atoship vs EasyPost

atoship 10

No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.

EasyPost 85

The releases page has an entry dated 29 October 2026, six days before this check, and the Node, Go, Java and C# libraries were tagged the same day (30). Eight dated release notes fall in the 90 days from 6 August (8, 15, 22 and 29 August, 25 and 28 September, 8 and 29 October), and every library had a release on 27 or 29 October (20). A closed service with public release notes, support@easypost.com, a help centre, ai@easypost.com for the MCP server and a published four-hour response target on the Base support tier. We didn't read GitHub issues or test response times (11 of 15). Seven official SDKs, each with a release on 27 or 29 October 2026: Node 9.1.0, Python 10.8.0, Go 5.12.0, Java 8.10.0, C# 7.12.0, PHP 8.9.0 and Ruby 7.8.0 (15). The Python library's CI lints and runs tests, per the 7 October check, and Node 9.0.0 moved to TypeScript and fetch (9 of 10, partly met). 30 + 20 + 11 + 15 + 9 = 85.

atoship 30

Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a RATE_LIMIT_EXCEEDED code are documented, without numbers (5 of 15). A 429 carries error.retryAfter and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

EasyPost 68

Read with the hosted lines and scored on the REST API at api.easypost.com/v2, the surface an agent would use to rate, buy and track. www.easypoststatus.com on Statuspage lists 44 components on its page, re-read 4 November 2026 (20). Its history feed covers the whole 90 days from 6 August. Five incidents fall in that window, each partial. On 27 August the Core APIs degraded briefly during a deployment, resolved 14 minutes after it was identified. On 20 September USPS Ship requests failed most of the time for about five and a half hours (09:55 to 15:19 PDT) on a USPS-side fault, on 23 September a subset of USPS Ship buys failed, on 5 October UPS Mail Innovations returned elevated errors, and on 8 October some rating and tracking requests timed out for about 73 minutes at the hosting provider. Announced maintenance windows (14, 21 and 28 August, and the USPS windows in October and November) are maintenance, not incidents. Minor incidents only (20). The rate-limiting guide gives five requests a second on index endpoints and a 60-account cap on rating, but the load-based limiter on buying and rating has no published number (8 of 15, partly met). The guide asks for retry with growing backoff on 429 and gives a code sample that retries only GET and DELETE. No Retry-After header, no idempotency keys and no stated safe-retry rule for writes on the REST API (10). The Master Customer Agreement supplies the service as is and as available, and the support addendum sets response targets only (0). The v2 API is generally available (10). 20 + 20 + 8 + 10 + 0 + 10 = 68.

atoship 45

Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.

EasyPost 71

The service is closed, under a Master Customer Agreement (version 6.1, effective 25 August 2026) and seven addenda in a legal centre that keeps every past version. The SDKs are MIT or ISC (15). The privacy policy (18 August 2025) gives no retention period. The agreement points to a Data Retention Policy in the help centre, which refused our reader, and it grants EasyPost a licence to use customer data to improve its services and develop new products during and after the term. A data processing addendum with EU and UK standard clauses is public (15 of 30). The agreement says EasyPost will use reasonable efforts to notify customers before API changes that aren't backwards compatible, with no notice period, and allows termination with a refund within 15 days if functionality is materially reduced. No deprecation policy with dates was found (6 of 20). Annex D of the addendum lists 12 subprocessors with purpose and country, all in the USA, and customers have 10 days to object to a new one (17 of 20). The legal centre was re-read on 4 November; the MCA is still version 6.1. 15 + 15 + 6 + 17 = 53.

atoship 40

No x402, MPP or L402 (0). Per-unit fees are published without a login ($0.08 a BYOCA label, $0.03 a tracking number or address check), and wallet postage is priced live in a public calculator (20). Free account with no card, and test keys (20). A person signs up in a browser and funds the wallet (0). 0 + 20 + 20 + 0 = 40.

EasyPost 22

Read with the hosted rubric. No x402, MPP or L402 (0). The API Addendum (version 4.3, effective 30 October 2026) publishes unit fees without a login ($0.02 for each extra tracker, US address verification or rating call, $0.06 for an international verification, $0.03 a SmartRate call), and the pricing page lists tracking at $0.01 to $0.03 a shipment and insurance at 1 per cent. The per-label fee after 3,000 free labels isn't stated, and Forge, GlobalShip and Luma are priced by sales (12 of 20). Up to 3,000 labels carry no EasyPost fee and test keys cost nothing, but postage is always paid, and the docs say a wallet must be set up before keys are issued. Whether that needs a card wasn't established (10 of 20). A person signs up in a browser. Keys can be created by API only with an existing production key (0). The MCP apps in ChatGPT and Claude still need a person to sign in to an EasyPost account. 0 + 12 + 10 + 0 = 22.

atoship 53

12 MCP tools (15, for 11 to 30). List tools for orders and labels, with paging not documented in the pages read (8 of 20). Machine-readable error codes with a retry delay (18 of 20). The npm package's tools carry no readOnlyHint or destructiveHint, and no idempotency key was found; void_label undoes a mistaken purchase (5 of 20). Only the Go SDK installs, the hosted server is one URL, and test keys give a safe default (7 of 15). 15 + 8 + 18 + 5 + 7 = 53.

EasyPost 63

List calls take page_size up to 100 with a default of 20 on most endpoints. No field selection was found, and a shipment response nests addresses, parcel, rates and tracker (12 of 25). Cursor pagination by before_id and after_id, date ranges and a has_more flag, with support that varies by endpoint (16 of 20). Errors carry a machine-readable code, a message and per-field entries with an occasional suggestion. The errors array arrives as objects or as strings, so a client has to handle both (15 of 20). The REST API has no idempotency keys. Trackers are deduplicated by tracking code and carrier for three months, but reference on a shipment isn't unique and nothing guards a repeated buy. Since 29 October 2026 the MCP server's buy_shipment returns the label already bought when a timed-out buy is retried, and the guide says three write tools are marked destructive; the tool definitions weren't read (5 of 20, partly met, held). One-call buy creates and purchases in one request, addresses and parcels can be nested or reused by id, and official SDKs cover seven languages (15). 12 + 16 + 15 + 5 + 15 = 63.

atoship 55

Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.

EasyPost 47

API keys go in the HTTP Basic username over TLS 1.2. Keys can be created, disabled, enabled and deleted through the API or the dashboard, and the docs say a key allows full account access. Plain revocable keys, with no secret in a query string. The MCP server also takes a sign-in with an EasyPost account from the ChatGPT and Claude apps (20 of 30). Test keys buy no postage and child users hold separate keys. The REST API has no read-only or scoped key and no confirmation step before a purchase. Since 29 October 2026 the MCP server buys labels too (20 tools, 7 of them writes); buy_shipment refuses a price that differs from the one the user approved, and the guide asks users to keep client approval on for the three paid or destructive writes (8 of 20, held). Responses carry addresses and carrier tracking text. The MCP guide advises connecting only to trusted clients and servers, and no injection guidance was found (4 of 15). Events and their payloads can be retrieved and each shipment lists its fees, but no audit log of API calls or key use was found in the reviewed documentation (5 of 15). A Responsible Disclosure Policy with a safe-harbour commitment and the contact security-abuse@easypost.com, with no acknowledgement time, HMAC-signed webhooks, and a SOC 2 Type 2 report referred to in the data processing addendum. No security.txt (per the 7 October check) and no bug bounty were found, and OSV lists no advisory for EasyPost packages (10 of 20). 20 + 8 + 4 + 5 + 10 = 47.