{ "data": { "a": { "slug": "atoship", "name": "atoship", "vendor": "atoship LLC", "vendorUrl": "https://atoship.com", "kind": "http-api", "category": "shipping", "summary": "atoship is US shipping software for e-commerce sellers that sells discounted USPS, UPS, FedEx and DHL labels with no subscription. Agents use its REST API v1 or an MCP server, hosted with OAuth or local through npx.", "url": "https://www.anchorterminal.com/tools/atoship", "markdownUrl": "https://www.anchorterminal.com/tools/atoship.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/atoship.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/atoship.json", "dns": "atoship.grade.anchorterminal.com", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://atoship.com/api/mcp", "packages": [ { "registry": "npm", "name": "@atoship/mcp" } ], "auth": "mixed", "authNotes": "REST and the local MCP server take API keys from the dashboard, `ak_live_` for production and `ak_test_` for sandbox, sent as Bearer tokens; the docs advise separate keys with limited scopes and periodic rotation. The hosted MCP server uses OAuth with PKCE (S256) and dynamic registration or a published public client ID, and its approval screen lists what the assistant may do, including buying and voiding labels.", "pricing": "usage", "pricingNotes": "No subscription or seat fee. Wallet-funded labels cost the discounted carrier rate shown live when quoting. Metered fees are $0.08 a label on your own carrier account, $0.03 a number for tracking labels bought elsewhere and $0.03 a call for the standalone Address Verification API. Sign-up is free with no card, and test keys create no real labels.", "priceSummary": "$0.08 / tx", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP docs, API docs, llms.txt or pricing page (checked 2026-11-06). Labels are paid from a prefunded wallet.", "endpoints": [] }, "toolCount": 12, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://atoship.com/docs/mcp", "llmsTxt": "https://atoship.com/llms.txt", "capabilities": [ "shipping.rates", "shipping.labels", "shipping.tracking", "shipping.address-validation", "shipping.returns" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "llms-txt", "usage", "prepaid", "no-card", "sandbox", "webhooks", "postman" ], "lastRelease": "2026-02-18", "graded": true, "anchor": { "graded": true, "score": 43, "grade": "E", "agentReady": false, "rank": 1247, "ranked": true, "rankOf": 1486, "categoryRank": 9, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 53, "maintenance": 10, "payments": 40, "reliability": 30, "schema": 55, "security": 55, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "atoship gives agents twelve MCP tools and a REST API for US labels with published per-unit fees, free sign-up, test keys and a wallet the agent cannot overspend. No status page, rate-limit figures, OpenAPI spec or changelog was found, and the npm MCP package has not changed since February 2026.", "bestFor": "US sellers who want cheap USPS, UPS and FedEx labels bought by an agent from a capped wallet.", "strengths": [ "Free account with no card, and `ak_test_` keys that create no real labels", "Per-unit fees published: $0.08 a label on your own carrier account, $0.03 a tracking number or address check", "Hosted MCP server with OAuth and PKCE, whose consent screen names label buying and voiding", "An agent can spend only what is already in the wallet", "Errors carry machine-readable codes and a `retryAfter` on 429" ], "weaknesses": [ "No status page; status.atoship.com serves the home page", "Rate limits are not given in numbers, and no OpenAPI spec was found", "No changelog, and @atoship/mcp was last published on 18 February 2026", "Most listed SDKs are not published; only Go installs", "No security certification, subprocessor list or retention periods found" ], "agentNotes": [ "Use an `ak_test_` key until the user confirms live labels; test mode creates no real labels", "Ask the user before `purchase_label`, since it spends the wallet balance", "Call `void_label` promptly for a mistaken label, and check the carrier's refund rules", "Branch on `error.code`, and on 429 wait `error.retryAfter` seconds", "Validate the address with `validate_address` before buying; the standalone endpoint costs $0.03 a call" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43 } ], "editorialScores": { "ergonomics": 53, "maintenance": 10, "payments": 40, "reliability": 30, "schema": 55, "security": 55, "transparency": 25 }, "provenanceScore": 65, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @atoship/mcp", "claudeCode": "claude mcp add --transport http atoship https://atoship.com/api/mcp", "config": { "mcpServers": { "atoship": { "url": "https://atoship.com/api/mcp" } } } }, "letme": { "capability": "https://letme.dev/shipping.rates", "tool": "https://letme.dev/atoship" }, "area": "business", "unitPrices": [ { "item": "Label on your own carrier account", "unit": "tx", "usd": 0.08, "note": "Per label; the carrier bills postage" }, { "item": "External tracking number", "unit": "tx", "usd": 0.03, "note": "Only for labels bought elsewhere" }, { "item": "Address Verification API call", "unit": "call", "usd": 0.03, "note": "Standalone endpoint only; checks inside rate quotes are free" } ], "provenance": { "legalEntity": "atoship LLC", "domain": "atoship.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://atoship.com/terms", "privacy": "https://atoship.com/privacy", "statusPage": "", "changelog": "", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "atoship.com/robots.txt disallows /api/, /dashboard/, /admin/, /_next/ and /static/ for all agents, so the MCP and REST endpoints under /api/ were not requested.", "Terms last updated 20 August 2026 and privacy policy 7 May 2026. The terms forbid decompiling or reverse engineering the platform; no clause on reading public pages was found.", "security.txt names security@atoship.com, points its policy to the terms and expires 31 December 2027.", "status.atoship.com answers with the marketing home page and /docs/status rendered no status content, so no status page is recorded." ], "score": 65 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/atoship.json", "live": { "slug": "atoship", "probe": { "target": "https://atoship.com/api/mcp", "method": "get", "lastAt": "2026-11-07T18:20:11.359764372Z", "lastOk": true, "lastStatus": 405, "lastMs": 404, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 366, "p95ms24h": 457, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "versions": [ { "registry": "npm", "name": "@atoship/mcp", "version": "1.0.2", "seenAt": "2026-11-06T23:07:48.297476849Z" } ], "npmWeekly": 6, "securityTxt": { "url": "https://atoship.com/.well-known/security.txt", "state": "valid", "expires": "2027-12-31T23:59:59.000Z", "checkedAt": "2026-11-07T16:01:05.350843408Z" }, "llmsTxt": { "url": "https://atoship.