Sendcloud vs TrackingMore

Sendcloud 89

29 OpenAPI 3.1 specs for API v3, 104 operations, linked from llms.txt (25). llms.txt and a Markdown copy of every docs page (10). Every operation has a description. Some state limits, such as when a cancellation is rejected, and many are one sentence. MCP tools take their text from the same specs (13). 243 enums, required fields and maxima such as page_size up to 100 (13). 216 example blocks and JSON:API error objects with status, code and detail. 429 responses appear only in the Support API spec (13). Versioned v2 and v3 with a dated v3 changelog of 174 entries back to 25 May 2023 (15).

TrackingMore 31

No OpenAPI or similar file was found in the docs, the SDK repositories or a search, and the reference at trackingmore.com/docs renders by script so its schemas were not read (0 of 25). No llms.txt or Markdown docs (0). The official SDK READMEs give one line per call, and the support centre explains when to pair create with get or a webhook and that the create response carries the result (8 of 20). Field names and the required tracking_number and courier_code appear in the SDK examples, with no types, enums or constraints readable (5 of 15). Examples in seven SDK languages and a table of HTTP and meta codes with messages (12 of 15). v4 in the path with v2 and v3 still served, and the support centre says there is no changelog for switching versions. No dated API changelog was found (6 of 15). 0 + 0 + 8 + 5 + 12 + 6 = 31.

Sendcloud 67

Latest API v3 changelog entry 30 October 2026 (30). 52 dated entries from 4 August to 30 October (20). Closed service with a dated changelog and a help centre with email and chat support. No developer forum or public issue tracker found (9). The MCP server isn't in the official MCP registry, and no official SDK was found. A public Postman workspace exists (3). No packages to assess. The specs change with the changelog (5).

TrackingMore 19

Read as a closed service. No dated API change was found. The SDKs were last pushed between February and December 2024, the support articles are dated 2023 and 2024, and the reference is undated (0 of 30). No releases or dated entries in the last 90 days were found (0). Support by email and chat with a help centre; GitHub issues were not read (6 of 15). Seven official SDKs exist but none has changed since December 2024 (10 of 15). The Node SDK has tests and no CI workflow (3 of 10). 0 + 0 + 6 + 10 + 3 = 19.

Sendcloud 58

A key pair per API integration, usable as Basic or exchanged for a one-hour Bearer token whose only scope is api, covering the whole account. Since 12 October 2026 the MCP sign-in lists permission groups on its consent screen and the token carries only the scopes chosen, with separate read and write scopes for each area (25 of 30). Scopes let an MCP connection read parcels without creating shipments, the toolset filter is enforced on the server, and annotations let a client prompt before creates and cancels. API key pairs have no read-only form (12). Responses carry text written by others, such as addresses, order data and support tickets. The MCP page says results are reference information only and gives no injection guidance (3). Integration exception logs are in the API. A read:audit-log scope is listed, but no audit log endpoint was found in the reference (3). ISO/IEC 27001, annual penetration tests, a private HackerOne programme reached through security@sendcloud.com, and a disclosure address. No security.txt and no SOC 2 found (15).

TrackingMore 31

One API key in the Tracking-Api-Key header, shown once, at most four per account, deleted in the web app. No scopes or expiry (20 of 30). No read-only key or least-privilege mode, and delete is one call (4 of 20). Tracking checkpoints are carrier text returned to the model, and no guidance was found (3 of 15). A webhook notification log exists in the web app; no log of API calls or key use was found (4 of 15). No security.txt (404), no security page on trackingmore.com, no certification, bug bounty or disclosure policy found. The CWILL privacy policy points to a trust site that was not read (0 of 20). 20 + 4 + 3 + 4 + 0 = 31.

Sendcloud 71

The MCP server makes one tool per operation, about 98 by the specs for its 24 toolsets, all on by default, which scores 5, and a ?toolsets= filter enforced on calls adds 10. The API has page_size and no field selection (15). Cursor pagination through Link headers and filters by status, tracking number, reference and dates on shipments (18). JSON:API errors, though a carrier failure on a synchronous announce arrives in an errors array inside a success response (15). external_reference_id deduplicates shipment creation, and the docs say tools carry read-only, idempotent and destructive hints by HTTP method, which we couldn't confirm without an account (16). Shipping rules and defaults cut required fields. No official SDK was found (7).

TrackingMore 54

trackings/get filters by tracking numbers, courier and created date range, and batch create takes 40 at once. No field selection was found, and the unread reference may document more (10 of 25). Date and courier filters exist; pagination parameters were not found in what was read (8 of 20). Every response carries an HTTP code and a meta code with a message, such as 4121 for an undetected courier and 4190 for a reached quota (14 of 20). No idempotency key. A repeated create is rejected with 4101, so the write is safe to retry, and delete and retrack take ids (10 of 20). Create needs only tracking_number and courier_code, detect is free, and official SDKs cover seven languages (12 of 15). 10 + 8 + 14 + 10 + 12 = 54.

Sendcloud 72

Closed service with terms dated 1 September 2026 naming Sendcloud B.V. and four country entities (15). The privacy policy keeps server logs for at most 7 days and contact forms for 6 years. The DPA deletes customers' order data within 365 days of shipment completion and gives 30 days' notice of new sub-processors. Neither page showed a version date we could read (22). API v2 maintenance mode announced for April 2026, and one endpoint deprecated with a date (9 June 2026). Other deprecated fields are to go "in a future version", and no notice-period policy was found (10). Trust centre names five sub-processors, and the security page names AWS EU Central and EU North (15).

TrackingMore 57

Closed service. The terms are the CWILL group's (effective 9 January 2026), which say the contracting entity depends on the product, and the privacy policy names CHANNELWILL CO., LIMITED for TrackingMore. The SDKs are MIT (15 of 30). The privacy policy (8 August 2026) distinguishes controller and processor roles and links a DPA and a sub-processor list, neither read; no retention periods were read (12 of 30). v2 and v3 are still served with no notice policy or dates (4 of 20). A sub-processor list exists at trust.cwill.com and was not read; no data location is stated on the pages read (8 of 20). 15 + 12 + 4 + 8 = 39.

Sendcloud 37

No x402, MPP or L402 (0). Plan prices and per-label fees are public in euros, from €28 a month plus €0.10 a label to €639 plus €0.07, with sample carrier rates. We couldn't read which plans the API access row covers (17). A Free plan for 20 parcels a month and a 14-day trial, both stated as needing no card, plus free Unstamped letter test labels (20). A person signs up in a browser, adds an invoice address and creates the keys in the panel (0).

TrackingMore 23

Read with the hosted rubric. No x402, MPP or L402 (0). The API page gives a from price of $0.03 a tracked order and three unlabelled figures, and the pricing page's plan prices render by script, so per-unit pricing is partly public (8 of 20). A Free plan and a 14-day trial are offered, and whether a card is asked for was not established (15 of 20). A person signs up in a browser and generates the key there (0). 0 + 8 + 15 + 0 = 23.