Easyship vs Envia

Easyship 76

easyship-mcp 0.6.7 was published on 28 October 2026, 4 days before the check, after 0.6.6 on 19 October, both on PyPI and in the MCP registry. Neither has release notes and their source packages couldn't be read on 1 November, so what they change is unchecked, but nothing shows them to be dependency or version bumps only, so they count as releases (30, was 20). The API changelog's last entry is still 30 October 2025. Five releases in the 90 days on three dates, 0.6.3 to 0.6.5 on 21 August, 0.6.6 and 0.6.7 (20, was 10). Closed service with a support desk and a bug report form. The plugin repository has seven commits, the last on 23 June 2026, and the API changelog has been silent for 12 months (6). Listed in the official MCP registry as com.easyship/mcp, a domain-verified namespace, with 0.6.7 as latest (15). The package pins fastmcp below 4 with a uv.lock and has version-check and deploy workflows. No tests ship in the 0.6.5 source package (5). 30 + 20 + 6 + 15 + 5 = 76.

Envia 10

The latest dated change found is the docs changelog for March 2026 and @envia/envia-mcp 0.1.0 on 4 March 2026, more than 180 days ago; doc pages show later updatedAt stamps (28 October for the FAQ) that record no change (0). No dated entries in the 90 days from 8 August (0). Support through the dashboard and docs, with no public tracker; the MCP repository named on npm could not be cloned (5 of 15). The MCP package is official, with no API SDK and no registry entry (5 of 15). No public CI to read (0). 0 + 0 + 5 + 5 + 0 = 10.

Easyship 80

Graded on the public API v2024-09, which the hosted MCP server calls. Statuspage at status.easyship.com with nine Easyship components, among them Core API, Open API and Rates API (20). Re-read on 1 November from the history feed (history.atom), because status.easyship.com's robots.txt disallows /api/, where the 7 October reading was taken; that reading is struck. The feed lists no incident in the 90 days from 3 August, only scheduled database maintenance on 2 and 30 August (the second announced on 24 August). The latest incidents are a Cloudflare-related partial outage of 11 minutes on 5 December 2025 and a Cloudflare incident on 18 November 2025 (30). Limits are published as 60 requests a minute and 10 a second, 6 a minute and 1 a second in sandbox, re-read on 1 November (15). The 429 too_many_requests code is documented with the advice to wait for the next window. No Retry-After header, backoff guidance or idempotency key was found in the docs or the spec (5). The developers page claims both 99.9% and 99.99% uptime, the US terms disclaim uninterrupted access, and no SLA was found (0). Version 2024-09 is described as the latest stable version. The MCP package is classified beta on PyPI (10). 20 + 30 + 15 + 5 + 0 + 10 = 80.

Envia 20

Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.

Easyship 72

Closed service under country-specific terms, the US version updated 28 July 2026 and naming Easyship Inc. The MCP server and plugin are MIT (17). The privacy policy of 28 July 2026 gives retention periods (account and shipment data for their lifetime plus seven years) and bars providers from training general-purpose AI on personal information. The DPA of 28 March 2025 says personal data is deleted on deactivation unless law requires otherwise, which sits uneasily with seven years (18). Deprecated endpoints are marked and migration guides exist, and the US terms promise 30 days' notice of material changes. No API deprecation policy with dates was found (8). The sub-processor list the DPA points to is dated 15 October 2020, names only analytics, advertising and CRM tools and cites Privacy Shield. The privacy policy names the United States and Singapore as processing locations (8).

Envia 16

Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.

Easyship 61

API tokens are created in the dashboard with per-resource scopes such as public.shipment:read and public.label:write on v2024-09, are revocable, and are separate for sandbox and production. The MCP server also publishes OAuth metadata with PKCE S256 and dynamic client registration. No token expiry was found (26). Read-only scopes make a read-only agent possible. Confirmation before delete and cancel exists only as a rule file in the plugin repository, not in the server (14). The MCP server strips tax identifiers from every response and withholds contact details and document links by default. No guidance on untrusted text in tracking or address fields was found (7). Transaction records and a request_id on errors are available. No API call log for the operator was found (4). security.txt is present but still expired on 5 October 2025, re-read on 1 November. It points to a disclosure policy at vdp.easyship.com, which needs JavaScript and went unread. The developers page claims SOC certification with no report or trust page found (10).

Envia 35

Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.

Easyship 73

The MCP server loads 25 tools with no toolsets. List tools return allow-listed summaries, and documents and contact details come back only when asked for (18). List endpoints take page and per_page (default 20) and filters by state, date, country and order number (20). Errors carry a code, type, details array, documentation links and a request_id (18). No idempotency keys, so a retried label purchase isn't protected. All 25 MCP tools set readOnlyHint, destructiveHint and openWorldHint (10). create_shipment picks a courier when none is given and get_rates needs six fields. No official SDK was found among the 15 public repositories in Easyship's GitHub organisation, though the developers page mentions SDKs (7).

Envia 53

Ten compact MCP tools (25). Rates take one carrier per request, and the Queries API filters carriers by country and shipment type; no paging or field selection was found (10 of 20). The FAQ maps common errors to fixes, but the changelog says the three APIs return different error formats that need a normalisation helper (10 of 20). No idempotency key for labels; an unscanned label can be cancelled for an automatic refund, and the MCP tools carry no annotations (3 of 20). The MCP server defaults to sandbox, with no official API SDK (5 of 15). 25 + 10 + 10 + 3 + 5 = 53.

Easyship 40

No x402, MPP or L402 (0). Plan prices and per-call prices for the metered endpoints are public in the data file the plans page loads, for example US$0.01 a rates call on Free and US$29 a month for Plus. Label prices depend on the courier and come back from the rates call (20). The Free plan needs no card and covers 50 shipments a month in the US, and paid plans have a 14-day trial (20). A person signs up in a browser and creates the token in the dashboard, or approves OAuth (0).

Envia 20

No x402, MPP or L402 (0). No public price list: each cost is shown when quoting, and volume plans go through sales (0). A free sandbox account creates test labels with no charges (20). A person signs up in a browser and tops up a balance for live labels (0). 0 + 0 + 20 + 0 = 20.