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:37.315201154Z" }, "pages": [ { "url": "https://atoship.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T13:59:42.701099832Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a06a9e463f87" }, { "url": "https://atoship.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T13:59:44.734681167Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b9b07e284da6" } ], "mcpTools": { "url": "https://atoship.com/api/mcp", "checkedAt": "2026-11-07T01:42:32.687477466Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:42:32.687477466Z" }, "updatedAt": "2026-11-07T18:20:11.359764372Z" } }, "answer": "Karrio scores 46.4 (D) on agent readiness against atoship's 43 (E), and leads in 4 of 7 scored categories. atoship leads on schema \u0026 documentation and security \u0026 auth.", "b": { "slug": "karrio", "name": "Karrio", "vendor": "Karrio, Inc.", "vendorUrl": "https://www.karrio.io", "kind": "http-api", "category": "shipping", "summary": "Karrio is an open-source multi-carrier shipping server from Karrio, Inc. Its REST API quotes rates, buys labels, tracks parcels and books pickups through the owner's own carrier accounts, self-hosted with Docker or run by Karrio as a paid platform.", "url": "https://www.anchorterminal.com/tools/karrio", "markdownUrl": "https://www.anchorterminal.com/tools/karrio.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/karrio.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/karrio.json", "dns": "karrio.grade.anchorterminal.com", "repo": "https://github.com/karrioapi/karrio", "license": "LGPL-3.0 for the server, SDK and modules. Code under `ee/` is under the Karrio Enterprise licence and needs a subscription for production use. The MCP package in `packages/mcp` is Apache-2.0", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "karrio" }, { "registry": "pypi", "name": "karrio-server" }, { "registry": "oci", "name": "karrio/server" } ], "auth": "api-key", "authNotes": "A private API key from the instance's dashboard, sent as the HTTP Basic username with no password or as `Authorization: Token key_...`. Keys carry a label and are bound to test or live mode, and the docs say a private key can perform any request without restriction. A JWT pair is also issued by `POST /api/token` for an email and password. On a self-hosted instance the owner creates the first account, so no approval from Karrio is involved. The managed platform is reached through a demo booking.", "pricing": "freemium", "pricingNotes": "Free when self-hosted under LGPL-3.0, with carrier postage billed by the owner's own carrier accounts. The platform page says the managed Scale platform starts at $499 a month with pay-as-you-go pricing and a commercial licence for embedding starts at $50,000 a year, with no unit prices published. An agent can start on a self-hosted instance in test mode with no contract. The managed platform has no self-serve signup, only a demo booking (checked 2026-10-08).", "priceSummary": "$499 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the OpenAPI file, the docs or the platform page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 799, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://www.karrio.io/docs", "openapi": "https://raw.githubusercontent.com/karrioapi/karrio/main/schemas/openapi.yml", "capabilities": [ "shipping.rates", "shipping.labels", "shipping.tracking", "shipping.returns" ], "tags": [ "open-source", "self-hosted", "api-key", "openapi", "graphql", "webhooks", "sandbox", "docker", "python", "mcp" ], "lastRelease": "2026-06-23", "graded": true, "anchor": { "graded": true, "score": 46.4, "grade": "D", "agentReady": false, "rank": 1158, "ranked": true, "rankOf": 1486, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 57, "maintenance": 29, "payments": 40, "reliability": 76, "schema": 43, "security": 47, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -6, "negativeNotes": [ "12 March to 23 June 2026. Versions 2026.1.22 to 2026.1.31 applied an MD5 `PASSWORD_HASHERS` override outside the test runner, so production instances stored MD5 password hashes. Fixed in 2026.1.32 and described in the changelog, with no published advisory. A fix released in 2026.1.22 on 17 March 2026, and listed again under 2026.1.27, stopped carrier API key headers reaching Sentry tracing spans and also shipped with no advisory. Released fixes of the product's own flaws without an advisory fold into one term of 3 (https://github.com/karrioapi/karrio/blob/main/CHANGELOG.md).", "8 October 2026. The README and the MCP guide tell users to run `npx karrio-mcp` and `npx -y @karrio/mcp`, and the npm registry answered 404 for both on 8 October. The examples' API host `api.karrio.io` didn't resolve the same day. Both pages still give the `npx` commands on 4 November, and npm wasn't re-read. 3 for a claim the listing can't meet (https://registry.npmjs.org/@karrio%2fmcp, https://www.karrio.io/docs/developing/mcp-server)." ], "verdict": "A free LGPL-3.0 server with 30 carrier connectors, cURL and JavaScript guides and an OpenAPI file in its repository suits a team that hosts it, though no docs page links that file as a download. The last release was 23 June 2026, and the `@karrio/mcp` package the docs install was absent from npm on 8 October 2026.", "bestFor": "A team that wants to host its own multi-carrier API with its own carrier contracts and can maintain a Django and PostgreSQL stack.", "strengths": [ "OpenAPI 3.0.3 file in the repository at