atoship vs TrackingMore

atoship 30

Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a RATE_LIMIT_EXCEEDED code are documented, without numbers (5 of 15). A 429 carries error.retryAfter and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

TrackingMore 65

Read with the hosted lines and scored on the REST API v4 at api.trackingmore.com. status.trackingmore.com is a hosted status page with uptime and a status update history (20). Its figures and history render by script, so the 90 days could not be read; the static text says there were no updates in the last 7 days (5). Rate limits are published per endpoint, 3 requests a second on trackings/create and 10 a second elsewhere, per account (15). The support centre says a 429 means the application should stop and wait 120 seconds, and a repeated create answers meta code 4101 rather than creating a duplicate. No Retry-After and no idempotency key (10 of 15). No SLA document was found. The Enterprise plan lists 99.99 per cent API uptime as a feature and the API page claims 99.9 per cent uptime, which is marketing rather than a published SLA (5 of 10). v4 is the current version and not marked beta (10). 20 + 5 + 15 + 10 + 5 + 10 = 65.

atoship 55

No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, error.code values and retryAfter, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.

TrackingMore 31

No OpenAPI or similar file was found in the docs, the SDK repositories or a search, and the reference at trackingmore.com/docs renders by script so its schemas were not read (0 of 25). No llms.txt or Markdown docs (0). The official SDK READMEs give one line per call, and the support centre explains when to pair create with get or a webhook and that the create response carries the result (8 of 20). Field names and the required tracking_number and courier_code appear in the SDK examples, with no types, enums or constraints readable (5 of 15). Examples in seven SDK languages and a table of HTTP and meta codes with messages (12 of 15). v4 in the path with v2 and v3 still served, and the support centre says there is no changelog for switching versions. No dated API changelog was found (6 of 15). 0 + 0 + 8 + 5 + 12 + 6 = 31.

atoship 55

Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.

TrackingMore 31

One API key in the Tracking-Api-Key header, shown once, at most four per account, deleted in the web app. No scopes or expiry (20 of 30). No read-only key or least-privilege mode, and delete is one call (4 of 20). Tracking checkpoints are carrier text returned to the model, and no guidance was found (3 of 15). A webhook notification log exists in the web app; no log of API calls or key use was found (4 of 15). No security.txt (404), no security page on trackingmore.com, no certification, bug bounty or disclosure policy found. The CWILL privacy policy points to a trust site that was not read (0 of 20). 20 + 4 + 3 + 4 + 0 = 31.

atoship 40

No x402, MPP or L402 (0). Per-unit fees are published without a login ($0.08 a BYOCA label, $0.03 a tracking number or address check), and wallet postage is priced live in a public calculator (20). Free account with no card, and test keys (20). A person signs up in a browser and funds the wallet (0). 0 + 20 + 20 + 0 = 40.

TrackingMore 23

Read with the hosted rubric. No x402, MPP or L402 (0). The API page gives a from price of $0.03 a tracked order and three unlabelled figures, and the pricing page's plan prices render by script, so per-unit pricing is partly public (8 of 20). A Free plan and a 14-day trial are offered, and whether a card is asked for was not established (15 of 20). A person signs up in a browser and generates the key there (0). 0 + 8 + 15 + 0 = 23.

atoship 45

Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.

TrackingMore 57

Closed service. The terms are the CWILL group's (effective 9 January 2026), which say the contracting entity depends on the product, and the privacy policy names CHANNELWILL CO., LIMITED for TrackingMore. The SDKs are MIT (15 of 30). The privacy policy (8 August 2026) distinguishes controller and processor roles and links a DPA and a sub-processor list, neither read; no retention periods were read (12 of 30). v2 and v3 are still served with no notice policy or dates (4 of 20). A sub-processor list exists at trust.cwill.com and was not read; no data location is stated on the pages read (8 of 20). 15 + 12 + 4 + 8 = 39.

atoship 10

No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.

TrackingMore 19

Read as a closed service. No dated API change was found. The SDKs were last pushed between February and December 2024, the support articles are dated 2023 and 2024, and the reference is undated (0 of 30). No releases or dated entries in the last 90 days were found (0). Support by email and chat with a help centre; GitHub issues were not read (6 of 15). Seven official SDKs exist but none has changed since December 2024 (10 of 15). The Node SDK has tests and no CI workflow (3 of 10). 0 + 0 + 6 + 10 + 3 = 19.