Lusha API + MCP vs ZeroBounce

Lusha API + MCP 83

OpenAPI files per the 30 September check (25). llms.txt (10). Reference pages explain credit use per call with worked examples (15 of 20). Typed inputs (12 of 15). Standard HTTP codes and examples, no error catalogue found (10 of 15). Semantic versioning with a support matrix and a dated changelog. Version numbers run out of order (2.8.0 dated after 2.12.0), and breaking changes shipped in minor versions (11 of 15).

ZeroBounce 54

No OpenAPI or other machine-readable contract found; a Postman collection is linked (5 of 25). llms.txt lists marketing pages, and the docs have no Markdown twins (5 of 10). Endpoint pages explain timing, credits and when to use batch or file APIs (14 of 20). Parameter tables and listed status and sub-status values, including the ai_agent_mailbox sub-status added in July 2026 (10 of 15). Examples per endpoint, a sandbox and an error-code page (12 of 15). v2 paths, an API migration page and dated maintenance notices on the status page, with no API changelog (8 of 15). 5+5+14+10+12+8 = 54.

Lusha API + MCP 51

The hosted MCP has 50 tools across enrichment, prospecting, signals, lookalikes, buying groups, tables, CRM export and account, with no toolsets found (5). Bulk calls take up to 25 records (8 of 25). Prospecting filters with a per-company cap and exact totals (18 of 20). Standard codes and back-off advice for 429 (12 of 20). Every request costs at least 1 credit even with no match, so retries aren't free, and the MCP writes to tables and CRM exports with no annotations found (6 of 20). No official SDKs found (7 of 15).

ZeroBounce 69

A compact JSON result per address, batch validation and a file API for lists (18 of 25). Little to paginate; file status and results by file id (10 of 20). Status and sub-status codes say why an address failed, and the error page explains 400, 404 and 429 (14 of 20). Unknown results are free and safe to retry; repeated validations are charged again (12 of 20). Many official SDK wrappers and an MCP server, with few required parameters (15). 18+10+14+12+15 = 69.

Lusha API + MCP 80

Closed service with terms naming Lusha Systems Inc. (15). The privacy notice (September 2026) covers people in the database, names its sources, including a community programme in which members share contacts from their CRM, email headers and calendars, plus data brokers and public APIs, relies on legitimate interest, names a DPO and an EU and UK representative, and takes removal requests at lusha.com/privacy-center/request-removal. Retention for contacts has no period (24 of 30). A support matrix exists, but the Decision Makers API was removed 88 days after launch with no notice period found (8 of 20). Subprocessor list published and data stored on AWS in the US (20).

ZeroBounce 63

Closed service under terms naming Hertza L.L.C. (ZeroBounce) of Nevada; SDKs and MCP server open source (15 of 30). The data protection page says uploaded data is never kept more than 30 days, the privacy policy of 30 June 2026 keeps account data 'as long as needed', and EU and UK DPAs are published (22 of 30). An API migration page, with no dated deprecation policy (6 of 20). A sub-processor list naming each provider and the data exchanged (16 of 20). 15+22+6+16 = 59.

Lusha API + MCP 82

Version 2.20.1 on 2026-10-29 (30). Fourteen dated versions from 2.7.0 on 5 August to 2.20.1 on 29 October 2026 (20). Detailed public changelog and support, issue handling not visible (12 of 15). Listed in the official MCP registry as com.lusha.mcp/mcp 1.0.0, a domain-verified namespace, active since 18 June 2026 (15). No packages to judge (5 of 10). 30+20+12+15+5 = 82.

ZeroBounce 70

Closed service. The JavaScript SDK 3.0.0 was published on 25 October 2026 (30). No API changelog; the dated changes found in 90 days are that release and status-page notices, fewer than three releases (10 of 20). Support by email and 24/7 chat per the docs, a public status page; replies not tested (10 of 15). Official SDKs in many languages and an MCP server (15). Package health not checked (5 of 10). 30+10+10+15+5 = 70.

Lusha API + MCP 85

Atlassian Statuspage at status.lusha.com with a Lusha API component and AWS us-east-1 components (20). The history feed (history.atom) lists one incident from 4 August to 2 November 2026, errors and incomplete results in Prospecting company search for some users on 7 August (20:44 to 21:33 IDT), partial and so minor; the 3 August API error incident falls just outside the window (20). Limits per plan, from 40 a minute and 100 a day on Free to 300 a minute and 50,000 a day on Scale (15). 429 documented with advice to back off exponentially, no Retry-After mentioned (10 of 15). The trust centre states a 99.95 per cent uptime SLA (10). Generally available (10). 20+20+15+10+10+10 = 85.

ZeroBounce 75

Hosted lines. Statuspage at status.zerobounce.net with API, API-US, API-EU, Bulk API, website and Cloudflare components (20). The incident feed for 8 August to 6 November shows a 6-minute members platform disruption on 9 September, about 3 minutes of reduced EU API availability on 1 October, and a file upload issue on 26 October resolved within 6 minutes, all minor (20). Limits published per endpoint group with numbers and block lengths (15). 429 is documented with advice to throttle, but no Retry-After, and a block can last an hour or a day (10 of 15). No SLA found (0). Generally available (10). 20+20+15+10+0+10 = 75.

Lusha API + MCP 59

REST takes an api_key header. Every user gets a key, admins can mint more and cap each one's monthly credits, and a key a user makes for themselves has no cap of its own. OAuth for the MCP in Claude, ChatGPT and Codex, x-api-key elsewhere. No endpoint scopes found (22 of 30). Credit caps limit damage, but the MCP isn't read-only and writes to workspace tables and CRM exports (8 of 20). Signals and conversation data carry some free text, no injection guidance found (5 of 15). Usage endpoint, no per-call log found (8 of 15). SOC 2 Type II and five ISO certifications claimed in the trust centre, ISO 27701 named in the privacy notice, security.txt valid (Expires 1 May 2027, read on 2 November), no bug bounty found (16 of 20).

ZeroBounce 65

Several named keys besides a Master key, regeneration, deactivation and IP whitelists (25), less 10 because the documented calls carry the key in the api_key query string (15 of 30). Validation only reads, though file and list endpoints can delete uploads (12 of 20). Results are structured status codes with little free text (10 of 15). API usage and dashboard statistics endpoints (10 of 15). SOC 2 Type 2, ISO/IEC 27001:2022, continuous testing with Intigriti and penetration testing with BitSentinel; no public disclosure policy found (18 of 20). 15+12+10+10+18 = 65.