# Envia vs Karrio

> Karrio scores 46.4 (D) to Envia's 36.5 (F) for shipping rates. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/envia-vs-karrio
- Markdown: https://www.anchorterminal.com/compare/envia-vs-karrio.md (~4,650 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Karrio scores 46.4 (D) on agent readiness against Envia's 36.5 (F), and leads in 6 of 7 scored categories. Envia leads on schema & documentation. Both do shipping rates.

- Envia: grade F, 36.5/100, rank #1384 of 1510. Markdown https://www.anchorterminal.com/tools/envia.md · JSON https://www.anchorterminal.com/api/v1/tools/envia.json
- Karrio: grade D, 46.4/100, rank #1174 of 1510. Markdown https://www.anchorterminal.com/tools/karrio.md · JSON https://www.anchorterminal.com/api/v1/tools/karrio.json
- Best shipping and fulfilment APIs for AI agents: https://www.anchorterminal.com/best/shipping/index.md
- All 66 shipping comparisons: https://www.anchorterminal.com/compare/shipping/index.md

## Which one, for what

### Envia (F)

Good for: Shops and platforms shipping in Mexico and Latin America that want rates and labels from many local carriers.

Ahead on:
- Schema & documentation, 80 against 43

Also in its favour:
- Runs on your own machine
- No incidents deducted, where Karrio loses 6 points for them

Watch for: No status page or rate limits found

### Karrio (D)

Good for: A team that wants to host its own multi-carrier API with its own carrier contracts and can maintain a Django and PostgreSQL stack.

Ahead on:
- Reliability, 76 against 20
- Security & auth, 47 against 35
- Payments & pricing, 40 against 20
- Maintenance & community, 29 against 10
- Transparency & trust, 59 against 16

Also in its favour:
- Open source

Watch for: No release since 2026.1.32 on 23 June 2026, 134 days before this check, and no newer commit on any branch


## Why the edge

### Reliability: Karrio +56

- Envia (20): Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.
- Karrio (76): Read with the local-software lines, since the graded surface is the open-source server its owner hosts. The managed platform has no status page we could find. Docker images and PyPI packages at 2026.1.32, per the 8 October check (PyPI and Docker Hub not re-read on 4 November). The clone's package files state Python 3.11 or later for `karrio`, while `karrio_server` still declares 3.7 or later (18 of 20). A public tests workflow runs SDK type checks, SDK tests and server tests on PostgreSQL, and the last five runs on main, all on 23 June 2026, passed, per the 8 October check. main hasn't moved since (25). GitHub Issues is switched off, so bug reports go to Discussions. Reports from July and August 2026 on FedEx dimensions and a GraphQL crash had no reply, per the 8 October check, not re-read on 4 November (10 of 25). Versions are calendar-based, not semver, and the breaking rename of the `purchased` status shipped in 2026.1.20 with a banner in the changelog (8 of 15). Releases are past 1.0 and numbered for production use (15). 18+25+10+8+15 = 76.

### Transparency & trust: Karrio +43

- Envia (16): Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.
- Karrio (59): The server, SDK and modules are LGPL-3.0, an OSI licence. `ee/` is under a proprietary licence in the same repository, and the `karrio_server` package file declares Apache-2.0 while the repository licence gives LGPL-3.0 outside `ee/` (26 of 30). The 8 October PyPI licence-field reading came from PyPI's JSON API and is withdrawn. On a self-hosted instance the data stays with the owner. The privacy policy (8 April 2025, per the 8 October check) covers the website and associated services, excludes customer data, gives no retention periods and names 12 service providers. No data processing addendum was found (14 of 30). Breaking changes are flagged in the changelog and the spec says a new dated version marks an incompatible change. No deprecation policy with notice periods was found (7 of 20). Sentry and PostHog reporting are documented and stay off unless the operator sets their keys. The Compose files pull images through a Scarf gateway and the README carries a Scarf pixel, neither described in the docs we read (12 of 20).

