Mailjet API + MCP vs SendLayer

Mailjet API + MCP 79

node-mailjet v7.1.1 on 26 October 2026, a code fix enforcing HTTPS-only requests, 9 days before the check (30). In the 90 days from 6 August, the releases page's 3 September entry and five SDK tags at half each (node-mailjet v7.1.0 on 14 August and v7.1.1, mailjet-apiv3-python 1.8.0 on 17 August, 1.9.0 on 14 September and 1.9.1 on 8 October), 3.5 in all (20). The MCP repository merges pull requests, and its README asks users to file an issue if npm and GitHub diverge. We couldn't see issue reply times (8). Node and Python SDKs released in the last 10 and 27 days (15). CI runs the tests, but the MCP repository's package.json says 1.2.0 while its git tags stop at v1.1.0-beta.1, and npm couldn't be read (6). 30 + 20 + 8 + 15 + 6 = 79.

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

Mailjet API + MCP 74

Closed service with published terms that name Mailjet SAS, Mailjet GmbH or Mailgun Technologies, Inc. depending on the customer, and an Apache-2.0 MCP server (20). Data stored on Google Cloud in Frankfurt and Saint-Ghislain, a Sinch DPA and a named DPO, but no retention periods stated, per the 1 October check, not re-read on 4 November (18). A Deprecated Endpoints page lists the newsletter and legacy statistics endpoints, saying they could be removed in the future and to migrate to the current endpoints without naming them, and the Python SDK warns at run time with the replacement, but no dates or policy (8 of 20, 5 on 1 October). Data locations are stated. We found no subprocessor list (12). 20 + 18 + 8 + 12 = 58.

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

Mailjet API + MCP 62

Statuspage at mailjet.statuspage.io with history back to 2023, read through its history.atom feed (20). In the 90 days from 6 August the feed has two entries. A planned hour of infrastructure maintenance on 23 September, during which logins and API and SMTP sends were unavailable and submitted mail waited in the queue, and a Microsoft incident on 4 September that deferred mail to M365 only, with other providers unaffected. Both read as minor (20). The rate-limit page, unchanged on 4 November, says transactional endpoints have a high limit and others a 'much lower' one, with no numbers (0). A 429 on excess and advice to wait and retry, but no Retry-After header and no idempotency key for sends. SandboxMode validates a send without delivering (7). Enterprise plans list a 'Service Level Agreement' with no published terms, per the 1 October check, not re-read on 4 November (5). GA (10). 20 + 20 + 0 + 7 + 5 + 10 = 62.

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.

Mailjet API + MCP 52

Email API calls use Basic auth with a public key and a secret. Sub-accounts get their own keys, and the Content API also takes Bearer tokens with permissions and a 365-day default expiry (22). The MCP server can only read, by construction. We found no send-only or read-only key for the Email API (10). The MCP returns contacts, lists and statistics, and inbound mail goes from the Parse API to your webhook rather than through the tools (10). No audit log or per-key activity view found (0). Sinch's trust portal for Mailjet lists ISO 27001:2022 and SOC 2 Type II, a 'Report a Vulnerability' route to security@sinch.com and public vulnerability notices. No bug bounty, and www.mailjet.com/.well-known/security.txt answered 404 on 4 November. Level with the Sinch messaging and voice listings on the same portal (10). 22 + 10 + 10 + 0 + 10 = 52.

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

Mailjet API + MCP 30

No x402, MPP or L402 (0). Plan prices are public, but the price per extra 1,000 emails sits behind a help-centre link rather than on the pricing page (10). Free plan of 6,000 emails a month, 200 a day, with no card (20). Browser signup, no autonomous route (0).

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.

Mailjet API + MCP 53

The released MCP server registers one tool for each of the 117 GET paths in its bundled spec, with no toolsets (5). Limit, Offset, Sort and countOnly on list resources, with a maximum of 1,000 results a page (15). Documented status codes and error codes with messages (14). Every MCP tool is a GET, so nothing it does can change the account. The repository's 1.2.0 (29 October 2026, no tag) adds readOnlyHint and destructiveHint annotations, but npm couldn't be read, so its release is unconfirmed and not credited. The Send API has no idempotency key (6). Official SDKs for Node, Python and other languages, one POST /v3.1/send call carries a Messages array, and the MCP needs the key and secret joined as key:secret (13). 5 + 15 + 14 + 6 + 13 = 53.

SendLayer 62

Small responses and five MCP tools (18 of 25). Events filter by start and end date, event type and message ID, with an offset and a count (15 of 20). Errors are JSON with a numbered code and message per field, and documented (14 of 20). No idempotency key on sends, and the MCP annotations can't be read (0 of 20). A send needs from, to, subject, content type and content; official SDKs for Node, Python, PHP, Ruby and Go (15). Total 62.