{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "shippo", "name": "Shippo", "vendor": "Shippo", "vendorUrl": "https://goshippo.com", "kind": "http-api", "category": "shipping", "summary": "Multi-carrier shipping API from Shippo. It quotes rates, buys labels, validates addresses, tracks parcels and creates return labels across the carriers it connects, through a REST API, official SDKs and a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/shippo", "markdownUrl": "https://www.anchorterminal.com/tools/shippo.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shippo.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shippo.json", "repo": "https://github.com/goshippo/ai", "license": "Proprietary service under Shippo's terms of use. The SDKs and the goshippo/ai repository (skills and MCP bridge) are MIT", "transports": [ "http" ], "remoteUrl": "https://api.goshippo.com", "packages": [ { "registry": "npm", "name": "shippo" }, { "registry": "pypi", "name": "shippo" }, { "registry": "npm", "name": "@shippo/shippo-mcp" } ], "auth": "mixed", "authNotes": "Self-serve API key. A person signs up at apps.goshippo.com/join and creates live (shippo_live_) and test (shippo_test_) keys in the API portal, with no review. Calls send `Authorization: ShippoToken \u003ckey\u003e`. Keys are shown once, can be deleted and replaced, and have no scopes. The hosted MCP server at mcp.shippo.com uses per-user OAuth against the live account, with one scope (\"*\"). OAuth credentials for a platform acting for other Shippo accounts come from the sales team. Client-side apps can use a 12-hour JWT from POST /embedded/authz.", "pricing": "freemium", "pricingNotes": "API Starter has no monthly fee. The first 30 labels a month are free, then 7 cents a label, on top of postage. Calls not tied to a Shippo label are charged per unit (see the price table). API Premier is custom, with volume discounts, through sales. Test mode is free with a test key, so an agent can start without a contract, and billing details are needed for live labels (https://goshippo.com/pricing/api).", "priceSummary": "$0.07 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI spec or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": 4, "popularity": { "githubStars": 3, "npmWeekly": 73114, "pypiWeekly": 20036, "asOf": "2026-10-07" }, "docsUrl": "https://docs.goshippo.com", "llmsTxt": "https://docs.goshippo.com/llms.txt", "openapi": "https://docs.goshippo.com/spec/shippoapi/public-api.yaml", "registryName": "com.shippo/shippo-mcp", "capabilities": [ "shipping.rates", "shipping.labels", "shipping.tracking", "shipping.address-validation", "shipping.returns" ], "tags": [ "hosted", "freemium", "free-tier", "api-key", "oauth", "mcp", "openapi", "llms-txt", "python", "typescript", "java", "webhooks", "sandbox", "status-page", "soc2" ], "lastRelease": "2026-10-01", "graded": true, "anchor": { "graded": true, "score": 61.9, "grade": "C", "agentReady": false, "rank": 317, "ranked": true, "rankOf": 629, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 77, "payments": 40, "reliability": 59, "schema": 83, "security": 52, "transparency": 61 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 59, "points": 11.8, "reason": "Read with the hosted lines and scored on the REST API at api.goshippo.com. Statuspage at status.goshippo.com with components for the REST API, the dashboard and each carrier (20). From 9 July to 7 October 2026 the history holds about 115 incidents outside maintenance, almost all on one carrier's rating, label or tracking service. None names the Shippo REST API. A third-party tracking vendor had elevated errors for 9 hours on 25 August, marked major, and USPS or Canada Post label creation failed for hours on several days, so we read this as one major rather than minor only (10 of 30). Per-minute limits per endpoint, live and test (15). The docs say a 429 is returned and nothing more. No Retry-After or backoff guidance was found, and label purchase takes no idempotency key, though the TypeScript SDK has a configurable backoff retry (4 of 15). No SLA found. API Premier lists paid 24/7 monitoring as an add-on (0). GA (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 83, "points": 13.49, "reason": "OpenAPI 3.1 spec for the main API with 71 operations, and six further specs for addresses v2, estimates, reporting, invoices and surcharges (25). llms.txt at docs.goshippo.com and a Markdown copy of each page (10). Descriptions state purpose and some conditions, such as the 390-day limit on shipments and when a batch is asynchronous, but rarely when not to use an endpoint (13 of 20). 