atoship vs Shippo

atoship 10

No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.

Shippo 77

The API release notes were last updated on 20 October 2026, and the shippo npm SDK 2.19.1 was tagged on 27 October 2026 (30). Six dated entries from 4 August, the latest on 1, 8, 14 and 20 October, plus TypeScript SDK 2.19.0 and 2.19.1 (20). Closed service with dated release notes and a support portal. Open issue counts weren't re-read (9 of 15). The MCP server is in the official registry as com.shippo/shippo-mcp, verified by DNS. Official SDKs exist in five languages. The TypeScript SDK was regenerated in October, while the Python SDK's latest stable tag is 3.9.0 from 26 November 2024, with 5.0.0 in beta since 22 October 2026 (12 of 15). SDKs are generated and validated by CI workflows, and goshippo/ai has test and validation workflows, last tagged 23 July (6 of 10).

atoship 30

Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a RATE_LIMIT_EXCEEDED code are documented, without numbers (5 of 15). A 429 carries error.retryAfter and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

Shippo 69

Read with the hosted lines and scored on the REST API at api.goshippo.com. Statuspage at status.goshippo.com with components for the REST API, the dashboard and each carrier (20). From 4 August to 2 November 2026 the history holds 101 incidents outside maintenance. All but three are on a single carrier's rating, label or tracking service. The others are degraded billing performance on 12 and 13 August, a dashboard error on 9 and 10 September and labels missing from the web app's shipments tab on 17 and 18 September. None names the Shippo REST API. The longest, 25 August (05:18 to 14:27 UTC, marked major), affected one carrier API (Pitney Bowes). This run reads incidents that hit one carrier or part of the service as partial, whatever their label, so minor only (20 of 30). Per-minute limits per endpoint, live and test (15). The docs say a 429 is returned and nothing more. No Retry-After or backoff guidance was found, and label purchase takes no idempotency key, though the TypeScript SDK has a configurable backoff retry (4 of 15). No SLA found. API Premier lists paid 24/7 monitoring as an add-on (0). GA (10).

atoship 55

No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, error.code values and retryAfter, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.

Shippo 83

OpenAPI 3.1 spec for the main API with 71 operations, and six further specs for addresses v2, estimates, reporting, invoices and surcharges (25). llms.txt at docs.goshippo.com and a Markdown copy of each page (10). Descriptions state purpose and some conditions, such as the 390-day limit on shipments and when a batch is asynchronous, but rarely when not to use an endpoint (13 of 20). 94 enums and required fields marked. The 400 response schema is an open object, and weights and dimensions are strings (11 of 15). 427 examples in the spec and samples in six languages. The spec documents 400 on 66 operations, 401 and 404 once each and never 429, and the status-code page is one line per code (9 of 15). Dated API versions set by the Shippo-API-Version header and dated release notes (15).

atoship 55

Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.

Shippo 42

Self-serve API keys, live and test kept apart, shown once, deletable in the portal, with no scopes and no documented expiry. The OAuth flow for platforms has one scope, "*". JWTs for client-side use last 12 hours (20 of 30). A webhook can carry a self-made token in its URL query string. That is the receiver's secret, not the API credential, so we noted it without the deduction. No read-only key. Test keys can't spend money, and the MCP server separates reads from writes and its docs say writes ask for confirmation (9 of 20). Tracking events, metadata and address text come from carriers and other parties. The AI repository's security policy puts prompt injection in scope for reports, with no guidance in the API docs (5 of 15). The API portal is described as showing usage. No audit log was found in the docs (3 of 15). The AI repository's security policy gives security@goshippo.com and names goshippo.com/security as the disclosure page, which returns 404, as does security.txt. The trust centre at trust.goshippo.com, where the 7 October check read SOC 2 Type II, PCI DSS, a penetration test and a bug bounty, now refuses our crawler, so those readings are set aside and unscored (5 of 20).

atoship 45

Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.

Shippo 58

Closed service. The terms of use sit in a privacy centre that loads only with JavaScript, so we couldn't read them or confirm the contracting entity. SDKs and the goshippo/ai repository are MIT (12 of 30). The privacy notice has the same problem. The release notes say shipments and rates are retrievable for 390 days. The trust centre's DPA link and encryption statements, read on 7 October, are set aside because the host now refuses our crawler, and no retention periods were read (4 of 30). The versioning page says accounts are never forced onto a new API version, and notices carry dates, such as the 1 and 14 October 2026 notices of the EU product identifier requirement from 1 November. Carrier removals are announced on the day (12 of 20). Webhook addresses are published for US and EU regions. The trust centre's hosting and third-party statements are set aside, and no subprocessor list was found (3 of 20).

atoship 53

12 MCP tools (15, for 11 to 30). List tools for orders and labels, with paging not documented in the pages read (8 of 20). Machine-readable error codes with a retry delay (18 of 20). The npm package's tools carry no readOnlyHint or destructiveHint, and no idempotency key was found; void_label undoes a mistaken purchase (5 of 20). Only the Go SDK installs, the hosted server is one URL, and test keys give a safe default (7 of 15). 15 + 8 + 18 + 5 + 7 = 53.

Shippo 64

Scored on the REST API, with the MCP server noted. List calls take results and page, and expand controls nested objects, but there's no field selection and a shipment returns every rate. The MCP server has four tools (list, describe, read-execute, write-execute) over 73 operations, which keeps definitions small (17 of 25). Pagination on every list. Date filters exist only on shipments, within a 90-day range (14 of 20). Status codes are documented in general terms and the error body is untyped. The goshippo/ai repository has an error reference with recovery steps for MCP use (12 of 20). No idempotency key on shipments, transactions or refunds. The Reporting API accepts idempotency_key. The MCP read and write split lets a client approve writes. Its annotations sit behind sign-in and weren't read (8 of 20). Official SDKs for Python, TypeScript, Java, C# and PHP. Shipments and transactions default to asynchronous, and objects can't be edited after creation (13 of 15).