EasyPost vs Envia

EasyPost 85

The releases page has an entry dated 29 October 2026, six days before this check, and the Node, Go, Java and C# libraries were tagged the same day (30). Eight dated release notes fall in the 90 days from 6 August (8, 15, 22 and 29 August, 25 and 28 September, 8 and 29 October), and every library had a release on 27 or 29 October (20). A closed service with public release notes, support@easypost.com, a help centre, ai@easypost.com for the MCP server and a published four-hour response target on the Base support tier. We didn't read GitHub issues or test response times (11 of 15). Seven official SDKs, each with a release on 27 or 29 October 2026: Node 9.1.0, Python 10.8.0, Go 5.12.0, Java 8.10.0, C# 7.12.0, PHP 8.9.0 and Ruby 7.8.0 (15). The Python library's CI lints and runs tests, per the 7 October check, and Node 9.0.0 moved to TypeScript and fetch (9 of 10, partly met). 30 + 20 + 11 + 15 + 9 = 85.

Envia 10

The latest dated change found is the docs changelog for March 2026 and @envia/envia-mcp 0.1.0 on 4 March 2026, more than 180 days ago; doc pages show later updatedAt stamps (28 October for the FAQ) that record no change (0). No dated entries in the 90 days from 8 August (0). Support through the dashboard and docs, with no public tracker; the MCP repository named on npm could not be cloned (5 of 15). The MCP package is official, with no API SDK and no registry entry (5 of 15). No public CI to read (0). 0 + 0 + 5 + 5 + 0 = 10.

EasyPost 71

The service is closed, under a Master Customer Agreement (version 6.1, effective 25 August 2026) and seven addenda in a legal centre that keeps every past version. The SDKs are MIT or ISC (15). The privacy policy (18 August 2025) gives no retention period. The agreement points to a Data Retention Policy in the help centre, which refused our reader, and it grants EasyPost a licence to use customer data to improve its services and develop new products during and after the term. A data processing addendum with EU and UK standard clauses is public (15 of 30). The agreement says EasyPost will use reasonable efforts to notify customers before API changes that aren't backwards compatible, with no notice period, and allows termination with a refund within 15 days if functionality is materially reduced. No deprecation policy with dates was found (6 of 20). Annex D of the addendum lists 12 subprocessors with purpose and country, all in the USA, and customers have 10 days to object to a new one (17 of 20). The legal centre was re-read on 4 November; the MCA is still version 6.1. 15 + 15 + 6 + 17 = 53.

Envia 16

Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.

EasyPost 68

Read with the hosted lines and scored on the REST API at api.easypost.com/v2, the surface an agent would use to rate, buy and track. www.easypoststatus.com on Statuspage lists 44 components on its page, re-read 4 November 2026 (20). Its history feed covers the whole 90 days from 6 August. Five incidents fall in that window, each partial. On 27 August the Core APIs degraded briefly during a deployment, resolved 14 minutes after it was identified. On 20 September USPS Ship requests failed most of the time for about five and a half hours (09:55 to 15:19 PDT) on a USPS-side fault, on 23 September a subset of USPS Ship buys failed, on 5 October UPS Mail Innovations returned elevated errors, and on 8 October some rating and tracking requests timed out for about 73 minutes at the hosting provider. Announced maintenance windows (14, 21 and 28 August, and the USPS windows in October and November) are maintenance, not incidents. Minor incidents only (20). The rate-limiting guide gives five requests a second on index endpoints and a 60-account cap on rating, but the load-based limiter on buying and rating has no published number (8 of 15, partly met). The guide asks for retry with growing backoff on 429 and gives a code sample that retries only GET and DELETE. No Retry-After header, no idempotency keys and no stated safe-retry rule for writes on the REST API (10). The Master Customer Agreement supplies the service as is and as available, and the support addendum sets response targets only (0). The v2 API is generally available (10). 20 + 20 + 8 + 10 + 0 + 10 = 68.

Envia 20

Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.