94 enums and required fields marked. The 400 response schema is an open object, and weights and dimensions are strings (11 of 15). 427 examples in the spec and samples in six languages. The spec documents 400 on 66 operations, 401 and 404 once each and never 429, and the status-code page is one line per code (9 of 15). Dated API versions set by the Shippo-API-Version header and dated release notes (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 64, "points": 10.4, "reason": "Scored on the REST API, with the MCP server noted. List calls take `results` and `page`, and `expand` controls nested objects, but there's no field selection and a shipment returns every rate. The MCP server has four tools (list, describe, read-execute, write-execute) over 73 operations, which keeps definitions small (17 of 25). Pagination on every list. Date filters exist only on shipments, within a 90-day range (14 of 20). Status codes are documented in general terms and the error body is untyped. The goshippo/ai repository has an error reference with recovery steps for MCP use (12 of 20). No idempotency key on shipments, transactions or refunds. The Reporting API accepts `idempotency_key`. The MCP read and write split lets a client approve writes. Its annotations sit behind sign-in and weren't read (8 of 20). Official SDKs for Python, TypeScript, Java, C# and PHP. Shipments and transactions default to asynchronous, and objects can't be edited after creation (13 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 52, "points": 9.1, "reason": "Self-serve API keys, live and test kept apart, shown once, deletable in the portal, with no scopes and no documented expiry. The OAuth flow for platforms has one scope, \"*\". JWTs for client-side use last 12 hours (20 of 30). A webhook can carry a self-made token in its URL query string. That is the receiver's secret, not the API credential, so we noted it without the deduction. No read-only key. Test keys can't spend money, and the MCP server separates reads from writes and its docs say writes ask for confirmation (9 of 20). Tracking events, metadata and address text come from carriers and other parties. The AI repository's security policy puts prompt injection in scope for reports, with no guidance in the API docs (5 of 15). The API portal is described as showing usage. No audit log was found in the docs (3 of 15). The trust centre lists SOC 2 Type II (November 2024 to November 2025), PCI DSS SAQ-A, an annual third-party penetration test and a bug bounty. security.txt returns 404, as does goshippo.com/security, which the repository names as the disclosure page (15 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 (0). Per-unit prices are public without a login. API Starter is 7 cents a label after 30 free a month, 1 cent a rate request, 2 cents a tracking request, 2 cents a US address validation and 8 cents elsewhere, plus the postage itself (20). Signup is free, and test keys create test labels and mock tracking at no charge. The docs say billing details are needed only for live label purchase. We didn't open an account to confirm (20). A person signs up in a browser and creates the key in the portal, or signs in through OAuth for the MCP server (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 77, "points": 6.74, "reason": "The API release notes were last updated on 1 October 2026 (30). Six dated entries since 9 July, including the Reporting API on 15 September and a tracking fix on 23 September (20). Closed service with dated release notes and a support portal. The SDK repositories show 9 and 4 open issues, and the TypeScript SDK's last release is 2.18.0 on 4 February 2026 (9 of 15). The MCP server is in the official registry as com.shippo/shippo-mcp, verified by DNS. Official SDKs exist in five languages, but PyPI's latest is 3.9.0 from 