MailPace vs SMTP2GO API + MCP

MailPace 25

No x402, MPP or L402 (0). $10 a month for 10,000 emails and $1 per 1,000 after, loaded from Paddle on the pricing page and stated in the comparison pages' tables without login (20). A free plan of up to 100 emails a month is available only by emailing support, so it isn't self-serve (5 of 20). Signup, DKIM verification and payment happen in a browser (0). Total 25.

SMTP2GO API + MCP 40

No x402, MPP or L402 (0). Plan prices and overage ($1 and $0.85 per 1,000) published without login (20). Free plan of 1,000 emails a month, 200 a day, with no card (20). Browser signup and a review of new paid accounts, no autonomous route (0).

MailPace 70

Graded with the hosted lines. A public Upptime status page at status.mailpace.com, driven by the mailpace/status repository, with monitors for the application, SMTP, docs, blog and landing page and GitHub issues as incident reports (20). The 90 days from 8 August hold two incidents, an application outage on 22 September 2026 that the operator put down to an upstream provider returning 5xx (issue open for two minutes), and SMTP down on 2 November 2026 for about 35 minutes, which leaves SMTP at 99.65% for the week. Minor incidents only (20). No rate limit numbers are published; the docs say limits vary by organisation age, plan and history (0). A documented 429 with its message, no Retry-After or backoff guidance, and an Idempotency-Key on sends with written retry rules (10 of 15). The terms guarantee 99% monthly availability of the API and dashboard with a 5% credit per 30 minutes (10). The API is at v1 with no beta label (10). Total 70.

SMTP2GO API + MCP 82

Statuspage at smtp2gostatus.com with five components (email sending, API servers, SMS, website, member dashboard) and history (20). From 6 August to 4 November the page posted 17 incidents. It labels them minor or none, except a 15 October softbounce problem with SMTP clients sending bare line feeds and two dashboard Activity reporting delays (21 and 23 September), which it labels major. Each names some customers, one region, one hostname, the dashboard or one class of traffic, so all read as partial (20, 0 on 1 October). Numbers for /activity/search (60 a minute), new paid accounts (1,000 a day until reviewed) and free accounts (200 a day, 25 an hour without a verified domain), with optional per-key send rates, but no general API limit (12). 429 with an IP timeout of at least a minute and advice to pause and lower the request rate, which is backoff guidance with no Retry-After or idempotency key (10). The terms (section 4) guarantee 100 per cent monthly availability excluding scheduled maintenance, with a 5 per cent credit per 30 minutes of downtime (10). GA (10). Total 20+20+12+10+10+10 = 82.

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

SMTP2GO API + MCP 59

API keys with per-endpoint permissions and their own send rate, IP allow lists for API and SMTP separately since 30 July, and keys masked in API responses since 22 June. The key can also travel in the JSON body, which the official Node SDK does by default (24). The MCP docs ask for a narrowly scoped key and list the three permissions a sender needs (14). No inbound mail, so the tools return only account data (10). Activity reporting for 30 days on paid plans, no per-key audit log found (6). A blog post (21 November 2023, updated 15 June 2026) says SMTP2GO achieved ISO 27001 and ISO 9001 certification, naming no certifying body; the privacy policy doesn't mention it. No security.txt (404), disclosure policy or security page (/security/ 404) found, so a bare certification claim with no disclosure route (5). Total 59.

MailPace 65

Email Status API documented on 22 October 2026, and the MCP server rewritten as 2.0.0 on 4 November 2026, two days before this check (30). In the 90 days from 8 August, the Q3 changelog post of 31 August, the Email Status docs of 22 October, a mailpace-rails push on 17 October and the MCP rewrite, but only one changelog post (15 of 20). A closed service with email support. Three pull requests to the MCP repository from 2025 have no reply (8 of 15). Not in the official MCP registry (search for mailpace returned nothing on 6 November). The Node library was last pushed in October 2024 and Go in January 2024, while mailpace-rails is current (7 of 15). The MCP server gained CI with tests on 4 November; the older SDKs weren't checked for CI (5 of 10). Total 65.

SMTP2GO API + MCP 73

Changelog entry on 27 October 2026 (a read-only sending_status property on /api_keys responses), 8 days before this check (30). Four dated entries in the 90 days from 6 August, on 7 September, 10 October, 13 October and 27 October (20, 0 on 1 October). Public changelog and ticket, chat and phone support (10). smtp2go-nodejs 1.0.0 (5 June 2026) and the smtp2go Python package, whose last tag is v2.3.1 from 2022 with an untagged attachment change in September 2025 (10). No CI configuration in either SDK repository (3). Total 73.

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

SMTP2GO API + MCP 59

No public OpenAPI file found, and the hosted MCP sends every call through one generic execute-request tool rather than a typed tool per endpoint (5). llms.txt with about 100 links and Markdown pages (10). Reference pages explain each endpoint, and the MCP's four docs tools let a model look one up before calling it (12). Request bodies through execute-request aren't typed per endpoint (5). A response-codes page and examples per endpoint (12). Dated changelog that flags breaking changes, and v3 in the path (15).

MailPace 71

Responses are small, the send returns an id and status and Email Status returns one email (18 of 25). Only the domains list takes limit, offset, sort and direction; there is no endpoint to list or search sent mail (8 of 20). Errors are JSON with a human message and an HTTP status for each case in the documented table, with no stable error codes (14 of 20). Idempotency-Key on sends, kept 24 hours per token, and failed validations are not stored so they can be retried. The MCP server marks send as not idempotent and revoke as destructive (18 of 20). A send needs from, to, a subject and a body; official libraries for Node, Rails, Go and PHP transports and an SMTP route (13 of 15). Total 71.

SMTP2GO API + MCP 66

Five tools, four of them read-only docs lookups (25). We didn't check pagination or output limits on /activity/search beyond its 60-a-minute limit (8). Documented response codes with messages (14). The docs tools only read. execute-request can send or delete with nothing marking it so that we found, and there's no idempotency key (6). Node and Python SDKs, and a send needs only sender, to, subject and a body (13).