{ "data": { "a": { "slug": "atoship", "name": "atoship", "vendor": "atoship LLC", "vendorUrl": "https://atoship.com", "kind": "http-api", "category": "shipping", "summary": "atoship is US shipping software for e-commerce sellers that sells discounted USPS, UPS, FedEx and DHL labels with no subscription. Agents use its REST API v1 or an MCP server, hosted with OAuth or local through npx.", "url": "https://www.anchorterminal.com/tools/atoship", "markdownUrl": "https://www.anchorterminal.com/tools/atoship.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/atoship.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/atoship.json", "dns": "atoship.grade.anchorterminal.com", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://atoship.com/api/mcp", "packages": [ { "registry": "npm", "name": "@atoship/mcp" } ], "auth": "mixed", "authNotes": "REST and the local MCP server take API keys from the dashboard, `ak_live_` for production and `ak_test_` for sandbox, sent as Bearer tokens; the docs advise separate keys with limited scopes and periodic rotation. The hosted MCP server uses OAuth with PKCE (S256) and dynamic registration or a published public client ID, and its approval screen lists what the assistant may do, including buying and voiding labels.", "pricing": "usage", "pricingNotes": "No subscription or seat fee. Wallet-funded labels cost the discounted carrier rate shown live when quoting. Metered fees are $0.08 a label on your own carrier account, $0.03 a number for tracking labels bought elsewhere and $0.03 a call for the standalone Address Verification API. Sign-up is free with no card, and test keys create no real labels.", "priceSummary": "$0.08 / tx", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the MCP docs, API docs, llms.txt or pricing page (checked 2026-11-06). Labels are paid from a prefunded wallet.", "endpoints": [] }, "toolCount": 12, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://atoship.com/docs/mcp", "llmsTxt": "https://atoship.com/llms.txt", "capabilities": [ "shipping.rates", "shipping.labels", "shipping.tracking", "shipping.address-validation", "shipping.returns" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "llms-txt", "usage", "prepaid", "no-card", "sandbox", "webhooks", "postman" ], "lastRelease": "2026-02-18", "graded": true, "anchor": { "graded": true, "score": 43, "grade": "E", "agentReady": false, "rank": 1247, "ranked": true, "rankOf": 1486, "categoryRank": 9, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 53, "maintenance": 10, "payments": 40, "reliability": 30, "schema": 55, "security": 55, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "atoship gives agents twelve MCP tools and a REST API for US labels with published per-unit fees, free sign-up, test keys and a wallet the agent cannot overspend. No status page, rate-limit figures, OpenAPI spec or changelog was found, and the npm MCP package has not changed since February 2026.", "bestFor": "US sellers who want cheap USPS, UPS and FedEx labels bought by an agent from a capped wallet.", "strengths": [ "Free account with no card, and `ak_test_` keys that create no real labels", "Per-unit fees published: $0.08 a label on your own carrier account, $0.03 a tracking number or address check", "Hosted MCP server with OAuth and PKCE, whose consent screen names label buying and voiding", "An agent can spend only what is already in the wallet", "Errors carry machine-readable codes and a `retryAfter` on 429" ], "weaknesses": [ "No status page; status.atoship.com serves the home page", "Rate limits are not given in numbers, and no OpenAPI spec was found", "No changelog, and @atoship/mcp was last published on 18 February 2026", "Most listed SDKs are not published; only Go installs", "No security certification, subprocessor list or retention periods found" ], "agentNotes": [ "Use an `ak_test_` key until the user confirms live labels; test mode creates no real labels", "Ask the user before `purchase_label`, since it spends the wallet balance", "Call `void_label` promptly for a mistaken label, and check the carrier's refund rules", "Branch on `error.code`, and on 429 wait `error.retryAfter` seconds", "Validate the address with `validate_address` before buying; the standalone endpoint costs $0.03 a call" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43 } ], "editorialScores": { "ergonomics": 53, "maintenance": 10, "payments": 40, "reliability": 30, "schema": 55, "security": 55, "transparency": 25 }, "provenanceScore": 65, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @atoship/mcp", "claudeCode": "claude mcp add --transport http atoship https://atoship.com/api/mcp", "config": { "mcpServers": { "atoship": { "url": "https://atoship.com/api/mcp" } } } }, "letme": { "capability": "https://letme.dev/shipping.rates", "tool": "https://letme.dev/atoship" }, "area": "business", "unitPrices": [ { "item": "Label on your own carrier account", "unit": "tx", "usd": 0.08, "note": "Per label; the carrier bills postage" }, { "item": "External tracking number", "unit": "tx", "usd": 0.03, "note": "Only for labels bought elsewhere" }, { "item": "Address Verification API call", "unit": "call", "usd": 0.03, "note": "Standalone endpoint only; checks inside rate quotes are free" } ], "provenance": { "legalEntity": "atoship LLC", "domain": "atoship.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://atoship.com/terms", "privacy": "https://atoship.com/privacy", "statusPage": "", "changelog": "", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "atoship.com/robots.txt disallows /api/, /dashboard/, /admin/, /_next/ and /static/ for all agents, so the MCP and REST endpoints under /api/ were not requested.", "Terms last updated 20 August 2026 and privacy policy 7 May 2026. The terms forbid decompiling or reverse engineering the platform; no clause on reading public pages was found.", "security.txt names security@atoship.com, points its policy to the terms and expires 31 December 2027.", "status.atoship.com answers with the marketing home page and /docs/status rendered no status content, so no status page is recorded." ], "score": 65 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/atoship.json", "live": { "slug": "atoship", "probe": { "target": "https://atoship.com/api/mcp", "method": "get", "lastAt": "2026-11-07T18:20:11.359764372Z", "lastOk": true, "lastStatus": 405, "lastMs": 404, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 366, "p95ms24h": 457, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "versions": [ { "registry": "npm", "name": "@atoship/mcp", "version": "1.0.2", "seenAt": "2026-11-06T23:07:48.297476849Z" } ], "npmWeekly": 6, "securityTxt": { "url": "https://atoship.com/.well-known/security.txt", "state": "valid", "expires": "2027-12-31T23:59:59.000Z", "checkedAt": "2026-11-07T16:01:05.350843408Z" }, "llmsTxt": { "url": "https://atoship.