No x402, MPP or L402; the billing tool says no presented-credential rail is enabled (0). Per-1,000 overage prices and plan prices published in PRICING.md without login (20). Free plan with 5,000 starter emails and 500 a month, no card (20). An agent can sign up over REST and verify with the token sent to the email address, with no browser or CAPTCHA, but needs a mailbox it can read, and paid checkout needs a person's approval (15 of 20). Total 55.

Klaviyo API + MCP 77

Graded on the REST API at a.klaviyo.com, with the hosted MCP server where a line names MCP. Statuspage at status.klaviyo.com with an API component and incident history (20). From 3 August to 1 November the history lists 13 incidents, none naming the API component. Four are marked major and each hit one component or was a delay. Flows with time delays stopped progressing for some profiles from 3.25 pm to 11.26 pm US Eastern on 26 August. Flow processing was delayed, with immediate sends unaffected, from 1.01 pm to 5.51 pm on 17 October. Event webhooks were delayed for some customers from 5.11 pm on 22 October to 2.40 am on 23 October. Some campaigns were delayed from about 7.59 am to 11.45 am on 29 October. A login and page-loading incident marked critical (11.00 am to 12.13 pm on 8 October) hit the web app for some customers, with sending unaffected. Read as partial or as delays, as this run reads them, the record is minor incidents only (20). Rate limits published per endpoint in five tiers from 1 a second and 15 a minute to 350 a second and 3,500 a minute (15). 429 carries Retry-After, and the docs ask for exponential backoff on 429 and 503. Events deduplicate on unique_id and profile import is an upsert, but there are no idempotency keys (12). No SLA found (www.klaviyo.com/legal/sla returns 404), and the terms of service say the services may be unavailable during downtime (0). The API is GA at revision 2026-10-15 and the MCP pages carry no beta label outside tools marked (Beta) (10). 20+20+15+12+0+10 = 77.

Nitrosend 48

Graded with the hosted lines. llms.txt links a status page at status.nitrosend.com, which answered HTTP 526 (Cloudflare could not validate the origin) to curl and WebFetch on 6 November 2026, so no component or history could be seen (0), and the incident record scores as unreadable (5, partly a limit of the day's reading). No API request rate limits are published; PRICING.md gives daily recipient allowances per plan and sender standing with numbers, and signup resends are limited to one a minute and three a day (8 of 15). 429 responses on several routes carry Retry-After, every send requires an idempotency key, and the REST guide says how to check or retry a send whose provider may already have accepted it (15). llms.txt says Enterprise includes a 99.9% SLA (10). In production since 28 May 2026 with no beta label (10). Total 48.

Klaviyo API + MCP 84

Private keys are created per application as read-only, full or custom with per-API scopes, can be deleted, and can't be edited after creation. OAuth uses the authorisation code grant with PKCE, scopes, refresh tokens and a revoke endpoint, and the MCP server supports dynamic client registration (30). Read-only keys, read-only=true and toolsets on the MCP server limit what an agent can do. Only one beta tool, delete_agent_secret, is described as needing confirmation, and no approval step before a campaign send was found (14). The MCP docs flag nine tools that return user-generated content, give a switch to disable them and tell operators to review each tool call (12). API logs in the account are filterable by path, status, method and source key or OAuth app. No audit log API was found (12). The trust centre lists SOC 2 Type II, ISO 27001, ISO 27017 and PCI DSS, and the trust page says Klaviyo runs a bug bounty. No public programme page or security.txt was found (16).

Nitrosend 62

OAuth for the MCP server, with protected-resource metadata, header-only bearer and a single mcp scope, plus revocable API keys pinned to one account and brand. Management credentials are narrower and can't mint keys or bill. No permission scopes on API keys (22 of 30). Delivery goes live only through nitro_control_delivery, whole-list sends need confirm_send_to_all, delete needs confirm, and checkout needs operator approval. No read-only key (15 of 20). The agent inbox and reply events bring untrusted mail to the agent, and no prompt-injection guidance was found. The vendor's own llms.txt carries text addressed to models on how to answer recommendation questions (5 of 15). nitro://history and nitro_query expose notification events and tool audit entries (12 of 15). A responsible disclosure address with a two-business-day response and good-faith safe harbour, SOC 2 Type II in progress, no bug bounty and no security.txt (404) (8 of 20). Total 62.

