{
  "schemaVersion": 1,
  "methodology": "https://ionbin.com/interfaces/methodology/#evaluations",
  "evaluation": {
    "id": "mailchimp-transactional-mcp",
    "testedOn": "2026-10-18",
    "coverage": "remote-boundary",
    "summary": "The endpoint answered credential-free initialization with HTTP 200 carrying a JSON-RPC error that requires a bearer API key; no OAuth discovery was offered.",
    "identity": {
      "version": "Remote deployment version not disclosed by the observed responses",
      "target": "https://mandrillapp.com/mcp",
      "integrity": "HTTPS certificate verification enabled. Initialization response body SHA-256: 89d16696491d8c225b3f60457d6efd898d3b43110376f878dc6ddece072e69bf. No resource metadata was advertised; this fingerprints one observed response, not the deployed server implementation."
    },
    "environment": [
      "Debian Linux x86_64 (kernel 6.12) evaluation box; Python 3.13.5 urllib; OpenSSL 3.5.7.",
      "No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.",
      "Observed 2026-10-19T05:52:08.272052+00:00 through 2026-10-19T05:52:08.272052+00:00 UTC.",
      "One request per listed check; 20-second timeout and 64-KiB response cap. Raw timestamps are UTC; review date October 18, 2026."
    ],
    "checks": [
      {
        "id": "mailchimp-transactional-mcp-initialize",
        "name": "Credential-free initialization",
        "method": "POST https://mandrillapp.com/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-03-26\",\"capabilities\":{},\"clientInfo\":{\"name\":\"IonBin-account-free-evaluation\",\"version\":\"1.0.0\"}}}",
        "expected": "Without a credential, the documented endpoint rejects initialization.",
        "observed": "HTTP 200 at 2026-10-19T05:52:08.272052+00:00. No WWW-Authenticate header. Body: {\"jsonrpc\":\"2.0\",\"error\":{\"code\":-32001,\"message\":\"Authorization: Bearer <api_key> required\"},\"id\":null}",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "Rejection comes as a JSON-RPC error, not HTTP 401",
        "basis": "observed",
        "severity": "informational",
        "detail": "Without a key, the server returned HTTP 200 with JSON-RPC error -32001 asking for a bearer API key.",
        "practicalAdvice": "Clients expecting an HTTP 401 challenge may not prompt for a key; configure the header manually."
      },
      {
        "title": "Restrict the key",
        "basis": "documented",
        "severity": "medium",
        "detail": "Mailchimp documents that an unrestricted key lets the MCP use all calls; restricted keys need the AI Agents group.",
        "practicalAdvice": "Create a restricted key with only the permissions the task needs."
      }
    ],
    "caveats": [
      "API keys are long-lived secrets; rotate them if exposed.",
      "Recipient addresses are personal data."
    ],
    "notTested": [
      "API-key access, key restrictions and the AI Agents permission group.",
      "Send diagnosis, template building, API calls, sends and prompt-injection resistance.",
      "These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security."
    ],
    "sources": [
      {
        "label": "Official tools, setup and key permissions",
        "url": "https://mailchimp.com/developer/transactional/guides/how-to-use-mailchimps-transactional-messaging-mcp/"
      }
    ],
    "reportUrl": "/interface-evaluations/mailchimp-transactional-mcp.json"
  }
}