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:37.315201154Z" }, "pages": [ { "url": "https://atoship.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T13:59:42.701099832Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a06a9e463f87" }, { "url": "https://atoship.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T13:59:44.734681167Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b9b07e284da6" } ], "mcpTools": { "url": "https://atoship.com/api/mcp", "checkedAt": "2026-11-07T01:42:32.687477466Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:42:32.687477466Z" }, "updatedAt": "2026-11-07T18:20:11.359764372Z" } }, "answer": "Shippo scores 61.9 (C) on agent readiness against atoship's 43 (E), and leads in 5 of 7 scored categories. atoship leads on security \u0026 auth.", "b": { "slug": "shippo", "name": "Shippo", "vendor": "Shippo", "vendorUrl": "https://goshippo.com", "kind": "http-api", "category": "shipping", "summary": "Multi-carrier shipping API from Shippo. It quotes rates, buys labels, validates addresses, tracks parcels and creates return labels across the carriers it connects, through a REST API, official SDKs and a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/shippo", "markdownUrl": "https://www.anchorterminal.com/tools/shippo.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shippo.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shippo.json", "dns": "shippo.grade.anchorterminal.com", "repo": "https://github.com/goshippo/ai", "license": "Proprietary service under Shippo's terms of use. The SDKs and the goshippo/ai repository (skills and MCP bridge) are MIT", "transports": [ "http" ], "remoteUrl": "https://api.goshippo.com", "packages": [ { "registry": "npm", "name": "shippo" }, { "registry": "pypi", "name": "shippo" }, { "registry": "npm", "name": "@shippo/shippo-mcp" } ], "auth": "mixed", "authNotes": "Self-serve API key. A person signs up at apps.goshippo.com/join and creates live (shippo_live_) and test (shippo_test_) keys in the API portal, with no review. Calls send `Authorization: ShippoToken \u003ckey\u003e`. Keys are shown once, can be deleted and replaced, and have no scopes. The hosted MCP server at mcp.shippo.com uses per-user OAuth against the live account, with one scope (\"*\"). OAuth credentials for a platform acting for other Shippo accounts come from the sales team. Client-side apps can use a 12-hour JWT from POST /embedded/authz.", "pricing": "freemium", "pricingNotes": "API Starter has no monthly fee. The first 30 labels a month are free, then 7 cents a label, on top of postage. Calls not tied to a Shippo label are charged per unit (see the price table). API Premier is custom, with volume discounts, through sales. Test mode is free with a test key, so an agent can start without a contract, and billing details are needed for live labels (https://goshippo.com/pricing/api).", "priceSummary": "$0.07 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI spec or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": 4, "popularity": { "githubStars": 3, "npmWeekly": 73114, "pypiWeekly": 20036, "asOf": "2026-10-07" }, "docsUrl": "https://docs.goshippo.com", "llmsTxt": "https://docs.goshippo.com/llms.txt", "openapi": "https://docs.goshippo.com/spec/shippoapi/public-api.yaml", "registryName": "com.shippo/shippo-mcp", "capabilities": [ "shipping.rates", "shipping.labels", "shipping.tracking", "shipping.address-validation", "shipping.returns" ], "tags": [ "hosted", "freemium", "free-tier", "api-key", "oauth", "mcp", "openapi", "llms-txt", "python", "typescript", "java", "webhooks", "sandbox", "status-page" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 61.9, "grade": "C", "agentReady": false, "rank": 581, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 77, "payments": 40, "reliability": 69, "schema": 83, "security": 42, "transparency": 58 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": 0, "verdict": "Per-label and per-call prices are public, test keys are self-serve, and the OpenAPI spec, llms.txt and Markdown docs are open to a fetch. Label purchase has no idempotency key, API keys carry no scopes, and the status page logged carrier-side incidents on most days from August to October 2026.", "bestFor": "An agent that quotes and buys parcel labels across USPS, UPS, FedEx and DHL Express for a small or mid-size shipper, with a free test mode and public unit prices.", "strengths": [ "Public prices per unit, 7 cents a label after 30 free a month, 1 cent a rate request and 2 cents a tracking request", "Test keys (shippo_test_) create free test labels and mock tracking, with data kept apart from live", "OpenAPI 3.1 spec with 71 operations, plus llms.txt and a Markdown copy of each docs page", "Hosted MCP server at mcp.shippo.com with four tools, reads and writes split so a client can require approval for writes", "Rate limits published per endpoint, with separate live and test figures", "Dated release notes gave a month's notice of the EU product identifier requirement of 1 November 2026, with warnings in responses before enforcement" ], "weaknesses": [ "No idempotency key on label purchase or other writes. Only the Reporting API accepts one", "API keys have no scopes or read-only mode, and the OAuth flow has one scope, \"*\"", "The hosted MCP server runs on the live account only, with no test mode", "Carrier-side incidents on the status page on most days from August to October 2026, many marked major or critical", "Terms of use and privacy notice load only with JavaScript, and no SLA or subprocessor list was found", "The Python SDK's latest stable tag is 3.9.0 from 26 November 2024. 