{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "ship24", "name": "Ship24", "vendor": "Ship24 Limited", "vendorUrl": "https://www.ship24.com", "kind": "http-api", "category": "shipping", "summary": "Ship24 is a parcel tracking API from Ship24 Limited in Hong Kong. Its REST API and hosted MCP server create trackers, return normalised tracking events across couriers and push updates by webhook.", "url": "https://www.anchorterminal.com/tools/ship24", "markdownUrl": "https://www.anchorterminal.com/tools/ship24.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ship24.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ship24.json", "repo": "https://github.com/ship24/ship24-node", "license": "Proprietary service under Ship24's Terms and Conditions. The Node SDK and the AI plugin on GitHub are MIT", "transports": [ "http" ], "remoteUrl": "https://api.ship24.com/public/v1", "packages": [ { "registry": "npm", "name": "ship24" } ], "auth": "api-key", "authNotes": "A self-serve API key, sent as `Authorization: Bearer apik_...`. A default key is created once a plan (free or paid) is chosen in the dashboard, and an account can hold up to 20 active keys. Keys have no scopes. The hosted MCP server takes the same key in the same header. No OAuth, partner review or sales approval is needed for the listed plans.", "pricing": "freemium", "pricingNotes": "Free for 10 shipments a month on the Tracking API, blocked at the limit, so an agent can start without a contract. Paid per-shipment plans start at $39 a month for 1,000 shipments with $0.045 for each extra. Per-call plans start at $99 a month for 10,000 calls with $0.015 for each extra. Above 1,000,000 shipments a month pricing is by sales. Whether the free plan needs a card wasn't established (checked 2026-10-08).", "priceSummary": "$39 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI spec or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 12, "popularity": { "githubStars": 0, "npmWeekly": 79, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.ship24.com", "llmsTxt": "https://docs.ship24.com/llms.txt", "openapi": "https://docs.ship24.com/assets/openapi/ship24-tracking-api.yaml", "registryName": "com.ship24/tracking-mcp", "capabilities": [ "shipping.tracking" ], "tags": [ "hosted", "closed-source", "api-key", "openapi", "llms-txt", "mcp", "webhooks", "free-tier", "typescript", "tracking" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 55, "grade": "C", "agentReady": false, "rank": 522, "ranked": true, "rankOf": 722, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 80, "payments": 30, "reliability": 45, "schema": 81, "security": 37, "transparency": 52 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 45, "points": 9, "reason": "Read with the hosted lines and scored on the REST API at `api.ship24.com/public/v1`, which the hosted MCP server wraps. No status page was found. `status.ship24.com` doesn't resolve, `ship24.statuspage.io` is inactive, and neither the site footer nor the docs link to one (0). With no readable incident history the record scores the default (5 of 30). The rate limiter page gives a number for each of 11 endpoints, from 1 request a second on `GET /couriers` to 10 on most others (15). Responses carry `RateLimit-*`, `X-RateLimit-*` and `Retry-After` headers, which we saw on a live response, the errors page recommends exponential backoff on 429, and tracker creation is documented as idempotent with a 409 `request_conflict` that can be retried (15). The terms supply the service as is and as available, with no SLA found for any plan (0). The path is `/public/v1` and the MCP server reports version 1.0.1, with no beta label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 81, "points": 13.16, "reason": "A public OpenAPI 3.1 spec at `docs.ship24.com/assets/openapi/ship24-tracking-api.yaml` covers 12 operations and two webhooks, and every MCP tool has a typed input and output schema (25). llms.txt and a hosted `SKILL.md` guide exist, but the docs pages have no Markdown copies and llms.txt truncates its descriptions (8 of 10). The MCP tool descriptions say when to use each tool and which to prefer, such as `search_tracking_by_number` before a billed lookup, and the docs explain the three ways to fetch results (18 of 20). Inputs are typed with required fields, 12 enums and limits such as 5 to 50 characters for a tracking number and 500 a page, though the `Authorization` header is modelled as a plain string parameter (12 of 15). The spec has many examples and the errors page lists 12 codes, but most operations document only their success response and the live `auth_missing_header` code