Mailgun API + MCP vs SendLayer

Mailgun API + MCP 87

Release notes on 29, 21, 20 and 13 October 2026 and mailgun-python 1.10.0 on 21 October (30). Release notes on 31 August, 1, 8, 15, 22 and 29 September and in October, mailgun.js 14.0.0 to 14.1.0 (12 August to 8 October) and mailgun-python 1.9.0 to 1.10.0 (4 August to 21 October), well over three in 90 days (20). The MCP repository merges pull requests and tags each release, the last v2.1.3 on 16 September. We couldn't see open issues or reply times from git (12). mailgun.js 14.1.0 (8 October) and mailgun-python 1.10.0 are current (15). MCP CI runs tests on Node 20, 22 and 24 plus lint, and npm releases publish from a workflow (10). 30 + 20 + 12 + 15 + 10 = 87.

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

Mailgun API + MCP 74

HTTP Basic auth with a key. Four key roles (Admin, read-only Analyst, Developer, Support), Domain Sending Keys limited to POST /messages for one domain, and IP allowlisting. Rotation is advised but keys don't expire (28). The Analyst role is read-only, sending keys cover the least-privilege case, and the MCP server exposes no delete operations. Confirmation is left to the client (15). The MCP can fetch stored messages, so inbound mail can reach the model. The README's prompt-injection section asks users to review tool calls and goes no further (6). Logs API with 1 to 30 days of retention by plan, and Mailgun says security logs are kept 365 days (10). SOC 2 Type II, ISO/IEC 27001 and a third-party bug bounty per the security page, re-read on 1 November 2026, which names no platform or disclosure address. Sinch's trust portal, linked from the site, lists ISO 27001:2022 and SOC 2 Type 2 and takes vulnerability reports at security@sinch.com. No security.txt (404). Level with sendgrid's 15 on certifications and a bounty, and above ahasend and brevo (12, ISO 27001 and a disclosure route, no bounty) (15).

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

Mailgun API + MCP 72

Statuspage at status.mailgun.com with dated history (20). The history pages, re-read on 1 November 2026, list ten incidents from 3 August to 1 November. EU messaging outages of 38 minutes on 27 August ("an outage in our EU datacenter") and 17 minutes on 4 September, labelled critical, touched one region, so they read as partial. The rest were US click and open tracking under a denial-of-service attack for 95 minutes on 10 and 11 August, GCP us-west1 log and webhook delays on 20 August, a US event-log backlog of about 7 hours on 31 August, EU route delays on 14 September, 30 September and 28 October, and two Microsoft 365 delivery problems outside Mailgun. Minor only (20). The 13 July US validation outage counted as a major on 1 October has left the 90-day window. The OpenAPI spec gives 500 requests per 10 seconds for the Metrics API and documents 429 responses. No general send limit is published (7). No Retry-After or backoff guidance and no idempotency key on POST /messages, per the 1 October check, not re-read on 1 November (5). The SLA page commits to 99.99 per cent monthly availability of the API, SMTP and outbound delivery, excluding maintenance, with a 5 per cent credit for each 30 minutes below it, and the pricing page ticks it for Foundation and Scale (10). GA (10). 20 + 20 + 7 + 5 + 10 + 10 = 72.

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.

Mailgun API + MCP 70

Closed service with published terms that name Sinch Email and the entity on the service order rather than one company. The MCP server is Apache-2.0 (18). Log retention by plan (1, 5 or 30 days) is on the pricing page, security logs 365 days, and a Sinch DPA is linked from the security page (22). Release notes date changes such as the May 2025 SMTP login change, and the MCP CHANGELOG flags its 2.0.0 tool renames, but we found no deprecation policy (12). Hosted on Google Cloud in US and EU regions. We didn't find a subprocessor list (12).

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

Mailgun API + MCP 40

No x402, MPP or L402 (0). Plan prices and per-1,000 overage ($1.80, $1.30, $1.10) published without login (20). Free plan of 100 emails a day with no card (20). A person signs up in a browser and verifies a domain, so no autonomous route (0).

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.

Mailgun API + MCP 83

OpenAPI 3.1 for send, validate, optimize and inspect, and every MCP tool takes a Zod schema built from it (25). llms.txt with about 145 links and Markdown pages (10). MCP tool descriptions are the OpenAPI operation summary, one line each, with nothing on when to use or avoid a tool (8). Inputs are typed from the spec, though the README says some edge-case parameters fall back to permissive validation (12). The spec carries request and error examples, and the server rewrites 400, 401, 403 and 404 into guidance (13). Dated release notes and a semver CHANGELOG for the MCP server (15).

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.