EasyPost vs TrackingMore

EasyPost 85

The releases page has an entry dated 28 September 2026, nine days before the check, and easypost-go 5.10.1 was tagged on 29 September (30). Ten dated release notes between 12 July and 28 September 2026 (20). A closed service with public release notes, support@easypost.com, a help centre, a dedicated ai@easypost.com address for the MCP server and a published four-hour response target on the Base support tier. We didn't read GitHub issues or test response times (11 of 15). Seven official SDKs, all pushed between 24 September and 3 October 2026, though the Java, Python, Ruby and Node stable releases date from 25 June (15). The Python library's CI lints and runs tests on Python 3.9 to 3.13, and the Node library has a 9.0.0 release candidate that moves to TypeScript and fetch (9 of 10).

TrackingMore 19

Read as a closed service. No dated API change was found. The SDKs were last pushed between February and December 2024, the support articles are dated 2023 and 2024, and the reference is undated (0 of 30). No releases or dated entries in the last 90 days were found (0). Support by email and chat with a help centre; GitHub issues were not read (6 of 15). Seven official SDKs exist but none has changed since December 2024 (10 of 15). The Node SDK has tests and no CI workflow (3 of 10). 0 + 0 + 6 + 10 + 3 = 19.

EasyPost 55

No OpenAPI or similar spec was found in the docs, llms.txt, the page index or the 56 public repositories of the EasyPost GitHub organisation. A Postman workspace is listed, which we didn't read (0 of 25). llms.txt, a Markdown copy of almost every page and doc-index.json with audience and usage notes for each page (10). Each object has a property table with a type and description, and the index says when each page applies. Endpoint pages are mostly examples, with little on when not to use a call (12 of 20). Types and allowed values are given in prose tables, such as the ten tracker statuses, with no schema to validate against, and the Markdown copies omit some parameter lists that the HTML pages render (8 of 15). Every endpoint has examples in cURL and seven SDK languages, plus an error object and 13 general error codes. The full error code list is on a part of the page the Markdown copy omits (13 of 15). The path carries v2 and the releases page has dated notes almost every week. No written versioning policy was found, and some calls sit under /beta (12 of 15).

TrackingMore 31

No OpenAPI or similar file was found in the docs, the SDK repositories or a search, and the reference at trackingmore.com/docs renders by script so its schemas were not read (0 of 25). No llms.txt or Markdown docs (0). The official SDK READMEs give one line per call, and the support centre explains when to pair create with get or a webhook and that the create response carries the result (8 of 20). Field names and the required tracking_number and courier_code appear in the SDK examples, with no types, enums or constraints readable (5 of 15). Examples in seven SDK languages and a table of HTTP and meta codes with messages (12 of 15). v4 in the path with v2 and v3 still served, and the support centre says there is no changelog for switching versions. No dated API changelog was found (6 of 15). 0 + 0 + 8 + 5 + 12 + 6 = 31.

EasyPost 47

API keys go in the HTTP Basic username over TLS 1.2. Keys can be created, disabled, enabled and deleted through the API or the dashboard, and the docs say a key allows full account access. Plain revocable keys, with no secret in a query string (20 of 30). Test keys buy no postage, child users hold separate keys, and the MCP server has read tools only and omits carrier credentials, wallet balances and payment methods. The REST API has no read-only or scoped key and no confirmation step before a purchase (8 of 20). Responses carry addresses and carrier tracking text. The MCP guide advises connecting only to trusted clients and servers, and no injection guidance was found (4 of 15). Events and their payloads can be retrieved and each shipment lists its fees, but no audit log of API calls or key use was found in the reviewed documentation (5 of 15). A Responsible Disclosure Policy with a safe-harbour commitment and the contact security-abuse@easypost.com, HMAC-signed webhooks, and a SOC 2 Type 2 report referred to in the data processing addendum. No security.txt and no bug bounty were found, and trust.easypost.com refused our reader (10 of 20).

TrackingMore 31

One API key in the Tracking-Api-Key header, shown once, at most four per account, deleted in the web app. No scopes or expiry (20 of 30). No read-only key or least-privilege mode, and delete is one call (4 of 20). Tracking checkpoints are carrier text returned to the model, and no guidance was found (3 of 15). A webhook notification log exists in the web app; no log of API calls or key use was found (4 of 15). No security.txt (404), no security page on trackingmore.com, no certification, bug bounty or disclosure policy found. The CWILL privacy policy points to a trust site that was not read (0 of 20). 20 + 4 + 3 + 4 + 0 = 31.