isn't on the list (10 of 15). The path carries v1 and the data format page promises that fields are never removed and lists four deprecated fields with months. No API changelog was found, only the SDK and plugin changelogs (8 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 68, "points": 11.05, "reason": "Scored on the REST API and the MCP server together. The MCP server has 12 tools, registered by plan, but its tools/list answer is about 61 KB because every tool carries an output schema, and the REST API has no field selection, so a results call returns every event (13 of 25). `GET /trackers` pages by `page` and `limit` (default 100, maximum 500) with a sort order. No filter appears in the spec for that call, and `GET /couriers` returns the full list unpaged (12 of 20). Errors are a JSON `errors` array with a stable `code` and a message that says what to fix, with 12 documented codes (16 of 20). `POST /trackers` and `POST /trackers/track` are idempotent for an identical payload, `clientTrackerId` is validated as unique, the bulk call is documented as not fully idempotent, and all 12 MCP tools carry `readOnlyHint` or `destructiveHint` and `idempotentHint` annotations (18 of 20). Only `trackingNumber` is required and the courier is detected automatically. One official SDK exists, for Node.js and TypeScript, so the two-language line isn't met (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 37, "points": 6.48, "reason": "API keys are sent as a Bearer token in the `Authorization` header. An account can hold up to 20, managed in the dashboard, and the plugin's security note advises a dedicated key so it can be revoked alone. Keys have no scopes and no secret travels in a query string (20 of 30). No read-only key or approval step was found. The API has no delete operation, the MCP server registers tools by plan and marks `resend_webhooks` as destructive, and that is the only least-privilege control (5 of 20). Results carry courier event text, which is untrusted, and no prompt-injection guidance was found in the docs or the plugin (3 of 15). `GET /trackers/:trackerId/webhook-history/download` returns every webhook push with its response, but no log of API calls or key use was found (4 of 15). `SECURITY.md` in the plugin repository gives contact@ship24.com for reports on the API and MCP server. No security.txt, bug bounty, SOC 2 or ISO 27001 statement was found, and webhooks are checked by a static shared secret with no signature (5 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "Read with the hosted rubric. No x402, MPP or L402 was found in the docs, the spec or the pricing page (0). The pricing page lists both billing models without a login, per shipment from $39 a month for 1,000 with $0.045 for each extra shipment, and per call from $99 a month for 10,000 with $0.015 for each extra call, with every tier and overage rate in a table (20). The Tracking API has a free plan of 10 shipments a month. Whether signup asks for a card wasn't established, because the dashboard needs a login we didn't create (10 of 20). A person signs up and picks a plan in the dashboard, and API key creation isn't available through the API or the MCP server (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 80, "points": 7, "reason": "The `ship24` npm package reached 1.1.0 on 6 October 2026, two days before the check (30). In the 90 days before the check there were five dated releases, the Node SDK 1.0.0 on 14 July and 1.1.0 on 6 October, MCP server 1.0.0 on 16 July and 1.0.1 on 27 August in the official registry, and the AI plugin 1.0.0 on 9 September (20). The service is closed, with no API changelog. Support is a contact form, and the GitHub API shows four open issues on the SDK repository and two on the plugin, which we didn't read (6 of 15). The MCP server is in the official registry under the domain namespace `com.ship24/tracking-mcp` (15). The SDK has no runtime dependencies, CI that tests Node 20, 22 and 24, and a workflow that reports drift from the OpenAPI spec (9 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 52, "points": 4.55, "note": "editorial 38, provenance 65", "reason": "The service is closed, under Terms and Conditions that name Ship24 Limited of Hong Kong and carry no date or version. They say an Application developer and API agreement applies to API use, and we found no such document on the site. The SDK and plugin are MIT (12 of 30). The privacy policy, last updated August 2026, covers accounts, payments and the MCP integration and gives retention only in general terms. The pricing page lists six months of data retention on the Pro plan, the