Resend API + MCP vs SendLayer

Resend API + MCP 93

resend-mcp 2.27.2 on 26 October, resend-node 6.35.0 on 27 October and 6.36.0, 6.36.1 and 6.37.0 on 30 October, and the Python SDK tag v2.50.1 on 29 October (30). Six MCP releases since 6 October (2.25.0 to 2.27.2) and five Node SDK releases since 16 October (20). Pull requests merge within days and Renovate keeps dependencies current. We couldn't see issue reply times from git (18). Current official SDKs (15). CI builds, lints, checks pinned dependencies and releases from the repository's workflows on 1 November (10).

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

Resend API + MCP 90

incident.io status page with per-component uptime and incident timelines (20). On 1 November the page's data starts on 2 October 2026, and the feed adds two incidents since 17 October, both labelled degraded performance. On 23 October "Intermittent latency spikes on our emails API" ran 15:57 to 16:47 UTC (50 minutes) on the sending components, and on 26 October email status updates were delayed from 14:34 to 14:57 UTC (23 minutes), with no data lost. Earlier in the window, new team provisioning and contact webhook delivery were delayed on 9 and 10 October, function processing was delayed 2 hours 46 minutes on 26 September (sending not affected), and API and dashboard errors lasted 45 minutes on 24 September and 37 minutes on 1 October. The broadcast sending stall of about two hours on 15 September, which held about 9,200 transactional emails up to 25 minutes, and the one-minute MCP outage on 11 September stay per the 6 October check, and the 3 to 10 September incidents per the 1 October check. Earlier checks gave 15, between minor only and one major, for the busy record and the two-hour stall. This run reads delays and degradation as minor however long they run, and no core API was down or erroring widely for an hour, so minor only (20). 10 requests a second per team, plus daily and monthly quotas, re-read on 1 November (15). 429 with retry-after and IETF ratelimit headers, and Idempotency-Key on POST /emails and /emails/batch, kept 24 hours, re-read on 1 November (15). 99.99% uptime SLA on Enterprise (10). GA (10). 20+20+15+15+10+10 = 90.

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.

Resend API + MCP 83

Closed service with published terms and an MIT MCP server (20). 30-day retention on Free, Pro and Scale per the pricing page, backups kept 7 days, a DPA (last update 31 December 2025) and a privacy policy (last update 27 August 2026) that keeps personal data "only for as long as is necessary", re-read on 1 November (24). Dated changelog, no deprecation policy found (8). 22 subprocessors listed, all in the USA, still dated 27 August 2026 on 1 November, including Anthropic and RunPod for AI processing. Hosting regions aren't stated beyond "multi-region" on the pricing page (18).

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

Resend API + MCP 69

Bearer keys with full_access or sending_access, and a sending key can be limited to one domain. The hosted MCP signs in by OAuth with no documented scope choice (25). Sending-only keys exist, but the MCP has no read-only mode, and with a full key an agent can create keys and remove domains (10). get-received-email and the new inbox thread tools hand inbound mail to the model. Since resend-mcp 2.25.0 (6 October) local file reads by send-email attachments and create-contact-import are off over HTTP unless --allowed-file-dirs is set, and the README tells stdio users to set it to stop a prompt-injected agent attaching files outside chosen folders. That's a documented mitigation for one injection path, with no guidance on treating received mail as untrusted (4). Before 2.25.0 any local file path could be attached, including over HTTP, where a remote caller could read the server's disk; the maintainers fixed it and disclosed it in the README, read as Mapbox's 5 October fix was, as part of a public programme rather than a deduction. API request logs with full request and response bodies (14). SOC 2 Type II, an annual penetration test, a responsible-disclosure page and a security.txt with Contact and Policy but no Expires field, re-read on 1 November (16). 25 + 10 + 4 + 14 + 16 = 69.

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

Resend API + MCP 50

No x402, MPP or L402 (0). Plan prices and overage ($0.90 down to $0.46 per 1,000) published without login, including a Markdown pricing page (20). Free plan of 3,000 emails a month, 100 a day, with no card per the 1 October check; the Markdown pricing page re-read on 1 November doesn't say (20). Since 22 September, stripe projects add resend/email creates a Resend account or links an existing one, generates an API key and writes it to .env, so an agent can get access through the operator's Stripe login. A person still needs a Stripe account and the Stripe CLI, so partial credit, as for other Stripe Projects listings (10).

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.

Resend API + MCP 95

OpenAPI spec in resend/resend-openapi, updated 30 October and typed Zod schemas on every MCP tool (25). llms.txt with about 423 links (1 November), Markdown docs and a Markdown pricing page (10). MCP descriptions follow a Purpose, NOT for, Returns, When to use and Workflow pattern and name the tool to use instead (20). min and max on limits, enums such as full_access and sending_access, and mutual exclusions spelt out (14). An errors page with typed error names, and examples throughout (14). Dated product changelog and semver tags on the MCP, but the repository's CHANGELOG.md stops at 1.1.0 and the API has no version in its path (12).

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.