version 2026.1.32, covering rates, shipments, trackers, pickups, manifests, orders, documents and webhooks", "The core server and SDK are LGPL-3.0 and run on the owner's infrastructure with Docker Compose, with no fee to Karrio", "30 carrier connectors in `modules/connectors`, among them UPS, FedEx, USPS, DHL Express, Canada Post, DPD and Australia Post, used with the owner's own carrier accounts", "API keys are bound to test or live mode, and test mode runs rates, labels, trackers and pickups against carrier sandboxes", "Default throttles are in the settings file with numbers (600 requests a minute per user, 300 for carrier calls) and can be changed by environment variable" ], "weaknesses": [ "No release since 2026.1.32 on 23 June 2026, 134 days before this check, and no newer commit on any branch", "Neither `@karrio/mcp` nor `karrio-mcp` exists on npm, though the README and the MCP guide give `npx` commands for them", "`api.karrio.io` didn't resolve and `app.karrio.io` answered 503 with a paused deployment on 8 October 2026, and the managed platform starts with a demo booking", "Versions 2026.1.22 to 2026.1.31 stored passwords as MD5 hashes in production, fixed in 2026.1.32 with a changelog line and no published advisory", "No idempotency keys were found, and a private API key can perform any request. Team permissions and audit logging sit in the paid `ee/` code" ], "agentNotes": [ "Run your own instance with Docker Compose and call it at `http://localhost:5002`. Don't rely on `api.karrio.io`, which didn't resolve on 8 October 2026", "Don't run `npx karrio-mcp` or `npx -y @karrio/mcp`. Neither name is published on npm, so build the server from `packages/mcp` in the repository", "Change the default `admin@example.com` and `demo` login before the instance is reachable, and upgrade to 2026.1.32 or later so passwords aren't stored as MD5", "Don't blind-retry `POST /v1/shipments` with a `service` set or `POST /v1/shipments/{id}/purchase`. Fetch the shipment and check its status first, since no idempotency key exists", "Use a test-mode API key while building. Send it as the HTTP Basic username or as `Authorization: Token key_...`" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.4 } ], "editorialScores": { "ergonomics": 57, "maintenance": 29, "payments": 40, "reliability": 76, "schema": 43, "security": 47, "transparency": 59 }, "provenanceScore": 59, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "git clone --depth 1 https://github.com/karrioapi/karrio\ncd karrio\ngit submodule update --init community\ncd docker\ndocker compose up", "http": "curl http://localhost:5002/v1/shipments \\\n -u key_xxxxxx:" }, "letme": { "capability": "https://letme.dev/shipping.rates", "tool": "https://letme.dev/karrio" }, "area": "business", "unitPrices": [ { "item": "Open-source edition, self-hosted", "unit": "month", "usd": 0, "note": "LGPL-3.0, you pay for your own hosting and carrier postage" }, { "item": "Scale managed platform, starting price", "unit": "month", "usd": 499, "note": "plus pay-as-you-go usage with no published unit price, by demo booking" } ], "provenance": { "legalEntity": "Karrio, Inc.", "domain": "karrio.io", "domainRegistered": "2022-01-20", "endpointOnVendorDomain": false, "terms": "https://www.karrio.io/terms-of-service", "privacy": "https://www.karrio.io/privacy-policy", "statusPage": "", "changelog": "https://github.com/karrioapi/karrio/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "The Customer Terms and Conditions (last modified 8 April 2025) name Karrio, Inc., a Delaware corporation at 760 Chemin Marie-Le Ber, Verdun, Quebec, Canada, and govern the hosted platform. The self-hosted open-source edition is governed by LGPL-3.0, and `LICENSE_EE` points `ee/` users to the subscription terms at docs.karrio.io/product/resources/terms, an older copy dated 19 April 2022.", "The privacy policy (last modified 8 April 2025) covers karrio.io and associated services and excludes customer data processed on a customer's behalf. No data processing addendum was found.", "The graded surface is an instance on the owner's own host, so the endpoint isn't on the vendor's domain. `api.karrio.io` didn't resolve and `app.karrio.io` returned 503 on 8 October 2026. Neither was requested on 4 November.", "No status page was found. `status.karrio.io` didn't resolve and the site links none.", "www.karrio.io/.well-known/security.txt returned 404 on 8 October. `SECURITY.md` in the repository sends reports to hello@karrio.io.", "The changelog page on www.karrio.io stops at 2024.12.6. `CHANGELOG.md` in the repository is current to 2026.1.32." ], "score": 59 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/karrio.json", "live": { "slug": "karrio", "versions": [ { "registry": "github", "name": "karrioapi/karrio", "version": "v2026.1.32", "released": "2026-06-23", "seenAt": "2026-11-06T23:36:29.050470307Z" }, { "registry": "pypi", "name": "karrio", "version": "2026.1.32", "released": "2026-06-23", "seenAt": "2026-11-06T23:36:26.928747372Z" }, { "registry": "pypi", "name": "karrio-server", "version": "2026.1.32", "released": "2026-06-23", "seenAt": "2026-11-06T23:36:27.118789208Z" } ], "githubStars": 811, "pypiWeekly": 1204, "securityTxt": { "url": "https://karrio.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:53.738045224Z" }, "domain": { "domain": "karrio.io", "checkedAt": "2026-11-01T14:10:04.150125467Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/karrioapi/karrio/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:21:29.952308849Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "314becff7ae6" }, { "url": "https://www.karrio.io/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:30:26.45435539Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3043d4d5d243" }, { "url": "https://www.karrio.io/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:30:29.300751957Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a7184cba65b2" } ], "github": { "repo": "karrioapi/karrio", "checkedAt": "2026-11-02T08:58:01.725794841Z", "stars": 809, "archived": false, "issuesEnabled": false, "pushedAt": "2026-06-23T10:07:06Z", "openIssues": 0, "openPRs": 36, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-06-23T07:35:49Z" } }, "updatedAt": "2026-11-07T15:59:53.738045224Z" } }, "edges": [ { "by": 46, "category": "reliability", "leads": "karrio", "name": "Reliability", "reasons": { "a": "Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a `RATE_LIMIT_EXCEEDED` code are documented, without numbers (5 of 15). A 429 carries `error.retryAfter` and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.", "b": "Read with the local-software lines, since the graded surface is the open-source server its owner hosts. The managed platform has no status page we could find. Docker images and PyPI packages at 2026.1.32, per the 8 October check (PyPI and Docker Hub not re-read on 4 November). The clone's package files state Python 3.11 or later for `karrio`, while `karrio_server` still declares 3.7 or later (18 of 20). A public tests workflow runs SDK type checks, SDK tests and server tests on PostgreSQL, and the last five runs on main, all on 23 June 2026, passed, per the 8 October check. main hasn't moved since (25). GitHub Issues is switched off, so bug reports go to Discussions. Reports from July and August 2026 on FedEx dimensions and a GraphQL crash had no reply, per the 8 October check, not re-read on 4 November (10 of 25). Versions are calendar-based, not semver, and the breaking rename of the `purchased` status shipped in 2026.1.20 with a banner in the changelog (8 of 15). Releases are past 1.0 and numbered for production use (15). 18+25+10+8+15 = 76." }, "scores": { "a": 30, "b": 76 } }, { "by": 19, "category": "maintenance", "leads": "karrio", "name": "Maintenance \u0026 community", "reasons": { "a": "No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.", "b": "The newest release, 2026.1.32, is dated 23 June 2026, 134 days before 4 November, and no tag, branch or commit on main is newer, read in a clone on 4 November (10 of 30). No release in the 90 days from 6 August (0 of 20). Of the 15 newest Discussions threads, 10 showed no maintainer reply, and fix pull requests opened between 23 September and 2 October 2026 each had one or two comments and were unmerged, among 83 open pull requests, per the 8 October check, not re-read on 4 November (8 of 25). The PyPI packages matched the last release on 8 October, and the npm client is at 2023.1.0. The 8 October search of the MCP registry used its JSON API and is withdrawn (5 of 15). CI passed on the last commit and the changelog records pinning axios away from compromised versions, while Dependabot branches from April and June 2026 remain unmerged (6 of 10). 10+0+8+5+6 = 29." }, "scores": { "a": 10, "b": 29 } }, { "by": 14, "category": "transparency", "leads": "karrio", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.", "b": "The server, SDK and modules are LGPL-3.0, an OSI licence. `ee/` is under a proprietary licence in the same repository, and the `karrio_server` package file declares Apache-2.0 while the repository licence gives LGPL-3.0 outside `ee/` (26 of 30). The 8 October PyPI licence-field reading came from PyPI's JSON API and is withdrawn. On a self-hosted instance the data stays with the owner. The privacy policy (8 April 2025, per the 8 October check) covers the website and associated services, excludes customer data, gives no retention periods and names 12 service providers. No data processing addendum was found (14 of 30). Breaking changes are flagged in the changelog and the spec says a new dated version marks an incompatible change. No deprecation policy with notice periods was found (7 of 20). Sentry and PostHog reporting are documented and stay off unless the operator sets their keys. The Compose files pull images through a Scarf gateway and the README carries a Scarf pixel, neither described in the docs we read (12 of 20)." }, "scores": { "a": 45, "b": 59 } }, { "by": 12, "category": "schema", "leads": "atoship", "name": "Schema \u0026 documentation", "reasons": { "a": "No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, `error.code` values and `retryAfter`, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.", "b": "`schemas/openapi.yml` in the repository is OpenAPI 3.0.3 at version 2026.1.32, re-read in a clone on 4 November, and GraphQL schemas sit beside it. The website's API reference loads a copy of it by script, and on 4 November no docs page or README linked a file as a visible download, so it isn't counted as a published contract, as for attendee's and jambonz's repository files (0, from 25). No llms.txt on www.karrio.io (404 again on 4 November) or docs.karrio.io (0). The repository file and the guides cover authentication, pagination, shipments, trackers and webhooks, with little on when not to use a call, such as the stored `/v1/shipments` against the pass-through `/v1/proxy/shipping` (12 of 20). Units, statuses and label types are enums and required fields are marked, but carrier `options` and connection `credentials` are open objects whose keys differ by carrier (10 of 15). The guides have cURL and JavaScript examples and the repository file has an `ErrorResponse` schema, while the error guide is a table of HTTP statuses only (9 of 15). Versions are dated and `CHANGELOG.md` is current, but the changelog page on the website stops at 2024.12.6 (12 of 15). 0+0+12+10+9+12 = 43." }, "scores": { "a": 55, "b": 43 } }, { "by": 8, "category": "security", "leads": "atoship", "name": "Security \u0026 auth", "reasons": { "a": "Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.", "b": "Private API keys with a label, bound to test or live mode, sent as the Basic username or in the `Authorization` header. The docs say a private key can perform any request without restriction. Short-lived resource tokens for document links can travel in a `?token=` query string, which we didn't count against the score because they expire in five minutes by default and open one resource (20 of 30). Test-mode keys keep building away from live carriers. Team permissions are in the paid `ee/` code, and the MCP guide asks the agent to confirm with the user before `create_shipment` (7 of 20). Responses carry carrier tracking text and addresses, and no injection guidance was found (3 of 15). API logs, tracing records and events are stored and readable in the open-source edition, and audit logging is listed as an enterprise feature (10 of 15). `SECURITY.md`, unchanged in the clone's history back to August 2024, is a security policy that sends reports to an email address, with no acknowledgement time. No security.txt, bug bounty or certification was found, and GitHub lists no published advisories although 2026.1.32 fixed MD5 password storage and a March 2026 release stopped carrier API keys reaching tracing spans. A disclosure policy with a reporting route and no acknowledgement time scores 7 in this run, and the fixes without advisories are charged once, in the deductions (7 of 20, from 4). 