5.0.0 has been in beta since 22 October 2026", "No security.txt, and the disclosure page named in Shippo's own security policy returns 404" ], "agentNotes": [ "Build and test with a shippo_test_ key. Test and live object IDs are separate, and the hosted MCP server has no test mode", "Send `Authorization: ShippoToken \u003ckey\u003e`, not Bearer, and pin `Shippo-API-Version: 2018-02-08`", "Before retrying a failed POST /transactions, list recent transactions. There is no idempotency key, and a second purchase is a second charge", "Pass `async: false` on shipments and transactions, or poll the object until its status leaves QUEUED", "Set `results` on list calls (under 200). Defaults vary by resource, and list calls are limited to 50 a minute on live keys" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.9 } ], "editorialScores": { "ergonomics": 64, "maintenance": 77, "payments": 40, "reliability": 69, "schema": 83, "security": 42, "transparency": 31 }, "provenanceScore": 85, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install shippo", "http": "curl https://api.goshippo.com/shipments/ \\\n -H \"Authorization: ShippoToken \u003cAPI_TOKEN\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -d '{...}'", "claudeCode": "claude mcp add --transport http shippo https://mcp.shippo.com", "config": { "mcpServers": { "shippo": { "url": "https://mcp.shippo.com" } } } }, "letme": { "capability": "https://letme.dev/shipping.rates", "tool": "https://letme.dev/shippo" }, "area": "business", "unitPrices": [ { "item": "Label, API Starter, after 30 free a month, plus postage", "unit": "tx", "usd": 0.07 }, { "item": "Rate request not tied to a Shippo label", "unit": "call", "usd": 0.01 }, { "item": "Tracking request not tied to a Shippo label", "unit": "call", "usd": 0.02 }, { "item": "Delivery date estimate", "unit": "call", "usd": 0.03 }, { "item": "US address validation", "unit": "call", "usd": 0.02 }, { "item": "Non-US address validation", "unit": "call", "usd": 0.08 } ], "provenance": { "legalEntity": "Shippo", "domain": "goshippo.com", "domainRegistered": "2013-09-21", "endpointOnVendorDomain": true, "terms": "https://privacy.goshippo.com/policies?name=terms-of-use", "privacy": "https://privacy.goshippo.com/policies?name=privacy-notice", "statusPage": "https://status.goshippo.com", "changelog": "https://docs.goshippo.com/api-concepts/api-change-log", "securityTxt": "none", "checked": "2026-11-02", "notes": [ "The registered legal entity wasn't confirmed. goshippo.com/terms and /privacy redirect to a privacy centre that returns no policy text without JavaScript. The SDK licences name \"Shippo\" as copyright holder.", "RDAP for goshippo.com gives a registration date of 2013-09-21.", "The API answers at api.goshippo.com and the MCP server at mcp.shippo.com, whose OAuth metadata names https://goshippo.com as the authorisation server.", "goshippo.com/.well-known/security.txt and goshippo.com/security both return 404. The AI repository's SECURITY.md gives security@goshippo.com.", "trust.goshippo.com answers robots.txt with 403 AccessDenied and privacy.goshippo.com with its app page, so neither was read on 2 November 2026." ], "score": 85 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shippo.json", "live": { "slug": "shippo", "probe": { "target": "https://api.goshippo.com", "method": "get", "lastAt": "2026-11-07T18:20:54.135623717Z", "lastOk": true, "lastStatus": 401, "lastMs": 152, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 137, "p95ms24h": 391, "samples24h": 239, "samples30d": 7463, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.goshippo.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:22:00.870658637Z" }, "versions": [ { "registry": "github", "name": "goshippo/ai", "version": "v1.5.4", "released": "2026-07-23", "seenAt": "2026-11-07T00:05:13.725507204Z" }, { "registry": "mcp-registry", "name": "com.shippo/shippo-mcp", "version": "1.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@shippo/shippo-mcp", "version": "3.0.4", "seenAt": "2026-11-07T00:05:12.570847669Z" }, { "registry": "npm", "name": "shippo", "version": "2.19.1", "seenAt": "2026-11-07T00:05:11.499604983Z" }, { "registry": "pypi", "name": "shippo", "version": "3.9.0", "released": "2024-11-26", "seenAt": "2026-11-07T00:05:12.355449434Z" } ], "githubStars": 3, "npmWeekly": 78382, "pypiWeekly": 22556, "securityTxt": { "url": "https://goshippo.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:05.451750051Z" }, "llmsTxt": { "url": "https://docs.goshippo.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.763692987Z" }, "domain": { "domain": "goshippo.com", "registered": "2013-09-21", "source": "https://rdap.verisign.com/com/v1/domain/goshippo.com", "checkedAt": "2026-11-01T14:23:37.391892924Z" }, "pages": [ { "url": "https://docs.goshippo.com/api-concepts/api-change-log", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:06:28.025111681Z", "changedAt": "2026-11-05T12:30:25.846068563Z", "fingerprint": "b3b2a73d88b1" }, { "url": "https://goshippo.com/pricing/api", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:10:33.463721097Z", "changedAt": "2026-11-03T07:50:52.570035252Z", "fingerprint": "63a2e0a9d7e4" }, { "url": "https://privacy.goshippo.com/policies?name=privacy-notice", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:17:23.915284521Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3b0c44298fc" }, { "url": "https://privacy.goshippo.com/policies?name=terms-of-use", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:17:26.364765063Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3b0c44298fc" } ], "mcpTools": { "url": "https://mcp.shippo.com", "checkedAt": "2026-11-07T01:47:54.524178346Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:47:54.524178346Z" }, "github": { "repo": "goshippo/ai", "checkedAt": "2026-11-02T08:52:34.500876974Z", "stars": 3, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-09T14:55:41Z", "openIssues": 0, "openPRs": 7, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 48, "success": 46, "failure": 1, "other": 1, "latest": "success", "latestAt": "2026-07-24T02:06:16Z" } }, "updatedAt": "2026-11-07T18:22:00.870658637Z" } }, "edges": [ { "by": 67, "category": "maintenance", "leads": "shippo", "name": "Maintenance \u0026 community", "reasons": { "a": "No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.", "b": "The API release notes were last updated on 20 October 2026, and the `shippo` npm SDK 2.19.1 was tagged on 27 October 2026 (30). Six