# atoship vs Karrio (slim)

> Karrio scores 46.4 (D) to atoship's 43 (E) for shipping rates. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/atoship-vs-karrio.md (~4,500 tokens) · this version ~2,780 tokens · JSON https://www.anchorterminal.com/compare/atoship-vs-karrio.json · canonical https://www.anchorterminal.com/compare/atoship-vs-karrio
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Karrio scores 46.4 (D) on agent readiness against atoship's 43 (E), and leads in 4 of 7 scored categories. atoship leads on schema & documentation and security & auth. Both do shipping rates.

- atoship: E 43, rank #1247 of 1486 · https://www.anchorterminal.com/tools/atoship.min.md
- Karrio: D 46.4, rank #1158 of 1486 · https://www.anchorterminal.com/tools/karrio.min.md
- atoship, good for US sellers who want cheap USPS, UPS and FedEx labels bought by an agent from a capped wallet. Ahead on Schema & documentation, 55 against 43; Security & auth, 55 against 47. Also A hosted endpoint, with nothing to install; Runs on your own machine; Free to start without a card; No incidents deducted, where Karrio loses 6 points for them.
- Karrio, good for A team that wants to host its own multi-carrier API with its own carrier contracts and can maintain a Django and PostgreSQL stack. Ahead on Reliability, 76 against 30; Maintenance & community, 29 against 10; Transparency & trust, 59 against 45. Also Open source.

| Category | atoship | Karrio |
| --- | --- | --- |
| Reliability (16%) | 30 | 76 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 55 | 43 |
| Agent ergonomics (13%) | 53 | 57 |
| Security & auth (14%) | 55 | 47 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 10 | 29 |
| Transparency & trust (7%) | 45 | 59 |

| Fact (where they differ) | atoship | Karrio |
| --- | --- | --- |
| Vendor | atoship LLC | Karrio, Inc. |
| Hosted endpoint | `https://atoship.com/api/mcp` | no (local only) |
| Transports | Streamable HTTP, stdio | HTTP |
| Auth | OAuth or key | API key |
| Pricing | Pay per use | Freemium |
| Licence | none | LGPL-3.0 for the server, SDK and modules. Code under `ee/` is under the Karrio Enterprise licence and needs a subscription for production use. The MCP package in `packages/mcp` is Apache-2.0 |
| Tools exposed | 12 | none |
| llms.txt | yes | no |
| Last release | 2026-02-18 | 2026-06-23 |
| Terms last updated | 2026-08-20 | 2025-04-08 |
| Privacy policy last updated | 2026-05-07 | 2025-04-08 |
| Terms restrict benchmarking | not found in the text | yes |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | none | 799 stars |

