Envia vs ShipBob

Envia 16

Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.

ShipBob 78

Closed service. The Terms of Service, updated 22 May 2026, name ShipBob, Inc. and Illinois law. The tutorials repository has no licence file (15 of 30). A privacy policy dated 29 March 2024, which says it doesn't apply where a commercial contract governs, and a DPA dated April 2026 under which ShipBob deletes or returns personal data at the end of the service if the merchant asks. No retention period is stated in days, and the terms grant ShipBob a perpetual right to use merchant content for product improvement (17 of 30). A written version policy with 24 months of support for each version, end dates in a table, and the phased shutdown of 1.0 published with dates (20 of 20). A public list of about 30 subprocessors with purpose and location, all in the United States, with no date on the page (17 of 20).

Envia 20

Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.

ShipBob 75

Read with the hosted lines and scored on the REST API at api.shipbob.com. Statuspage at status.shipbob.com with three components and 90-day uptime bars (20). history.atom, read on 3 November, holds only two scheduled maintenance notices (1 September 2025, and 18 October 2026 from 03:00 to 04:00 CDT on the dashboard and both warehouse systems, posted on 8 October) and no incident. The page says it reports major outages of the website or dashboard, has no API component and has never posted an incident, which this run scores 20 (20). 150 requests a minute, sliding window, per user and application (15). A 429 carries x-retry-after and the errors page recommends exponential backoff. A duplicate reference_id returns 422, but the docs give no idempotency key and don't say a retried write is safe, so this is backoff guidance alone (10 of 15, was 12). The terms publish fulfilment turnaround SLAs with 14 exclusions. No uptime SLA for the API was found (0). The dated API versions are generally available (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.

Envia 10

The latest dated change found is the docs changelog for March 2026 and @envia/envia-mcp 0.1.0 on 4 March 2026, more than 180 days ago; doc pages show later updatedAt stamps (28 October for the FAQ) that record no change (0). No dated entries in the 90 days from 8 August (0). Support through the dashboard and docs, with no public tracker; the MCP repository named on npm could not be cloned (5 of 15). The MCP package is official, with no API SDK and no registry entry (5 of 15). No public CI to read (0). 0 + 0 + 5 + 5 + 0 = 10.

ShipBob 51

The MCP tools page was updated on 27 October 2026 (its own dateModified, 'Last updated'), and now lists 89 tools across eleven domains where the 8 October check found 73, a dated change to the MCP server inside 30 days. The newest API release is 2026-07 on 31 July 2026, 95 days before the check (30 of 30, was 20). The release notes have no entry after July 2026, and July's PKCE entry has no day. Inside the 90 days from 5 August there are the MCP tools update and four tutorials repository commits from 17 to 20 August, so half for this line, as on 8 October (10 of 20). Closed service with dated release notes and a support address that promises a first reply within one business day (9 of 15). The MCP server isn't in the official registry (no result for shipbob on 3 November), and no official SDK was found (0 of 15). OpenAPI specs are kept for each version. Nothing else to judge package health on (2 of 10). 30 + 10 + 9 + 0 + 2 = 51.

Envia 35

Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.

ShipBob 55

OAuth 2.0 authorisation code grant with PKCE, read and write scopes per domain, one-hour access tokens, 30-day refresh tokens rotated on use, and a revocation endpoint. The MCP server adds dynamic client registration. Personal Access Tokens have every scope and no expiry, and can be revoked (27 of 30). An OAuth app can ask for read scopes only, MCP writes are limited to the channel created at consent, and inventory is read-only over MCP. A token has no read-only option, and no confirmation step for cancels was found (12 of 20). Orders, addresses, gift messages and return notes are written by third parties. The MCP security page covers token handling and consent, with nothing on injected text (3 of 15). No log of API calls for the operator was found. Shipment logs record warehouse events (2 of 15). The trust page says SOC 2 and ISO 27001 audits are complete and lists penetration testing. No security.txt, disclosure policy or bug bounty was found (11 of 20).

Envia 80

Each reference page's Markdown copy embeds an OpenAPI definition with sandbox and production servers (25). llms.txt and a Markdown copy of each page (10). Endpoint descriptions say what each is for and which call comes next in the workflow, and the rate tool warns that sandbox rates are simulated (15 of 20). The quote definition has 17 enums and required lists (11 of 15). Workflow examples and an error-formats guide named in the changelog, though its Markdown address answered 404 and the quote definition documents only 200 (9 of 15). A dated docs changelog by month, the latest March 2026 (10 of 15). 25 + 10 + 15 + 11 + 9 + 10 = 80.

ShipBob 85

OpenAPI 3.0 spec for each version at marketplaceapi.shipbob.com, 89 operations in 2026-07. The openapi.json link in the docs index returns an HTML page, not the spec (25). llms.txt per version and a Markdown copy of each page (10). 88 of 89 operations have a description, and some say when to use them, such as the inventory level call for current stock questions. Few say when not to (14 of 20). All 199 parameters have a schema, with 46 enums and required fields marked. Sort order and shipping method are free strings, and many filters are comma-separated lists (10 of 15). 504 examples. 401 and 403 are documented on 64 operations, 400 on 58 and 422 on 18, 429 on none, and error bodies differ by domain, with RFC 7807 problem details in some and an errors array in others (11 of 15). Date-based versions, an upgrade guide per version and dated release notes (15).