MailPace vs SendLayer

MailPace 75

Closed hosted service under terms that name OhMySMTP Ltd with its company number. The MCP server, SDKs, landing site and status page are MIT (18 of 30). The privacy policy (30 August 2026), the pricing page and the DPA agree on retention, 30 days in the dashboard and 7 more in backups, 37 days at most (25 of 30). The API reference promises an old version runs until a published end-of-life date, and the terms list dated changes. The terms also say changes apply immediately (8 of 20). Sub-processors listed with purpose and location, Freethought hosting in the EU, Hetzner backups in Germany, AppSignal in Amsterdam, Paddle in the UK and Tutanota in Germany (18 of 20). Total 69.

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

MailPace 65

Email Status API documented on 22 October 2026, and the MCP server rewritten as 2.0.0 on 4 November 2026, two days before this check (30). In the 90 days from 8 August, the Q3 changelog post of 31 August, the Email Status docs of 22 October, a mailpace-rails push on 17 October and the MCP rewrite, but only one changelog post (15 of 20). A closed service with email support. Three pull requests to the MCP repository from 2025 have no reply (8 of 15). Not in the official MCP registry (search for mailpace returned nothing on 6 November). The Node library was last pushed in October 2024 and Go in January 2024, while mailpace-rails is current (7 of 15). The MCP server gained CI with tests on 4 November; the older SDKs weren't checked for CI (5 of 10). Total 65.

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

MailPace 70

Graded with the hosted lines. A public Upptime status page at status.mailpace.com, driven by the mailpace/status repository, with monitors for the application, SMTP, docs, blog and landing page and GitHub issues as incident reports (20). The 90 days from 8 August hold two incidents, an application outage on 22 September 2026 that the operator put down to an upstream provider returning 5xx (issue open for two minutes), and SMTP down on 2 November 2026 for about 35 minutes, which leaves SMTP at 99.65% for the week. Minor incidents only (20). No rate limit numbers are published; the docs say limits vary by organisation age, plan and history (0). A documented 429 with its message, no Retry-After or backoff guidance, and an Idempotency-Key on sends with written retry rules (10 of 15). The terms guarantee 99% monthly availability of the API and dashboard with a 5% credit per 30 minutes (10). The API is at v1 with no beta label (10). Total 70.

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

MailPace 71

Responses are small, the send returns an id and status and Email Status returns one email (18 of 25). Only the domains list takes limit, offset, sort and direction; there is no endpoint to list or search sent mail (8 of 20). Errors are JSON with a human message and an HTTP status for each case in the documented table, with no stable error codes (14 of 20). Idempotency-Key on sends, kept 24 hours per token, and failed validations are not stored so they can be retried. The MCP server marks send as not idempotent and revoke as destructive (18 of 20). A send needs from, to, a subject and a body; official libraries for Node, Rails, Go and PHP transports and an SMTP route (13 of 15). Total 71.

SendLayer 62

Small responses and five MCP tools (18 of 25). Events filter by start and end date, event type and message ID, with an offset and a count (15 of 20). Errors are JSON with a numbered code and message per field, and documented (14 of 20). No idempotency key on sends, and the MCP annotations can't be read (0 of 20). A send needs from, to, subject, content type and content; official SDKs for Node, Python, PHP, Ruby and Go (15). Total 62.