20+7+3+10+7 = 47." }, "scores": { "a": 55, "b": 47 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "atoship LLC", "b": "Karrio, Inc.", "name": "Vendor" }, { "a": "https://atoship.com/api/mcp", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "Streamable HTTP, stdio", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "API key", "name": "Auth" }, { "a": "Pay per use", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "LGPL-3.0 for the server, SDK and modules. Code under `ee/` is under the Karrio Enterprise licence and needs a subscription for production use. The MCP package in `packages/mcp` is Apache-2.0", "name": "Licence" }, { "a": "12", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-02-18", "b": "2026-06-23", "name": "Last release" }, { "a": "2026-08-20", "b": "2025-04-08", "name": "Terms last updated" }, { "a": "2026-05-07", "b": "2025-04-08", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "799 stars", "name": "Popularity" } ], "faq": [ { "answer": "Karrio scores 46.4 (D) on agent readiness against atoship's 43 (E), and leads in 4 of 7 scored categories. atoship leads on schema \u0026 documentation and security \u0026 auth.", "question": "Which is better for AI agents, atoship or Karrio?" }, { "answer": "atoship takes an API key or an OAuth sign-in. Karrio needs an API key.", "question": "Do atoship and Karrio need an API key?" }, { "answer": "atoship has a hosted endpoint at https://atoship.com/api/mcp. No hosted endpoint is listed for Karrio.", "question": "Can an agent call atoship and Karrio without installing anything?" }, { "answer": "No open-source release is listed for atoship. Karrio is open source (LGPL-3.0 for the server, SDK and modules. Code under `ee/` is under the Karrio Enterprise licence and needs a subscription for production use. The MCP package in `packages/mcp` is Apache-2.0).", "question": "Are atoship and Karrio open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 55 against 43", "Security \u0026 auth, 55 against 47" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine", "Free to start without a card", "No incidents deducted, where Karrio loses 6 points for them" ], "goodFor": "US sellers who want cheap USPS, UPS and FedEx labels bought by an agent from a capped wallet.", "slug": "atoship", "watchFor": "No status page; status.atoship.com serves the home page" }, { "aheadOn": [ "Reliability, 76 against 30", "Maintenance \u0026 community, 29 against 10", "Transparency \u0026 trust, 59 against 45" ], "also": [ "Open source" ], "goodFor": "A team that wants to host its own multi-carrier API with its own carrier contracts and can maintain a Django and PostgreSQL stack.", "slug": "karrio", "watchFor": "No release since 2026.1.32 on 23 June 2026, 134 days before this check, and no newer commit on any branch" } ], "history": { "atoship": null, "karrio": [ { "causes": [ "correction" ], "date": "2026-11-04", "delta": -2.5, "from": 48.9, "fromGrade": "D", "to": 46.4, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 48.7, "fromGrade": "D", "to": 48.9, "toGrade": "D" } ] }, "job": { "capability": "shipping.rates", "name": "Shipping rates" }, "others": [ { "json": "https://www.anchorterminal.com/compare/atoship-vs-easypost.json", "title": "atoship vs EasyPost", "url": "https://www.anchorterminal.com/compare/atoship-vs-easypost" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-easyship.json", "title": "atoship vs Easyship", "url": "https://www.anchorterminal.com/compare/atoship-vs-easyship" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-envia.json", "title": "atoship vs Envia", "url": "https://www.anchorterminal.com/compare/atoship-vs-envia" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-sendcloud.json", "title": "atoship vs Sendcloud", "url": "https://www.anchorterminal.com/compare/atoship-vs-sendcloud" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-shipbob.json", "title": "atoship vs ShipBob", "url": "https://www.anchorterminal.com/compare/atoship-vs-shipbob" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-shippo.json", "title": "atoship vs Shippo", "url": "https://www.anchorterminal.com/compare/atoship-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-shippypro.json", "title": "atoship vs ShippyPro", "url": "https://www.anchorterminal.com/compare/atoship-vs-shippypro" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-shipstation.json", "title": "atoship vs ShipStation API", "url": "https://www.anchorterminal.com/compare/atoship-vs-shipstation" }, { "json": "https://www.anchorterminal.com/compare/easypost-vs-karrio.json", "title": "EasyPost vs Karrio", "url": "https://www.anchorterminal.com/compare/easypost-vs-karrio" }, { "json": "https://www.anchorterminal.com/compare/easyship-vs-karrio.json", "title": "Easyship vs Karrio", "url": "https://www.anchorterminal.com/compare/easyship-vs-karrio" }, { "json": "https://www.anchorterminal.com/compare/envia-vs-karrio.json", "title": "Envia vs Karrio", "url": "https://www.anchorterminal.com/compare/envia-vs-karrio" }, { "json": "https://www.anchorterminal.com/compare/karrio-vs-sendcloud.json", "title": "Karrio vs Sendcloud", "url": "https://www.anchorterminal.com/compare/karrio-vs-sendcloud" }, { "json": "https://www.anchorterminal.com/compare/karrio-vs-shipbob.json", "title": "Karrio vs ShipBob", "url": "https://www.anchorterminal.com/compare/karrio-vs-shipbob" }, { "json": "https://www.anchorterminal.com/compare/karrio-vs-shippo.json", "title": "Karrio