### Schema & documentation: Envia +37

- Envia (80): Each reference page's Markdown copy embeds an OpenAPI definition with sandbox and production servers (25). llms.txt and a Markdown copy of each page (10). Endpoint descriptions say what each is for and which call comes next in the workflow, and the rate tool warns that sandbox rates are simulated (15 of 20). The quote definition has 17 enums and required lists (11 of 15). Workflow examples and an error-formats guide named in the changelog, though its Markdown address answered 404 and the quote definition documents only 200 (9 of 15). A dated docs changelog by month, the latest March 2026 (10 of 15). 25 + 10 + 15 + 11 + 9 + 10 = 80.
- Karrio (43): `schemas/openapi.yml` in the repository is OpenAPI 3.0.3 at version 2026.1.32, re-read in a clone on 4 November, and GraphQL schemas sit beside it. The website's API reference loads a copy of it by script, and on 4 November no docs page or README linked a file as a visible download, so it isn't counted as a published contract, as for attendee's and jambonz's repository files (0, from 25). No llms.txt on www.karrio.io (404 again on 4 November) or docs.karrio.io (0). The repository file and the guides cover authentication, pagination, shipments, trackers and webhooks, with little on when not to use a call, such as the stored `/v1/shipments` against the pass-through `/v1/proxy/shipping` (12 of 20). Units, statuses and label types are enums and required fields are marked, but carrier `options` and connection `credentials` are open objects whose keys differ by carrier (10 of 15). The guides have cURL and JavaScript examples and the repository file has an `ErrorResponse` schema, while the error guide is a table of HTTP statuses only (9 of 15). Versions are dated and `CHANGELOG.md` is current, but the changelog page on the website stops at 2024.12.6 (12 of 15). 0+0+12+10+9+12 = 43.

### Payments & pricing: Karrio +20

- Envia (20): No x402, MPP or L402 (0). No public price list: each cost is shown when quoting, and volume plans go through sales (0). A free sandbox account creates test labels with no charges (20). A person signs up in a browser and tops up a balance for live labels (0). 0 + 0 + 20 + 0 = 20.
- Karrio (40): Scored with the self-hosted rule, taking prices from the paid options beside the free edition. No x402, MPP or L402 (0). Self-hosting is free, and the platform page gives starting prices only, $499 a month for the managed Scale platform with pay-as-you-go usage and $50,000 a year for a commercial licence, with no unit price (10 of 20). The open-source edition needs no card or account (20). Install is scriptable with Docker Compose and `POST /api/token` issues a JWT for an email and password, but carrier accounts and the API key are set up by a person, so half (10 of 20).

### Maintenance & community: Karrio +19

- Envia (10): The latest dated change found is the docs changelog for March 2026 and @envia/envia-mcp 0.1.0 on 4 March 2026, more than 180 days ago; doc pages show later `updatedAt` stamps (28 October for the FAQ) that record no change (0). No dated entries in the 90 days from 8 August (0). Support through the dashboard and docs, with no public tracker; the MCP repository named on npm could not be cloned (5 of 15). The MCP package is official, with no API SDK and no registry entry (5 of 15). No public CI to read (0). 0 + 0 + 5 + 5 + 0 = 10.
- Karrio (29): The newest release, 2026.1.32, is dated 23 June 2026, 134 days before 4 November, and no tag, branch or commit on main is newer, read in a clone on 4 November (10 of 30). No release in the 90 days from 6 August (0 of 20). Of the 15 newest Discussions threads, 10 showed no maintainer reply, and fix pull requests opened between 23 September and 2 October 2026 each had one or two comments and were unmerged, among 83 open pull requests, per the 8 October check, not re-read on 4 November (8 of 25). The PyPI packages matched the last release on 8 October, and the npm client is at 2023.1.0. The 8 October search of the MCP registry used its JSON API and is withdrawn (5 of 15). CI passed on the last commit and the changelog records pinning axios away from compromised versions, while Dependabot branches from April and June 2026 remain unmerged (6 of 10). 10+0+8+5+6 = 29.

