atoship vs ShippyPro

atoship 30

Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a RATE_LIMIT_EXCEEDED code are documented, without numbers (5 of 15). A 429 carries error.retryAfter and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

ShippyPro 80

Read with the hosted lines and scored on the v1 REST API, where rates, labels and tracking live. Statuspage at status.shippypro.com, read under its own robots.txt on 4 November, with components for ShippyPro Platform (UI), ShippyPro API & Webhooks and each carrier (20). Its history pages and feed cover the whole 90 days from 6 August, with 122 entries outside scheduled maintenance. Nearly all are one carrier's label creation, marked critical. The others are Orders page problems on 10 August, unsent SMS one-time codes and notifications (29 August to 3 September and 19 September to 5 October), a platform login problem of 3 hours 6 minutes on 18 September, pickup point search for some carriers on 22 October (47 minutes), PDF label retrieval on 22 October and website timeouts for some users on 27 October. None names the API, and each touches one carrier, one function or the web app, so all are partial and read as minor, as on Shippo, ShipStation, Sendcloud and EasyPost (20, from 10, where the 9 October check read the login problem as a major). 20 API calls every 10 seconds, with a 429 above it and a higher limit for a fee, per the help centre re-read on 4 November (15). The help centre documents the 429 with no backoff or Retry-After guidance and suggests spreading calls over several IP addresses. Its API errors article says a Ship call that times out can still create a label, recommends the asynchronous Ship option and names the error for a repeated Transaction ID, which is safe-retry guidance for the core write. The 9 October reading of v2's Retry-After and Idempotency-Key came from files this run doesn't read (see Schema), so the earlier partial is kept on the help centre alone (5). The SLA commits to 99.5 per cent a month with service credits, per the 9 October check, not re-read on 4 November (10). GA (10). 20+20+15+5+10+10 = 80.

atoship 55

No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, error.code values and retryAfter, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.

ShippyPro 18

The API reference at api.shippypro.com/docs loads its two OpenAPI files (/docs/v1.json and /docs/v2.json) by script, and neither it, the API product page, llms.txt nor the help centre links them as a visible download. This run counts a spec only where a docs page links it as a download, so the contract line is 0 (from 25) and the 9 October readings taken from the files are withdrawn. www.shippypro.com/llms.txt, which robots.txt now allows, lists marketing pages and one link to the reference, and no Markdown docs were found, so it doesn't meet the line (0). The help centre's API articles say what the API is for, that Ship and Edit calls create real labels while the Generic carrier is for tests, that only successful Ship calls count against the plan, and how field validation can block a call (6 of 20, from 14). No typed parameter reference was found outside the script-loaded files (0, from 9). The API errors article explains Status 1 and 2 and names common error messages with their fixes, and the panel keeps an error history. No request examples were found outside the files (6 of 15, from 10). The reference page names v1 and v2, and no changelog was found (6 of 15). 0+0+6+0+6+6 = 18.

atoship 40

No x402, MPP or L402 (0). Per-unit fees are published without a login ($0.08 a BYOCA label, $0.03 a tracking number or address check), and wallet postage is priced live in a public calculator (20). Free account with no card, and test keys (20). A person signs up in a browser and funds the wallet (0). 0 + 20 + 20 + 0 = 40.

ShippyPro 5

No x402, MPP or L402 (0). The pricing page, re-read on 4 November, lists full access to the Multicarrier APIs only on the Enterprise plan at a custom price through sales, and marks Professional (159 EUR a month) as Multicarrier API Access not included (0). The terms describe a 14-day, 30-order trial with no card. The help centre now says to check that the subscription includes API access, so we could not establish that a trial account can call the API, and give part credit (5 of 20). A person signs up in a browser and sales activates the API (0). 0+0+5+0 = 5.

atoship 53

12 MCP tools (15, for 11 to 30). List tools for orders and labels, with paging not documented in the pages read (8 of 20). Machine-readable error codes with a retry delay (18 of 20). The npm package's tools carry no readOnlyHint or destructiveHint, and no idempotency key was found; void_label undoes a mistaken purchase (5 of 20). Only the Go SDK installs, the hosted server is one URL, and test keys give a safe default (7 of 15). 15 + 8 + 18 + 5 + 7 = 53.

ShippyPro 19

Scored on the REST API from the help centre, since the OpenAPI files aren't read. No response sizing or field selection (0 of 25, from 12) and no pagination or filtering (0 of 20, from 10) is documented outside the files. Label failures return Status 2 with an error message, and the errors article gives causes and fixes for common errors, with an error history in the panel (12 of 20, kept). No idempotency key is documented outside the files, but a repeated Transaction ID is refused with a pointer to the Edit call, and Ship can run asynchronously so a timeout doesn't leave its result unknown (7 of 20, kept). No official SDK was found, though the API page's FAQ mentions SDKs, and required parameters can't be read outside the files (0 of 15, from 5). 0+0+12+7+0 = 19.

atoship 45

Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.

ShippyPro 61

Closed service. The Terms & Conditions, re-read on 4 November, are public and name the contracting entity, but carry no date and reserve the right to change the agreement without notice. No automated-access ban was found (12 of 30). The privacy policy covers shipment sender and recipient data per product area, anonymises Amazon customer data 30 days after delivery, keeps staff impersonation logs for 19 months and says personal data is never sold. General retention is stated only as long as necessary, and no DPA was found, per the 9 October check (18 of 30). No deprecation policy. The terms allow any service to be discontinued without notice. The status page carries dated carrier notices, among them the FedEx SOAP API deprecation notice (posted 30 March, closed 22 October 2026) and Deutsche Post (17 August), and the SLA promises seven days' notice of planned downtime (6 of 20). Sub-processors are named per product area, and the full list with countries is a PDF whose file name is dated 15 September 2022, which we did not read (12 of 20). 12+18+6+12 = 48.

atoship 55

Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.

ShippyPro 48

API keys are created in the panel, several per account, in three types (Full Access, Maps, PII Excluded), per the help centre re-read on 4 November. No expiry or rotation was found, and the 9 October reading of a 401 for a revoked key came from the unread v2 file, so the earlier partial is kept (22 of 30). The Maps and PII Excluded types narrow a key, but there is no read-only key and no confirmation step for label creation or voiding. The Generic carrier allows tests without a real shipment (8 of 20). Tracking messages and marketplace order text come from third parties, and no guidance on untrusted content was found. The errors article says requests are screened for script-like strings (3 of 15). The panel has API logs with requests and responses, an API error history and webhook logs (10 of 15). llms.txt and the site footer state SOC 2 Type II and ISO 27001, with no certificate, report, trust page or disclosure route found, and robots.txt still disallows /.well-known/security.txt. This run scores a certification claim with no report or disclosure route 5 (from 8). 22+8+3+10+5 = 48.