terms allow deletion of an account's data without notice, and the data processing agreement the terms refer to wasn't found (12 of 30). The data format page promises that existing fields are never removed or changed and lists deprecated fields with the month, most recently `signedBy` in August 2026. No notice period is stated (10 of 20). Stripe, Google and Meta are named in the privacy policy, with no subprocessor list and no hosting locations (4 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Scored on the REST API and the MCP server together. The MCP server has 12 tools, registered by plan, but its tools/list answer is about 61 KB because every tool carries an output schema, and the REST API has no field selection, so a results call returns every event (13 of 25). `GET /trackers` pages by `page` and `limit` (default 100, maximum 500) with a sort order. No filter appears in the spec for that call, and `GET /couriers` returns the full list unpaged (12 of 20). Errors are a JSON `errors` array with a stable `code` and a message that says what to fix, with 12 documented codes (16 of 20). `POST /trackers` and `POST /trackers/track` are idempotent for an identical payload, `clientTrackerId` is validated as unique, the bulk call is documented as not fully idempotent, and all 12 MCP tools carry `readOnlyHint` or `destructiveHint` and `idempotentHint` annotations (18 of 20). Only `trackingNumber` is required and the courier is detected automatically. One official SDK exists, for Node.js and TypeScript, so the two-language line isn't met (9 of 15).", "maintenance": "The `ship24` npm package reached 1.1.0 on 6 October 2026, two days before the check (30). In the 90 days before the check there were five dated releases, the Node SDK 1.0.0 on 14 July and 1.1.0 on 6 October, MCP server 1.0.0 on 16 July and 1.0.1 on 27 August in the official registry, and the AI plugin 1.0.0 on 9 September (20). The service is closed, with no API changelog. Support is a contact form, and the GitHub API shows four open issues on the SDK repository and two on the plugin, which we didn't read (6 of 15). The MCP server is in the official registry under the domain namespace `com.ship24/tracking-mcp` (15). The SDK has no runtime dependencies, CI that tests Node 20, 22 and 24, and a workflow that reports drift from the OpenAPI spec (9 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 was found in the docs, the spec or the pricing page (0). The pricing page lists both billing models without a login, per shipment from $39 a month for 1,000 with $0.045 for each extra shipment, and per call from $99 a month for 10,000 with $0.015 for each extra call, with every tier and overage rate in a table (20). The Tracking API has a free plan of 10 shipments a month. Whether signup asks for a card wasn't established, because the dashboard needs a login we didn't create (10 of 20). A person signs up and picks a plan in the dashboard, and API key creation isn't available through the API or the MCP server (0).", "reliability": "Read with the hosted lines and scored on the REST API at `api.ship24.com/public/v1`, which the hosted MCP server wraps. No status page was found. `status.ship24.com` doesn't resolve, `ship24.statuspage.io` is inactive, and neither the site footer nor the docs link to one (0). With no readable incident history the record scores the default (5 of 30). The rate limiter page gives a number for each of 11 endpoints, from 1 request a second on `GET /couriers` to 10 on most others (15). Responses carry `RateLimit-*`, `X-RateLimit-*` and `Retry-After` headers, which we saw on a live response, the errors page recommends exponential backoff on 429, and tracker creation is documented as idempotent with a 409 `request_conflict` that can be retried (15). The terms supply the service as is and as available, with no SLA found for any plan (0). The path is `/public/v1` and the MCP server reports version 1.0.1, with no beta label (10).", "schema": "A public OpenAPI 3.1 spec at `docs.ship24.com/assets/openapi/ship24-tracking-api.yaml` covers 12 operations and two webhooks, and every MCP tool has a typed input and output schema (25). llms.txt and a hosted `SKILL.md` guide exist, but the docs pages have no Markdown copies and llms.txt truncates its descriptions (8 of 10). The MCP tool descriptions say when to use each tool and which to prefer, such as `search_tracking_by_number` before a billed lookup, and the docs explain the three ways to fetch results (18 of 20). Inputs are typed with required fields, 12 enums and limits such as 5 to 50 characters for a tracking number and 500 a page, though the `Authorization` header is modelled as a plain string parameter (12 of 15). The spec has many examples and the errors page lists 12 codes, but most operations document only their success response and the live `auth_missing_header` code isn't on the list (10 of 15). The path carries v1 and the data format page promises that fields are never removed and lists four deprecated fields with months. No API changelog was found, only the SDK and plugin changelogs (8 of 15).", "security": "API keys are sent as a Bearer token in the `Authorization` header. An account can hold up to 20, managed in the dashboard, and the plugin's security note advises a dedicated key so it can be revoked alone. Keys have no scopes and no secret travels in a query string (20 of 30). No read-only key or approval step was found. The API has no delete operation, the MCP server registers tools by plan and marks `resend_webhooks` as destructive, and that is the only least-privilege control (5 of 20). Results carry courier event text, which is untrusted, and no prompt-injection guidance was found in the docs or the plugin (3 of 15). `GET /trackers/:trackerId/webhook-history/download` returns every webhook push with its response, but no log of API calls or key use was found (4 of 15). `SECURITY.md` in the plugin repository gives contact@ship24.com for reports on the API and MCP server. No security.txt, bug bounty, SOC 2 or ISO 27001 statement was found, and webhooks are checked by a static shared secret with no signature (5 of 20).", "transparency": "The service is closed, under Terms and Conditions that name Ship24 Limited of Hong Kong and carry no date or version. They say an Application developer and API agreement applies to API use, and we found no such document on the site. The SDK and plugin are MIT (12 of 30). The privacy policy, last updated August 2026, covers accounts, payments and the MCP integration and gives retention only in general terms. The pricing page lists six months of data retention on the Pro plan, the terms allow deletion of an account's data without notice, and the data processing agreement the terms refer to wasn't found (12 of 30). The data format page promises that existing fields are never removed or changed and lists deprecated fields with the month, most recently `signedBy` in August 2026. No notice period is stated (10 of 20). Stripe, Google and Meta are named in the privacy policy, with no subprocessor list and no hosting locations (4 of 20)." }, "sources": [ { "what": "home page", "url": "https://www.ship24.com/", "seen": "2026-10-08" }, { "what": "Tracking API pricing, per-shipment and per-call tables", "url": "https://www.ship24.com/pricing?product=s24-prod-track-api-shipment", "seen": "2026-10-08" }, { "what": "Tracking API product page", "url": "https://www.ship24.com/tracking-api", "seen": "2026-10-08" }, { "what": "about page, offices", "url": "https://www.ship24.com/about-us", "seen": "2026-10-08" }, { "what": "Terms and Conditions", "url": "https://www.ship24.com/terms", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.ship24.com/privacy-policy", "seen": "2026-10-08" }, { "what": "docs llms.txt", "url": "https://docs.ship24.com/llms.txt", "seen": "2026-10-08" }, { "what": "getting started, API keys", "url": "https://docs.ship24.com/getting-started", "seen": "2026-10-08" }, { "what": "AI integration page, plugin and MCP server", "url": "https://docs.ship24.com/integrate-with-ai", "seen": "2026-10-08" }, { "what": "hosted integration skill", "url": "https://docs.ship24.com/assets/ai/skills/ship24-tracking-api-integration/SKILL.md", "seen": "2026-10-08" }, { "what": "OpenAPI 3.1 spec", "url": "https://docs.ship24.com/assets/openapi/ship24-tracking-api.yaml", "seen": "2026-10-08" }, { "what": "rate limiter", "url": "https://docs.ship24.com/rate-limiter", "seen": "2026-10-08" }, { "what": "error management", "url": "https://docs.ship24.com/errors", "seen": "2026-10-08" }, { "what": "trackers", "url": "https://docs.ship24.com/trackers", "seen": "2026-10-08" }, { "what": "data format, API evolution and deprecated fields", "url": "https://docs.ship24.com/data-format", "seen": "2026-10-08" }, { "what": "couriers", "url": "https://docs.ship24.com/couriers", "seen": "2026-10-08" }, { "what": "statuses and sample tracking numbers", "url": "https://docs.ship24.com/status/", "seen": "2026-10-08" }, { "what": "per-call API", "url": "https://docs.ship24.com/per-call-api", "seen": "2026-10-08" }, { "what": "webhook authentication", "url": "https://docs.ship24.com/webhooks/authentication", "seen": "2026-10-08" }, { "what": "webhook sending behaviour, retries and