Easyship vs TrackingMore

Easyship 76

easyship-mcp 0.6.7 was published on 28 October 2026, 4 days before the check, after 0.6.6 on 19 October, both on PyPI and in the MCP registry. Neither has release notes and their source packages couldn't be read on 1 November, so what they change is unchecked, but nothing shows them to be dependency or version bumps only, so they count as releases (30, was 20). The API changelog's last entry is still 30 October 2025. Five releases in the 90 days on three dates, 0.6.3 to 0.6.5 on 21 August, 0.6.6 and 0.6.7 (20, was 10). Closed service with a support desk and a bug report form. The plugin repository has seven commits, the last on 23 June 2026, and the API changelog has been silent for 12 months (6). Listed in the official MCP registry as com.easyship/mcp, a domain-verified namespace, with 0.6.7 as latest (15). The package pins fastmcp below 4 with a uv.lock and has version-check and deploy workflows. No tests ship in the 0.6.5 source package (5). 30 + 20 + 6 + 15 + 5 = 76.

TrackingMore 19

Read as a closed service. No dated API change was found. The SDKs were last pushed between February and December 2024, the support articles are dated 2023 and 2024, and the reference is undated (0 of 30). No releases or dated entries in the last 90 days were found (0). Support by email and chat with a help centre; GitHub issues were not read (6 of 15). Seven official SDKs exist but none has changed since December 2024 (10 of 15). The Node SDK has tests and no CI workflow (3 of 10). 0 + 0 + 6 + 10 + 3 = 19.

Easyship 87

Every reference page has a Markdown twin with its OpenAPI 3.0.3 definition, and the full v2024-09 spec (132 operations on 98 paths) ships in the easyship-mcp source package. No single spec URL was found on the docs site. MCP inputs are typed with Pydantic (25). llms.txt at developers.easyship.com lists 240 lines of Markdown pages (10). MCP descriptions state what to collect before calling, when to buy a label or only draft a shipment, and which tool to use for detail. Not every tool says when not to use it (17). The spec has 177 enum declarations and required fields. In the MCP, incoterms, currency and item category are free strings (12). Twelve error codes are documented with HTTP status and a worked example, and endpoints list 402 and 422 responses (13). Versions are dated in the path (2023-01, 2024-09) with migration guides. The changelog's last entry is 30 October 2025, and the MCP server has no changelog (10).

TrackingMore 31

No OpenAPI or similar file was found in the docs, the SDK repositories or a search, and the reference at trackingmore.com/docs renders by script so its schemas were not read (0 of 25). No llms.txt or Markdown docs (0). The official SDK READMEs give one line per call, and the support centre explains when to pair create with get or a webhook and that the create response carries the result (8 of 20). Field names and the required tracking_number and courier_code appear in the SDK examples, with no types, enums or constraints readable (5 of 15). Examples in seven SDK languages and a table of HTTP and meta codes with messages (12 of 15). v4 in the path with v2 and v3 still served, and the support centre says there is no changelog for switching versions. No dated API changelog was found (6 of 15). 0 + 0 + 8 + 5 + 12 + 6 = 31.

Easyship 61

API tokens are created in the dashboard with per-resource scopes such as public.shipment:read and public.label:write on v2024-09, are revocable, and are separate for sandbox and production. The MCP server also publishes OAuth metadata with PKCE S256 and dynamic client registration. No token expiry was found (26). Read-only scopes make a read-only agent possible. Confirmation before delete and cancel exists only as a rule file in the plugin repository, not in the server (14). The MCP server strips tax identifiers from every response and withholds contact details and document links by default. No guidance on untrusted text in tracking or address fields was found (7). Transaction records and a request_id on errors are available. No API call log for the operator was found (4). security.txt is present but still expired on 5 October 2025, re-read on 1 November. It points to a disclosure policy at vdp.easyship.com, which needs JavaScript and went unread. The developers page claims SOC certification with no report or trust page found (10).

TrackingMore 31

One API key in the Tracking-Api-Key header, shown once, at most four per account, deleted in the web app. No scopes or expiry (20 of 30). No read-only key or least-privilege mode, and delete is one call (4 of 20). Tracking checkpoints are carrier text returned to the model, and no guidance was found (3 of 15). A webhook notification log exists in the web app; no log of API calls or key use was found (4 of 15). No security.txt (404), no security page on trackingmore.com, no certification, bug bounty or disclosure policy found. The CWILL privacy policy points to a trust site that was not read (0 of 20). 20 + 4 + 3 + 4 + 0 = 31.