dated entries from 4 August, the latest on 1, 8, 14 and 20 October, plus TypeScript SDK 2.19.0 and 2.19.1 (20). Closed service with dated release notes and a support portal. Open issue counts weren't re-read (9 of 15). The MCP server is in the official registry as com.shippo/shippo-mcp, verified by DNS. Official SDKs exist in five languages. The TypeScript SDK was regenerated in October, while the Python SDK's latest stable tag is 3.9.0 from 26 November 2024, with 5.0.0 in beta since 22 October 2026 (12 of 15). SDKs are generated and validated by CI workflows, and goshippo/ai has test and validation workflows, last tagged 23 July (6 of 10)." }, "scores": { "a": 10, "b": 77 } }, { "by": 39, "category": "reliability", "leads": "shippo", "name": "Reliability", "reasons": { "a": "Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a `RATE_LIMIT_EXCEEDED` code are documented, without numbers (5 of 15). A 429 carries `error.retryAfter` and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.", "b": "Read with the hosted lines and scored on the REST API at api.goshippo.com. Statuspage at status.goshippo.com with components for the REST API, the dashboard and each carrier (20). From 4 August to 2 November 2026 the history holds 101 incidents outside maintenance. All but three are on a single carrier's rating, label or tracking service. The others are degraded billing performance on 12 and 13 August, a dashboard error on 9 and 10 September and labels missing from the web app's shipments tab on 17 and 18 September. None names the Shippo REST API. The longest, 25 August (05:18 to 14:27 UTC, marked major), affected one carrier API (Pitney Bowes). This run reads incidents that hit one carrier or part of the service as partial, whatever their label, so minor only (20 of 30). Per-minute limits per endpoint, live and test (15). The docs say a 429 is returned and nothing more. No Retry-After or backoff guidance was found, and label purchase takes no idempotency key, though the TypeScript SDK has a configurable backoff retry (4 of 15). No SLA found. API Premier lists paid 24/7 monitoring as an add-on (0). GA (10)." }, "scores": { "a": 30, "b": 69 } }, { "by": 28, "category": "schema", "leads": "shippo", "name": "Schema \u0026 documentation", "reasons": { "a": "No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, `error.code` values and `retryAfter`, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.", "b": "OpenAPI 3.1 spec for the main API with 71 operations, and six further specs for addresses v2, estimates, reporting, invoices and surcharges (25). llms.txt at docs.goshippo.com and a Markdown copy of each page (10). Descriptions state purpose and some conditions, such as the 390-day limit on shipments and when a batch is asynchronous, but rarely when not to use an endpoint (13 of 20). 94 enums and required fields marked. The 400 response schema is an open object, and weights and dimensions are strings (11 of 15). 427 examples in the spec and samples in six languages. The spec documents 400 on 66 operations, 401 and 404 once each and never 429, and the status-code page is one line per code (9 of 15). Dated API versions set by the Shippo-API-Version header and dated release notes (15)." }, "scores": { "a": 55, "b": 83 } }, { "by": 13, "category": "security", "leads": "atoship", "name": "Security \u0026 auth", "reasons": { "a": "Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.", "b": "Self-serve API keys, live and test kept apart, shown once, deletable in the portal, with no scopes and no documented expiry. The OAuth flow for platforms has one scope, \"*\". JWTs for client-side use last 12 hours (20 of 30). A webhook can carry a self-made token in its URL query string. That is the receiver's secret, not the API credential, so we noted it without the deduction. No read-only key. Test keys can't spend money, and the MCP server separates reads from writes and its docs say writes ask for confirmation (9 of 20). Tracking events, metadata and address text come from carriers and other parties. The AI repository's security policy puts prompt injection in scope for reports, with no guidance in the API docs (5 of 15). The API portal is described as showing usage. No audit log was found in the docs (3 of 15). The AI repository's security policy gives security@goshippo.com and names goshippo.com/security as the disclosure page, which returns 404, as does security.txt. The trust centre at trust.goshippo.com, where the 7 October check read SOC 2 Type II, PCI DSS, a penetration test and a bug bounty, now refuses our crawler, so those readings are set aside and unscored (5 of 20)." }, "scores": { "a": 55, "b": 42 } }, { "by": 13, "category": "transparency", "leads": "shippo", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.", "b": "Closed service. The terms of use sit in a privacy centre that loads only with JavaScript, so we couldn't read them or confirm the contracting entity. SDKs and the goshippo/ai repository are MIT (12 of 30). The privacy notice has the same problem. The release notes say shipments and rates are retrievable for 390 days. The trust centre's DPA link and encryption statements, read on 7 October, are set aside because the host now refuses our crawler, and no retention periods were read (4 of 30). The versioning page says accounts are never forced onto a new API version, and notices carry dates, such as the 1 and 14 October 2026 notices of the EU product identifier requirement from 1 November. Carrier removals are announced on the day (12 of 20). Webhook addresses are published for US and EU regions. The trust centre's hosting and third-party statements are set aside, and no subprocessor list was found (3 of 20)." }, "scores": { "a": 45, "b": 58 } }, { "by": 11, "category": "ergonomics", "leads": "shippo", "name": "Agent ergonomics", "reasons": { "a": "12 MCP tools (15, for 11 to 30). List tools for orders and labels, with paging not documented in the pages read (8 of 20). Machine-readable error codes with a retry delay (18 of 20). The npm package's tools carry no readOnlyHint or destructiveHint, and no idempotency key was found; `void_label` undoes a mistaken purchase (5 of 20). Only the Go SDK installs, the hosted server is one URL, and test keys give a safe default (7 of 15). 