IPs", "url": "https://docs.ship24.com/webhooks/delivery", "seen": "2026-10-08" }, { "what": "support", "url": "https://docs.ship24.com/support/introduction", "seen": "2026-10-08" }, { "what": "MCP endpoint, initialize and tools/list without a key", "url": "https://api.ship24.com/mcp", "seen": "2026-10-08" }, { "what": "REST API response without a key (400, rate limit headers)", "url": "https://api.ship24.com/public/v1/couriers", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=ship24", "seen": "2026-10-08" }, { "what": "AI plugin repository, README, SECURITY.md, changelog", "url": "https://github.com/ship24/ship24-ai-plugin", "seen": "2026-10-08" }, { "what": "Node SDK repository, README, changelog, CI", "url": "https://github.com/ship24/ship24-node", "seen": "2026-10-08" }, { "what": "vendor repositories", "url": "https://api.github.com/users/ship24/repos?per_page=100\u0026sort=pushed", "seen": "2026-10-08" }, { "what": "npm package", "url": "https://registry.npmjs.org/ship24", "seen": "2026-10-08" }, { "what": "npm weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/ship24", "seen": "2026-10-08" }, { "what": "security.txt (404)", "url": "https://www.ship24.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "Statuspage address (inactive)", "url": "https://ship24.statuspage.io/", "seen": "2026-10-08" }, { "what": "domain registration (RDAP)", "url": "https://rdap.verisign.com/com/v1/domain/ship24.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: whether the free plan asks for a card. The dashboard at dashboard.ship24.com needs an account, and we didn't sign up.", "unchecked: API key rotation and revocation in the dashboard. The docs say keys are viewed and managed there, and the plugin's security note says a key can be revoked.", "unchecked: GitHub issues on ship24-node (four open) and ship24-ai-plugin (two open), and how quickly they are answered.", "No status page was found. status.ship24.com failed to resolve from two readers and ship24.statuspage.io redirects to an inactive page. Ship24 may publish one at an address we didn't find.", "The Application developer and API agreement and the Ship24 Data Processing Agreement named in the terms were not found on the site, so `provenance.terms` points at the Terms and Conditions.", "The Terms and Conditions carry no effective date or version.", "A second registry entry, io.github.ship24-official/ship24-tracking, describes a stdio server from a different GitHub account. We didn't establish whether Ship24 runs that account and left it out.", "The listing covers the Tracking API. Ship24's tracking pages, delivery notifications, IOSS and Ship from China services have no API in the reviewed documentation.", "Courier count (2,500+) is the vendor's figure. We didn't fetch `GET /couriers`, which needs a key." ] }, "negative": 0, "verdict": "The REST API and the hosted MCP server share one public OpenAPI 3.1 spec, numbered rate limits with Retry-After, and tracker creation that is idempotent by payload. No status page, SLA or security certification was found, API keys carry no scopes, and the API agreement and data processing agreement named in the terms aren't published.", "bestFor": "An agent that only needs tracking events across many couriers, by webhook or by lookup, from a tracking number alone.", "strengths": [ "Public OpenAPI 3.1 spec with 12 operations and two webhook definitions, plus llms.txt and a hosted `SKILL.md` integration guide", "Hosted MCP server at `https://api.ship24.com/mcp` with 12 tools, each carrying read-only, destructive and idempotent annotations and an output schema", "Rate limits are published per endpoint (1 to 10 requests a second) with `RateLimit-*`, `X-RateLimit-*` and `Retry-After` headers", "`POST /trackers` and `POST /trackers/track` are idempotent for an identical payload, and `clientTrackerId` is checked for uniqueness", "Prices are public for both billing models, with a free API plan of 10 shipments a month and sample tracking numbers for each status" ], "weaknesses": [ "No status page was found. `status.ship24.com` doesn't resolve, and neither the site nor the docs link to one", "The terms supply the service as is, with no uptime commitment, and allow account termination and data deletion without notice", "API keys have no scopes or read-only mode. The docs describe up to 20 keys an account, managed in the dashboard", "Webhooks are authenticated by a static secret in the `Authorization` header, with no payload signature", "The API agreement and the data processing agreement named in the terms, and a subprocessor list, were not found on the site" ], "agentNotes": [ "Send `Authorization: Bearer apik_...