Easyship 73

The MCP server loads 25 tools with no toolsets. List tools return allow-listed summaries, and documents and contact details come back only when asked for (18). List endpoints take page and per_page (default 20) and filters by state, date, country and order number (20). Errors carry a code, type, details array, documentation links and a request_id (18). No idempotency keys, so a retried label purchase isn't protected. All 25 MCP tools set readOnlyHint, destructiveHint and openWorldHint (10). create_shipment picks a courier when none is given and get_rates needs six fields. No official SDK was found among the 15 public repositories in Easyship's GitHub organisation, though the developers page mentions SDKs (7).

TrackingMore 54

trackings/get filters by tracking numbers, courier and created date range, and batch create takes 40 at once. No field selection was found, and the unread reference may document more (10 of 25). Date and courier filters exist; pagination parameters were not found in what was read (8 of 20). Every response carries an HTTP code and a meta code with a message, such as 4121 for an undetected courier and 4190 for a reached quota (14 of 20). No idempotency key. A repeated create is rejected with 4101, so the write is safe to retry, and delete and retrack take ids (10 of 20). Create needs only tracking_number and courier_code, detect is free, and official SDKs cover seven languages (12 of 15). 10 + 8 + 14 + 10 + 12 = 54.

Easyship 40

No x402, MPP or L402 (0). Plan prices and per-call prices for the metered endpoints are public in the data file the plans page loads, for example US$0.01 a rates call on Free and US$29 a month for Plus. Label prices depend on the courier and come back from the rates call (20). The Free plan needs no card and covers 50 shipments a month in the US, and paid plans have a 14-day trial (20). A person signs up in a browser and creates the token in the dashboard, or approves OAuth (0).

TrackingMore 23

Read with the hosted rubric. No x402, MPP or L402 (0). The API page gives a from price of $0.03 a tracked order and three unlabelled figures, and the pricing page's plan prices render by script, so per-unit pricing is partly public (8 of 20). A Free plan and a 14-day trial are offered, and whether a card is asked for was not established (15 of 20). A person signs up in a browser and generates the key there (0). 0 + 8 + 15 + 0 = 23.

Easyship 80

Graded on the public API v2024-09, which the hosted MCP server calls. Statuspage at status.easyship.com with nine Easyship components, among them Core API, Open API and Rates API (20). Re-read on 1 November from the history feed (history.atom), because status.easyship.com's robots.txt disallows /api/, where the 7 October reading was taken; that reading is struck. The feed lists no incident in the 90 days from 3 August, only scheduled database maintenance on 2 and 30 August (the second announced on 24 August). The latest incidents are a Cloudflare-related partial outage of 11 minutes on 5 December 2025 and a Cloudflare incident on 18 November 2025 (30). Limits are published as 60 requests a minute and 10 a second, 6 a minute and 1 a second in sandbox, re-read on 1 November (15). The 429 too_many_requests code is documented with the advice to wait for the next window. No Retry-After header, backoff guidance or idempotency key was found in the docs or the spec (5). The developers page claims both 99.9% and 99.99% uptime, the US terms disclaim uninterrupted access, and no SLA was found (0). Version 2024-09 is described as the latest stable version. The MCP package is classified beta on PyPI (10). 20 + 30 + 15 + 5 + 0 + 10 = 80.

TrackingMore 65

Read with the hosted lines and scored on the REST API v4 at api.trackingmore.com. status.trackingmore.com is a hosted status page with uptime and a status update history (20). Its figures and history render by script, so the 90 days could not be read; the static text says there were no updates in the last 7 days (5). Rate limits are published per endpoint, 3 requests a second on trackings/create and 10 a second elsewhere, per account (15). The support centre says a 429 means the application should stop and wait 120 seconds, and a repeated create answers meta code 4101 rather than creating a duplicate. No Retry-After and no idempotency key (10 of 15). No SLA document was found. The Enterprise plan lists 99.99 per cent API uptime as a feature and the API page claims 99.9 per cent uptime, which is marketing rather than a published SLA (5 of 10). v4 is the current version and not marked beta (10). 20 + 5 + 15 + 10 + 5 + 10 = 65.