EasyPost 71

The service is closed, under a Master Customer Agreement (version 6.1, effective 25 August 2026) and seven addenda in a legal centre that keeps every past version. The SDKs are MIT or ISC (15). The privacy policy (18 August 2025) gives no retention period. The agreement points to a Data Retention Policy in the help centre, which refused our reader, and it grants EasyPost a licence to use customer data to improve its services and develop new products during and after the term. A data processing addendum with EU and UK standard clauses is public (15 of 30). The agreement says EasyPost will use reasonable efforts to notify customers before API changes that aren't backwards compatible, with no notice period, and allows termination with a refund within 15 days if functionality is materially reduced. No deprecation policy with dates was found (6 of 20). Annex D of the addendum lists 12 subprocessors with purpose and country, all in the USA, and customers have 10 days to object to a new one (17 of 20).

TrackingMore 57

Closed service. The terms are the CWILL group's (effective 9 January 2026), which say the contracting entity depends on the product, and the privacy policy names CHANNELWILL CO., LIMITED for TrackingMore. The SDKs are MIT (15 of 30). The privacy policy (8 August 2026) distinguishes controller and processor roles and links a DPA and a sub-processor list, neither read; no retention periods were read (12 of 30). v2 and v3 are still served with no notice policy or dates (4 of 20). A sub-processor list exists at trust.cwill.com and was not read; no data location is stated on the pages read (8 of 20). 15 + 12 + 4 + 8 = 39.

EasyPost 53

Read with the hosted lines and scored on the REST API at api.easypost.com/v2, the surface an agent would use to rate, buy and track. The hosted MCP server only reads and is an early release. www.easypoststatus.com on Statuspage lists 44 components with incident history (20). In the 90 days to 7 October 2026 it shows seven incidents. A connectivity fault at the hosting provider on 23 July affected all operations from 07:57 to about 12:21 Pacific time, and two carrier-side incidents were marked major (UPS accounts supplied by EasyPost on 22 July for 3 h 29 min, USPS Ship on 20 September for 5 h 24 min). Two short API degradations lasted 10 and 14 minutes. One core outage and two upstream majors (7 of 30). The rate-limiting guide gives five requests a second on index endpoints and a 60-account cap on rating, but the load-based limiter on buying and rating has no published number (8 of 15). The guide describes 429 handling with retry and backoff and a code sample. No Retry-After header and no idempotency keys were found, and the sample retries only GET and DELETE (8 of 15). The Master Customer Agreement supplies the service as is and as available, and the support addendum sets response targets only (0). The v2 API is generally available (10).

TrackingMore 65

Read with the hosted lines and scored on the REST API v4 at api.trackingmore.com. status.trackingmore.com is a hosted status page with uptime and a status update history (20). Its figures and history render by script, so the 90 days could not be read; the static text says there were no updates in the last 7 days (5). Rate limits are published per endpoint, 3 requests a second on trackings/create and 10 a second elsewhere, per account (15). The support centre says a 429 means the application should stop and wait 120 seconds, and a repeated create answers meta code 4101 rather than creating a duplicate. No Retry-After and no idempotency key (10 of 15). No SLA document was found. The Enterprise plan lists 99.99 per cent API uptime as a feature and the API page claims 99.9 per cent uptime, which is marketing rather than a published SLA (5 of 10). v4 is the current version and not marked beta (10). 20 + 5 + 15 + 10 + 5 + 10 = 65.

EasyPost 63

List calls take page_size up to 100 with a default of 20 on most endpoints. No field selection was found, and a shipment response nests addresses, parcel, rates and tracker (12 of 25). Cursor pagination by before_id and after_id, date ranges and a has_more flag, with support that varies by endpoint (16 of 20). Errors carry a machine-readable code, a message and per-field entries with an occasional suggestion. The errors array arrives as objects or as strings, so a client has to handle both (15 of 20). No idempotency keys were found. Trackers are deduplicated by tracking code and carrier for three months, but reference on a shipment isn't unique and nothing guards a repeated buy. The MCP tools only read, though we couldn't list them without a key to see annotations (5 of 20). One-call buy creates and purchases in one request, addresses and parcels can be nested or reused by id, and official SDKs cover seven languages (15).

TrackingMore 54

trackings/get filters by tracking numbers, courier and created date range, and batch create takes 40 at once. No field selection was found, and the unread reference may document more (10 of 25). Date and courier filters exist; pagination parameters were not found in what was read (8 of 20). Every response carries an HTTP code and a meta code with a message, such as 4121 for an undetected courier and 4190 for a reached quota (14 of 20). No idempotency key. A repeated create is rejected with 4101, so the write is safe to retry, and delete and retrack take ids (10 of 20). Create needs only tracking_number and courier_code, detect is free, and official SDKs cover seven languages (12 of 15). 10 + 8 + 14 + 10 + 12 = 54.