15 + 8 + 18 + 5 + 7 = 53.", "b": "Scored on the REST API, with the MCP server noted. List calls take `results` and `page`, and `expand` controls nested objects, but there's no field selection and a shipment returns every rate. The MCP server has four tools (list, describe, read-execute, write-execute) over 73 operations, which keeps definitions small (17 of 25). Pagination on every list. Date filters exist only on shipments, within a 90-day range (14 of 20). Status codes are documented in general terms and the error body is untyped. The goshippo/ai repository has an error reference with recovery steps for MCP use (12 of 20). No idempotency key on shipments, transactions or refunds. The Reporting API accepts `idempotency_key`. The MCP read and write split lets a client approve writes. Its annotations sit behind sign-in and weren't read (8 of 20). Official SDKs for Python, TypeScript, Java, C# and PHP. Shipments and transactions default to asynchronous, and objects can't be edited after creation (13 of 15)." }, "scores": { "a": 53, "b": 64 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "atoship LLC", "b": "Shippo", "name": "Vendor" }, { "a": "https://atoship.com/api/mcp", "b": "https://api.goshippo.com", "name": "Hosted endpoint" }, { "a": "Streamable HTTP, stdio", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Pay per use", "b": "Freemium", "name": "Pricing" }, { "a": "not published", "b": "$0.01 per call", "name": "Price for shipping rates" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary service under Shippo's terms of use. The SDKs and the goshippo/ai repository (skills and MCP bridge) are MIT", "name": "Licence" }, { "a": "12", "b": "4", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "com.shippo/shippo-mcp", "name": "MCP registry" }, { "a": "2026-02-18", "b": "2026-10-27", "name": "Last release" }, { "a": "2026-08-20", "b": "couldn't be read", "name": "Terms last updated" }, { "a": "2026-05-07", "b": "couldn't be read", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "couldn't be read", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "3 stars, 73k npm/wk, 20k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Shippo scores 61.9 (C) on agent readiness against atoship's 43 (E), and leads in 5 of 7 scored categories. atoship leads on security \u0026 auth.", "question": "Which is better for AI agents, atoship or Shippo?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do atoship and Shippo need an API key?" }, { "answer": "Yes. atoship has a hosted endpoint at https://atoship.com/api/mcp and Shippo at https://api.goshippo.com.", "question": "Can an agent call atoship and Shippo without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 55 against 42" ], "also": [ "Runs on your own machine", "Free to start without a card" ], "goodFor": "US sellers who want cheap USPS, UPS and FedEx labels bought by an agent from a capped wallet.", "slug": "atoship", "watchFor": "No status page; status.atoship.com serves the home page" }, { "aheadOn": [ "Reliability, 69 against 30", "Schema \u0026 documentation, 83 against 55", "Agent ergonomics, 64 against 53", "Maintenance \u0026 community, 77 against 10", "Transparency \u0026 trust, 58 against 45" ], "also": null, "goodFor": "An agent that quotes and buys parcel labels across USPS, UPS, FedEx and DHL Express for a small or mid-size shipper, with a free test mode and public unit prices.", "slug": "shippo", "watchFor": "No idempotency key on label purchase or other writes. Only the Reporting API accepts one" } ], "history": { "atoship": null, "shippo": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-02", "delta": -0.1, "from": 62, "fromGrade": "B", "to": 61.9, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-28", "delta": 0.1, "from": 61.9, "fromGrade": "C", "to": 62, "toGrade": "B" } ] }, "job": { "capability": "shipping.rates", "name": "Shipping rates" }, "others": [ { "json": "https://www.anchorterminal.com/compare/atoship-vs-easypost.json", "title": "atoship vs EasyPost", "url": "https://www.anchorterminal.com/compare/atoship-vs-easypost" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-easyship.json", "title": "atoship vs Easyship", "url": "https://www.anchorterminal.com/compare/atoship-vs-easyship" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-envia.json", "title": "atoship vs Envia", "url": "https://www.anchorterminal.com/compare/atoship-vs-envia" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-karrio.json", "title": "atoship vs Karrio", "url": "https://www.anchorterminal.com/compare/atoship-vs-karrio" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-sendcloud.json", "title": "atoship vs Sendcloud", "url": "https://www.anchorterminal.com/compare/atoship-vs-sendcloud" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-shipbob.json", "title": "atoship vs ShipBob", "url": "https://www.anchorterminal.com/compare/atoship-vs-shipbob" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-shippypro.json", "title": "atoship vs ShippyPro", "url": "https://www.anchorterminal.com/compare/atoship-vs-shippypro" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-shipstation.json", "title": "atoship vs ShipStation API", "url": "https://www.anchorterminal.com/compare/atoship-vs-shipstation" }, { "json": "https://www.anchorterminal.com/compare/easypost-vs-shippo.json", "title": "EasyPost vs Shippo", "url": "https://www.anchorterminal.com/compare/easypost-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/easyship-vs-shippo.json", "title": "Easyship vs Shippo", "url": "https://www.anchorterminal.com/compare/easyship-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/envia-vs-shippo.json", "title": "Envia vs Shippo", "url": "https://www.anchorterminal.com/compare/envia-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/karrio-vs-shippo.json", "title": "Karrio vs Shippo", "url": "https://www.anchorterminal.com/compare/karrio-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/sendcloud-vs-shippo.json", "title": "Sendcloud vs Shippo", "url": "https://www.anchorterminal.com/compare/sendcloud-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/shipbob-vs-shippo.json", "title": "ShipBob vs Shippo", "url": "https://www.anchorterminal.com/compare/shipbob-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/shippo-vs-shippypro.json", "title": "Shippo vs