Why the edge:
- Reliability, Karrio +46: atoship 30 (Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a `RATE_LIMIT_EXCEEDED` code are documented, without numbers (5 of 15). A 429 carries `error.retryAfter` and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.); Karrio 76 (Read with the local-software lines, since the graded surface is the open-source server its owner hosts. The managed platform has no status page we could find. Docker images and PyPI packages at 2026.1.32, per the 8 October check (PyPI and Docker Hub not re-read on 4 November). The clone's package files state Python 3.11 or later for `karrio`, while `karrio_server` still declares 3.7 or later (18 of 20). A public tests workflow runs SDK type checks, SDK tests and server tests on PostgreSQL, and the last five runs on main, all on 23 June 2026, passed, per the 8 October check. main hasn't moved since (25). GitHub Issues is switched off, so bug reports go to Discussions. Reports from July and August 2026 on FedEx dimensions and a GraphQL crash had no reply, per the 8 October check, not re-read on 4 November (10 of 25). Versions are calendar-based, not semver, and the breaking rename of the `purchased` status shipped in 2026.1.20 with a banner in the changelog (8 of 15). Releases are past 1.0 and numbered for production use (15). 18+25+10+8+15 = 76.)
- Maintenance & community, Karrio +19: atoship 10 (No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.); Karrio 29 (The newest release, 2026.1.32, is dated 23 June 2026, 134 days before 4 November, and no tag, branch or commit on main is newer, read in a clone on 4 November (10 of 30). No release in the 90 days from 6 August (0 of 20). Of the 15 newest Discussions threads, 10 showed no maintainer reply, and fix pull requests opened between 23 September and 2 October 2026 each had one or two comments and were unmerged, among 83 open pull requests, per the 8 October check, not re-read on 4 November (8 of 25). The PyPI packages matched the last release on 8 October, and the npm client is at 2023.1.0. The 8 October search of the MCP registry used its JSON API and is withdrawn (5 of 15). CI passed on the last commit and the changelog records pinning axios away from compromised versions, while Dependabot branches from April and June 2026 remain unmerged (6 of 10). 10+0+8+5+6 = 29.)
- Transparency & trust, Karrio +14: atoship 45 (Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.); Karrio 59 (The server, SDK and modules are LGPL-3.0, an OSI licence. `ee/` is under a proprietary licence in the same repository, and the `karrio_server` package file declares Apache-2.0 while the repository licence gives LGPL-3.0 outside `ee/` (26 of 30). The 8 October PyPI licence-field reading came from PyPI's JSON API and is withdrawn. On a self-hosted instance the data stays with the owner. The privacy policy (8 April 2025, per the 8 October check) covers the website and associated services, excludes customer data, gives no retention periods and names 12 service providers. No data processing addendum was found (14 of 30). Breaking changes are flagged in the changelog and the spec says a new dated version marks an incompatible change. No deprecation policy with notice periods was found (7 of 20). Sentry and PostHog reporting are documented and stay off unless the operator sets their keys. The Compose files pull images through a Scarf gateway and the README carries a Scarf pixel, neither described in the docs we read (12 of 20).)
- Schema & documentation, atoship +12: atoship 55 (No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, `error.code` values and `retryAfter`, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.); Karrio 43 (`schemas/openapi.yml` in the repository is OpenAPI 3.0.3 at version 2026.1.32, re-read in a clone on 4 November, and GraphQL schemas sit beside it. The website's API reference loads a copy of it by script, and on 4 November no docs page or README linked a file as a visible download, so it isn't counted as a published contract, as for attendee's and jambonz's repository files (0, from 25). No llms.txt on www.karrio.io (404 again on 4 November) or docs.karrio.io (0). The repository file and the guides cover authentication, pagination, shipments, trackers and webhooks, with little on when not to use a call, such as the stored `/v1/shipments` against the pass-through `/v1/proxy/shipping` (12 of 20). Units, statuses and label types are enums and required fields are marked, but carrier `options` and connection `credentials` are open objects whose keys differ by carrier (10 of 15). The guides have cURL and JavaScript examples and the repository file has an `ErrorResponse` schema, while the error guide is a table of HTTP statuses only (9 of 15). Versions are dated and `CHANGELOG.md` is current, but the changelog page on the website stops at 2024.12.6 (12 of 15). 0+0+12+10+9+12 = 43.)
- Security & auth, atoship +8: atoship 55 (Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.); Karrio 47 (Private API keys with a label, bound to test or live mode, sent as the Basic username or in the `Authorization` header. The docs say a private key can perform any request without restriction. Short-lived resource tokens for document links can travel in a `?token=` query string, which we didn't count against the score because they expire in five minutes by default and open one resource (20 of 30). Test-mode keys keep building away from live carriers. Team permissions are in the paid `ee/` code, and the MCP guide asks the agent to confirm with the user before `create_shipment` (7 of 20). Responses carry carrier tracking text and addresses, and no injection guidance was found (3 of 15). API logs, tracing records and events are stored and readable in the open-source edition, and audit logging is listed as an enterprise feature (10 of 15). `SECURITY.md`, unchanged in the clone's history back to August 2024, is a security policy that sends reports to an email address, with no acknowledgement time. No security.txt, bug bounty or certification was found, and GitHub lists no published advisories although 2026.1.32 fixed MD5 password storage and a March 2026 release stopped carrier API keys reaching tracing spans. A disclosure policy with a reporting route and no acknowledgement time scores 7 in this run, and the fixes without advisories are charged once, in the deductions (7 of 20, from 4). 20+7+3+10+7 = 47.)