Karrio vs TrackingMore

Karrio 68

schemas/openapi.yml is OpenAPI 3.0.3 at version 2026.1.32, with 65 paths, and the docs site renders a reference from it. GraphQL schemas sit beside it (25). No llms.txt on www.karrio.io or docs.karrio.io, both 404 (0). The spec carries about 1,200 description lines and the guides cover authentication, pagination, shipments, trackers and webhooks, with little on when not to use a call, such as the stored /v1/shipments against the pass-through /v1/proxy/shipping (12 of 20). Units, statuses and label types are enums and required fields are marked, but carrier options and connection credentials are open objects whose keys differ by carrier (10 of 15). The guides have cURL and JavaScript examples and the spec has an ErrorResponse schema, while the error guide is a table of HTTP statuses only (9 of 15). Versions are dated and CHANGELOG.md is current, but the changelog page on the website stops at 2024.12.6 (12 of 15).

TrackingMore 31

No OpenAPI or similar file was found in the docs, the SDK repositories or a search, and the reference at trackingmore.com/docs renders by script so its schemas were not read (0 of 25). No llms.txt or Markdown docs (0). The official SDK READMEs give one line per call, and the support centre explains when to pair create with get or a webhook and that the create response carries the result (8 of 20). Field names and the required tracking_number and courier_code appear in the SDK examples, with no types, enums or constraints readable (5 of 15). Examples in seven SDK languages and a table of HTTP and meta codes with messages (12 of 15). v4 in the path with v2 and v3 still served, and the support centre says there is no changelog for switching versions. No dated API changelog was found (6 of 15). 0 + 0 + 8 + 5 + 12 + 6 = 31.

Karrio 40

Scored with the self-hosted rule, taking prices from the paid options beside the free edition. No x402, MPP or L402 (0). Self-hosting is free, and the platform page gives starting prices only, $499 a month for the managed Scale platform with pay-as-you-go usage and $50,000 a year for a commercial licence, with no unit price (10 of 20). The open-source edition needs no card or account (20). Install is scriptable with Docker Compose and POST /api/token issues a JWT for an email and password, but carrier accounts and the API key are set up by a person, so half (10 of 20).

TrackingMore 23

Read with the hosted rubric. No x402, MPP or L402 (0). The API page gives a from price of $0.03 a tracked order and three unlabelled figures, and the pricing page's plan prices render by script, so per-unit pricing is partly public (8 of 20). A Free plan and a 14-day trial are offered, and whether a card is asked for was not established (15 of 20). A person signs up in a browser and generates the key there (0). 0 + 8 + 15 + 0 = 23.

Karrio 44

Private API keys with a label, bound to test or live mode, sent as the Basic username or in the Authorization header. The docs say a private key can perform any request without restriction. Short-lived resource tokens for document links can travel in a ?token= query string, which we didn't count against the score because they expire in five minutes by default and open one resource (20 of 30). Test-mode keys keep building away from live carriers. Team permissions are in the paid ee/ code, and the MCP guide asks the agent to confirm with the user before create_shipment (7 of 20). Responses carry carrier tracking text and addresses, and no injection guidance was found (3 of 15). API logs, tracing records and events are stored and readable in the open-source edition, and audit logging is listed as an enterprise feature (10 of 15). SECURITY.md gives an email address only. No security.txt, bug bounty or certification was found, and GitHub lists no published advisories although 2026.1.32 fixed MD5 password storage (4 of 20).

TrackingMore 31

One API key in the Tracking-Api-Key header, shown once, at most four per account, deleted in the web app. No scopes or expiry (20 of 30). No read-only key or least-privilege mode, and delete is one call (4 of 20). Tracking checkpoints are carrier text returned to the model, and no guidance was found (3 of 15). A webhook notification log exists in the web app; no log of API calls or key use was found (4 of 15). No security.txt (404), no security page on trackingmore.com, no certification, bug bounty or disclosure policy found. The CWILL privacy policy points to a trust site that was not read (0 of 20). 20 + 4 + 3 + 4 + 0 = 31.

Karrio 76

Read with the local-software lines, since the graded surface is the open-source server its owner hosts. The managed platform has no status page we could find, and its hosts didn't answer on 8 October 2026. Docker images on Docker Hub and PyPI packages at 2026.1.32, with Python 3.11 or later stated for karrio, though karrio-server still declares 3.7 or later (18 of 20). A public tests workflow runs SDK type checks, SDK tests and server tests on PostgreSQL, and the last five runs on main, all on 23 June 2026, passed (25). GitHub Issues is switched off, so bug reports go to Discussions. Reports from July and August 2026 on FedEx dimensions and a GraphQL crash had no reply, and a June report that migration 0093 deleted tracker history was fixed in 2026.1.32 (10 of 25). Versions are calendar-based, not semver, and the breaking rename of the purchased status shipped in 2026.1.20 with a banner in the changelog (8 of 15). Releases are past 1.0 and numbered for production use (15).

TrackingMore 65

Read with the hosted lines and scored on the REST API v4 at api.trackingmore.com. status.trackingmore.com is a hosted status page with uptime and a status update history (20). Its figures and history render by script, so the 90 days could not be read; the static text says there were no updates in the last 7 days (5). Rate limits are published per endpoint, 3 requests a second on trackings/create and 10 a second elsewhere, per account (15). The support centre says a 429 means the application should stop and wait 120 seconds, and a repeated create answers meta code 4101 rather than creating a duplicate. No Retry-After and no idempotency key (10 of 15). No SLA document was found. The Enterprise plan lists 99.99 per cent API uptime as a feature and the API page claims 99.9 per cent uptime, which is marketing rather than a published SLA (5 of 10). v4 is the current version and not marked beta (10). 20 + 5 + 15 + 10 + 5 + 10 = 65.

Karrio 29

The newest release, 2026.1.32, is dated 23 June 2026, 107 days before the check, and nothing has landed on main since (10 of 30). No release between 10 July and 8 October 2026 (0 of 20). Of the 15 newest Discussions threads, 10 showed no maintainer reply, and fix pull requests opened between 23 September and 2 October 2026 each had one or two comments and were unmerged, among 83 open pull requests (8 of 25). No entry in the official MCP registry and no MCP package on npm. The PyPI packages match the last release and the npm client is at 2023.1.0 (5 of 15). CI passed on the last commit and the changelog records pinning axios away from compromised versions, while dependency pull requests from April and June 2026 remain open (6 of 10).

TrackingMore 19

Read as a closed service. No dated API change was found. The SDKs were last pushed between February and December 2024, the support articles are dated 2023 and 2024, and the reference is undated (0 of 30). No releases or dated entries in the last 90 days were found (0). Support by email and chat with a help centre; GitHub issues were not read (6 of 15). Seven official SDKs exist but none has changed since December 2024 (10 of 15). The Node SDK has tests and no CI workflow (3 of 10). 0 + 0 + 6 + 10 + 3 = 19.