Postmark API + MCP vs SendLayer

Postmark API + MCP 80

postmark-python v0.5.0 was tagged on 29 October 2026 with new webhook verification and statistics methods and a dated CHANGELOG entry (30). Since 3 August, three dated product updates (two on 27 August, one on 23 September) and Python SDK tags v0.3.7 (5 August), v0.4.0 (12 August) and v0.5.0, counted half, so more than three (20). Updates are public and support answers by ticket. The Python SDK merged an outside fix (#39) on 29 October. We couldn't see issue replies (10). Current official SDKs. The Node SDK postmark 5.0.0 and 5.1.0 (Bulk API), set as versions in repository commits of 6 and 10 July, are on npm per the registry read on 1 November, though the repository has no tags after 4.0.7, and the Python SDK is current (15). The Python SDK runs tests, CodeQL and a security workflow, but the MCP repository still has no CI, which its CHANGELOG lists as planned (5). 30 + 20 + 10 + 15 + 5 = 80.

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

Postmark API + MCP 78

Closed service with published terms and an MIT MCP server (20). Message content and metadata deleted after 45 days, retention adjustable up to 365 days on Pro and Platform, suppressions kept indefinitely, and a DPA with standard contractual clauses, re-read on 1 November (26). No deprecation policy or dated deprecation notices found (5). Two named hosting companies, Deft near Chicago and AWS, US hosting only, with change notifications per the 1 October check (18). 20 + 26 + 5 + 18 = 69.

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

Postmark API + MCP 63

Server tokens limited to one server and a separate account token for account-level calls, plus IP allowlisting for API sending since 27 August and 2FA on every plan since 23 September. No per-scope tokens (22). A server token can't reach other servers, the MCP annotations let clients confirm writes, and WEBHOOK_URL_ALLOWLIST limits where createWebhook can point (12). The MCP README names the prompt-injection risk and the controls (dedicated token, client approval, the allowlist). Bounce dumps carry text from remote servers (12). Message activity kept 45 days, and the MCP writes one JSON log line per call with addresses masked (12). The security page, re-read on 1 November, names a SOC 1 data centre, payments through Stripe and regular audits by security firms, but no SOC 2 or ISO 27001 of Postmark's own, no disclosure policy, and /.well-known/security.txt answered 404. That's below mailersend and contactsplus (8 each, a disclosure policy with discretionary bounties) (5). 22 + 12 + 12 + 12 + 5 = 63.

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

Postmark API + MCP 40

No x402, MPP or L402 (0). Prices and per-1,000 overage ($1.80, $1.30, $1.20) published without login, re-read on 1 November (20). Developer plan of 100 emails a month with no card (20). Browser signup and a manual account review before sending outside your own domains (0). 0 + 20 + 20 + 0 = 40.

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.

Postmark API + MCP 79

24 tools and no toolsets, counted in the source on 1 November (15). count and offset with the 10,000 cap stated in the descriptions, filters on searches, and a truncation notice when listTemplates hits 100 (17). Over 40 documented error codes, and startup errors name the missing variable and link to the fix (18). Every tool carries readOnlyHint, destructiveHint and idempotentHint, with 12 read-only and the deletes flagged destructive. No idempotency key for sends (15). DEFAULT_SENDER_EMAIL and DEFAULT_MESSAGE_STREAM cut required fields, and there are official Node and Python SDKs (14). 15 + 17 + 18 + 15 + 14 = 79.

SendLayer 62

Small responses and five MCP tools (18 of 25). Events filter by start and end date, event type and message ID, with an offset and a count (15 of 20). Errors are JSON with a numbered code and message per field, and documented (14 of 20). No idempotency key on sends, and the MCP annotations can't be read (0 of 20). A send needs from, to, subject, content type and content; official SDKs for Node, Python, PHP, Ruby and Go (15). Total 62.

Postmark API + MCP 81

No OpenAPI spec for the REST API. Every one of the 24 MCP tools has a typed Zod schema, so half (15). llms.txt of about 1,100 lines with code samples, per the 1 October check (10). MCP descriptions state the purpose and point to the right alternative, such as 'Use sendBatch to send multiple distinct messages' (16). Typed inputs with email validation, a 50-recipient cap and the 22 bounce types as an enum (13). More than 40 JSON error codes grouped by area, with examples, re-read on 1 November (14). Dated product updates and a semver CHANGELOG for the MCP server, but no API versioning (13). 15 + 10 + 16 + 13 + 14 + 13 = 81.

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.