### Security & auth: Karrio +12

- Envia (35): Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.
- Karrio (47): Private API keys with a label, bound to test or live mode, sent as the Basic username or in the `Authorization` header. The docs say a private key can perform any request without restriction. Short-lived resource tokens for document links can travel in a `?token=` query string, which we didn't count against the score because they expire in five minutes by default and open one resource (20 of 30). Test-mode keys keep building away from live carriers. Team permissions are in the paid `ee/` code, and the MCP guide asks the agent to confirm with the user before `create_shipment` (7 of 20). Responses carry carrier tracking text and addresses, and no injection guidance was found (3 of 15). API logs, tracing records and events are stored and readable in the open-source edition, and audit logging is listed as an enterprise feature (10 of 15). `SECURITY.md`, unchanged in the clone's history back to August 2024, is a security policy that sends reports to an email address, with no acknowledgement time. No security.txt, bug bounty or certification was found, and GitHub lists no published advisories although 2026.1.32 fixed MD5 password storage and a March 2026 release stopped carrier API keys reaching tracing spans. A disclosure policy with a reporting route and no acknowledgement time scores 7 in this run, and the fixes without advisories are charged once, in the deductions (7 of 20, from 4). 20+7+3+10+7 = 47.

## Score by category

| Category | Weight | Envia | Karrio | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 20 | 76 | Karrio +56 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 80 | 43 | Envia +37 |
| Agent ergonomics | 13% (16.2 this run) | 53 | 57 | Karrio +4 |
| Security & auth | 14% (17.5 this run) | 35 | 47 | Karrio +12 |
| Payments & pricing | 10% (12.5 this run) | 20 | 40 | Karrio +20 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 10 | 29 | Karrio +19 |
| Transparency & trust | 7% (8.8 this run) | 16 | 59 | Karrio +43 |
| Negative events | ≤15 | 0 | -6 | |
| **Total** | | **36.5 · F** | **46.4 · D** | |

## Facts side by side

| Fact | Envia | Karrio |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Envia Shipping | Karrio, Inc. |
| Hosted endpoint | no (local only) | no (local only) |
| Transports | stdio | HTTP |
| Auth | API key | API key |
| Pricing | Pay per use | Freemium |
| x402 | no | no |
| Licence | none | LGPL-3.0 for the server, SDK and modules. Code under `ee/` is under the Karrio Enterprise licence and needs a subscription for production use. The MCP package in `packages/mcp` is Apache-2.0 |
| Tools exposed | 10 | none |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| Last release | 2026-03-06 | 2026-06-23 |
| Terms last updated | no document linked | 2025-04-08 |
| Privacy policy last updated | no date given | 2025-04-08 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | none | 799 stars |

## How the scores have moved

### Envia

No score change since it was listed.

### Karrio

- -2.5 on 4 November 2026: correction
- +0.2 on 27 October 2026: checklist

## Verdicts

**Envia.** Envia's shipping APIs are documented for agents, with llms.txt, OpenAPI definitions on every reference page, a free sandbox and a compact ten-tool MCP server that defaults to test mode. No status page, rate limits, public price list or readable terms were found, and the MCP package has had one release.

**Karrio.** A free LGPL-3.0 server with 30 carrier connectors, cURL and JavaScript guides and an OpenAPI file in its repository suits a team that hosts it, though no docs page links that file as a download. The last release was 23 June 2026, and the `@karrio/mcp` package the docs install was absent from npm on 8 October 2026.