26 November 2024 and the SDK page says the libraries are being updated (12 of 15). SDKs are generated and validated by CI workflows, and goshippo/ai has test and validation workflows, last tagged 23 July (6 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 61, "points": 5.34, "note": "editorial 38, provenance 84", "reason": "Closed service. The terms of use sit in a privacy centre that loads only with JavaScript, so we couldn't read them or confirm the contracting entity. SDKs and the goshippo/ai repository are MIT (12 of 30). The privacy notice has the same problem. The trust centre links a Data Processing Addendum and says data is encrypted in transit and at rest, and the release notes say shipments and rates are retrievable for 390 days. No retention periods were read (8 of 30). The versioning page says accounts are never forced onto a new API version, and notices carry dates, such as the 13 January 2026 notice to re-register FedEx accounts before 31 March. Carrier removals are announced on the day (12 of 20). The trust centre names AWS and says third parties are used. No subprocessor list was found. Webhook addresses are published for US and EU regions (6 of 20)." } ], "assessment": { "date": "2026-10-07", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Scored on the REST API, with the MCP server noted. List calls take `results` and `page`, and `expand` controls nested objects, but there's no field selection and a shipment returns every rate. The MCP server has four tools (list, describe, read-execute, write-execute) over 73 operations, which keeps definitions small (17 of 25). Pagination on every list. Date filters exist only on shipments, within a 90-day range (14 of 20). Status codes are documented in general terms and the error body is untyped. The goshippo/ai repository has an error reference with recovery steps for MCP use (12 of 20). No idempotency key on shipments, transactions or refunds. The Reporting API accepts `idempotency_key`. The MCP read and write split lets a client approve writes. Its annotations sit behind sign-in and weren't read (8 of 20). Official SDKs for Python, TypeScript, Java, C# and PHP. Shipments and transactions default to asynchronous, and objects can't be edited after creation (13 of 15).", "maintenance": "The API release notes were last updated on 1 October 2026 (30). Six dated entries since 9 July, including the Reporting API on 15 September and a tracking fix on 23 September (20). Closed service with dated release notes and a support portal. The SDK repositories show 9 and 4 open issues, and the TypeScript SDK's last release is 2.18.0 on 4 February 2026 (9 of 15). The MCP server is in the official registry as com.shippo/shippo-mcp, verified by DNS. Official SDKs exist in five languages, but PyPI's latest is 3.9.0 from 26 November 2024 and the SDK page says the libraries are being updated (12 of 15). SDKs are generated and validated by CI workflows, and goshippo/ai has test and validation workflows, last tagged 23 July (6 of 10).", "payments": "No x402, MPP or L402 (0). Per-unit prices are public without a login. API Starter is 7 cents a label after 30 free a month, 1 cent a rate request, 2 cents a tracking request, 2 cents a US address validation and 8 cents elsewhere, plus the postage itself (20). Signup is free, and test keys create test labels and mock tracking at no charge. The docs say billing details are needed only for live label purchase. We didn't open an account to confirm (20). A person signs up in a browser and creates the key in the portal, or signs in through OAuth for the MCP server (0).", "reliability": "Read with the hosted lines and scored on the REST API at api.goshippo.com. Statuspage at status.goshippo.com with components for the REST API, the dashboard and each carrier (20). From 9 July to 7 October 2026 the history holds about 115 incidents outside maintenance, almost all on one carrier's rating, label or tracking service. None names the Shippo REST API. A third-party tracking vendor had elevated errors for 9 hours on 25 August, marked major, and USPS or Canada Post label creation failed for hours on several days, so we read this as one major rather than minor only (10 of 30). Per-minute limits per endpoint, live and test (15). The docs say a 429 is returned and nothing more. No Retry-After or backoff guidance was found, and label purchase takes no idempotency key, though the TypeScript SDK has a configurable backoff retry (4 of 15). No SLA found. API Premier lists paid 24/7 monitoring as an add-on (0). GA (10).", "schema": "OpenAPI 3.1 spec for the main API with 71 operations, and six further specs for addresses v2, estimates, reporting, invoices and surcharges (25). llms.txt at docs.goshippo.com and a Markdown copy of each page (10). Descriptions state purpose and some conditions, such as the 390-day limit on shipments and when a batch is asynchronous, but rarely when not to use an endpoint (13 of 20). 94 enums and required fields marked. The 400 response schema is an open object, and weights and dimensions are strings (11 of 15). 427 examples in the spec and samples in six languages. The spec documents 400 on 66 operations, 401 and 404 once each and never 429, and the status-code page is one line per code (9 of 15). Dated API versions set by the Shippo-API-Version header and dated release notes (15).", "security": "Self-serve API keys, live and test kept apart, shown once, deletable in the portal, with no scopes and no documented expiry. The OAuth flow for platforms has one scope, \"*\". JWTs for client-side use last 12 hours (20 of 30). A webhook can carry a self-made token in its URL query string. That is the receiver's secret, not the API credential, so we noted it without the deduction. No read-only key. Test keys can't spend money, and the MCP server separates reads from writes and its docs say writes ask for confirmation (9 of 20). Tracking events, metadata and address text come from carriers and other parties. The AI repository's security policy puts prompt injection in scope for reports, with no guidance in the API docs (5 of 15). The API portal is described as showing usage. No audit log was found in the docs (3 of 15). The trust centre lists SOC 2 Type II (November 2024 to November 2025), PCI DSS SAQ-A, an annual third-party penetration test and a bug bounty. security.txt returns 404, as does goshippo.com/security, which the repository names as the disclosure page (15 of 20).", "transparency": "Closed service. The terms of use sit in a privacy centre that loads only with JavaScript, so we couldn't read them or confirm the contracting entity. SDKs and the goshippo/ai repository are MIT (12 of 30). The privacy notice has the same problem. The trust centre links a Data Processing Addendum and says data is encrypted in transit and at rest, and the release notes say shipments and rates are retrievable for 390 days. No retention periods were read (8 of 30). The versioning page says accounts are never forced onto a new API version, and notices carry dates, such as the 13 January 2026 notice to re-register FedEx accounts before 31 March. Carrier removals are announced on the day (12 of 20). The trust centre names AWS and says third parties are used. No subprocessor list was found. Webhook addresses are published for US and EU regions (6 of 20)." }, "sources": [ { "what": "docs index (llms.txt)", "url": "https://docs.goshippo.com/llms.txt", "seen": "2026-10-07" }, { "what": "rate limits", "url": "https://docs.goshippo.com/api-concepts/rate-limits.md", "seen": "2026-10-07" }, { "what": "authentication and keys", "url": "https://docs.goshippo.com/guides/authentication.md", "seen": "2026-10-07" }, { "what": "test mode", "url": "https://docs.goshippo.com/guides/testing.md", "seen": "2026-10-07" }, { "what": "API release notes", "url": "https://docs.goshippo.com/api-concepts/api-change-log.md", "seen": "2026-10-07" }, { "what": "API versioning", "url": "https://docs.goshippo.com/api-concepts/api-versioning.md", "seen": "2026-10-07" }, { "what": "HTTP status codes", "url": "https://docs.goshippo.com/api-concepts/apihttp-status-codes.md", "seen": "2026-10-07" }, { "what": "filtering and pagination", "url": "https://docs.goshippo.com/api-concepts/filtering.md", "seen": "2026-10-07" }, { "what": "OpenAPI spec", "url": "https://docs.goshippo.com/spec/shippoapi/public-api.yaml", "seen": "2026-10-07" }, { "what": "MCP server guide", "url": "https://docs.goshippo.com/guides/mcp-server.md", "seen": "2026-10-07" }, { "what": "OAuth for platforms", "url": "https://docs.goshippo.com/o-auth-integrations/o-auth.md", "seen": "2026-10-07" }, { "what": "webhook security", "url": "https://docs.goshippo.com/tracking/webhook-security.md", "seen": "2026-10-07" }, { "what": "Reporting API concepts (idempotency)", "url": "https://docs.goshippo.com/reporting-api/concepts.md", "seen": "2026-10-07" }, { "what": "SDKs", "url": "https://docs.goshippo.com/guides/client-libraries.md", "seen": "2026-10-07" }, { "what": "API pricing", "url": "https://goshippo.com/pricing/api", "seen": "2026-10-07" }, { "what": "status history", "url": "https://status.goshippo.com/history", "seen": "2026-10-07" }, { "what": "status incidents (JSON)", "url": "https://status.goshippo.com/api/v2/incidents.json", "seen": "2026-10-07" }, { "what": "trust centre", "url": "https://trust.goshippo.com/", "seen": "2026-10-07" }, { "what": "AI repository (skills, MCP bridge, security policy)", "url": "https://github.com/goshippo/ai", "seen": "2026-10-07" }, { "what": "TypeScript SDK repository", "url": "https://github.com/goshippo/shippo-javascript-sdk", "seen": "2026-10-07" }, { "what": "Python SDK on PyPI", "url": "https://pypi.org/pypi/shippo/json", "seen": "2026-10-07" }, { "what": "MCP registry entry", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=shippo", "seen": "2026-10-07" }, { "what": "MCP protected-resource metadata", "url": "https://mcp.shippo.com/.well-known/oauth-protected-resource", "seen": "2026-10-07" }, { "what": "terms of use (JavaScript only, not read)", "url": "https://privacy.goshippo.com/policies?name=terms-of-use", "seen": "2026-10-07" } ], "openQuestions": [ "unchecked: the terms of use and privacy notice at privacy.goshippo.com load only with JavaScript, so the contracting legal entity, governing law, retention periods and any AI training statement weren't read", "unchecked: the hosted MCP server's tool definitions and annotations, which need a Shippo sign-in", "unchecked: whether signup asks for a card before a test key is issued. The docs say billing details are needed only for live labels", "unchecked: the SOC 2 report, DPA text and bug bounty terms, which the trust centre gives on request", "Whether the 390-day limit on retrieving shipments and rates (release note of 6 April 2026) had advance notice", "Whether an SLA exists on API Premier. None is published", "Whether the API returns Retry-After on a 429. The docs and the spec don't say" ] }, "negative": 0, "verdict": "Per-label and per-call prices are public, test keys are self-serve, and the OpenAPI spec, llms.txt and Markdown docs are open to a fetch. Label purchase has no idempotency key, API keys carry no scopes, and the status page logged carrier-side incidents on most days between July and October 2026.", "bestFor": "An agent that quotes and buys parcel labels across USPS, UPS, FedEx and DHL Express for a small or mid-size shipper, with a free test mode and public unit prices.", "strengths": [ "Public prices per unit, 7 cents a label after 30 free a month, 1 cent a rate request and 2 cents a tracking request", "Test keys (shippo_test_) create free test labels and mock tracking, with data kept apart from live", "OpenAPI 3.1 spec with 71 operations, plus llms.txt and a Markdown copy of each docs page", "Hosted MCP server at mcp.shippo.com with four tools, reads and writes split so a client can require approval for writes", "Rate limits published per endpoint, with separate live and test figures", "SOC 2 Type II and PCI DSS listed on the trust centre, with an annual third-party penetration test" ], "weaknesses": [ "No idempotency key on label purchase or other writes. Only the Reporting API accepts one", "API keys have no scopes or read-only mode, and the OAuth flow has one scope, \"*\"", "The hosted MCP server runs on the live account only, with no test mode", "Carrier-side incidents on the status page on most days from July to October 2026, many marked major or critical", "Terms of use and privacy notice load only with JavaScript, and no SLA or subprocessor list was found", "The Python SDK on PyPI is 3.9.0 from 26 November 2024" ], "agentNotes": [ "Build