Mailchimp Marketing API vs Nitrosend

Mailchimp Marketing API 25

No x402, MPP or L402 (0). Plan prices are public without a login, from $13 a month for Essentials, $20 for Standard and $350 for Premium with USD selected, rising with contacts through a selector. Nothing is priced per API call (10). The Free plan has 250 contacts and 500 sends a month with no time limit. We could not confirm that signup asks for no card, and the 14-day trial of a paid plan needs payment details, so 15 of 20. A person signs up in a browser and creates a key or approves OAuth (0).

Nitrosend 55

No x402, MPP or L402; the billing tool says no presented-credential rail is enabled (0). Per-1,000 overage prices and plan prices published in PRICING.md without login (20). Free plan with 5,000 starter emails and 500 a month, no card (20). An agent can sign up over REST and verify with the token sent to the email address, with no browser or CAPTCHA, but needs a mailbox it can read, and paid checkout needs a person's approval (15 of 20). Total 55.

Mailchimp Marketing API 72

Graded on the hosted REST API with the hosted lines. status.mailchimp.com lists an API component for each of 21 data centres and keeps event history by month, re-read on 4 November (20). In the 90 days from 6 August 2026 the marketing events are campaign links returning 500 errors on 13 August, delayed audience updates on 11 September, cropped images disappearing in campaigns from 9 October, and access issues on some app pages "for some Mailchimp users" on 27 to 29 October. Each hit one function or some users, none names the API component, and November has none, so minor only (20). The loss of click tracking from 3 to 4 August ended before the window. The three Transactional delays belong to the Mailchimp Transactional listing. The docs give 10 simultaneous connections per user, a 120-second timeout and 500 pending batches, with no per-minute figure (12 of 15, partly met). 429 is documented with its cause. The official Python library's README says it retries 408, 409, 429 and 5xx with exponential backoff, two retries by default. No Retry-After header, idempotency key or safe-retry guidance for writes was found in the docs, so backoff alone (10). No SLA found (0). Version 3.0 is generally available, and the Audiences endpoints are beta (10). 20 + 20 + 12 + 10 + 0 + 10 = 72.

Nitrosend 48

Graded with the hosted lines. llms.txt links a status page at status.nitrosend.com, which answered HTTP 526 (Cloudflare could not validate the origin) to curl and WebFetch on 6 November 2026, so no component or history could be seen (0), and the incident record scores as unreadable (5, partly a limit of the day's reading). No API request rate limits are published; PRICING.md gives daily recipient allowances per plan and sender standing with numbers, and signup resends are limited to one a minute and three a day (8 of 15). 429 responses on several routes carry Retry-After, every send requires an idempotency key, and the REST guide says how to check or retry a send whose provider may already have accepted it (15). llms.txt says Enterprise includes a 99.9% SLA (10). In production since 28 May 2026 with no beta label (10). Total 48.

Mailchimp Marketing API 76

An OpenAPI 3.1.1 file with all 297 operations is public on the API host, and the docs site serves a 1.2 MB copy (25). llms.txt at each level of the docs and a Markdown copy of every page at the URL plus .md (10). Every operation has a description, averaging about 60 characters. They say what a call does and seldom when not to use it, and four agent skills cover consent, OAuth, webhooks and bulk jobs (10). The smaller file carries 498 enums and required fields on request bodies. Merge fields and event properties are free-form objects (12). The API's own file has examples throughout and a default error response on every operation, and the docs have an error glossary. The docs-site copy lists only 200 and 204 responses (12). The version is in the path and has been 3.0 since 2016. The public changelog's newest entry is 19 August 2025, so key expiry from 22 June 2026, webhook signing and the new client libraries are not in it, and the specification's version label is 0.1.0-dev (7).

Nitrosend 93

OpenAPI 3.1 at api.nitrosend.com/openapi.yaml (version 1.1.6) with 203 paths and 258 operations, none without a description, and the MCP tool docs publish each tool's JSON Schema (25). llms.txt, llms-full.txt, agent.txt, SKILL.md, PRICING.md and a Markdown twin of each docs page (10). Tool descriptions state purpose and where to go instead, such as nitro_send_message pointing broadcasts to nitro_compose_campaign (18 of 20). Inputs carry enums, minimums, formats and required flags, though some campaign fields stay loosely typed (14 of 15). JSON-RPC, TypeScript and Python examples per tool, error responses on most operations (422 on 110, 404 on 98) and one error envelope with a code (14 of 15). A spec version and a changelog by monthly release, v0.1.0 in February to v1.4.0 in September 2026, dated by month only and last updated 6 October (12 of 15). Total 93.

