# Lumbox vs Postfleet (slim)

> Lumbox scores 60.7 (C) to Postfleet's 57.4 (C) for agent inboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/lumbox-vs-postfleet.md (~4,200 tokens) · this version ~2,480 tokens · JSON https://www.anchorterminal.com/compare/lumbox-vs-postfleet.json · canonical https://www.anchorterminal.com/compare/lumbox-vs-postfleet
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Lumbox scores 60.7 (C) on agent readiness against Postfleet's 57.4 (C), and leads in 5 of 7 scored categories. Postfleet leads on maintenance & community. Both do agent inboxes.

- Lumbox: C 60.7, rank #645 of 1510 · https://www.anchorterminal.com/tools/lumbox.min.md
- Postfleet: C 57.4, rank #796 of 1510 · https://www.anchorterminal.com/tools/postfleet.min.md
- Lumbox, good for Agents that need their own address to receive sign-up codes and links and to send replies. Ahead on Reliability, 45 against 35; Agent ergonomics, 78 against 72; Payments & pricing, 40 against 30; Transparency & trust, 72 against 34.
- Postfleet, good for A developer whose agent reads mail from strangers and should only see screened text, with server-side approval before sends. Ahead on Maintenance & community, 75 against 23.

| Category | Lumbox | Postfleet |
| --- | --- | --- |
| Reliability (16%) | 45 | 35 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 82 | 83 |
| Agent ergonomics (13%) | 78 | 72 |
| Security & auth (14%) | 71 | 68 |
| Payments & pricing (10%) | 40 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 23 | 75 |
| Transparency & trust (7%) | 72 | 34 |

| Fact (where they differ) | Lumbox | Postfleet |
| --- | --- | --- |
| Vendor | Cyphen Innovations Private Limited | Postfleet |
| Hosted endpoint | `https://mcp.lumbox.co/mcp` | `https://api.postfleet.ai/api/v1` |
| Auth | OAuth or key | API key |
| Licence | none | Proprietary hosted service under Postfleet's terms (effective 6 October 2026), which name no company or governing law. The MCP server package @postfleet/mcp and the TypeScript SDK postfleet are MIT on npm; the GitHub repository is a mirror of the MCP server only |
| Tools exposed | 18 | 16 |
| MCP registry | not listed | `ai.postfleet/postfleet` |
| Last release | 2026-06-19 | 2026-09-08 |
| Terms last updated | 2026-09-07 | 2026-10-06 |
| Privacy policy last updated | 2026-03-16 | 2026-10-06 |
| Terms restrict automated access | yes | not found in the text |
| Popularity | 13 npm/wk | 0 stars |