ShippyPro", "url": "https://www.anchorterminal.com/compare/shippo-vs-shippypro" }, { "json": "https://www.anchorterminal.com/compare/shippo-vs-shipstation.json", "title": "Shippo vs ShipStation API", "url": "https://www.anchorterminal.com/compare/shippo-vs-shipstation" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-ship24.json", "title": "atoship vs Ship24", "url": "https://www.anchorterminal.com/compare/atoship-vs-ship24" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-trackingmore.json", "title": "atoship vs TrackingMore", "url": "https://www.anchorterminal.com/compare/atoship-vs-trackingmore" }, { "json": "https://www.anchorterminal.com/compare/ship24-vs-shippo.json", "title": "Ship24 vs Shippo", "url": "https://www.anchorterminal.com/compare/ship24-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/shippo-vs-trackingmore.json", "title": "Shippo vs TrackingMore", "url": "https://www.anchorterminal.com/compare/shippo-vs-trackingmore" } ], "panel": null, "scores": [ { "atoship": 30, "by": 39, "edge": "shippo", "key": "reliability", "name": "Reliability", "shippo": 69, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "atoship": 55, "by": 28, "edge": "shippo", "key": "schema", "name": "Schema \u0026 documentation", "shippo": 83, "weight": 13 }, { "atoship": 53, "by": 11, "edge": "shippo", "key": "ergonomics", "name": "Agent ergonomics", "shippo": 64, "weight": 13 }, { "atoship": 55, "by": 13, "edge": "atoship", "key": "security", "name": "Security \u0026 auth", "shippo": 42, "weight": 14 }, { "atoship": 40, "by": 0, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "shippo": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "atoship": 10, "by": 67, "edge": "shippo", "key": "maintenance", "name": "Maintenance \u0026 community", "shippo": 77, "weight": 7 }, { "atoship": 45, "by": 13, "edge": "shippo", "key": "transparency", "name": "Transparency \u0026 trust", "shippo": 58, "weight": 7 } ], "summary": "Shippo scores 61.9 (C) on agent readiness against atoship's 43 (E), and leads in 5 of 7 scored categories. atoship leads on security \u0026 auth. Both do shipping rates.", "tasks": null, "tutorials": [], "verdicts": { "atoship": "atoship gives agents twelve MCP tools and a REST API for US labels with published per-unit fees, free sign-up, test keys and a wallet the agent cannot overspend. No status page, rate-limit figures, OpenAPI spec or changelog was found, and the npm MCP package has not changed since February 2026.", "shippo": "Per-label and per-call prices are public, test keys are self-serve, and the OpenAPI spec, llms.txt and Markdown docs are open to a fetch. Label purchase has no idempotency key, API keys carry no scopes, and the status page logged carrier-side incidents on most days from August to October 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/atoship-vs-shippo", "json": "https://www.anchorterminal.com/compare/atoship-vs-shippo.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/atoship-vs-shippo.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/atoship-vs-shippo.min.md" }, "markdown": "Shippo scores 61.9 (C) on agent readiness against atoship's 43 (E), and leads in 5 of 7 scored categories. atoship leads on security \u0026 auth. Both do shipping rates.\n\n- atoship: grade E, 43/100, rank #1247 of 1486. Markdown https://www.anchorterminal.com/tools/atoship.md · JSON https://www.anchorterminal.com/api/v1/tools/atoship.json\n- Shippo: grade C, 61.9/100, rank #581 of 1486. Markdown https://www.anchorterminal.com/tools/shippo.md · JSON https://www.anchorterminal.com/api/v1/tools/shippo.json\n- Best shipping and fulfilment APIs for AI agents: https://www.anchorterminal.com/best/shipping/index.md\n- All 66 shipping comparisons: https://www.anchorterminal.com/compare/shipping/index.md\n\n## Which one, for what\n\n### atoship (E)\n\nGood for: US sellers who want cheap USPS, UPS and FedEx labels bought by an agent from a capped wallet.\n\nAhead on:\n- Security \u0026 auth, 55 against 42\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: No status page; status.atoship.com serves the home page\n\n### Shippo (C)\n\nGood for: An agent that quotes and buys parcel labels across USPS, UPS, FedEx and DHL Express for a small or mid-size shipper, with a free test mode and public unit prices.\n\nAhead on:\n- Reliability, 69 against 30\n- Schema \u0026 documentation, 83 against 55\n- Agent ergonomics, 64 against 53\n- Maintenance \u0026 community, 77 against 10\n- Transparency \u0026 trust, 58 against 45\n\nWatch for: No idempotency key on label purchase or other writes. Only the Reporting API accepts one\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Shippo +67\n\n- atoship (10): No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.\n- Shippo (77): The API release notes were last updated on 20 October 2026, and the `shippo` npm SDK 2.19.1 was tagged on 27 October 2026 (30). Six dated entries from 4 August, the latest on 1, 8, 14 and 20 October, plus TypeScript SDK 2.19.0 and 2.19.1 (20). Closed service with dated release notes and a support portal. Open issue counts weren't re-read (9 of 15). The MCP server is in the official registry as com.shippo/shippo-mcp, verified by DNS. Official SDKs exist in five languages. The TypeScript SDK was regenerated in October, while the Python SDK's latest stable tag is 3.9.0 from 26 November 2024, with 5.0.0 in beta since 22 October 2026 (12 of 15). SDKs are generated and validated by CI workflows, and goshippo/ai has test and validation workflows, last tagged 23 July (6 of 10).\n\n### Reliability: Shippo +39\n\n- atoship (30): Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a `RATE_LIMIT_EXCEEDED` code are documented, without numbers (5 of 15). A 429 carries `error.retryAfter` and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.