MailPace vs Mailchimp Transactional (Mandrill)

MailPace 65

Email Status API documented on 22 October 2026, and the MCP server rewritten as 2.0.0 on 4 November 2026, two days before this check (30). In the 90 days from 8 August, the Q3 changelog post of 31 August, the Email Status docs of 22 October, a mailpace-rails push on 17 October and the MCP rewrite, but only one changelog post (15 of 20). A closed service with email support. Three pull requests to the MCP repository from 2025 have no reply (8 of 15). Not in the official MCP registry (search for mailpace returned nothing on 6 November). The Node library was last pushed in October 2024 and Go in January 2024, while mailpace-rails is current (7 of 15). The MCP server gained CI with tests on 4 November; the older SDKs weren't checked for CI (5 of 10). Total 65.

Mailchimp Transactional (Mandrill) 28

The newest dated Transactional release is specification 1.4.1 on 24 March 2026 (commit a996b63 in the generator repository), with the Node and Python libraries at 1.4.1, 225 days before this check (0). No dated Transactional release or changelog entry in the 90 days from 6 August. The newest Transactional release-notes entry is 19 August 2025 (0). A public changelog, a support contact and an API help address in the specification. We saw no public issue replies (6). The Node and Python libraries are both at 1.4.1 and match the current API version (15). The generator repository has workflows that validate the specification and build and test each library, and the Node library was updated in February 2024 for an Axios advisory. The test workflow needs a secret key, so we could not see results (7). 0+0+6+15+7 = 28.

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

Mailchimp Transactional (Mandrill) 79

An OpenAPI 3.1 file with all 99 operations is public at mailchimp.com/developer/openapi/api-reference-2.json, and a Swagger 2.0 copy sits in the client library repository. The link to it in the Transactional llms.txt returns 404 (25). llms.txt for the developer site and for Transactional, and a Markdown copy of every page at the URL plus .md (10). Each operation has a summary and a description averaging about 120 characters. They say what a call does and seldom when not to use it (11). Request bodies carry 36 enums, required fields, date patterns and minimum and maximum values. Headers, metadata and merge variables are free-form objects (11). Reference pages show request and response samples with code in eight languages, and each operation lists typed error bodies. The OpenAPI file itself has no examples (13). The version is in the path, but the docs use 1.0, 1.3 and 1.4 in different places, and the public changelog has nothing newer than 19 August 2025, so the move to 1.4 in March 2026 is not in it (9).

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

Mailchimp Transactional (Mandrill) 68

API keys are created and revoked in the web app, several to an account, and each can be limited to chosen endpoints and to IP addresses. Keys do not expire and no rotation tooling was found. A new key has full account access by default. The key travels in the JSON body or a Bearer header, not the URL (26). Per-endpoint key permissions, IP limits, test keys that send nothing and subaccounts that can be paused. No approval step for sends or deletes (15). The API and the MCP server return inbound mail and stored message content, which is untrusted text. No guidance on prompt injection was found in the MCP guide or the docs (3). The Account Security page lists the IP addresses that used the account and whether each came by API, SMTP or web, and searches can filter by API key (10). A responsible disclosure programme with no rewards, a security.txt with a contact and no Expires field, SOC 2 reports and ISO 27001 per the security page, and regular penetration tests. No public advisory feed found (14).

MailPace 71

Responses are small, the send returns an id and status and Email Status returns one email (18 of 25). Only the domains list takes limit, offset, sort and direction; there is no endpoint to list or search sent mail (8 of 20). Errors are JSON with a human message and an HTTP status for each case in the documented table, with no stable error codes (14 of 20). Idempotency-Key on sends, kept 24 hours per token, and failed validations are not stored so they can be retried. The MCP server marks send as not idempotent and revoke as destructive (18 of 20). A send needs from, to, a subject and a body; official libraries for Node, Rails, Go and PHP transports and an SMTP route (13 of 15). Total 71.

Mailchimp Transactional (Mandrill) 60

Graded on the API. /messages/search takes a limit up to 1,000 and send responses are one small object per recipient. No field selection was found. The hosted MCP server has 9 tools and reaches the 99 operations through list_api, describe_api and call_api, which keeps the definitions small (16). Search filters by date, tag, sender and API key, with no offset or cursor, so larger result sets go through a queued export (10). Errors return status, code, name and message, and the fundamentals page pairs common ones with a cause and a fix (16). No idempotency key. Test keys let an agent try sends without delivery, and scheduled messages can be listed and cancelled. The MCP tool annotations need a key to list, so they're unread (5). A send needs a key, a sender, a recipient and content. Official libraries for Node, Python, PHP and Ruby (13).

MailPace 25

No x402, MPP or L402 (0). $10 a month for 10,000 emails and $1 per 1,000 after, loaded from Paddle on the pricing page and stated in the comparison pages' tables without login (20). A free plan of up to 100 emails a month is available only by emailing support, so it isn't self-serve (5 of 20). Signup, DKIM verification and payment happen in a browser (0). Total 25.

Mailchimp Transactional (Mandrill) 35

No x402, MPP or L402 (0). Block prices are public without a login, $20 per 25,000 emails falling to $10, and $29.95 a month for a dedicated IP. Full use also needs a Standard or Premium marketing plan, whose price is on a separate page (20). The demo gives 500 emails once on any Mailchimp account, free plan included. We take 5 off because it sends only to the account's own verified domain and we could not confirm that signup asks for no card (15). A person signs up in a browser, enables the add-on, creates a key and sets DNS records, so there is no autonomous route (0).