and test with a shippo_test_ key. Test and live object IDs are separate, and the hosted MCP server has no test mode", "Send `Authorization: ShippoToken \u003ckey\u003e`, not Bearer, and pin `Shippo-API-Version: 2018-02-08`", "Before retrying a failed POST /transactions, list recent transactions. There is no idempotency key, and a second purchase is a second charge", "Pass `async: false` on shipments and transactions, or poll the object until its status leaves QUEUED", "Set `results` on list calls (under 200). Defaults vary by resource, and list calls are limited to 50 a minute on live keys" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.9 } ], "editorialScores": { "ergonomics": 64, "maintenance": 77, "payments": 40, "reliability": 59, "schema": 83, "security": 52, "transparency": 38 }, "provenanceScore": 84 }, "connect": { "install": "npm install shippo", "http": "curl https://api.goshippo.com/shipments/ \\\n -H \"Authorization: ShippoToken \u003cAPI_TOKEN\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -d '{...}'", "claudeCode": "claude mcp add --transport http shippo https://mcp.shippo.com", "config": { "mcpServers": { "shippo": { "url": "https://mcp.shippo.com" } } } }, "letme": { "capability": "https://letme.dev/shipping.rates", "tool": "https://letme.dev/shippo" }, "notable": [ "API Starter charges 7 cents a label after 30 free a month, 1 cent a rate request, 2 cents a tracking request, 3 cents a delivery estimate, 2 cents a US address validation and 8 cents elsewhere (https://goshippo.com/pricing/api)", "The hosted MCP server at https://mcp.shippo.com has four tools (shippo_list_tools, shippo_describe_tool, shippo_read_execute_tool, shippo_write_execute_tool) over 73 operations, per the vendor's repository (https://github.com/goshippo/ai)", "The MCP server works on the live account only. Test labels and mock tracking need a shippo_test_ key against the REST API (https://docs.goshippo.com/guides/mcp-server)", "Rate limits per minute on live keys are 500 for POST, 4,000 for a single GET and 50 for a list on most endpoints, with test keys at about a tenth (https://docs.goshippo.com/api-concepts/rate-limits)", "The API version is 2018-02-08, set by the Shippo-API-Version header, with dated release notes last updated on 1 October 2026 (https://docs.goshippo.com/api-concepts/api-change-log)", "Shipment and rate objects can be retrieved for 390 days after creation, per the 6 April 2026 release note (https://docs.goshippo.com/api-concepts/api-change-log)", "A batch call can create up to 10,000 labels in one request (https://docs.goshippo.com/shipments/batch-label-creation)", "The status page lists a component per carrier, and most incidents name one carrier's rating, label or tracking service (https://status.goshippo.com/history)" ], "area": "business", "details": [ { "label": "API", "value": "REST at https://api.goshippo.com, version 2018-02-08, 71 operations in the OpenAPI 3.1 spec, with further specs for addresses v2, estimates, reporting, invoices and surcharges" }, { "label": "Access", "value": "Self-serve. Free signup, then live and test keys from the API portal. Platform OAuth credentials come from sales" }, { "label": "Test mode", "value": "shippo_test_ keys create free test labels and mock tracking numbers such as SHIPPO_TRANSIT. Test and live data are separate, and test rates may differ from live" }, { "label": "MCP server", "value": "Hosted at https://mcp.shippo.com over streamable HTTP with per-user OAuth, four tools over 73 operations, live account only. @shippo/shippo-mcp 3.0.4 on npm is a stdio bridge to it" }, { "label": "Rate limits", "value": "Per minute on live keys, 500 POST, 4,000 single GET, 50 list on most endpoints. Batch 50 POST and 400 GET. Tracking 750 POST and 500 GET. Test keys about a tenth" }, { "label": "Carriers", "value": "Shippo says 40+ carriers for labels, among them USPS, UPS, FedEx and DHL Express, on its own discounted accounts or the customer's" }, { "label": "Returns", "value": "Scan-based return labels for USPS, FedEx and UPS, charged only when used" }, { "label": "Refunds", "value": "POST /refunds with a transaction ID for an unused label, one label per request, subject to the carrier's