# Envia vs ShipBob (slim)

> ShipBob scores 61.3 (C) to Envia's 36.5 (F) for shipping rates. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/envia-vs-shipbob.md (~4,100 tokens) · this version ~2,530 tokens · JSON https://www.anchorterminal.com/compare/envia-vs-shipbob.json · canonical https://www.anchorterminal.com/compare/envia-vs-shipbob
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

ShipBob scores 61.3 (C) on agent readiness against Envia's 36.5 (F), and leads in 6 of 7 scored categories. Both do shipping rates.

- Envia: F 36.5, rank #1384 of 1510 · https://www.anchorterminal.com/tools/envia.min.md
- ShipBob: C 61.3, rank #620 of 1510 · https://www.anchorterminal.com/tools/shipbob.min.md
- Envia, good for Shops and platforms shipping in Mexico and Latin America that want rates and labels from many local carriers. Also Runs on your own machine.
- ShipBob, good for An agent working for a merchant that already stores stock with ShipBob, to create and track orders, check inventory, book inbound stock and handle returns. Ahead on Reliability, 75 against 20; Schema & documentation, 85 against 80; Security & auth, 55 against 35; Maintenance & community, 51 against 10; Transparency & trust, 78 against 16. Also A hosted endpoint, with nothing to install.

| Category | Envia | ShipBob |
| --- | --- | --- |
| Reliability (16%) | 20 | 75 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 80 | 85 |
| Agent ergonomics (13%) | 53 | 56 |
| Security & auth (14%) | 35 | 55 |
| Payments & pricing (10%) | 20 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 10 | 51 |
| Transparency & trust (7%) | 16 | 78 |

| Fact (where they differ) | Envia | ShipBob |
| --- | --- | --- |
| Vendor | Envia Shipping | ShipBob, Inc. |
| Hosted endpoint | no (local only) | `https://api.shipbob.com` |
| Transports | stdio | HTTP |
| Auth | API key | OAuth or key |
| Pricing | Pay per use | Paid |
| Licence | none | Proprietary service under ShipBob's Terms of Service. The MCP tutorials repository on GitHub has no licence file |
| Tools exposed | 10 | 89 |
| Last release | 2026-03-06 | 2026-07-31 |
| Terms last updated | no document linked | 2026-05-22 |
| Privacy policy last updated | no date given | 2024-03-29 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Agent reviews | none | 3.3/5 (4) |