vs Shippo", "url": "https://www.anchorterminal.com/compare/karrio-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/karrio-vs-shippypro.json", "title": "Karrio vs ShippyPro", "url": "https://www.anchorterminal.com/compare/karrio-vs-shippypro" }, { "json": "https://www.anchorterminal.com/compare/karrio-vs-shipstation.json", "title": "Karrio vs ShipStation API", "url": "https://www.anchorterminal.com/compare/karrio-vs-shipstation" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-ship24.json", "title": "atoship vs Ship24", "url": "https://www.anchorterminal.com/compare/atoship-vs-ship24" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-trackingmore.json", "title": "atoship vs TrackingMore", "url": "https://www.anchorterminal.com/compare/atoship-vs-trackingmore" }, { "json": "https://www.anchorterminal.com/compare/karrio-vs-ship24.json", "title": "Karrio vs Ship24", "url": "https://www.anchorterminal.com/compare/karrio-vs-ship24" }, { "json": "https://www.anchorterminal.com/compare/karrio-vs-trackingmore.json", "title": "Karrio vs TrackingMore", "url": "https://www.anchorterminal.com/compare/karrio-vs-trackingmore" } ], "panel": null, "scores": [ { "atoship": 30, "by": 46, "edge": "karrio", "karrio": 76, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "atoship": 55, "by": 12, "edge": "atoship", "karrio": 43, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "atoship": 53, "by": 4, "edge": "karrio", "karrio": 57, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "atoship": 55, "by": 8, "edge": "atoship", "karrio": 47, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "atoship": 40, "by": 0, "edge": "", "karrio": 40, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "atoship": 10, "by": 19, "edge": "karrio", "karrio": 29, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "atoship": 45, "by": 14, "edge": "karrio", "karrio": 59, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Karrio scores 46.4 (D) on agent readiness against atoship's 43 (E), and leads in 4 of 7 scored categories. atoship leads on schema \u0026 documentation and security \u0026 auth. Both do shipping rates.", "tasks": null, "tutorials": [], "verdicts": { "atoship": "atoship gives agents twelve MCP tools and a REST API for US labels with published per-unit fees, free sign-up, test keys and a wallet the agent cannot overspend. No status page, rate-limit figures, OpenAPI spec or changelog was found, and the npm MCP package has not changed since February 2026.", "karrio": "A free LGPL-3.0 server with 30 carrier connectors, cURL and JavaScript guides and an OpenAPI file in its repository suits a team that hosts it, though no docs page links that file as a download. The last release was 23 June 2026, and the `@karrio/mcp` package the docs install was absent from npm on 8 October 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/atoship-vs-karrio", "json": "https://www.anchorterminal.com/compare/atoship-vs-karrio.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/atoship-vs-karrio.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/atoship-vs-karrio.min.md" }, "markdown": "Karrio scores 46.4 (D) on agent readiness against atoship's 43 (E), and leads in 4 of 7 scored categories. atoship leads on schema \u0026 documentation and security \u0026 auth. Both do shipping rates.\n\n- atoship: grade E, 43/100, rank #1247 of 1486. Markdown https://www.anchorterminal.com/tools/atoship.md · JSON https://www.anchorterminal.com/api/v1/tools/atoship.json\n- Karrio: grade D, 46.4/100, rank #1158 of 1486. Markdown https://www.anchorterminal.com/tools/karrio.md · JSON https://www.anchorterminal.com/api/v1/tools/karrio.json\n- Best shipping and fulfilment APIs for AI agents: https://www.anchorterminal.com/best/shipping/index.md\n- All 66 shipping comparisons: https://www.anchorterminal.com/compare/shipping/index.md\n\n## Which one, for what\n\n### atoship (E)\n\nGood for: US sellers who want cheap USPS, UPS and FedEx labels bought by an agent from a capped wallet.\n\nAhead on:\n- Schema \u0026 documentation, 55 against 43\n- Security \u0026 auth, 55 against 47\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- Free to start without a card\n- No incidents deducted, where Karrio loses 6 points for them\n\nWatch for: No status page; status.atoship.com serves the home page\n\n### Karrio (D)\n\nGood for: A team that wants to host its own multi-carrier API with its own carrier contracts and can maintain a Django and PostgreSQL stack.\n\nAhead on:\n- Reliability, 76 against 30\n- Maintenance \u0026 community, 29 against 10\n- Transparency \u0026 trust, 59 against 45\n\nAlso in its favour:\n- Open source\n\nWatch for: No release since 2026.1.32 on 23 June 2026, 134 days before this check, and no newer commit on any branch\n\n\n## Why the edge\n\n### Reliability: Karrio +46\n\n- atoship (30): Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a `RATE_LIMIT_EXCEEDED` code are documented, without numbers (5 of 15). A 429 carries `error.retryAfter` and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.\n- Karrio (76): Read with the local-software lines, since the graded surface is the open-source server its owner hosts. The managed platform has no status page we could find. Docker images and PyPI packages at 2026.1.32, per the 8 October check (PyPI and Docker Hub not re-read on 4 November). The clone's package files state Python 3.11 or later for `karrio`, while `karrio_server` still declares 3.7 or later (18 of 20). A public tests workflow runs SDK type checks, SDK tests and server tests on PostgreSQL, and the last five runs on main, all on 23 June 2026, passed, per the 8 October check. main hasn't moved since (25). GitHub Issues is switched off, so bug reports go to Discussions. Reports from July and August 2026 on FedEx dimensions and a GraphQL crash had no reply, per the 8 October check, not re-read on 4 November (10 of 25). Versions are calendar-based, not semver, and the breaking rename of the `purchased` status shipped in 2026.1.20 with a banner in the changelog (8 of 15). Releases are past 1.0 and numbered for production use (15). 18+25+10+8+15 = 76.