Klaviyo API + MCP vs Sequenzy

Klaviyo API + MCP 77

Graded on the REST API at a.klaviyo.com, with the hosted MCP server where a line names MCP. Statuspage at status.klaviyo.com with an API component and incident history (20). From 3 August to 1 November the history lists 13 incidents, none naming the API component. Four are marked major and each hit one component or was a delay. Flows with time delays stopped progressing for some profiles from 3.25 pm to 11.26 pm US Eastern on 26 August. Flow processing was delayed, with immediate sends unaffected, from 1.01 pm to 5.51 pm on 17 October. Event webhooks were delayed for some customers from 5.11 pm on 22 October to 2.40 am on 23 October. Some campaigns were delayed from about 7.59 am to 11.45 am on 29 October. A login and page-loading incident marked critical (11.00 am to 12.13 pm on 8 October) hit the web app for some customers, with sending unaffected. Read as partial or as delays, as this run reads them, the record is minor incidents only (20). Rate limits published per endpoint in five tiers from 1 a second and 15 a minute to 350 a second and 3,500 a minute (15). 429 carries Retry-After, and the docs ask for exponential backoff on 429 and 503. Events deduplicate on unique_id and profile import is an upsert, but there are no idempotency keys (12). No SLA found (www.klaviyo.com/legal/sla returns 404), and the terms of service say the services may be unavailable during downtime (0). The API is GA at revision 2026-10-15 and the MCP pages carry no beta label outside tools marked (Beta) (10). 20+20+15+12+0+10 = 77.

Sequenzy 38

Graded with the hosted lines. No status page was found; none is linked from the site, llms.txt or docs, and status.sequenzy.com doesn't resolve (0). With no history to read, the incident line takes 5. 429 responses carry RateLimit-Limit and RateLimit-Remaining headers for a per-minute policy, and some routes state numbers (20 requests a minute per workspace for AI copy), but no table of limits per key was found (8 of 15). 429s carry Retry-After, sends take an Idempotency-Key, a reused key with a different body returns IDEMPOTENCY_KEY_REUSED, and the MCP docs say a retry hint alone doesn't make a write safe to repeat (15). No SLA found (0). No beta label on the API or MCP server (10). Total 38.

Klaviyo API + MCP 84

Private keys are created per application as read-only, full or custom with per-API scopes, can be deleted, and can't be edited after creation. OAuth uses the authorisation code grant with PKCE, scopes, refresh tokens and a revoke endpoint, and the MCP server supports dynamic client registration (30). Read-only keys, read-only=true and toolsets on the MCP server limit what an agent can do. Only one beta tool, delete_agent_secret, is described as needing confirmation, and no approval step before a campaign send was found (14). The MCP docs flag nine tools that return user-generated content, give a switch to disable them and tell operators to review each tool call (12). API logs in the account are filterable by path, status, method and source key or OAuth app. No audit log API was found (12). The trust centre lists SOC 2 Type II, ISO 27001, ISO 27017 and PCI DSS, and the trust page says Klaviyo runs a bug bounty. No public programme page or security.txt was found (16).

Sequenzy 67

Workspace and account API keys with fine-grained permission scopes, presets and explicit *:delete rights, revocable in settings, plus an OAuth service_auth flow for agents with user confirmation (30). Read-only and drafts-only presets let an agent prepare mail without sending, and account keys keep the user's workspace role (20). The agent inbox and reply tracking give the agent inbound mail, and no prompt-injection guidance was found in the MCP, permissions or inbox docs (4 of 15). The DPA lists administrative audit logs and MCP events report replies and bounces; no per-call API log for the customer was found (8 of 15). A responsible disclosure address on the security page, no security.txt (404), bug bounty or certification (5 of 20). Total 67.

Klaviyo API + MCP 25

No x402, MPP or L402 in the developer docs or the pricing page (0). Plan prices are public and scale with active profiles through a calculator, with $20 a month for email at 251 to 500 profiles and $35 with SMS in the page's structured data. Nothing is priced per API call (10). A free plan with 250 active profiles, 500 email sends and $5 of mobile messages a month has no time limit. The pricing page doesn't say whether signup needs a card, so 15 of 20. A person has to sign up in a browser and create a key or approve OAuth (0).