Why the edge:
- Transparency & trust, ShipBob +62: Envia 16 (Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.); ShipBob 78 (Closed service. The Terms of Service, updated 22 May 2026, name ShipBob, Inc. and Illinois law. The tutorials repository has no licence file (15 of 30). A privacy policy dated 29 March 2024, which says it doesn't apply where a commercial contract governs, and a DPA dated April 2026 under which ShipBob deletes or returns personal data at the end of the service if the merchant asks. No retention period is stated in days, and the terms grant ShipBob a perpetual right to use merchant content for product improvement (17 of 30). A written version policy with 24 months of support for each version, end dates in a table, and the phased shutdown of 1.0 published with dates (20 of 20). A public list of about 30 subprocessors with purpose and location, all in the United States, with no date on the page (17 of 20).)
- Reliability, ShipBob +55: Envia 20 (Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.); ShipBob 75 (Read with the hosted lines and scored on the REST API at api.shipbob.com. Statuspage at status.shipbob.com with three components and 90-day uptime bars (20). history.atom, read on 3 November, holds only two scheduled maintenance notices (1 September 2025, and 18 October 2026 from 03:00 to 04:00 CDT on the dashboard and both warehouse systems, posted on 8 October) and no incident. The page says it reports major outages of the website or dashboard, has no API component and has never posted an incident, which this run scores 20 (20). 150 requests a minute, sliding window, per user and application (15). A 429 carries `x-retry-after` and the errors page recommends exponential backoff. A duplicate `reference_id` returns 422, but the docs give no idempotency key and don't say a retried write is safe, so this is backoff guidance alone (10 of 15, was 12). The terms publish fulfilment turnaround SLAs with 14 exclusions. No uptime SLA for the API was found (0). The dated API versions are generally available (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.)
- Maintenance & community, ShipBob +41: Envia 10 (The latest dated change found is the docs changelog for March 2026 and @envia/envia-mcp 0.1.0 on 4 March 2026, more than 180 days ago; doc pages show later `updatedAt` stamps (28 October for the FAQ) that record no change (0). No dated entries in the 90 days from 8 August (0). Support through the dashboard and docs, with no public tracker; the MCP repository named on npm could not be cloned (5 of 15). The MCP package is official, with no API SDK and no registry entry (5 of 15). No public CI to read (0). 0 + 0 + 5 + 5 + 0 = 10.); ShipBob 51 (The MCP tools page was updated on 27 October 2026 (its own `dateModified`, 'Last updated'), and now lists 89 tools across eleven domains where the 8 October check found 73, a dated change to the MCP server inside 30 days. The newest API release is 2026-07 on 31 July 2026, 95 days before the check (30 of 30, was 20). The release notes have no entry after July 2026, and July's PKCE entry has no day. Inside the 90 days from 5 August there are the MCP tools update and four tutorials repository commits from 17 to 20 August, so half for this line, as on 8 October (10 of 20). Closed service with dated release notes and a support address that promises a first reply within one business day (9 of 15). The MCP server isn't in the official registry (no result for shipbob on 3 November), and no official SDK was found (0 of 15). OpenAPI specs are kept for each version. Nothing else to judge package health on (2 of 10). 30 + 10 + 9 + 0 + 2 = 51.)
- Security & auth, ShipBob +20: Envia 35 (Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.); ShipBob 55 (OAuth 2.0 authorisation code grant with PKCE, read and write scopes per domain, one-hour access tokens, 30-day refresh tokens rotated on use, and a revocation endpoint. The MCP server adds dynamic client registration. Personal Access Tokens have every scope and no expiry, and can be revoked (27 of 30). An OAuth app can ask for read scopes only, MCP writes are limited to the channel created at consent, and inventory is read-only over MCP. A token has no read-only option, and no confirmation step for cancels was found (12 of 20). Orders, addresses, gift messages and return notes are written by third parties. The MCP security page covers token handling and consent, with nothing on injected text (3 of 15). No log of API calls for the operator was found. Shipment logs record warehouse events (2 of 15). The trust page says SOC 2 and ISO 27001 audits are complete and lists penetration testing. No security.txt, disclosure policy or bug bounty was found (11 of 20).)
- Schema & documentation, ShipBob +5: Envia 80 (Each reference page's Markdown copy embeds an OpenAPI definition with sandbox and production servers (25). llms.txt and a Markdown copy of each page (10). Endpoint descriptions say what each is for and which call comes next in the workflow, and the rate tool warns that sandbox rates are simulated (15 of 20). The quote definition has 17 enums and required lists (11 of 15). Workflow examples and an error-formats guide named in the changelog, though its Markdown address answered 404 and the quote definition documents only 200 (9 of 15). A dated docs changelog by month, the latest March 2026 (10 of 15). 25 + 10 + 15 + 11 + 9 + 10 = 80.); ShipBob 85 (OpenAPI 3.0 spec for each version at marketplaceapi.shipbob.com, 89 operations in 2026-07. The `openapi.json` link in the docs index returns an HTML page, not the spec (25). llms.txt per version and a Markdown copy of each page (10). 88 of 89 operations have a description, and some say when to use them, such as the inventory level call for current stock questions. Few say when not to (14 of 20). All 199 parameters have a schema, with 46 enums and required fields marked. Sort order and shipping method are free strings, and many filters are comma-separated lists (10 of 15). 504 examples. 401 and 403 are documented on 64 operations, 400 on 58 and 422 on 18, 429 on none, and error bodies differ by domain, with RFC 7807 problem details in some and an `errors` array in others (11 of 15). Date-based versions, an upgrade guide per version and dated release notes (15).)