\n- Shippo (69): Read with the hosted lines and scored on the REST API at api.goshippo.com. Statuspage at status.goshippo.com with components for the REST API, the dashboard and each carrier (20). From 4 August to 2 November 2026 the history holds 101 incidents outside maintenance. All but three are on a single carrier's rating, label or tracking service. The others are degraded billing performance on 12 and 13 August, a dashboard error on 9 and 10 September and labels missing from the web app's shipments tab on 17 and 18 September. None names the Shippo REST API. The longest, 25 August (05:18 to 14:27 UTC, marked major), affected one carrier API (Pitney Bowes). This run reads incidents that hit one carrier or part of the service as partial, whatever their label, so minor only (20 of 30). Per-minute limits per endpoint, live and test (15). The docs say a 429 is returned and nothing more. No Retry-After or backoff guidance was found, and label purchase takes no idempotency key, though the TypeScript SDK has a configurable backoff retry (4 of 15). No SLA found. API Premier lists paid 24/7 monitoring as an add-on (0). GA (10).\n\n### Schema \u0026 documentation: Shippo +28\n\n- atoship (55): No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, `error.code` values and `retryAfter`, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.\n- Shippo (83): OpenAPI 3.1 spec for the main API with 71 operations, and six further specs for addresses v2, estimates, reporting, invoices and surcharges (25). llms.txt at docs.goshippo.com and a Markdown copy of each page (10). Descriptions state purpose and some conditions, such as the 390-day limit on shipments and when a batch is asynchronous, but rarely when not to use an endpoint (13 of 20). 94 enums and required fields marked. The 400 response schema is an open object, and weights and dimensions are strings (11 of 15). 427 examples in the spec and samples in six languages. The spec documents 400 on 66 operations, 401 and 404 once each and never 429, and the status-code page is one line per code (9 of 15). Dated API versions set by the Shippo-API-Version header and dated release notes (15).\n\n### Security \u0026 auth: atoship +13\n\n- atoship (55): Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.\n- Shippo (42): Self-serve API keys, live and test kept apart, shown once, deletable in the portal, with no scopes and no documented expiry. The OAuth flow for platforms has one scope, \"*\". JWTs for client-side use last 12 hours (20 of 30). A webhook can carry a self-made token in its URL query string. That is the receiver's secret, not the API credential, so we noted it without the deduction. No read-only key. Test keys can't spend money, and the MCP server separates reads from writes and its docs say writes ask for confirmation (9 of 20). Tracking events, metadata and address text come from carriers and other parties. The AI repository's security policy puts prompt injection in scope for reports, with no guidance in the API docs (5 of 15). The API portal is described as showing usage. No audit log was found in the docs (3 of 15). The AI repository's security policy gives security@goshippo.com and names goshippo.com/security as the disclosure page, which returns 404, as does security.txt. The trust centre at trust.goshippo.com, where the 7 October check read SOC 2 Type II, PCI DSS, a penetration test and a bug bounty, now refuses our crawler, so those readings are set aside and unscored (5 of 20).\n\n### Transparency \u0026 trust: Shippo +13\n\n- atoship (45): Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.\n- Shippo (58): Closed service. The terms of use sit in a privacy centre that loads only with JavaScript, so we couldn't read them or confirm the contracting entity. SDKs and the goshippo/ai repository are MIT (12 of 30). The privacy notice has the same problem. The release notes say shipments and rates are retrievable for 390 days. The trust centre's DPA link and encryption statements, read on 7 October, are set aside because the host now refuses our crawler, and no retention periods were read (4 of 30). The versioning page says accounts are never forced onto a new API version, and notices carry dates, such as the 1 and 14 October 2026 notices of the EU product identifier requirement from 1 November. Carrier removals are announced on the day (12 of 20). Webhook addresses are published for US and EU regions. The trust centre's hosting and third-party statements are set aside, and no subprocessor list was found (3 of 20).\n\n### Agent ergonomics: Shippo +11\n\n- atoship (53): 12 MCP tools (15, for 11 to 30). List tools for orders and labels, with paging not documented in the pages read (8 of 20). Machine-readable error codes with a retry delay (18 of 20). The npm package's tools carry no readOnlyHint or destructiveHint, and no idempotency key was found; `void_label` undoes a mistaken purchase (5 of 20). Only the Go SDK installs, the hosted server is one URL, and test keys give a safe default (7 of 15). 15 + 8 + 18 + 5 + 7 = 53.\n- Shippo (64): Scored on the REST API, with the MCP server noted. List calls take `results` and `page`, and `expand` controls nested objects, but there's no field selection and a shipment returns every rate. The MCP server has four tools (list, describe, read-execute, write-execute) over 73 operations, which keeps definitions small (17 of 25). Pagination on every list. Date filters exist only on shipments, within a 90-day range (14 of 20). Status codes are documented in general terms and the error body is untyped. The goshippo/ai repository has an error reference with recovery steps for MCP use (12 of 20). No idempotency key on shipments, transactions or refunds. The Reporting API accepts `idempotency_key`. The MCP read and write split lets a client approve writes. Its annotations sit behind sign-in and weren't read (8 of 20). Official SDKs for Python, TypeScript, Java, C# and PHP. Shipments and transactions default to asynchronous, and objects can't be edited after creation (13 of 15).