` to `https://api.ship24.com/public/v1`. The same key works on the MCP server, which lists tools without a key but answers 401 on calls", "Store the `trackerId` or set a unique `clientTrackerId`. Tracking numbers aren't unique, and any changed field on a repeat `POST /trackers` creates a second tracker that uses quota", "Allow up to 60 seconds for the first `POST /trackers/track` or `POST /tracking/search` call, since results are fetched from the courier synchronously", "Cache `GET /couriers`. It is limited to one request a second and returns the whole courier list, and courier auto-detection usually makes `courierCode` unnecessary", "Check for `quota_limit_reached` and `no_active_subscription`. `POST /tracking/search` needs a separate per-call plan, and the free plan blocks at 10 shipments a month" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55 } ], "editorialScores": { "ergonomics": 68, "maintenance": 80, "payments": 30, "reliability": 45, "schema": 81, "security": 37, "transparency": 38 }, "provenanceScore": 65 }, "connect": { "install": "npm install ship24", "http": "curl -sS -X POST https://api.ship24.com/public/v1/trackers/track \\\n -H \"Authorization: Bearer $SHIP24_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{ \"trackingNumber\": \"SHIP24_SAMPLE_DELIVERED_000\" }'", "claudeCode": "claude mcp add --transport http ship24-tracking https://api.ship24.com/mcp -H \"Authorization: Bearer apik_your_key_here\"", "config": { "mcpServers": { "ship24-tracking": { "headers": { "Authorization": "Bearer apik_your_key_here" }, "type": "http", "url": "https://api.ship24.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/shipping.tracking", "tool": "https://letme.dev/ship24" }, "notable": [ "The hosted MCP server at https://api.ship24.com/mcp lists 12 tools without a key and answers calls only with one. Each tool has annotations and an output schema (https://docs.ship24.com/integrate-with-ai)", "The server is in the official MCP registry as com.ship24/tracking-mcp, version 1.0.1 published 27 August 2026 (https://registry.modelcontextprotocol.io/v0/servers?search=ship24)", "ship24-ai-plugin packages eight skills, a read-only integration reviewer agent and the MCP configuration for Claude Code, Cursor, Codex, Gemini CLI and Copilot (https://github.com/ship24/ship24-ai-plugin)", "Two billing models with separate endpoints. Per-shipment plans use trackers and webhooks, and per-call plans use `POST /tracking/search`, which fetches from the courier on each call (https://docs.ship24.com/per-call-api)", "Sample tracking numbers such as SHIP24_SAMPLE_DELIVERED_000 simulate each status milestone for testing (https://docs.ship24.com/status/)", "Ship24 says it covers more than 2,500 couriers and third-party logistics firms, with the courier detected from the tracking number (https://www.ship24.com/tracking-api)", "Section 7.5 of the terms covers access through AI platforms by MCP and applies the same usage restrictions (https://www.ship24.com/terms)", "No status page was found. status.ship24.com doesn't resolve and ship24.statuspage.io is inactive (checked 2026-10-08)" ], "area": "business", "details": [ { "label": "API", "value": "REST at https://api.ship24.com/public/v1, JSON, 12 operations. Create, bulk create (up to 100), list, get and update trackers, get results by tracker or tracking number, create and track in one call, per-call search, list couriers, resend webhooks and download webhook history" }, { "label": "MCP server", "value": "Hosted at https://api.ship24.com/mcp, Streamable HTTP, Bearer API key, version 1.0.1. 12 tools (create_tracker, bulk_create_trackers, track, list_trackers, get_tracker, update_tracker, get_tracking_results, search_tracking_by_number, get_couriers, search_tracking, resend_webhooks, download_webhook_history), registered by the plan on the key" }, { "label": "Credentials", "value": "API key (`apik_...`) as a Bearer token. Up to 20 active keys an account, managed in the dashboard. No scopes" }, { "label": "Getting access", "value": "Self-serve signup at dashboard.ship24.com. A plan, free or paid, must be chosen before the default key is created" }, { "label": "Testing", "value": "No separate sandbox. The free plan and sample tracking numbers (SHIP24_SAMPLE_\u003cSTATUS\u003e_000) simulate each of the eight status milestones" }, { "label": "Rate limits", "value": "A second, per endpoint. 10 on most, 3 on `POST /trackers/bulk`, 1 on `GET /couriers` and on webhook resend. `RateLimit-*`, `X-RateLimit-*` and `Retry-After` headers" }, { "label": "Lists", "value": "`GET /trackers` takes `page`, `limit` (default 100, maximum 500) and `sort`. `GET /couriers` returns the whole list" }, { "label": "Errors", "value": "JSON `errors` array of `code` and `message`. 