EasyPost 55

No OpenAPI or similar spec was found in the docs, llms.txt, the page index or the 56 public repositories of the EasyPost GitHub organisation. A Postman workspace is listed, which we didn't read (0 of 25). llms.txt, a Markdown copy of almost every page and doc-index.json with audience and usage notes for each page (10). Each object has a property table with a type and description, and the index says when each page applies. Endpoint pages are mostly examples, with little on when not to use a call (12 of 20). Types and allowed values are given in prose tables, such as the ten tracker statuses, with no schema to validate against, and the Markdown copies omit some parameter lists that the HTML pages render (8 of 15). Every endpoint has examples in cURL and seven SDK languages, plus an error object and 13 general error codes. The full error code list is on a part of the page the Markdown copy omits (13 of 15). The path carries v2 and the releases page has dated notes almost every week. No written versioning policy was found, and some calls sit under /beta (12 of 15). 0 + 10 + 12 + 8 + 13 + 12 = 55.

Envia 80

Each reference page's Markdown copy embeds an OpenAPI definition with sandbox and production servers (25). llms.txt and a Markdown copy of each page (10). Endpoint descriptions say what each is for and which call comes next in the workflow, and the rate tool warns that sandbox rates are simulated (15 of 20). The quote definition has 17 enums and required lists (11 of 15). Workflow examples and an error-formats guide named in the changelog, though its Markdown address answered 404 and the quote definition documents only 200 (9 of 15). A dated docs changelog by month, the latest March 2026 (10 of 15). 25 + 10 + 15 + 11 + 9 + 10 = 80.

EasyPost 47

API keys go in the HTTP Basic username over TLS 1.2. Keys can be created, disabled, enabled and deleted through the API or the dashboard, and the docs say a key allows full account access. Plain revocable keys, with no secret in a query string. The MCP server also takes a sign-in with an EasyPost account from the ChatGPT and Claude apps (20 of 30). Test keys buy no postage and child users hold separate keys. The REST API has no read-only or scoped key and no confirmation step before a purchase. Since 29 October 2026 the MCP server buys labels too (20 tools, 7 of them writes); buy_shipment refuses a price that differs from the one the user approved, and the guide asks users to keep client approval on for the three paid or destructive writes (8 of 20, held). Responses carry addresses and carrier tracking text. The MCP guide advises connecting only to trusted clients and servers, and no injection guidance was found (4 of 15). Events and their payloads can be retrieved and each shipment lists its fees, but no audit log of API calls or key use was found in the reviewed documentation (5 of 15). A Responsible Disclosure Policy with a safe-harbour commitment and the contact security-abuse@easypost.com, with no acknowledgement time, HMAC-signed webhooks, and a SOC 2 Type 2 report referred to in the data processing addendum. No security.txt (per the 7 October check) and no bug bounty were found, and OSV lists no advisory for EasyPost packages (10 of 20). 20 + 8 + 4 + 5 + 10 = 47.

Envia 35

Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.

EasyPost 63

List calls take page_size up to 100 with a default of 20 on most endpoints. No field selection was found, and a shipment response nests addresses, parcel, rates and tracker (12 of 25). Cursor pagination by before_id and after_id, date ranges and a has_more flag, with support that varies by endpoint (16 of 20). Errors carry a machine-readable code, a message and per-field entries with an occasional suggestion. The errors array arrives as objects or as strings, so a client has to handle both (15 of 20). The REST API has no idempotency keys. Trackers are deduplicated by tracking code and carrier for three months, but reference on a shipment isn't unique and nothing guards a repeated buy. Since 29 October 2026 the MCP server's buy_shipment returns the label already bought when a timed-out buy is retried, and the guide says three write tools are marked destructive; the tool definitions weren't read (5 of 20, partly met, held). One-call buy creates and purchases in one request, addresses and parcels can be nested or reused by id, and official SDKs cover seven languages (15). 12 + 16 + 15 + 5 + 15 = 63.

Envia 53

Ten compact MCP tools (25). Rates take one carrier per request, and the Queries API filters carriers by country and shipment type; no paging or field selection was found (10 of 20). The FAQ maps common errors to fixes, but the changelog says the three APIs return different error formats that need a normalisation helper (10 of 20). No idempotency key for labels; an unscanned label can be cancelled for an automatic refund, and the MCP tools carry no annotations (3 of 20). The MCP server defaults to sandbox, with no official API SDK (5 of 15). 25 + 10 + 10 + 3 + 5 = 53.