atoship vs Envia

atoship 45

Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.

Envia 16

Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.

atoship 55

No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, error.code values and retryAfter, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.

Envia 80

Each reference page's Markdown copy embeds an OpenAPI definition with sandbox and production servers (25). llms.txt and a Markdown copy of each page (10). Endpoint descriptions say what each is for and which call comes next in the workflow, and the rate tool warns that sandbox rates are simulated (15 of 20). The quote definition has 17 enums and required lists (11 of 15). Workflow examples and an error-formats guide named in the changelog, though its Markdown address answered 404 and the quote definition documents only 200 (9 of 15). A dated docs changelog by month, the latest March 2026 (10 of 15). 25 + 10 + 15 + 11 + 9 + 10 = 80.

atoship 55

Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.

Envia 35

Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.

atoship 40

No x402, MPP or L402 (0). Per-unit fees are published without a login ($0.08 a BYOCA label, $0.03 a tracking number or address check), and wallet postage is priced live in a public calculator (20). Free account with no card, and test keys (20). A person signs up in a browser and funds the wallet (0). 0 + 20 + 20 + 0 = 40.

Envia 20

No x402, MPP or L402 (0). No public price list: each cost is shown when quoting, and volume plans go through sales (0). A free sandbox account creates test labels with no charges (20). A person signs up in a browser and tops up a balance for live labels (0). 0 + 0 + 20 + 0 = 20.

atoship 30

Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a RATE_LIMIT_EXCEEDED code are documented, without numbers (5 of 15). A 429 carries error.retryAfter and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

Envia 20

Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.