12 documented codes, among them validation_error, quota_limit_reached, no_active_subscription, tracker_conflict and request_conflict (409)" }, { "label": "Idempotency", "value": "`POST /trackers` and `POST /trackers/track` reuse the tracker for an identical payload. Any changed field creates a new tracker. `clientTrackerId` is unique across subscribed trackers. Bulk create isn't fully idempotent" }, { "label": "Statuses", "value": "`statusMilestone` on every event (pending, info_received, in_transit, out_for_delivery, failed_attempt, available_for_pickup, delivered, exception), plus `statusCategory` and `statusCode`" }, { "label": "Webhooks", "value": "One URL set in the dashboard. A static secret in the `Authorization` header, up to 20 retries with exponential backoff, replay by tracker, sent from 54.161.7.2. Order isn't guaranteed" }, { "label": "Limits", "value": "Tracking numbers of 5 to 50 characters. Up to three courier codes a request and nine a shipment. Trackers with a shipping date more than 180 days old are rejected" }, { "label": "Plans", "value": "Per shipment, Free (10 a month), Pro from $39 for 1,000 to 1,000,000 a month, Enterprise by sales. Per call, from $99 for 10,000 calls to $5,999 for 1.5 million. Monthly billing only, by card through Stripe" }, { "label": "Add-ons", "value": "Shipment Dashboard from $10 a month, Proof of Delivery, AI Predictive Delivery Date and AI Analytics at $9 a month each, first month free" }, { "label": "SDK and plugin", "value": "`ship24` on npm, 1.1.0 (6 October 2026), Node 18+, no runtime dependencies, MIT. ship24-ai-plugin 1.0.0 (9 September 2026) with eight skills. An n8n node is also in the vendor's GitHub account" }, { "label": "Support", "value": "Contact form on ship24.com. Dedicated customer support is listed from the Pro plan" } ], "unitPrices": [ { "item": "Tracking API Pro, 1,000 shipments", "unit": "month", "usd": 39, "note": "$0.039 a shipment; tiers up to 1,000,000 a month" }, { "item": "Extra tracked shipment", "unit": "tx", "usd": 0.045, "note": "on the 1,000 tier; $0.010 on the 1,000,000 tier" }, { "item": "Per-call plan, 10,000 calls", "unit": "month", "usd": 99, "note": "separate subscription for `POST /tracking/search`" }, { "item": "Extra per-call lookup", "unit": "call", "usd": 0.015, "note": "on the 10,000 tier; $0.007 on the 1.5 million tier" } ], "provenance": { "legalEntity": "Ship24 Limited", "domain": "ship24.com", "domainRegistered": "2005-09-18", "endpointOnVendorDomain": true, "terms": "https://www.ship24.com/terms", "privacy": "https://www.ship24.com/privacy-policy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Terms and Conditions say Ship24 Limited, a company registered in Hong Kong, is the party called Ship24, and place disputes with the courts of Hong Kong. They carry no date or version.", "The terms govern accounts, fees and the API, and say an Application developer and API agreement and a Data Processing Agreement also apply. Neither document was found on the site.", "The privacy policy was last updated in August 2026 and has a section on the MCP integration. It names UAB Clefino of Lithuania as a group company for the IOSS service.", "The about page lists offices in Hong Kong, Tremblay-en-France and Vilnius.", "www.ship24.com, docs.ship24.com and api.ship24.com have no security.txt. SECURITY.md in ship24-ai-plugin gives contact@ship24.com for reports.", "No status page and no API changelog were found. The Node SDK and the plugin each keep a CHANGELOG.md on GitHub.", "RDAP for ship24.com gives a registration date of 2005-09-18." ], "score": 65, "checks": [ { "check": "Legal entity named", "value": "Ship24 Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "ship24.com, registered 2005-09-18 (21 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.ship24.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 1 clause that costs points", "points": 6.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 6 of the 8 things a reader expects", "points": 8.5, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://www.ship24.com/terms", "state": "read", "readAt": "2026-10-08", "words": 6916, "points": 6.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "18.1 These terms of use will be governed by and construed in accordance with the laws of Hong Kong, without giving effect to any conflict of laws rules or provisions.", "says": "The law of Hong Kong" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…these terms, whether in contract, tort (including negligence), strict liability, or otherwise, shall not exceed the price paid by you during the twelve (12) months immediately preceding the first event giving rise to any claim for damages.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "We may suspend or terminate your use of the Service if you are not complying with these Terms, the Documentation, or if you use the Services in any way that could cause us legal liability or disrupt others’ use of the Services." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "to modify or update any of the Terms of Use, said modification or update being effective upon its posting on the Site;", "says": "Changes are posted, with no other notice named" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You may not use the Site if you are not of legal age to form a binding contract and otherwise capable of entering into these Terms." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "(o) not to use or access the Service in order to monitor the availability, performance or functionality of the Service or for any other similar benchmarking purposes;", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Ship24 reserves the right in its sole discretion to terminate Your Account, delete Your profile and any of Your Data and restrict Your use of all or any part of the Service for any or no reason, without notice, and without liability to you or anyone else." } ], "notes": [ { "date": "2026-10-08", "text": "Use of the service through a third-party AI assistant or agent platform is also governed by that platform's terms, and the section 3.4 restrictions apply to such access.", "quote": "Your access to and use of the Service through any AI Platform is additionally governed by that AI Platform's own terms of use and policies." }, { "date": "2026-10-08", "text": "Ship24 may treat an account as inactive and permanently delete it and its data when the user has not logged in for 12 or more months.", "quote": "If User does not log in to the Account for 12 or more months, Ship24 may treat the Account as \"inactive\" and permanently delete the Account, Your Data and any other data associated with it." }, { "date": "2026-10-08", "text": "Ship24 may use, combine, disclose, analyse and create derivative works of anonymised data, which includes customer data with identifying information removed.", "quote": "Ship24 shall be authorized to use, combine, disclose, analyze and create derivative works of all Anonymized Data." } ] }, { "kind": "privacy", "url": "https://www.ship24.com/privacy-policy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-08-01", "words": 2843, "points": 8.5, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: August 2026.", "says": "Last updated 2026-08-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": false }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Retention: unless stated otherwise in the relevant sections below, we retain account-related personal data for as long as your account remains active.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Stripe is certified as a PCI DSS Level 1 service provider, and applies Strong Customer Authentication (3-D Secure) where required." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Where GDPR applies, the legal basis for account creation and account administration is typically Article 6(1)(b) GDPR (performance of a contract or steps at your request)." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "About Us Contact Us Privacy Policy Terms" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Within the scope of the activities described above, your personal data may be transferred to and processed in countries outside the EEA, which may have different data protection standards from your country of residence." } ], "notes": [ { "date": "2026-10-08", "text": "Queries made through a third-party AI assistant and Ship24's responses pass through that platform, whose own privacy policy governs the conversation data.", "quote": "Third-party platform: your query and Ship24's response pass through the AI assistant platform (e.g., OpenAI) as part of that conversation." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ship24.json", "live": { "slug": "ship24", "probe": { "target": "https://api.ship24.com/public/v1", "method": "get", "lastAt": "2026-10-08T21:12:21.34039578Z", "lastOk": true, "lastStatus": 404, "lastMs": 246, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 259, "p95ms24h": 354, "samples24h": 21, "samples30d": 21, "days": [ { "date": "2026-10-08", "probes": 21, "ok": 21 } ] }, "updatedAt": "2026-10-08T21:12:21.34039578Z" } } }