MailPace vs Postmark API + MCP

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

Postmark API + MCP 81

No OpenAPI spec for the REST API. Every one of the 24 MCP tools has a typed Zod schema, so half (15). llms.txt of about 1,100 lines with code samples, per the 1 October check (10). MCP descriptions state the purpose and point to the right alternative, such as 'Use sendBatch to send multiple distinct messages' (16). Typed inputs with email validation, a 50-recipient cap and the 22 bounce types as an enum (13). More than 40 JSON error codes grouped by area, with examples, re-read on 1 November (14). Dated product updates and a semver CHANGELOG for the MCP server, but no API versioning (13). 15 + 10 + 16 + 13 + 14 + 13 = 81.

MailPace 25

No x402, MPP or L402 (0). $10 a month for 10,000 emails and $1 per 1,000 after, loaded from Paddle on the pricing page and stated in the comparison pages' tables without login (20). A free plan of up to 100 emails a month is available only by emailing support, so it isn't self-serve (5 of 20). Signup, DKIM verification and payment happen in a browser (0). Total 25.

Postmark API + MCP 40

No x402, MPP or L402 (0). Prices and per-1,000 overage ($1.80, $1.30, $1.20) published without login, re-read on 1 November (20). Developer plan of 100 emails a month with no card (20). Browser signup and a manual account review before sending outside your own domains (0). 0 + 20 + 20 + 0 = 40.

MailPace 65

Email Status API documented on 22 October 2026, and the MCP server rewritten as 2.0.0 on 4 November 2026, two days before this check (30). In the 90 days from 8 August, the Q3 changelog post of 31 August, the Email Status docs of 22 October, a mailpace-rails push on 17 October and the MCP rewrite, but only one changelog post (15 of 20). A closed service with email support. Three pull requests to the MCP repository from 2025 have no reply (8 of 15). Not in the official MCP registry (search for mailpace returned nothing on 6 November). The Node library was last pushed in October 2024 and Go in January 2024, while mailpace-rails is current (7 of 15). The MCP server gained CI with tests on 4 November; the older SDKs weren't checked for CI (5 of 10). Total 65.

Postmark API + MCP 80

postmark-python v0.5.0 was tagged on 29 October 2026 with new webhook verification and statistics methods and a dated CHANGELOG entry (30). Since 3 August, three dated product updates (two on 27 August, one on 23 September) and Python SDK tags v0.3.7 (5 August), v0.4.0 (12 August) and v0.5.0, counted half, so more than three (20). Updates are public and support answers by ticket. The Python SDK merged an outside fix (#39) on 29 October. We couldn't see issue replies (10). Current official SDKs. The Node SDK postmark 5.0.0 and 5.1.0 (Bulk API), set as versions in repository commits of 6 and 10 July, are on npm per the registry read on 1 November, though the repository has no tags after 4.0.7, and the Python SDK is current (15). The Python SDK runs tests, CodeQL and a security workflow, but the MCP repository still has no CI, which its CHANGELOG lists as planned (5). 30 + 20 + 10 + 15 + 5 = 80.

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

Postmark API + MCP 63

Server tokens limited to one server and a separate account token for account-level calls, plus IP allowlisting for API sending since 27 August and 2FA on every plan since 23 September. No per-scope tokens (22). A server token can't reach other servers, the MCP annotations let clients confirm writes, and WEBHOOK_URL_ALLOWLIST limits where createWebhook can point (12). The MCP README names the prompt-injection risk and the controls (dedicated token, client approval, the allowlist). Bounce dumps carry text from remote servers (12). Message activity kept 45 days, and the MCP writes one JSON log line per call with addresses masked (12). The security page, re-read on 1 November, names a SOC 1 data centre, payments through Stripe and regular audits by security firms, but no SOC 2 or ISO 27001 of Postmark's own, no disclosure policy, and /.well-known/security.txt answered 404. That's below mailersend and contactsplus (8 each, a disclosure policy with discretionary bounties) (5). 22 + 12 + 12 + 12 + 5 = 63.

MailPace 70

Graded with the hosted lines. A public Upptime status page at status.mailpace.com, driven by the mailpace/status repository, with monitors for the application, SMTP, docs, blog and landing page and GitHub issues as incident reports (20). The 90 days from 8 August hold two incidents, an application outage on 22 September 2026 that the operator put down to an upstream provider returning 5xx (issue open for two minutes), and SMTP down on 2 November 2026 for about 35 minutes, which leaves SMTP at 99.65% for the week. Minor incidents only (20). No rate limit numbers are published; the docs say limits vary by organisation age, plan and history (0). A documented 429 with its message, no Retry-After or backoff guidance, and an Idempotency-Key on sends with written retry rules (10 of 15). The terms guarantee 99% monthly availability of the API and dashboard with a 5% credit per 30 minutes (10). The API is at v1 with no beta label (10). Total 70.

Postmark API + MCP 60

Status page at status.postmarkapp.com (Sorry) with monthly history (20). On 1 November its robots.txt answered 406 with an empty body, which this run treats as blocked, so the history wasn't re-read. Per the 1 October read, the incidents inside the 90-day window that starts on 3 August were sending delays on 15 August, open-webhook delays on 19 August, 70 minutes of web-app errors on 17 September and sending delays of 20 minutes on 22 September and 18 minutes on 28 September with mail queued and not lost, plus planned maintenance on 7 August, all minor. The window from 2 October to 1 November is unread and isn't credited, so the line stays at the 1 October award, as mailtrap's was held when its status host refused us (20). Batch limits are published (500 messages, 50 MB a call) but no request-rate limit, re-read on 1 November (5). A 429 is documented with advice to reduce the rate, with no Retry-After and no idempotency key for sends (5). No SLA on the pricing page, re-read on 1 November (0). GA (10). 20 + 20 + 5 + 5 + 0 + 10 = 60.

MailPace 71

Responses are small, the send returns an id and status and Email Status returns one email (18 of 25). Only the domains list takes limit, offset, sort and direction; there is no endpoint to list or search sent mail (8 of 20). Errors are JSON with a human message and an HTTP status for each case in the documented table, with no stable error codes (14 of 20). Idempotency-Key on sends, kept 24 hours per token, and failed validations are not stored so they can be retried. The MCP server marks send as not idempotent and revoke as destructive (18 of 20). A send needs from, to, a subject and a body; official libraries for Node, Rails, Go and PHP transports and an SMTP route (13 of 15). Total 71.

Postmark API + MCP 79

24 tools and no toolsets, counted in the source on 1 November (15). count and offset with the 10,000 cap stated in the descriptions, filters on searches, and a truncation notice when listTemplates hits 100 (17). Over 40 documented error codes, and startup errors name the missing variable and link to the fix (18). Every tool carries readOnlyHint, destructiveHint and idempotentHint, with 12 read-only and the deletes flagged destructive. No idempotency key for sends (15). DEFAULT_SENDER_EMAIL and DEFAULT_MESSAGE_STREAM cut required fields, and there are official Node and Python SDKs (14). 15 + 17 + 18 + 15 + 14 = 79.