Mailchimp Marketing API 46

API keys are named, several to an account, revocable, and bounded by the creating user's level. A key has full account access, and the docs say there is no read-only key and no per-endpoint limit. Keys made from 22 June 2026 expire after one year per the help centre. OAuth 2 uses the authorisation code grant with no scopes, and its tokens never expire. Credentials travel in a header, not the URL (20). No read-only mode. send-checklist, actions/test, actions/unschedule and actions/cancel-send exist, with no approval step before a send or a permanent contact delete (6). The API returns contact fields, conversation messages and survey answers, which are untrusted text, and no guidance on prompt injection was found (2). /authorized-apps lists the OAuth apps on an account and each response carries a request id. No API call log or audit log was found in the docs we read (4). A responsible disclosure programme with no rewards, a security.txt with a contact and no Expires field, SOC 2 reports, ISO 27001, regular penetration tests and optional two-factor sign-in. No public advisory feed found (14).

Nitrosend 62

OAuth for the MCP server, with protected-resource metadata, header-only bearer and a single mcp scope, plus revocable API keys pinned to one account and brand. Management credentials are narrower and can't mint keys or bill. No permission scopes on API keys (22 of 30). Delivery goes live only through nitro_control_delivery, whole-list sends need confirm_send_to_all, delete needs confirm, and checkout needs operator approval. No read-only key (15 of 20). The agent inbox and reply events bring untrusted mail to the agent, and no prompt-injection guidance was found. The vendor's own llms.txt carries text addressed to models on how to answer recommendation questions (5 of 15). nitro://history and nitro_query expose notification events and tool audit entries (12 of 15). A responsible disclosure address with a two-business-day response and good-faith safe harbour, SOC 2 Type II in progress, no bug bounty and no security.txt (404) (8 of 20). Total 62.

Mailchimp Marketing API 68

Release 1.0.3 of the TypeScript, Python and Go client libraries, the first tag in each, is dated 5 October 2026, 30 days before this check (30). The TypeScript library's 1.0.03 of 13 October changes only version strings and the lockfile, so it counts half and doesn't set recency. Dated releases in the 90 days from 6 August include the CLI's 0.0.212 and 0.0.213 and Swift 1.0.0 on 18 September, Java 1.0.0 and C# 1.0.0 and 1.0.1 on 21 September, and 1.0.3 across the libraries on 5 October (20). The API changelog has no entry in that time. A public changelog whose newest entry is 19 August 2025, an API help address, and a help centre article saying support is not trained for in-depth API questions. We saw no public issue replies (5 of 15). Nine official client libraries generated from the current specification, with the TypeScript package absent from npm on 8 October (8 of 15, partly met). Each repository has a workflow that compiles and tests, whose results we could not see, and release 1.0.3 removed the LICENSE and NOTICE files added on 18 September (5 of 10, partly met). 30 + 20 + 5 + 8 + 5 = 68.

Nitrosend 81

@nitrosend/sdk 0.12.1 and @nitrosend/cli 0.3.11 were published on 6 November 2026 (30). 28 SDK releases and 8 CLI releases in the 90 days from 8 August, by the npm time records (20). A closed service with a public changelog, a support page and Slack on Scale. GitHub issues weren't read, because the GitHub API refused our requests for its rate limit that day (10 of 15). com.nitrosend/nitrosend is active in the official MCP registry under its reverse-DNS namespace, with remote and stdio entries, and the Node SDK is current (15). MIT packages released often; CI not read (6 of 10). Total 81.

Mailchimp Marketing API 73

Graded on the API, since the MCP server only searches docs. fields and exclude_fields trim responses on 130 operations (20). count up to 1,000 with offset on 59 operations and per-endpoint filters. No cursor, so deep pages get slow against the 120-second timeout (16). Errors are application/problem+json with title, status, detail, instance and a per-field errors list, and X-Trigger-Error returns a named error on demand (17). No idempotency key. PUT on a member upserts by email hash, is_syncing keeps loaded events from triggering automations, and scheduled campaigns can be unscheduled (8). One root URL and few required fields, but a contact is addressed by an MD5 hash of the lowercase email. Nine official client libraries and a CLI, with the TypeScript package missing from npm on 8 October (12).

Nitrosend 83

25 MCP tools is the 11 to 30 band; nitro_query reads every entity with filters, but no read-only subset or dynamic loading was found (15 of 25). Page and limit up to 100 with total and next-page headers, and keyset cursors on timelines (20). Errors return error, a code, validation details and next actions, and signup returns next_action (18 of 20). Required idempotency keys on sends, events, checkout and validation, and declared readOnlyHint and destructiveHint on the tools (20). Defaults such as the active brand and a recommended first call, but the only official SDK is Node, with a CLI beside it (10 of 15). Total 83.