Lumbox vs Postfleet

Lumbox 23

The latest package releases found are lumbox 0.3.1 on npm (19 June 2026) and @lumbox/mcp-server 0.2.2 (12 June 2026), 140 days before this check, the 91 to 180 day band (10). No releases or dated changelog entries in the 90 days from 8 August (0). A closed service with a support address and an X account; no changelog (5 of 15). Not in the official MCP registry (search for lumbox returned nothing on 6 November); Node and Python SDKs exist but haven't changed since June (5 of 15). The MCP server card says 0.2.1 while npm has 0.2.2, and the SDK repository named in npm isn't publicly readable (3 of 10). Total 23.

Postfleet 75

Read for a closed service. The security page's record of 25 October 2026 says the scan moved to claude-haiku-5-5, a model released on 7 October, and the sending docs were updated on 13 October with account-wide sending holds (30, 10 days before 4 November). Dated changes in the 90 days to 4 November include @postfleet/mcp 0.1.2 and 0.1.3 on 24 August and 0.1.4 on 2 September, the SDK 0.1.0 on 8 September, docs updates on 12 and 18 September and 13 October, and the terms of 6 October (20). No public changelog (/changelog still 404) or issue activity we could read. The GitHub mirror's last commits, on 19 and 27 September, carry no version or tag and don't count as releases; GitHub pages beyond the repository front page were refused to our reader. Support is by email to a mailbox the site says an agent reads, untested (5 of 15). Listed in the official MCP registry as ai.postfleet/postfleet, a domain-verified namespace (15). The MCP package has two current dependencies (@modelcontextprotocol/sdk ^1.26.0, zod ^4.4.3) and a publish workflow with npm trusted publishing, but no tests or CI build, and 0.1.4 was published by hand without provenance (5 of 10).

Lumbox 72

A closed hosted service; the security page says it can be self-hosted, but the repository the deployment guide clones isn't publicly readable. The footer names Cyphen Innovations Private Limited (15 of 30). The privacy policy and security page agree that mail is kept while its inbox exists and an account's data is deleted within 30 days, that email isn't used for training, and that the vault uses AES-256-GCM per-organisation keys (26 of 30). A deprecation policy with Deprecation and Sunset headers, 90 days' notice and 12 months for an old version (20). Hosts and locations named, Hetzner in Germany, Neon in the US, Vercel, Cloudflare, AWS SES, Dodo Payments and Steel for browsers (18 of 20). Total 79.

Postfleet 34

The service is closed. The MCP server and SDK are MIT on npm, but the terms name no company, address or governing law, so a customer can't tell who they contract with (10 of 30). The privacy policy and terms agree on retention (original 7 days, cleaned mail 90 days, webhook payloads 7 days, signup IP 30 days), say mail isn't used for training, and disclose Google Analytics, Microsoft Clarity and an OpenAI ads pixel with a server-side signup event carrying a hashed email. The DPA is on request only, returned within 60 days (20 of 30). No deprecation policy or dated notices; the terms change when the page changes (0 of 20). The privacy policy names no processors or regions and says it doesn't claim EU residency; the docs name AWS SES, Resend and Claude Haiku in passing (6 of 20).

Lumbox 45

Graded with the hosted lines. No status page was found; none is linked from the site or llms.txt, and status.lumbox.co doesn't resolve (0). With no history to read, the incident line takes 5. 120 requests a minute per API key, per IP for unauthenticated routes, with X-RateLimit headers (15). 429 returns retry_after_seconds, the spec gives a backoff schedule and says which statuses not to retry, and Idempotency-Key works on every POST for 24 hours (15). The terms say Lumbox doesn't guarantee uninterrupted service, and no SLA was found (0). The core API carries no beta label; dedicated phone numbers are early access (10). Total 45.

Postfleet 35

Graded with the hosted lines, on the REST API with the MCP server noted. No status page found. /status still answered 404 on 4 November and none is linked (0). No readable incident history (5). Sending limits are published with numbers (holds at 20 attempts a minute and 100 an hour, Free at 100 sends a day and 3,000 a month, monthly quotas per plan), but read limits aren't, Free's new-recipient limit has no number and the comprehend route's hourly cap is unstated (10 of 15). Sends take a client_id with a full replay table, errors carry retryable, and the docs say which outcomes to retry with the same key and which need a new one. API 429s document no Retry-After or reset time (10 of 15). No SLA found on any plan (0). Nothing on the site calls the API or MCP server beta or preview, though both packages are 0.x (10).

Lumbox 40

No x402, MPP or L402 (0). Four plans with prices and limits published without login, no per-email price (10 of 20). Free plan with 3 inboxes, 500 received and 100 sent emails a month, no card (20). Agent self-signup lets an agent create its own key, which a person approves once in a browser (10 of 20). Total 40.

Postfleet 30

No x402, MPP or L402 in the docs or the OpenAPI file (0 of 40). Four plans with public prices and limits, but no per-message metered price (10). Free has no card, with 100 comprehended messages, 3 mailboxes and 3,000 sends a month (20). A person has to sign up and create keys in the dashboard. The homepage says the agent provisions its own address with no account page, which is true of mailboxes once a key exists, but not of the key. The demo inbox needs no signup but is a demo under /api/demo, not API access (0 of 20).

Lumbox 78

18 MCP tools, the 11 to 30 band; OAuth scopes narrow what a grant can do, but no read-only tool subset was found (15 of 25). Cursor pagination with limit and has_more, search, and an SSE stream for new mail (20). Errors are a human-readable message with the HTTP status, plus retry_after_seconds on 429 and written guidance on what to retry (12 of 20). Idempotency-Key on every POST; MCP annotations weren't readable without a session (16 of 20). One POST creates an inbox with a default address; official Node and Python SDKs (15). Total 78.

Postfleet 72

Graded on the REST API and the MCP server together. Sixteen MCP tools with descriptions of two to four sentences, and no toolsets or dynamic loading; the vendor's tutorials show client-side allowlists of three read tools. Message lists return metadata and comprehension status without bodies (17 of 25). Listing takes only limit (1 to 100), with no cursor, date filter, thread filter or search; wait_for_email filters by sender and subject substrings (8 of 20). Errors carry a stable code, retryable and, on MCP, a recovery hint per code and status (19 of 20). client_id is required on MCP sends and optional on REST, replays are specified per state, and every tool carries readOnly, destructive and idempotent annotations in the package source (20). Few required fields; one official SDK, TypeScript 0.1.0, and no Python SDK, which the vendor confirms (8 of 15).