atoship vs Easyship

atoship 10

No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.

Easyship 76

easyship-mcp 0.6.7 was published on 28 October 2026, 4 days before the check, after 0.6.6 on 19 October, both on PyPI and in the MCP registry. Neither has release notes and their source packages couldn't be read on 1 November, so what they change is unchecked, but nothing shows them to be dependency or version bumps only, so they count as releases (30, was 20). The API changelog's last entry is still 30 October 2025. Five releases in the 90 days on three dates, 0.6.3 to 0.6.5 on 21 August, 0.6.6 and 0.6.7 (20, was 10). Closed service with a support desk and a bug report form. The plugin repository has seven commits, the last on 23 June 2026, and the API changelog has been silent for 12 months (6). Listed in the official MCP registry as com.easyship/mcp, a domain-verified namespace, with 0.6.7 as latest (15). The package pins fastmcp below 4 with a uv.lock and has version-check and deploy workflows. No tests ship in the 0.6.5 source package (5). 30 + 20 + 6 + 15 + 5 = 76.

atoship 30

Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a RATE_LIMIT_EXCEEDED code are documented, without numbers (5 of 15). A 429 carries error.retryAfter and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

Easyship 80

Graded on the public API v2024-09, which the hosted MCP server calls. Statuspage at status.easyship.com with nine Easyship components, among them Core API, Open API and Rates API (20). Re-read on 1 November from the history feed (history.atom), because status.easyship.com's robots.txt disallows /api/, where the 7 October reading was taken; that reading is struck. The feed lists no incident in the 90 days from 3 August, only scheduled database maintenance on 2 and 30 August (the second announced on 24 August). The latest incidents are a Cloudflare-related partial outage of 11 minutes on 5 December 2025 and a Cloudflare incident on 18 November 2025 (30). Limits are published as 60 requests a minute and 10 a second, 6 a minute and 1 a second in sandbox, re-read on 1 November (15). The 429 too_many_requests code is documented with the advice to wait for the next window. No Retry-After header, backoff guidance or idempotency key was found in the docs or the spec (5). The developers page claims both 99.9% and 99.99% uptime, the US terms disclaim uninterrupted access, and no SLA was found (0). Version 2024-09 is described as the latest stable version. The MCP package is classified beta on PyPI (10). 20 + 30 + 15 + 5 + 0 + 10 = 80.

atoship 55

No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, error.code values and retryAfter, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.

Easyship 87

Every reference page has a Markdown twin with its OpenAPI 3.0.3 definition, and the full v2024-09 spec (132 operations on 98 paths) ships in the easyship-mcp source package. No single spec URL was found on the docs site. MCP inputs are typed with Pydantic (25). llms.txt at developers.easyship.com lists 240 lines of Markdown pages (10). MCP descriptions state what to collect before calling, when to buy a label or only draft a shipment, and which tool to use for detail. Not every tool says when not to use it (17). The spec has 177 enum declarations and required fields. In the MCP, incoterms, currency and item category are free strings (12). Twelve error codes are documented with HTTP status and a worked example, and endpoints list 402 and 422 responses (13). Versions are dated in the path (2023-01, 2024-09) with migration guides. The changelog's last entry is 30 October 2025, and the MCP server has no changelog (10).

atoship 45

Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.

Easyship 72

Closed service under country-specific terms, the US version updated 28 July 2026 and naming Easyship Inc. The MCP server and plugin are MIT (17). The privacy policy of 28 July 2026 gives retention periods (account and shipment data for their lifetime plus seven years) and bars providers from training general-purpose AI on personal information. The DPA of 28 March 2025 says personal data is deleted on deactivation unless law requires otherwise, which sits uneasily with seven years (18). Deprecated endpoints are marked and migration guides exist, and the US terms promise 30 days' notice of material changes. No API deprecation policy with dates was found (8). The sub-processor list the DPA points to is dated 15 October 2020, names only analytics, advertising and CRM tools and cites Privacy Shield. The privacy policy names the United States and Singapore as processing locations (8).

atoship 53

12 MCP tools (15, for 11 to 30). List tools for orders and labels, with paging not documented in the pages read (8 of 20). Machine-readable error codes with a retry delay (18 of 20). The npm package's tools carry no readOnlyHint or destructiveHint, and no idempotency key was found; void_label undoes a mistaken purchase (5 of 20). Only the Go SDK installs, the hosted server is one URL, and test keys give a safe default (7 of 15). 15 + 8 + 18 + 5 + 7 = 53.

Easyship 73

The MCP server loads 25 tools with no toolsets. List tools return allow-listed summaries, and documents and contact details come back only when asked for (18). List endpoints take page and per_page (default 20) and filters by state, date, country and order number (20). Errors carry a code, type, details array, documentation links and a request_id (18). No idempotency keys, so a retried label purchase isn't protected. All 25 MCP tools set readOnlyHint, destructiveHint and openWorldHint (10). create_shipment picks a courier when none is given and get_rates needs six fields. No official SDK was found among the 15 public repositories in Easyship's GitHub organisation, though the developers page mentions SDKs (7).

atoship 55

Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.

Easyship 61

API tokens are created in the dashboard with per-resource scopes such as public.shipment:read and public.label:write on v2024-09, are revocable, and are separate for sandbox and production. The MCP server also publishes OAuth metadata with PKCE S256 and dynamic client registration. No token expiry was found (26). Read-only scopes make a read-only agent possible. Confirmation before delete and cancel exists only as a rule file in the plugin repository, not in the server (14). The MCP server strips tax identifiers from every response and withholds contact details and document links by default. No guidance on untrusted text in tracking or address fields was found (7). Transaction records and a request_id on errors are available. No API call log for the operator was found (4). security.txt is present but still expired on 5 October 2025, re-read on 1 November. It points to a disclosure policy at vdp.easyship.com, which needs JavaScript and went unread. The developers page claims SOC certification with no report or trust page found (10).