## Before you call either

### Envia

1. Leave `ENVIA_ENVIRONMENT` unset until the user confirms live shipping; the default is sandbox
2. Ask the user before `envia_create_label` in production, since it spends the account balance
3. Validate the postal code at geocodes.envia.com before quoting to avoid no-coverage errors
4. Cancel an unwanted label before the carrier scans it to get the automatic refund
5. Use a sandbox token with sandbox hosts and a production token with production hosts; they are not interchangeable

### Karrio

1. Run your own instance with Docker Compose and call it at `http://localhost:5002`. Don't rely on `api.karrio.io`, which didn't resolve on 8 October 2026
2. Don't run `npx karrio-mcp` or `npx -y @karrio/mcp`. Neither name is published on npm, so build the server from `packages/mcp` in the repository
3. Change the default `admin@example.com` and `demo` login before the instance is reachable, and upgrade to 2026.1.32 or later so passwords aren't stored as MD5
4. Don't blind-retry `POST /v1/shipments` with a `service` set or `POST /v1/shipments/{id}/purchase`. Fetch the shipment and check its status first, since no idempotency key exists
5. Use a test-mode API key while building. Send it as the HTTP Basic username or as `Authorization: Token key_...`

## Questions

### Which is better for AI agents, Envia or Karrio?

Karrio scores 46.4 (D) on agent readiness against Envia's 36.5 (F), and leads in 6 of 7 scored categories. Envia leads on schema & documentation.

### Do Envia and Karrio need an API key?

Both need an API key.

### Can an agent call Envia and Karrio without installing anything?

Envia runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Karrio.

### Are Envia and Karrio open source?

No open-source release is listed for Envia. Karrio is open source (LGPL-3.0 for the server, SDK and modules. Code under `ee/` is under the Karrio Enterprise licence and needs a subscription for production use. The MCP package in `packages/mcp` is Apache-2.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/envia-vs-karrio.json, and with the fewest tokens: https://www.anchorterminal.com/compare/envia-vs-karrio.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "envia", "b": "karrio"}`. From a terminal: `anchor compare envia karrio`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/envia.json and https://www.anchorterminal.com/api/v1/tools/karrio.json

## Other comparisons with Envia or Karrio

- [atoship vs Envia](https://www.anchorterminal.com/compare/atoship-vs-envia.md)
- [atoship vs Karrio](https://www.anchorterminal.com/compare/atoship-vs-karrio.md)
- [EasyPost vs Envia](https://www.anchorterminal.com/compare/easypost-vs-envia.md)
- [EasyPost vs Karrio](https://www.anchorterminal.com/compare/easypost-vs-karrio.md)
- [Easyship vs Envia](https://www.anchorterminal.com/compare/easyship-vs-envia.md)
- [Easyship vs Karrio](https://www.anchorterminal.com/compare/easyship-vs-karrio.md)
- [Envia vs Sendcloud](https://www.anchorterminal.com/compare/envia-vs-sendcloud.md)
- [Envia vs ShipBob](https://www.anchorterminal.com/compare/envia-vs-shipbob.md)
- [Envia vs Shippo](https://www.anchorterminal.com/compare/envia-vs-shippo.md)
- [Envia vs ShippyPro](https://www.anchorterminal.com/compare/envia-vs-shippypro.md)
- [Envia vs ShipStation API](https://www.anchorterminal.com/compare/envia-vs-shipstation.md)
- [Karrio vs Sendcloud](https://www.anchorterminal.com/compare/karrio-vs-sendcloud.md)
- [Karrio vs ShipBob](https://www.anchorterminal.com/compare/karrio-vs-shipbob.md)
- [Karrio vs Shippo](https://www.anchorterminal.com/compare/karrio-vs-shippo.md)
- [Karrio vs ShippyPro](https://www.anchorterminal.com/compare/karrio-vs-shippypro.md)
- [Karrio vs ShipStation API](https://www.anchorterminal.com/compare/karrio-vs-shipstation.md)
- [Envia vs Ship24](https://www.anchorterminal.com/compare/envia-vs-ship24.md)
- [Envia vs TrackingMore](https://www.anchorterminal.com/compare/envia-vs-trackingmore.md)
- [Karrio vs Ship24](https://www.anchorterminal.com/compare/karrio-vs-ship24.md)
- [Karrio vs TrackingMore](https://www.anchorterminal.com/compare/karrio-vs-trackingmore.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp