atoship vs Ship24

atoship 10

No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.

Ship24 60

Every dated source of Ship24's own looked for on 4 November, from depth-200 clones. They are the ship24 Node SDK (tags v1.0.0 on 14 July and v1.1.0 on 6 October 2026), ship24-ai-plugin (v1.0.0 on 9 September 2026), n8n-nodes-ship24 (newest v1.1.3 on 30 June 2026), the data format page's deprecated-field table (signedBy, dated 2026-08 by month only) and no API changelog. The newest release is the SDK's 1.1.0 on 6 October, 29 days back (30). In the 90 days from 6 August there are two dated releases, SDK 1.1.0 and plugin 1.0.0. The 14 and 16 July releases have left the window and the MCP server's 27 August version date came from the MCP registry's JSON API, which is struck, so the line is 0 (20 on 8 October). The service is closed, with no API changelog. Support is a contact form, and four open SDK issues and two plugin issues were counted on 8 October, not re-read (6 of 15, kept). Current official SDK for Node.js and TypeScript, synced with the OpenAPI spec in 1.1.0 (15). The SDK has no runtime dependencies, CI that tests Node 20, 22 and 24, and a workflow that reports drift from the OpenAPI spec (9 of 10). 30 + 0 + 6 + 15 + 9 = 60.

atoship 55

No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, error.code values and retryAfter, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.

Ship24 81

A public OpenAPI 3.1 spec at docs.ship24.com/assets/openapi/ship24-tracking-api.yaml covers 12 operations and two webhooks and is linked as a download from the AI integration page (25, re-read 4 November). llms.txt and a hosted SKILL.md guide exist, but the docs pages have no Markdown copies and llms.txt truncates its descriptions (8 of 10). The docs' MCP tool table says what each tool does and which calls are billed or large, such as caching get_couriers, and the docs explain the three ways to fetch results (18 of 20). Inputs are typed with required fields, 12 enums and limits such as 5 to 50 characters for a tracking number and 500 a page, though the Authorization header is modelled as a plain string parameter (12 of 15). The spec has many examples and the errors page lists 12 codes, but most operations document only their success response (10 of 15). The path carries v1 and the data format page promises that fields are never removed and lists four deprecated fields with months. No API changelog was found, only the SDK and plugin changelogs (8 of 15).

atoship 55

Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.

Ship24 34

API keys are sent as a Bearer token in the Authorization header. An account can hold up to 20, managed in the dashboard, and the plugin's SECURITY.md advises a dedicated key so it can be revoked alone. Keys have no scopes and no secret travels in a query string (20 of 30). No read-only key, approval step or other least-privilege control was found in the docs. The 8 October credit for plan-based tool registration and a destructive mark on resend_webhooks came from a request to the MCP server, which is struck (0 of 20). Results carry courier event text, which is untrusted, and no prompt-injection guidance was found in the docs or the plugin (3 of 15). GET /trackers/:trackerId/webhook-history/download returns every webhook push with its response, but no log of API calls or key use was found (4 of 15). SECURITY.md in the plugin repository is a disclosure policy (email contact@ship24.com with "Security" in the subject, no public issues, API and MCP server reports the same way) with no acknowledgement time, which this run reads as 7 (5 on 8 October). No security.txt (404 on 4 November), bug bounty, SOC 2 or ISO 27001 statement was found, and webhooks are checked by a static shared secret with no signature (7 of 20). 20 + 0 + 3 + 4 + 7 = 34.

atoship 53

12 MCP tools (15, for 11 to 30). List tools for orders and labels, with paging not documented in the pages read (8 of 20). Machine-readable error codes with a retry delay (18 of 20). The npm package's tools carry no readOnlyHint or destructiveHint, and no idempotency key was found; void_label undoes a mistaken purchase (5 of 20). Only the Go SDK installs, the hosted server is one URL, and test keys give a safe default (7 of 15). 15 + 8 + 18 + 5 + 7 = 53.

Ship24 68

Scored on the REST API and the MCP server together. The docs list 11 MCP tools; the REST API has no field selection, so a results call returns every event (13 of 25, kept; the 8 October size of the tools/list answer came from a request to the server and is struck). GET /trackers pages by page and limit (default 100, maximum 500) with a sort order. No filter appears in the spec for that call, and GET /couriers returns the full list unpaged (12 of 20). Errors are a JSON errors array with a stable code and a message that says what to fix, with 12 documented codes (16 of 20). POST /trackers and POST /trackers/track are idempotent for an identical payload, clientTrackerId is validated as unique, and the bulk call is documented as not fully idempotent. The MCP annotations credited on 8 October came from the struck tools/list request, so the line now rests on the REST behaviour (18 of 20, the earlier partial kept and flagged). Only trackingNumber is required and the courier is detected automatically. One official SDK exists, for Node.js and TypeScript, so the two-language line isn't met (9 of 15). 13 + 12 + 16 + 18 + 9 = 68.

atoship 30

Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a RATE_LIMIT_EXCEEDED code are documented, without numbers (5 of 15). A 429 carries error.retryAfter and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

Ship24 42

Read with the hosted lines and scored on the REST API at api.ship24.com/public/v1, which the hosted MCP server wraps. No status page was found. status.ship24.com doesn't resolve, ship24.statuspage.io still redirects to its inactive page, and neither the site footer nor the docs link to one (0, re-read 4 November). With no readable incident history the record scores the default (5 of 30). The rate limiter page gives a number for each of 11 endpoints, from 1 request a second on GET /couriers and webhook resend to 10 on most others (15). The rate limiter page documents RateLimit-*, X-RateLimit-* and Retry-After headers, the errors page recommends exponential back-off on 429, and tracker creation is documented as idempotent for an identical payload with a 409 request_conflict. That is back-off plus safe-retry guidance with no idempotency keys, 12 on this run's settled reading (15 on 8 October). The terms supply the service as is and as available, with no SLA found for any plan (0). The path is /public/v1 with no beta label (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.

atoship 40

No x402, MPP or L402 (0). Per-unit fees are published without a login ($0.08 a BYOCA label, $0.03 a tracking number or address check), and wallet postage is priced live in a public calculator (20). Free account with no card, and test keys (20). A person signs up in a browser and funds the wallet (0). 0 + 20 + 20 + 0 = 40.

Ship24 30

Read with the hosted rubric. No x402, MPP or L402 was found in the docs, the spec or the pricing page (0). The pricing page lists both billing models without a login, per shipment from $39 a month for 1,000 with $0.045 for each extra shipment, and per call from $99 a month for 10,000 with $0.015 for each extra call, with every tier and overage rate in a table (20). The Tracking API has a free plan of 10 shipments a month. Whether signup asks for a card wasn't established, because the dashboard needs a login we didn't create (10 of 20). A person signs up and picks a plan in the dashboard, and API key creation isn't available through the API or the MCP server (0).