policy" }, { "label": "SDKs", "value": "Official Python, TypeScript, Java, C# and PHP. npm shippo 2.18.0 (4 February 2026), PyPI shippo 3.9.0 (26 November 2024). Go is community-maintained" }, { "label": "Webhooks", "value": "Tracking, label and batch events. Secured by IP allowlist, a token in the URL, or HMAC set up through an account manager" }, { "label": "Compliance", "value": "SOC 2 Type II and PCI DSS SAQ-A listed on trust.goshippo.com, reports on request" } ], "unitPrices": [ { "item": "Label, API Starter, after 30 free a month, plus postage", "unit": "tx", "usd": 0.07 }, { "item": "Rate request not tied to a Shippo label", "unit": "call", "usd": 0.01 }, { "item": "Tracking request not tied to a Shippo label", "unit": "call", "usd": 0.02 }, { "item": "Delivery date estimate", "unit": "call", "usd": 0.03 }, { "item": "US address validation", "unit": "call", "usd": 0.02 }, { "item": "Non-US address validation", "unit": "call", "usd": 0.08 } ], "provenance": { "legalEntity": "Shippo", "domain": "goshippo.com", "domainRegistered": "2013-09-21", "endpointOnVendorDomain": true, "terms": "https://privacy.goshippo.com/policies?name=terms-of-use", "privacy": "https://privacy.goshippo.com/policies?name=privacy-notice", "statusPage": "https://status.goshippo.com", "changelog": "https://docs.goshippo.com/api-concepts/api-change-log", "securityTxt": "none", "checked": "2026-10-07", "notes": [ "The registered legal entity wasn't confirmed. goshippo.com/terms and /privacy redirect to a privacy centre that returns no policy text without JavaScript. The SDK licences name \"Shippo\" as copyright holder.", "RDAP for goshippo.com gives a registration date of 2013-09-21.", "The API answers at api.goshippo.com and the MCP server at mcp.shippo.com, whose OAuth metadata names https://goshippo.com as the authorisation server.", "goshippo.com/.well-known/security.txt and goshippo.com/security both return 404. The trust centre gives security@shippo.com and the AI repository's SECURITY.md gives security@goshippo.com.", "The trust centre at trust.goshippo.com lists a SOC 2 Type II report (November 2024 to November 2025), a 2026 bridge letter and a PCI SAQ-A attestation, each on request." ], "score": 84, "checks": [ { "check": "Legal entity named", "value": "Shippo", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "goshippo.com, registered 2013-09-21 (13 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.goshippo.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.goshippo.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://privacy.goshippo.com/policies?name=terms-of-use", "state": "unreadable", "reason": "the page has 0 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-08", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://privacy.goshippo.com/policies?name=privacy-notice", "state": "unreadable", "reason": "the page has 0 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-08", "points": 7, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shippo.json", "live": { "slug": "shippo", "probe": { "target": "https://api.goshippo.com", "method": "get", "lastAt": "2026-10-08T17:36:45.281641673Z", "lastOk": true, "lastStatus": 401, "lastMs": 143, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 149, "p95ms24h": 392, "samples24h": 25, "samples30d": 25, "days": [ { "date": "2026-10-08", "probes": 25, "ok": 25 } ] }, "vendorStatus": { "page": "https://status.goshippo.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T17:25:43.253068618Z" }, "versions": [ { "registry": "github", "name": "goshippo/ai", "version": "v1.5.4", "released": "2026-07-23", "seenAt": "2026-10-08T16:29:07.821314571Z" }, { "registry": "npm", "name": "@shippo/shippo-mcp", "version": "3.0.4", "seenAt": "2026-10-08T16:29:06.611030249Z" }, { "registry": "npm", "name": "shippo", "version": "2.18.0", "seenAt": "2026-10-08T16:29:05.577126262Z" }, { "registry": "pypi", "name": "shippo", "version": "3.9.0", "released": "2024-11-26", "seenAt": "2026-10-08T16:29:06.416959144Z" } ], "githubStars": 3, "npmWeekly": 73114, "pypiWeekly": 21417, "securityTxt": { "url": "https://goshippo.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-08T15:38:36.985520401Z" }, "updatedAt": "2026-10-08T17:36:45.281641673Z" } } }