Envia vs Shippo

Envia 10

The latest dated change found is the docs changelog for March 2026 and @envia/envia-mcp 0.1.0 on 4 March 2026, more than 180 days ago; doc pages show later updatedAt stamps (28 October for the FAQ) that record no change (0). No dated entries in the 90 days from 8 August (0). Support through the dashboard and docs, with no public tracker; the MCP repository named on npm could not be cloned (5 of 15). The MCP package is official, with no API SDK and no registry entry (5 of 15). No public CI to read (0). 0 + 0 + 5 + 5 + 0 = 10.

Shippo 77

The API release notes were last updated on 20 October 2026, and the shippo npm SDK 2.19.1 was tagged on 27 October 2026 (30). Six dated entries from 4 August, the latest on 1, 8, 14 and 20 October, plus TypeScript SDK 2.19.0 and 2.19.1 (20). Closed service with dated release notes and a support portal. Open issue counts weren't re-read (9 of 15). The MCP server is in the official registry as com.shippo/shippo-mcp, verified by DNS. Official SDKs exist in five languages. The TypeScript SDK was regenerated in October, while the Python SDK's latest stable tag is 3.9.0 from 26 November 2024, with 5.0.0 in beta since 22 October 2026 (12 of 15). SDKs are generated and validated by CI workflows, and goshippo/ai has test and validation workflows, last tagged 23 July (6 of 10).

Envia 20

Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.

Shippo 69

Read with the hosted lines and scored on the REST API at api.goshippo.com. Statuspage at status.goshippo.com with components for the REST API, the dashboard and each carrier (20). From 4 August to 2 November 2026 the history holds 101 incidents outside maintenance. All but three are on a single carrier's rating, label or tracking service. The others are degraded billing performance on 12 and 13 August, a dashboard error on 9 and 10 September and labels missing from the web app's shipments tab on 17 and 18 September. None names the Shippo REST API. The longest, 25 August (05:18 to 14:27 UTC, marked major), affected one carrier API (Pitney Bowes). This run reads incidents that hit one carrier or part of the service as partial, whatever their label, so minor only (20 of 30). Per-minute limits per endpoint, live and test (15). The docs say a 429 is returned and nothing more. No Retry-After or backoff guidance was found, and label purchase takes no idempotency key, though the TypeScript SDK has a configurable backoff retry (4 of 15). No SLA found. API Premier lists paid 24/7 monitoring as an add-on (0). GA (10).

Envia 16

Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.

Shippo 58

Closed service. The terms of use sit in a privacy centre that loads only with JavaScript, so we couldn't read them or confirm the contracting entity. SDKs and the goshippo/ai repository are MIT (12 of 30). The privacy notice has the same problem. The release notes say shipments and rates are retrievable for 390 days. The trust centre's DPA link and encryption statements, read on 7 October, are set aside because the host now refuses our crawler, and no retention periods were read (4 of 30). The versioning page says accounts are never forced onto a new API version, and notices carry dates, such as the 1 and 14 October 2026 notices of the EU product identifier requirement from 1 November. Carrier removals are announced on the day (12 of 20). Webhook addresses are published for US and EU regions. The trust centre's hosting and third-party statements are set aside, and no subprocessor list was found (3 of 20).

Envia 20

No x402, MPP or L402 (0). No public price list: each cost is shown when quoting, and volume plans go through sales (0). A free sandbox account creates test labels with no charges (20). A person signs up in a browser and tops up a balance for live labels (0). 0 + 0 + 20 + 0 = 20.

Shippo 40

No x402, MPP or L402 (0). Per-unit prices are public without a login. API Starter is 7 cents a label after 30 free a month, 1 cent a rate request, 2 cents a tracking request, 2 cents a US address validation and 8 cents elsewhere, plus the postage itself (20). Signup is free, and test keys create test labels and mock tracking at no charge. The docs say billing details are needed only for live label purchase. We didn't open an account to confirm (20). A person signs up in a browser and creates the key in the portal, or signs in through OAuth for the MCP server (0).

Envia 53

Ten compact MCP tools (25). Rates take one carrier per request, and the Queries API filters carriers by country and shipment type; no paging or field selection was found (10 of 20). The FAQ maps common errors to fixes, but the changelog says the three APIs return different error formats that need a normalisation helper (10 of 20). No idempotency key for labels; an unscanned label can be cancelled for an automatic refund, and the MCP tools carry no annotations (3 of 20). The MCP server defaults to sandbox, with no official API SDK (5 of 15). 25 + 10 + 10 + 3 + 5 = 53.

Shippo 64

Scored on the REST API, with the MCP server noted. List calls take results and page, and expand controls nested objects, but there's no field selection and a shipment returns every rate. The MCP server has four tools (list, describe, read-execute, write-execute) over 73 operations, which keeps definitions small (17 of 25). Pagination on every list. Date filters exist only on shipments, within a 90-day range (14 of 20). Status codes are documented in general terms and the error body is untyped. The goshippo/ai repository has an error reference with recovery steps for MCP use (12 of 20). No idempotency key on shipments, transactions or refunds. The Reporting API accepts idempotency_key. The MCP read and write split lets a client approve writes. Its annotations sit behind sign-in and weren't read (8 of 20). Official SDKs for Python, TypeScript, Java, C# and PHP. Shipments and transactions default to asynchronous, and objects can't be edited after creation (13 of 15).

Envia 35

Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.

Shippo 42

Self-serve API keys, live and test kept apart, shown once, deletable in the portal, with no scopes and no documented expiry. The OAuth flow for platforms has one scope, "*". JWTs for client-side use last 12 hours (20 of 30). A webhook can carry a self-made token in its URL query string. That is the receiver's secret, not the API credential, so we noted it without the deduction. No read-only key. Test keys can't spend money, and the MCP server separates reads from writes and its docs say writes ask for confirmation (9 of 20). Tracking events, metadata and address text come from carriers and other parties. The AI repository's security policy puts prompt injection in scope for reports, with no guidance in the API docs (5 of 15). The API portal is described as showing usage. No audit log was found in the docs (3 of 15). The AI repository's security policy gives security@goshippo.com and names goshippo.com/security as the disclosure page, which returns 404, as does security.txt. The trust centre at trust.goshippo.com, where the 7 October check read SOC 2 Type II, PCI DSS, a penetration test and a bug bounty, now refuses our crawler, so those readings are set aside and unscored (5 of 20).