Why the edge:
- Maintenance & community, Postfleet +52: Lumbox 23 (The latest package releases found are lumbox 0.3.1 on npm (19 June 2026) and @lumbox/mcp-server 0.2.2 (12 June 2026), 140 days before this check, the 91 to 180 day band (10). No releases or dated changelog entries in the 90 days from 8 August (0). A closed service with a support address and an X account; no changelog (5 of 15). Not in the official MCP registry (search for lumbox returned nothing on 6 November); Node and Python SDKs exist but haven't changed since June (5 of 15). The MCP server card says 0.2.1 while npm has 0.2.2, and the SDK repository named in npm isn't publicly readable (3 of 10). Total 23.); Postfleet 75 (Read for a closed service. The security page's record of 25 October 2026 says the scan moved to claude-haiku-5-5, a model released on 7 October, and the sending docs were updated on 13 October with account-wide sending holds (30, 10 days before 4 November). Dated changes in the 90 days to 4 November include @postfleet/mcp 0.1.2 and 0.1.3 on 24 August and 0.1.4 on 2 September, the SDK 0.1.0 on 8 September, docs updates on 12 and 18 September and 13 October, and the terms of 6 October (20). No public changelog (/changelog still 404) or issue activity we could read. The GitHub mirror's last commits, on 19 and 27 September, carry no version or tag and don't count as releases; GitHub pages beyond the repository front page were refused to our reader. Support is by email to a mailbox the site says an agent reads, untested (5 of 15). Listed in the official MCP registry as `ai.postfleet/postfleet`, a domain-verified namespace (15). The MCP package has two current dependencies (`@modelcontextprotocol/sdk` ^1.26.0, `zod` ^4.4.3) and a publish workflow with npm trusted publishing, but no tests or CI build, and 0.1.4 was published by hand without provenance (5 of 10).)
- Transparency & trust, Lumbox +38: Lumbox 72 (A closed hosted service; the security page says it can be self-hosted, but the repository the deployment guide clones isn't publicly readable. The footer names Cyphen Innovations Private Limited (15 of 30). The privacy policy and security page agree that mail is kept while its inbox exists and an account's data is deleted within 30 days, that email isn't used for training, and that the vault uses AES-256-GCM per-organisation keys (26 of 30). A deprecation policy with Deprecation and Sunset headers, 90 days' notice and 12 months for an old version (20). Hosts and locations named, Hetzner in Germany, Neon in the US, Vercel, Cloudflare, AWS SES, Dodo Payments and Steel for browsers (18 of 20). Total 79.); Postfleet 34 (The service is closed. The MCP server and SDK are MIT on npm, but the terms name no company, address or governing law, so a customer can't tell who they contract with (10 of 30). The privacy policy and terms agree on retention (original 7 days, cleaned mail 90 days, webhook payloads 7 days, signup IP 30 days), say mail isn't used for training, and disclose Google Analytics, Microsoft Clarity and an OpenAI ads pixel with a server-side signup event carrying a hashed email. The DPA is on request only, returned within 60 days (20 of 30). No deprecation policy or dated notices; the terms change when the page changes (0 of 20). The privacy policy names no processors or regions and says it doesn't claim EU residency; the docs name AWS SES, Resend and Claude Haiku in passing (6 of 20).)
- Reliability, Lumbox +10: Lumbox 45 (Graded with the hosted lines. No status page was found; none is linked from the site or llms.txt, and status.lumbox.co doesn't resolve (0). With no history to read, the incident line takes 5. 120 requests a minute per API key, per IP for unauthenticated routes, with X-RateLimit headers (15). 429 returns `retry_after_seconds`, the spec gives a backoff schedule and says which statuses not to retry, and `Idempotency-Key` works on every POST for 24 hours (15). The terms say Lumbox doesn't guarantee uninterrupted service, and no SLA was found (0). The core API carries no beta label; dedicated phone numbers are early access (10). Total 45.); Postfleet 35 (Graded with the hosted lines, on the REST API with the MCP server noted. No status page found. /status still answered 404 on 4 November and none is linked (0). No readable incident history (5). Sending limits are published with numbers (holds at 20 attempts a minute and 100 an hour, Free at 100 sends a day and 3,000 a month, monthly quotas per plan), but read limits aren't, Free's new-recipient limit has no number and the comprehend route's hourly cap is unstated (10 of 15). Sends take a `client_id` with a full replay table, errors carry `retryable`, and the docs say which outcomes to retry with the same key and which need a new one. API 429s document no `Retry-After` or reset time (10 of 15). No SLA found on any plan (0). Nothing on the site calls the API or MCP server beta or preview, though both packages are 0.x (10).)
- Payments & pricing, Lumbox +10: Lumbox 40 (No x402, MPP or L402 (0). Four plans with prices and limits published without login, no per-email price (10 of 20). Free plan with 3 inboxes, 500 received and 100 sent emails a month, no card (20). Agent self-signup lets an agent create its own key, which a person approves once in a browser (10 of 20). Total 40.); Postfleet 30 (No x402, MPP or L402 in the docs or the OpenAPI file (0 of 40). Four plans with public prices and limits, but no per-message metered price (10). Free has no card, with 100 comprehended messages, 3 mailboxes and 3,000 sends a month (20). A person has to sign up and create keys in the dashboard. The homepage says the agent provisions its own address with no account page, which is true of mailboxes once a key exists, but not of the key. The demo inbox needs no signup but is a demo under /api/demo, not API access (0 of 20).)
- Agent ergonomics, Lumbox +6: Lumbox 78 (18 MCP tools, the 11 to 30 band; OAuth scopes narrow what a grant can do, but no read-only tool subset was found (15 of 25). Cursor pagination with `limit` and `has_more`, search, and an SSE stream for new mail (20). Errors are a human-readable message with the HTTP status, plus `retry_after_seconds` on 429 and written guidance on what to retry (12 of 20). `Idempotency-Key` on every POST; MCP annotations weren't readable without a session (16 of 20). One POST creates an inbox with a default address; official Node and Python SDKs (15). Total 78.); Postfleet 72 (Graded on the REST API and the MCP server together. Sixteen MCP tools with descriptions of two to four sentences, and no toolsets or dynamic loading; the vendor's tutorials show client-side allowlists of three read tools. Message lists return metadata and comprehension status without bodies (17 of 25). Listing takes only `limit` (1 to 100), with no cursor, date filter, thread filter or search; `wait_for_email` filters by sender and subject substrings (8 of 20). Errors carry a stable `code`, `retryable` and, on MCP, a recovery hint per code and status (19 of 20). `client_id` is required on MCP sends and optional on REST, replays are specified per state, and every tool carries readOnly, destructive and idempotent annotations in the package source (20). Few required fields; one official SDK, TypeScript 0.1.0, and no Python SDK, which the vendor confirms (8 of 15).)