\n\n### Maintenance \u0026 community: Karrio +19\n\n- atoship (10): No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.\n- Karrio (29): The newest release, 2026.1.32, is dated 23 June 2026, 134 days before 4 November, and no tag, branch or commit on main is newer, read in a clone on 4 November (10 of 30). No release in the 90 days from 6 August (0 of 20). Of the 15 newest Discussions threads, 10 showed no maintainer reply, and fix pull requests opened between 23 September and 2 October 2026 each had one or two comments and were unmerged, among 83 open pull requests, per the 8 October check, not re-read on 4 November (8 of 25). The PyPI packages matched the last release on 8 October, and the npm client is at 2023.1.0. The 8 October search of the MCP registry used its JSON API and is withdrawn (5 of 15). CI passed on the last commit and the changelog records pinning axios away from compromised versions, while Dependabot branches from April and June 2026 remain unmerged (6 of 10). 10+0+8+5+6 = 29.\n\n### Transparency \u0026 trust: Karrio +14\n\n- atoship (45): Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.\n- Karrio (59): The server, SDK and modules are LGPL-3.0, an OSI licence. `ee/` is under a proprietary licence in the same repository, and the `karrio_server` package file declares Apache-2.0 while the repository licence gives LGPL-3.0 outside `ee/` (26 of 30). The 8 October PyPI licence-field reading came from PyPI's JSON API and is withdrawn. On a self-hosted instance the data stays with the owner. The privacy policy (8 April 2025, per the 8 October check) covers the website and associated services, excludes customer data, gives no retention periods and names 12 service providers. No data processing addendum was found (14 of 30). Breaking changes are flagged in the changelog and the spec says a new dated version marks an incompatible change. No deprecation policy with notice periods was found (7 of 20). Sentry and PostHog reporting are documented and stay off unless the operator sets their keys. The Compose files pull images through a Scarf gateway and the README carries a Scarf pixel, neither described in the docs we read (12 of 20).\n\n### Schema \u0026 documentation: atoship +12\n\n- atoship (55): No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, `error.code` values and `retryAfter`, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.\n- Karrio (43): `schemas/openapi.yml` in the repository is OpenAPI 3.0.3 at version 2026.1.32, re-read in a clone on 4 November, and GraphQL schemas sit beside it. The website's API reference loads a copy of it by script, and on 4 November no docs page or README linked a file as a visible download, so it isn't counted as a published contract, as for attendee's and jambonz's repository files (0, from 25). No llms.txt on www.karrio.io (404 again on 4 November) or docs.karrio.io (0). The repository file and the guides cover authentication, pagination, shipments, trackers and webhooks, with little on when not to use a call, such as the stored `/v1/shipments` against the pass-through `/v1/proxy/shipping` (12 of 20). Units, statuses and label types are enums and required fields are marked, but carrier `options` and connection `credentials` are open objects whose keys differ by carrier (10 of 15). The guides have cURL and JavaScript examples and the repository file has an `ErrorResponse` schema, while the error guide is a table of HTTP statuses only (9 of 15). Versions are dated and `CHANGELOG.md` is current, but the changelog page on the website stops at 2024.12.6 (12 of 15). 0+0+12+10+9+12 = 43.\n\n### Security \u0026 auth: atoship +8\n\n- atoship (55): Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.\n- Karrio (47): Private API keys with a label, bound to test or live mode, sent as the Basic username or in the `Authorization` header. The docs say a private key can perform any request without restriction. Short-lived resource tokens for document links can travel in a `?token=` query string, which we didn't count against the score because they expire in five minutes by default and open one resource (20 of 30). Test-mode keys keep building away from live carriers. Team permissions are in the paid `ee/` code, and the MCP guide asks the agent to confirm with the user before `create_shipment` (7 of 20). Responses carry carrier tracking text and addresses, and no injection guidance was found (3 of 15). API logs, tracing records and events are stored and readable in the open-source edition, and audit logging is listed as an enterprise feature (10 of 15). `SECURITY.md`, unchanged in the clone's history back to August 2024, is a security policy that sends reports to an email address, with no acknowledgement time. No security.txt, bug bounty or certification was found, and GitHub lists no published advisories although 2026.1.32 fixed MD5 password storage and a March 2026 release stopped carrier API keys reaching tracing spans. A disclosure policy with a reporting route and no acknowledgement time scores 7 in this run, and the fixes without advisories are charged once, in the deductions (7 of 20, from 4). 20+7+3+10+7 = 47.\n\n## Score by category\n\n| Category | Weight | atoship | Karrio | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 30 | 76 | Karrio +46 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 55 | 43 | atoship +12 |\n| Agent ergonomics | 13% (16.2 this run) | 53 | 57 | Karrio +4 |\n| Security \u0026 auth | 14% (17.5 this run) | 55 | 47 | atoship +8 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 40 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 10 | 29 | Karrio +19 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 45 | 59 | Karrio +14 |\n| Negative events | ≤15 | 0 | -6 | |\n| **Total** | | **43 · E** | **46.4 · D** | |\n\n## Facts side by side\n\n| Fact | atoship | Karrio |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | atoship LLC | Karrio, Inc. |\n| Hosted endpoint | `https://atoship.com/api/mcp` | no (local only) |\n| Transports | Streamable HTTP, stdio | HTTP |\n| Auth | OAuth or key | API key |\n| Pricing | Pay per use | Freemium |\n| x402 | no | no |\n| Licence | none | LGPL-3.0 for the server, SDK and modules. Code under `ee/` is under the Karrio Enterprise licence and needs a subscription for production use. The MCP package in `packages/mcp` is Apache-2.0 |\n| Tools exposed | 12 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| Last release | 2026-02-18 | 2026-06-23 |\n| Terms last updated | 2026-08-20 | 2025-04-08 |\n| Privacy policy last updated | 2026-05-07 | 2025-04-08 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | none | 799 stars |\n\n## How the scores have moved\n\n### atoship\n\nNo score change since it was listed.