\n\n## Score by category\n\n| Category | Weight | atoship | Shippo | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 30 | 69 | Shippo +39 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 55 | 83 | Shippo +28 |\n| Agent ergonomics | 13% (16.2 this run) | 53 | 64 | Shippo +11 |\n| Security \u0026 auth | 14% (17.5 this run) | 55 | 42 | atoship +13 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 40 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 10 | 77 | Shippo +67 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 45 | 58 | Shippo +13 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **43 · E** | **61.9 · C** | |\n\n## Facts side by side\n\n| Fact | atoship | Shippo |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | atoship LLC | Shippo |\n| Hosted endpoint | `https://atoship.com/api/mcp` | `https://api.goshippo.com` |\n| Transports | Streamable HTTP, stdio | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Pay per use | Freemium |\n| Price for shipping rates | not published | $0.01 per call |\n| x402 | no | no |\n| Licence | none | Proprietary service under Shippo's terms of use. The SDKs and the goshippo/ai repository (skills and MCP bridge) are MIT |\n| Tools exposed | 12 | 4 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `com.shippo/shippo-mcp` |\n| Last release | 2026-02-18 | 2026-10-27 |\n| Terms last updated | 2026-08-20 | couldn't be read |\n| Privacy policy last updated | 2026-05-07 | couldn't be read |\n| Customer content may train models | not found in the text | couldn't be read |\n| Terms restrict automated access | not found in the text | couldn't be read |\n| Terms restrict benchmarking | not found in the text | couldn't be read |\n| Terms or service can change without notice | not found in the text | couldn't be read |\n| Arbitration or class-action waiver | yes | couldn't be read |\n| Popularity | none | 3 stars, 73k npm/wk, 20k PyPI/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### atoship\n\nNo score change since it was listed.\n\n### Shippo\n\n- -0.1 on 2 November 2026 (B to C): new evidence, correction\n- +0.1 on 28 October 2026 (C to B): checklist\n\n## Verdicts\n\n**atoship.** atoship gives agents twelve MCP tools and a REST API for US labels with published per-unit fees, free sign-up, test keys and a wallet the agent cannot overspend. No status page, rate-limit figures, OpenAPI spec or changelog was found, and the npm MCP package has not changed since February 2026.\n\n**Shippo.** Per-label and per-call prices are public, test keys are self-serve, and the OpenAPI spec, llms.txt and Markdown docs are open to a fetch. Label purchase has no idempotency key, API keys carry no scopes, and the status page logged carrier-side incidents on most days from August to October 2026.\n\n## Before you call either\n\n### atoship\n\n1. Use an `ak_test_` key until the user confirms live labels; test mode creates no real labels\n2. Ask the user before `purchase_label`, since it spends the wallet balance\n3. Call `void_label` promptly for a mistaken label, and check the carrier's refund rules\n4. Branch on `error.code`, and on 429 wait `error.retryAfter` seconds\n5. Validate the address with `validate_address` before buying; the standalone endpoint costs $0.03 a call\n\n### Shippo\n\n1. Build and test with a shippo_test_ key. Test and live object IDs are separate, and the hosted MCP server has no test mode\n2. Send `Authorization: ShippoToken \u003ckey\u003e`, not Bearer, and pin `Shippo-API-Version: 2018-02-08`\n3. Before retrying a failed POST /transactions, list recent transactions. There is no idempotency key, and a second purchase is a second charge\n4. Pass `async: false` on shipments and transactions, or poll the object until its status leaves QUEUED\n5. Set `results` on list calls (under 200). Defaults vary by resource, and list calls are limited to 50 a minute on live keys\n\n## Questions\n\n### Which is better for AI agents, atoship or Shippo?\n\nShippo scores 61.9 (C) on agent readiness against atoship's 43 (E), and leads in 5 of 7 scored categories. atoship leads on security \u0026 auth.\n\n### Do atoship and Shippo need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call atoship and Shippo without installing anything?\n\nYes. atoship has a hosted endpoint at https://atoship.com/api/mcp and Shippo at https://api.goshippo.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/atoship-vs-shippo.json, and with the fewest tokens: https://www.anchorterminal.com/compare/atoship-vs-shippo.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"atoship\", \"b\": \"shippo\"}`. From a terminal: `anchor compare atoship shippo`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/atoship.json and https://www.anchorterminal.com/api/v1/tools/shippo.json\n\n## Other comparisons with atoship or Shippo\n\n- [atoship vs EasyPost](https://www.anchorterminal.com/compare/atoship-vs-easypost.md)\n- [atoship vs Easyship](https://www.anchorterminal.com/compare/atoship-vs-easyship.md)\n- [atoship vs Envia](https://www.anchorterminal.com/compare/atoship-vs-envia.md)\n- [atoship vs Karrio](https://www.anchorterminal.com/compare/atoship-vs-karrio.md)\n- [atoship vs Sendcloud](https://www.anchorterminal.com/compare/atoship-vs-sendcloud.md)\n- [atoship vs ShipBob](https://www.anchorterminal.com/compare/atoship-vs-shipbob.md)\n- [atoship vs ShippyPro](https://www.anchorterminal.com/compare/atoship-vs-shippypro.md)\n- [atoship vs ShipStation API](https://www.anchorterminal.com/compare/atoship-vs-shipstation.md)\n- [EasyPost vs Shippo](https://www.anchorterminal.com/compare/easypost-vs-shippo.md)\n- [Easyship vs Shippo](https://www.anchorterminal.com/compare/easyship-vs-shippo.md)\n- [Envia vs Shippo](https://www.anchorterminal.com/compare/envia-vs-shippo.md)\n- [Karrio vs Shippo](https://www.anchorterminal.com/compare/karrio-vs-shippo.md)\n- [Sendcloud vs Shippo](https://www.anchorterminal.com/compare/sendcloud-vs-shippo.md)\n- [ShipBob vs Shippo](https://www.anchorterminal.com/compare/shipbob-vs-shippo.md)\n- [Shippo vs ShippyPro](https://www.anchorterminal.com/compare/shippo-vs-shippypro.md)\n- [Shippo vs ShipStation API](https://www.anchorterminal.com/compare/shippo-vs-shipstation.md)\n- [atoship vs Ship24](https://www.anchorterminal.com/compare/atoship-vs-ship24.md)\n- [atoship vs TrackingMore](https://www.anchorterminal.com/compare/atoship-vs-trackingmore.md)\n- [Ship24 vs Shippo](https://www.anchorterminal.com/compare/ship24-vs-shippo.md)\n- [Shippo vs TrackingMore](https://www.anchorterminal.com/compare/shippo-vs-trackingmore.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "atoship vs Shippo", "url": "" } ], "description": "Shippo scores 61.9 (C) to atoship's 43 (E) for shipping rates. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "atoship E 43", "Shippo C 61.9", "scores" ], "h1": "atoship vs Shippo", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/atoship-vs-shippo", "published": "2026-10-01", "section": "tools", "title": "atoship vs Shippo for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/atoship-vs-shippo" }, "tokens": { "markdown": 4550, "slim": 3030 }, "version": 1 }