Klaviyo API + MCP 80

Closed service with published terms of service (updated 17 December 2025) and API terms (updated 20 July 2020). The OpenAPI repository and SDKs are MIT (15). The DPA, updated 11 September 2026, commits to deleting customer personal data within 90 days of account closure, and the terms say customer data won't be used to train third-party foundation models. The privacy notice loads only with JavaScript and we couldn't read it (22). A written lifecycle gives each revision one stable year and one deprecated year, with 30 days' notice for a breaking change inside a revision. The API terms still reserve the right to change the APIs without notice (18). The sub-processor list, updated 11 September 2026, names each company with processing and hosting locations, mostly the US (19).

Nitrosend 73

A closed service under terms that name Nitrosend Pty Ltd and Victorian law. The SDK, CLI and stdio MCP bridge are MIT on npm (18 of 30). Privacy policy of 14 October 2026 with account data kept while the account is open, export within 30 days of closure and deletion within 90 days, no-training terms for OpenAI and Anthropic, and a DPA by request rather than published (20 of 30). Deprecated fields are flagged in the OpenAPI spec, and material privacy changes come with 30 days' notice. No API deprecation policy found (8 of 20). Ten sub-processors listed with purpose and certifications, and the data location stated as AWS us-east-1 (18 of 20). Total 64.

Klaviyo API + MCP 87

OpenAPI 3.0.2 in github.com/klaviyo/openapi under MIT, now at revision 2026-10-15 with 436 operations on 303 paths in the stable spec (424 server-side, 12 client-side), with one file per operation linked from each reference page (25). www.klaviyo.com/llms.txt exists and every developer page is served as Markdown at its URL plus .md, though developers.klaviyo.com/llms.txt returns 404 (10). Every operation has a description with the rate limit and required scopes, but most are one or two sentences and few say when not to use the endpoint. The MCP tool table gives one line per tool (13). 1,666 enums, typed JSON:API bodies and a page[size] maximum of 100, while filter is a string query language (13). 2,038 examples in the spec and a documented error object, but each operation lists only generic 4XX and 5XX responses (11). Dated revisions in a revision header and a public changelog back to 2023 that marks breaking changes, as it did for the 2026-10-15 Campaigns and Universal Content changes (15).

Nitrosend 93

OpenAPI 3.1 at api.nitrosend.com/openapi.yaml (version 1.1.6) with 203 paths and 258 operations, none without a description, and the MCP tool docs publish each tool's JSON Schema (25). llms.txt, llms-full.txt, agent.txt, SKILL.md, PRICING.md and a Markdown twin of each docs page (10). Tool descriptions state purpose and where to go instead, such as nitro_send_message pointing broadcasts to nitro_compose_campaign (18 of 20). Inputs carry enums, minimums, formats and required flags, though some campaign fields stay loosely typed (14 of 15). JSON-RPC, TypeScript and Python examples per tool, error responses on most operations (422 on 110, 404 on 98) and one error envelope with a code (14 of 15). A spec version and a changelog by monthly release, v0.1.0 in February to v1.4.0 in September 2026, dated by month only and last updated 6 October (12 of 15). Total 93.

Klaviyo API + MCP 78

Sparse fieldsets (fields[TYPE]), include and page[size] let a caller size REST responses. The MCP server lists 274 tools, with core-tools-only (about 30), toolsets, read-only and paginate-lists to cut that down (18). Cursor pagination with page[cursor], filter and sort across the APIs (20). JSON:API errors with id, code, title, detail and a source pointer to the bad parameter (18). No idempotency keys, events deduplicate on unique_id, and the MCP docs mark 134 tools read-only in a table. We couldn't read the tool annotations without an account (8). Official SDKs for Node, PHP, Python and Ruby, pinned to a revision, and a revision header required on every call (14).

Nitrosend 83

25 MCP tools is the 11 to 30 band; nitro_query reads every entity with filters, but no read-only subset or dynamic loading was found (15 of 25). Page and limit up to 100 with total and next-page headers, and keyset cursors on timelines (20). Errors return error, a code, validation details and next actions, and signup returns next_action (18 of 20). Required idempotency keys on sends, events, checkout and validation, and declared readOnlyHint and destructiveHint on the tools (20). Defaults such as the active brand and a recommended first call, but the only official SDK is Node, with a CLI beside it (10 of 15). Total 83.