Nitrosend vs Omnisend

Nitrosend 81

@nitrosend/sdk 0.12.1 and @nitrosend/cli 0.3.11 were published on 6 November 2026 (30). 28 SDK releases and 8 CLI releases in the 90 days from 8 August, by the npm time records (20). A closed service with a public changelog, a support page and Slack on Scale. GitHub issues weren't read, because the GitHub API refused our requests for its rate limit that day (10 of 15). com.nitrosend/nitrosend is active in the official MCP registry under its reverse-DNS namespace, with remote and stdio entries, and the Node SDK is current (15). MIT packages released often; CI not read (6 of 10). Total 81.

Omnisend 39

The newest dated change to the agent surface is the Content Translations API's GET /content-translations/languages operation page, stamped 30 October 2026 and not in the 104-operation index read on 9 October. The MCP reference pages carry 1 September 2026 stamps, and the newest product changelog entry that names the API or MCP is 10 July 2026 (30). The product changelog's newest entries are 1 and 24 September 2026, neither naming the API or MCP, and the docs revisions on 5 August, 26 August and 1 September (per the 9 October check) and the 30 October operation page give one dated API change, not three (0 of 20). A public changelog with a roadmap tab, a support address in the docs and live chat and email support on every plan per the pricing page. No developer forum was found and we saw no reply times (9 of 15). No official SDK was found, and a search of the official MCP registry for Omnisend returned no server on 2 November (0 of 15). No package to assess (0 of 10).

Nitrosend 48

Graded with the hosted lines. llms.txt links a status page at status.nitrosend.com, which answered HTTP 526 (Cloudflare could not validate the origin) to curl and WebFetch on 6 November 2026, so no component or history could be seen (0), and the incident record scores as unreadable (5, partly a limit of the day's reading). No API request rate limits are published; PRICING.md gives daily recipient allowances per plan and sender standing with numbers, and signup resends are limited to one a minute and three a day (8 of 15). 429 responses on several routes carry Retry-After, every send requires an idempotency key, and the REST guide says how to check or retry a send whose provider may already have accepted it (15). llms.txt says Enterprise includes a 99.9% SLA (10). In production since 28 May 2026 with no beta label (10). Total 48.

Omnisend 81

Graded on the REST API at api.omnisend.com, with the hosted MCP server where a line names MCP. Statuspage at status.omnisend.com with an API component and incident history (20). The history feed's newest incident is still 26 May 2026 on 2 November, so the 90 days from 4 August are clean (30). Rate limits published per endpoint, 400 requests a minute per brand by default and down to 10 a minute and 55 a day for analytics reports (15). A 429 returns a problem document, and some endpoints add retryAfter in seconds. No Retry-After header, backoff guidance or idempotency keys were found. POST /contacts upserts on the email identifier and only a draft campaign can be sent, so a repeated send returns 409 (8). No SLA found, and the terms say scheduled or unscheduled downtime may occur (0). Version 2026-03-15 is the current version, but the Campaigns API definition is labelled 2026-preview and the changelog announced the Forms API as beta on 24 April 2026, so 8 of 10.

Nitrosend 55

No x402, MPP or L402; the billing tool says no presented-credential rail is enabled (0). Per-1,000 overage prices and plan prices published in PRICING.md without login (20). Free plan with 5,000 starter emails and 500 a month, no card (20). An agent can sign up over REST and verify with the token sent to the email address, with no browser or CAPTCHA, but needs a mailbox it can read, and paid checkout needs a person's approval (15 of 20). Total 55.

Omnisend 30

No x402, MPP or L402 in the API documentation or the pricing page. The 402 on the send campaign endpoint is a plan payment error (0). Plan prices are public and scale with contacts through a slider, with Standard at 500 contacts and Pro at 2,500 contacts shown at a three-month discount. Nothing is priced per API call (10). The Free plan has 250 contacts and 500 emails a month, and the page says no credit card is required (20). A person has to sign up in a browser and create a key or approve OAuth (0).

Nitrosend 93

OpenAPI 3.1 at api.nitrosend.com/openapi.yaml (version 1.1.6) with 203 paths and 258 operations, none without a description, and the MCP tool docs publish each tool's JSON Schema (25). llms.txt, llms-full.txt, agent.txt, SKILL.md, PRICING.md and a Markdown twin of each docs page (10). Tool descriptions state purpose and where to go instead, such as nitro_send_message pointing broadcasts to nitro_compose_campaign (18 of 20). Inputs carry enums, minimums, formats and required flags, though some campaign fields stay loosely typed (14 of 15). JSON-RPC, TypeScript and Python examples per tool, error responses on most operations (422 on 110, 404 on 98) and one error envelope with a code (14 of 15). A spec version and a changelog by monthly release, v0.1.0 in February to v1.4.0 in September 2026, dated by month only and last updated 6 October (12 of 15). Total 93.

Omnisend 79

Every operation page is served as Markdown with its OpenAPI 3.0.0 definition, security schemes and scopes. No single downloadable OpenAPI file was linked from the pages read, and a Postman collection is linked instead, so 22 of 25. api-docs.omnisend.com/llms.txt indexes the guides and all 105 operation pages as Markdown, one more than on 9 October (10). Descriptions state the purpose, scopes, rate limit and state rules, such as that only a draft campaign can be sent and a sent one must be copied. Few say when not to use an endpoint (15). The two definitions read in full use required fields, enums and typed parameters. The rest were read only as index lines (11). Each operation lists its own 400, 401, 402, 403, 404, 409, 410, 429 and 500 responses with schemas and examples (13). Dated versions in a header and migration guides from versions 3 and 5, but no API changelog. API changes appear only now and then in the product changelog (8).

Nitrosend 62

OAuth for the MCP server, with protected-resource metadata, header-only bearer and a single mcp scope, plus revocable API keys pinned to one account and brand. Management credentials are narrower and can't mint keys or bill. No permission scopes on API keys (22 of 30). Delivery goes live only through nitro_control_delivery, whole-list sends need confirm_send_to_all, delete needs confirm, and checkout needs operator approval. No read-only key (15 of 20). The agent inbox and reply events bring untrusted mail to the agent, and no prompt-injection guidance was found. The vendor's own llms.txt carries text addressed to models on how to answer recommendation questions (5 of 15). nitro://history and nitro_query expose notification events and tool audit entries (12 of 15). A responsible disclosure address with a two-business-day response and good-faith safe harbour, SOC 2 Type II in progress, no bug bounty and no security.txt (404) (8 of 20). Total 62.

Omnisend 57

API keys are named, shown once and sent in a header. OAuth uses the authorisation code grant with per-resource read and write scopes, but credentials need a request form, no PKCE is documented and the token in the docs never expires unless revoked. The MCP server uses OAuth with dynamic client registration. Whether an API key can be scoped or rotated was not found (22). The MCP consent screen sets an access level with a read-only preset, and scopes split read from write. No approval or confirmation step before a campaign send was found, and the terms put approval of each agent action on the customer (13). The MCP docs warn against enabling two brand connectors in one chat and advise read-only access. No guidance on untrusted content in contact or form data was found (4). The app records API errors under API Issues. No log of successful calls or audit log endpoint was found (6). security.txt names a contact and a bug bounty policy whose scope includes api.omnisend.com, and the DPA states annual third-party penetration tests. No SOC 2 or ISO 27001 statement was found on the pages read (12).