Sequenzy 40

No x402, MPP or L402 (0). Prices are public as volume tiers from $19 for 15,000 emails to $2,999 for 5 million, without a per-email overage rate (10 of 20). Free plan of 2,500 emails a month with no card (20). Agents can register through service_auth, but the user has to confirm a code in a Sequenzy browser page, and plan payment is through Stripe (10 of 20). Total 40.

Klaviyo API + MCP 80

Closed service with published terms of service (updated 17 December 2025) and API terms (updated 20 July 2020). The OpenAPI repository and SDKs are MIT (15). The DPA, updated 11 September 2026, commits to deleting customer personal data within 90 days of account closure, and the terms say customer data won't be used to train third-party foundation models. The privacy notice loads only with JavaScript and we couldn't read it (22). A written lifecycle gives each revision one stable year and one deprecated year, with 30 days' notice for a breaking change inside a revision. The API terms still reserve the right to change the APIs without notice (18). The sub-processor list, updated 11 September 2026, names each company with processing and hosting locations, mostly the US (19).

Sequenzy 67

A closed service. The SDK, MCP server and CLI are MIT on npm. The terms (30 June 2026) don't name the contracting entity in their text or a governing jurisdiction; the footer names Nic Tech Solutions, LLC (15 of 30). Privacy policy of 16 September 2026 and a public DPA agree on processing, and the terms say data is deleted within 30 days of termination (24 of 30). Deprecated endpoints are marked and kept as compatibility aliases; no written deprecation policy with notice periods (10 of 20). The DPA names its core sub-processors with their purpose; data locations aren't stated (15 of 20). Total 64.

Klaviyo API + MCP 78

Sparse fieldsets (fields[TYPE]), include and page[size] let a caller size REST responses. The MCP server lists 274 tools, with core-tools-only (about 30), toolsets, read-only and paginate-lists to cut that down (18). Cursor pagination with page[cursor], filter and sort across the APIs (20). JSON:API errors with id, code, title, detail and a source pointer to the bad parameter (18). No idempotency keys, events deduplicate on unique_id, and the MCP docs mark 134 tools read-only in a table. We couldn't read the tool annotations without an account (8). Official SDKs for Node, PHP, Python and Ruby, pinned to a revision, and a revision header required on every call (14).

Sequenzy 69

The MCP tool reference lists about 306 tools, the over-30 band, and no toolsets, tool search or dynamic loading was found (5 of 25). List endpoints paginate and filter, and contact timelines use cursors (20). Errors carry a code, a human message, a fix and a docs link, with retryAfterSeconds when the API sent Retry-After (20). Idempotency keys on sends and event imports; MCP readOnlyHint and destructiveHint annotations weren't found in the published reference (14 of 20). Sensible defaults with a selected workspace; one official SDK (TypeScript) plus a CLI (10 of 15). Total 69.

Klaviyo API + MCP 87

OpenAPI 3.0.2 in github.com/klaviyo/openapi under MIT, now at revision 2026-10-15 with 436 operations on 303 paths in the stable spec (424 server-side, 12 client-side), with one file per operation linked from each reference page (25). www.klaviyo.com/llms.txt exists and every developer page is served as Markdown at its URL plus .md, though developers.klaviyo.com/llms.txt returns 404 (10). Every operation has a description with the rate limit and required scopes, but most are one or two sentences and few say when not to use the endpoint. The MCP tool table gives one line per tool (13). 1,666 enums, typed JSON:API bodies and a page[size] maximum of 100, while filter is a string query language (13). 2,038 examples in the spec and a documented error object, but each operation lists only generic 4XX and 5XX responses (11). Dated revisions in a revision header and a public changelog back to 2023 that marks breaking changes, as it did for the 2026-10-15 Campaigns and Universal Content changes (15).

Sequenzy 95

OpenAPI 3.1 at docs.sequenzy.com/openapi.yaml with 349 paths and 475 operations, all described (25). llms.txt on both hosts, llms-full.txt, auth.md, agents.md and Markdown twins of the docs (10). Operation and tool descriptions give purpose, the scope each needs and the alternative, such as the deprecated generate-sequence alias (18 of 20). Typed inputs, and tools reject undeclared arguments with an error naming the supported ones (13 of 15). Errors on nearly every operation (401 on 442, 404 on 330, 400 on 290) with examples, and a structured error with code, howToFix and docsUrl for tools (14 of 15). Version in the path and spec, and a dated changelog (15). Total 95.