Lumbox vs Mailows

Lumbox 72

A closed hosted service; the security page says it can be self-hosted, but the repository the deployment guide clones isn't publicly readable. The footer names Cyphen Innovations Private Limited (15 of 30). The privacy policy and security page agree that mail is kept while its inbox exists and an account's data is deleted within 30 days, that email isn't used for training, and that the vault uses AES-256-GCM per-organisation keys (26 of 30). A deprecation policy with Deprecation and Sunset headers, 90 days' notice and 12 months for an old version (20). Hosts and locations named, Hetzner in Germany, Neon in the US, Vercel, Cloudflare, AWS SES, Dodo Payments and Steel for browsers (18 of 20). Total 79.

Mailows 57

A closed service under clear, dated terms naming the operator and New Mexico law (version 2026-10-25.1). The terms promise the source of the two AGPL-3.0 parts; the Stalwart fork is public, but the linked webmail repository isn't (16 of 30). The privacy policy (version 2026-10-30.1) is specific about hosting at Contabo in the EU with administration from the USA, a retention table, backups kept up to 12 months and no training on mail. The terms and the policy now agree on 90 days for message records. They disagree on tracking. The terms say there is no analytics or advertising cookie and no third-party tracking script, and the pricing page says no analytics scripts, while the policy describes OpenAI's advertising pixel and its _oaiq cookie on the public pages, and the home page loads it. That contradiction is charged once, in the misleading-claim term, so this line holds at its earlier 22 for the missing DPA (22 of 30). Terms changes get 30 days' email notice and planned outages are announced, but no API deprecation policy was found and free plans may be limited or discontinued (5 of 20). Processors and locations are named, Contabo (EU and USA), Stripe (EU and USA), OpenAI (USA) and Cloudflare (global) (18 of 20).

Lumbox 82

OpenAPI 3.1 at lumbox.co/openapi.json with 29 operations on 23 paths, all described (25). llms.txt with plan limits, endpoints and the MCP setup (10). Descriptions state what each call does, with notes such as long-poll endpoints being safe to retry; the MCP server card gives one line per tool (15 of 20). Typed parameters with limit and cursor, required fields marked (12 of 15). Shared responses for 400 to 429 and a default error on 28 operations, but errors are a bare error string with no code (12 of 15). Path versioning and a written deprecation policy, but the changelog it refers to wasn't found (8 of 15). Total 82.

Mailows 70

OpenAPI 3.1 at api.mailows.com/openapi.json with 28 operations, typed request bodies and a shared ErrorResponse. Most success responses are untyped objects, and five /acp/checkout_sessions operations have no schemas (20 of 25). llms.txt, an agent-written auth.md and two SKILL.md files listed in a skills index (10). The API and MCP manuals say what each route and tool is for, when to list rather than read, and what not to use on which host. The MCP tool descriptions as served weren't read, because no session was opened (14 of 20). Inputs have required fields and bounded limit, but the file has one enum, folder is a free string and response shapes are open (9 of 15). curl, Python and Rust examples throughout and named error codes (rate_limited, monthly_quota_exceeded, recipient_suppressed, tenant_suspended_abuse, attachment_not_clean), with no full error catalogue (12 of 15). The API is at /v1 and the OpenAPI file is 1.0.0, but there's no changelog; /changelog answers 404 (5 of 15).

Lumbox 45

Graded with the hosted lines. No status page was found; none is linked from the site or llms.txt, and status.lumbox.co doesn't resolve (0). With no history to read, the incident line takes 5. 120 requests a minute per API key, per IP for unauthenticated routes, with X-RateLimit headers (15). 429 returns retry_after_seconds, the spec gives a backoff schedule and says which statuses not to retry, and Idempotency-Key works on every POST for 24 hours (15). The terms say Lumbox doesn't guarantee uninterrupted service, and no SLA was found (0). The core API carries no beta label; dedicated phone numbers are early access (10). Total 45.

Mailows 38

Graded with the hosted lines, on the REST API with the MCP server noted. No status page found. www.mailows.com/status answers 404, status.mailows.com didn't resolve on 21 October and none is linked from the site or its sitemap (0). No readable incident history (5). Limits are described per agent and per account by hour, day and month, monthly units per plan are published and the agents page gives Free 10 sends a day, but hourly numbers for paid plans weren't found (8 of 15, partly met, kept). A 429 carries Retry-After, retry_after_seconds, retry_at and a scope, the manual says to retry network errors, 5xx and 429, a batch is all or nothing, and every send takes an Idempotency-Key honoured for 24 hours (15). The terms give no SLA except one arranged individually on Enterprise (0). The terms of 25 October 2026 and the privacy policy of 30 October 2026 no longer call the service an open beta, and the REST API manual carries no beta or preview label. The MCP manual still describes a pilot for OpenAI clients, outside the graded surface (10).

Lumbox 40

No x402, MPP or L402 (0). Four plans with prices and limits published without login, no per-email price (10 of 20). Free plan with 3 inboxes, 500 received and 100 sent emails a month, no card (20). Agent self-signup lets an agent create its own key, which a person approves once in a browser (10 of 20). Total 40.

Mailows 35

No x402, MPP or L402 in the docs or the OpenAPI file. The OpenAPI file lists five undocumented /acp/checkout_sessions operations with untyped bodies, which no page describes, so no credit (0 of 40). Plan prices are public with VAT and the unit is defined (2 per external recipient, 1 per internal), plus a $12 yearly agent add-on, with no metered per-unit price (10). Free needs no card and doesn't expire, with 200 units (100 external recipients) a month (20). An agent can start a claim ceremony with no browser, but a person has to have signed up in a browser with a bot check, set up 2FA and confirm it, and a person pays at Stripe checkout (5 of 20).

Lumbox 23

The latest package releases found are lumbox 0.3.1 on npm (19 June 2026) and @lumbox/mcp-server 0.2.2 (12 June 2026), 140 days before this check, the 91 to 180 day band (10). No releases or dated changelog entries in the 90 days from 8 August (0). A closed service with a support address and an X account; no changelog (5 of 15). Not in the official MCP registry (search for lumbox returned nothing on 6 November); Node and Python SDKs exist but haven't changed since June (5 of 15). The MCP server card says 0.2.1 while npm has 0.2.2, and the SDK repository named in npm isn't publicly readable (3 of 10). Total 23.

Mailows 28

Read for a closed service. No changelog. The MCP registry date of 19 October counted before came from the registry's JSON API, which this method doesn't read, so it is struck. The Stalwart fork has dated commits from 14 to 31 October 2026 but no tag, version or changelog entry, and the server card's version 0.9.2 is undated, so neither is a release. The last dated API change found is Sent-folder storage. The MCP manual says a copy of every sent message now goes to the Sent folder, which the REST API lists with folder=sent, and that nothing was stored before 6 September 2026, 59 days before the check (20). The start of the service on 30 July 2026, the effective date of the first terms, is a page date that records no API change. Only one dated change falls in the 90 days from 6 August (0). Support by email and a contact form, untested, with no public changelog or issue tracker (5 of 15). No official SDKs, and the registry listing that earned this line before is struck (0). No SDK or package to judge; the public Stalwart fork has Dependabot branches (3 of 10).