\n\n### Karrio\n\n- -2.5 on 4 November 2026: correction\n- +0.2 on 27 October 2026: checklist\n\n## Verdicts\n\n**atoship.** atoship gives agents twelve MCP tools and a REST API for US labels with published per-unit fees, free sign-up, test keys and a wallet the agent cannot overspend. No status page, rate-limit figures, OpenAPI spec or changelog was found, and the npm MCP package has not changed since February 2026.\n\n**Karrio.** A free LGPL-3.0 server with 30 carrier connectors, cURL and JavaScript guides and an OpenAPI file in its repository suits a team that hosts it, though no docs page links that file as a download. The last release was 23 June 2026, and the `@karrio/mcp` package the docs install was absent from npm on 8 October 2026.\n\n## Before you call either\n\n### atoship\n\n1. Use an `ak_test_` key until the user confirms live labels; test mode creates no real labels\n2. Ask the user before `purchase_label`, since it spends the wallet balance\n3. Call `void_label` promptly for a mistaken label, and check the carrier's refund rules\n4. Branch on `error.code`, and on 429 wait `error.retryAfter` seconds\n5. Validate the address with `validate_address` before buying; the standalone endpoint costs $0.03 a call\n\n### Karrio\n\n1. Run your own instance with Docker Compose and call it at `http://localhost:5002`. Don't rely on `api.karrio.io`, which didn't resolve on 8 October 2026\n2. Don't run `npx karrio-mcp` or `npx -y @karrio/mcp`. Neither name is published on npm, so build the server from `packages/mcp` in the repository\n3. Change the default `admin@example.com` and `demo` login before the instance is reachable, and upgrade to 2026.1.32 or later so passwords aren't stored as MD5\n4. Don't blind-retry `POST /v1/shipments` with a `service` set or `POST /v1/shipments/{id}/purchase`. Fetch the shipment and check its status first, since no idempotency key exists\n5. Use a test-mode API key while building. Send it as the HTTP Basic username or as `Authorization: Token key_...`\n\n## Questions\n\n### Which is better for AI agents, atoship or Karrio?\n\nKarrio scores 46.4 (D) on agent readiness against atoship's 43 (E), and leads in 4 of 7 scored categories. atoship leads on schema \u0026 documentation and security \u0026 auth.\n\n### Do atoship and Karrio need an API key?\n\natoship takes an API key or an OAuth sign-in. Karrio needs an API key.\n\n### Can an agent call atoship and Karrio without installing anything?\n\natoship has a hosted endpoint at https://atoship.com/api/mcp. No hosted endpoint is listed for Karrio.\n\n### Are atoship and Karrio open source?\n\nNo open-source release is listed for atoship. Karrio is open source (LGPL-3.0 for the server, SDK and modules. Code under `ee/` is under the Karrio Enterprise licence and needs a subscription for production use. The MCP package in `packages/mcp` is Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/atoship-vs-karrio.json, and with the fewest tokens: https://www.anchorterminal.com/compare/atoship-vs-karrio.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"atoship\", \"b\": \"karrio\"}`. From a terminal: `anchor compare atoship karrio`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/atoship.json and https://www.anchorterminal.com/api/v1/tools/karrio.json\n\n## Other comparisons with atoship or Karrio\n\n- [atoship vs EasyPost](https://www.anchorterminal.com/compare/atoship-vs-easypost.md)\n- [atoship vs Easyship](https://www.anchorterminal.com/compare/atoship-vs-easyship.md)\n- [atoship vs Envia](https://www.anchorterminal.com/compare/atoship-vs-envia.md)\n- [atoship vs Sendcloud](https://www.anchorterminal.com/compare/atoship-vs-sendcloud.md)\n- [atoship vs ShipBob](https://www.anchorterminal.com/compare/atoship-vs-shipbob.md)\n- [atoship vs Shippo](https://www.anchorterminal.com/compare/atoship-vs-shippo.md)\n- [atoship vs ShippyPro](https://www.anchorterminal.com/compare/atoship-vs-shippypro.md)\n- [atoship vs ShipStation API](https://www.anchorterminal.com/compare/atoship-vs-shipstation.md)\n- [EasyPost vs Karrio](https://www.anchorterminal.com/compare/easypost-vs-karrio.md)\n- [Easyship vs Karrio](https://www.anchorterminal.com/compare/easyship-vs-karrio.md)\n- [Envia vs Karrio](https://www.anchorterminal.com/compare/envia-vs-karrio.md)\n- [Karrio vs Sendcloud](https://www.anchorterminal.com/compare/karrio-vs-sendcloud.md)\n- [Karrio vs ShipBob](https://www.anchorterminal.com/compare/karrio-vs-shipbob.md)\n- [Karrio vs Shippo](https://www.anchorterminal.com/compare/karrio-vs-shippo.md)\n- [Karrio vs ShippyPro](https://www.anchorterminal.com/compare/karrio-vs-shippypro.md)\n- [Karrio vs ShipStation API](https://www.anchorterminal.com/compare/karrio-vs-shipstation.md)\n- [atoship vs Ship24](https://www.anchorterminal.com/compare/atoship-vs-ship24.md)\n- [atoship vs TrackingMore](https://www.anchorterminal.com/compare/atoship-vs-trackingmore.md)\n- [Karrio vs Ship24](https://www.anchorterminal.com/compare/karrio-vs-ship24.md)\n- [Karrio vs TrackingMore](https://www.anchorterminal.com/compare/karrio-vs-trackingmore.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "atoship vs Karrio", "url": "" } ], "description": "Karrio scores 46.4 (D) to atoship's 43 (E) for shipping rates. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "atoship E 43", "Karrio D 46.4", "scores" ], "h1": "atoship vs Karrio", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/atoship-vs-karrio", "published": "2026-10-01", "section": "tools", "title": "atoship vs Karrio for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/atoship-vs-karrio" }, "tokens": { "markdown": 4500, "slim": 2780 }, "version": 1 }