Ship24 vs TrackingMore

Ship24 80

The ship24 npm package reached 1.1.0 on 6 October 2026, two days before the check (30). In the 90 days before the check there were five dated releases, the Node SDK 1.0.0 on 14 July and 1.1.0 on 6 October, MCP server 1.0.0 on 16 July and 1.0.1 on 27 August in the official registry, and the AI plugin 1.0.0 on 9 September (20). The service is closed, with no API changelog. Support is a contact form, and the GitHub API shows four open issues on the SDK repository and two on the plugin, which we didn't read (6 of 15). The MCP server is in the official registry under the domain namespace com.ship24/tracking-mcp (15). The SDK has no runtime dependencies, CI that tests Node 20, 22 and 24, and a workflow that reports drift from the OpenAPI spec (9 of 10).

TrackingMore 19

Read as a closed service. No dated API change was found. The SDKs were last pushed between February and December 2024, the support articles are dated 2023 and 2024, and the reference is undated (0 of 30). No releases or dated entries in the last 90 days were found (0). Support by email and chat with a help centre; GitHub issues were not read (6 of 15). Seven official SDKs exist but none has changed since December 2024 (10 of 15). The Node SDK has tests and no CI workflow (3 of 10). 0 + 0 + 6 + 10 + 3 = 19.

Ship24 81

A public OpenAPI 3.1 spec at docs.ship24.com/assets/openapi/ship24-tracking-api.yaml covers 12 operations and two webhooks, and every MCP tool has a typed input and output schema (25). llms.txt and a hosted SKILL.md guide exist, but the docs pages have no Markdown copies and llms.txt truncates its descriptions (8 of 10). The MCP tool descriptions say when to use each tool and which to prefer, such as search_tracking_by_number before a billed lookup, and the docs explain the three ways to fetch results (18 of 20). Inputs are typed with required fields, 12 enums and limits such as 5 to 50 characters for a tracking number and 500 a page, though the Authorization header is modelled as a plain string parameter (12 of 15). The spec has many examples and the errors page lists 12 codes, but most operations document only their success response and the live auth_missing_header code isn't on the list (10 of 15). The path carries v1 and the data format page promises that fields are never removed and lists four deprecated fields with months. No API changelog was found, only the SDK and plugin changelogs (8 of 15).

TrackingMore 31

No OpenAPI or similar file was found in the docs, the SDK repositories or a search, and the reference at trackingmore.com/docs renders by script so its schemas were not read (0 of 25). No llms.txt or Markdown docs (0). The official SDK READMEs give one line per call, and the support centre explains when to pair create with get or a webhook and that the create response carries the result (8 of 20). Field names and the required tracking_number and courier_code appear in the SDK examples, with no types, enums or constraints readable (5 of 15). Examples in seven SDK languages and a table of HTTP and meta codes with messages (12 of 15). v4 in the path with v2 and v3 still served, and the support centre says there is no changelog for switching versions. No dated API changelog was found (6 of 15). 0 + 0 + 8 + 5 + 12 + 6 = 31.

Ship24 45

Read with the hosted lines and scored on the REST API at api.ship24.com/public/v1, which the hosted MCP server wraps. No status page was found. status.ship24.com doesn't resolve, ship24.statuspage.io is inactive, and neither the site footer nor the docs link to one (0). With no readable incident history the record scores the default (5 of 30). The rate limiter page gives a number for each of 11 endpoints, from 1 request a second on GET /couriers to 10 on most others (15). Responses carry RateLimit-*, X-RateLimit-* and Retry-After headers, which we saw on a live response, the errors page recommends exponential backoff on 429, and tracker creation is documented as idempotent with a 409 request_conflict that can be retried (15). The terms supply the service as is and as available, with no SLA found for any plan (0). The path is /public/v1 and the MCP server reports version 1.0.1, with no beta label (10).

TrackingMore 65

Read with the hosted lines and scored on the REST API v4 at api.trackingmore.com. status.trackingmore.com is a hosted status page with uptime and a status update history (20). Its figures and history render by script, so the 90 days could not be read; the static text says there were no updates in the last 7 days (5). Rate limits are published per endpoint, 3 requests a second on trackings/create and 10 a second elsewhere, per account (15). The support centre says a 429 means the application should stop and wait 120 seconds, and a repeated create answers meta code 4101 rather than creating a duplicate. No Retry-After and no idempotency key (10 of 15). No SLA document was found. The Enterprise plan lists 99.99 per cent API uptime as a feature and the API page claims 99.9 per cent uptime, which is marketing rather than a published SLA (5 of 10). v4 is the current version and not marked beta (10). 20 + 5 + 15 + 10 + 5 + 10 = 65.

Ship24 68

Scored on the REST API and the MCP server together. The MCP server has 12 tools, registered by plan, but its tools/list answer is about 61 KB because every tool carries an output schema, and the REST API has no field selection, so a results call returns every event (13 of 25). GET /trackers pages by page and limit (default 100, maximum 500) with a sort order. No filter appears in the spec for that call, and GET /couriers returns the full list unpaged (12 of 20). Errors are a JSON errors array with a stable code and a message that says what to fix, with 12 documented codes (16 of 20). POST /trackers and POST /trackers/track are idempotent for an identical payload, clientTrackerId is validated as unique, the bulk call is documented as not fully idempotent, and all 12 MCP tools carry readOnlyHint or destructiveHint and idempotentHint annotations (18 of 20). Only trackingNumber is required and the courier is detected automatically. One official SDK exists, for Node.js and TypeScript, so the two-language line isn't met (9 of 15).

TrackingMore 54

trackings/get filters by tracking numbers, courier and created date range, and batch create takes 40 at once. No field selection was found, and the unread reference may document more (10 of 25). Date and courier filters exist; pagination parameters were not found in what was read (8 of 20). Every response carries an HTTP code and a meta code with a message, such as 4121 for an undetected courier and 4190 for a reached quota (14 of 20). No idempotency key. A repeated create is rejected with 4101, so the write is safe to retry, and delete and retrack take ids (10 of 20). Create needs only tracking_number and courier_code, detect is free, and official SDKs cover seven languages (12 of 15). 10 + 8 + 14 + 10 + 12 = 54.

Ship24 30

Read with the hosted rubric. No x402, MPP or L402 was found in the docs, the spec or the pricing page (0). The pricing page lists both billing models without a login, per shipment from $39 a month for 1,000 with $0.045 for each extra shipment, and per call from $99 a month for 10,000 with $0.015 for each extra call, with every tier and overage rate in a table (20). The Tracking API has a free plan of 10 shipments a month. Whether signup asks for a card wasn't established, because the dashboard needs a login we didn't create (10 of 20). A person signs up and picks a plan in the dashboard, and API key creation isn't available through the API or the MCP server (0).

TrackingMore 23

Read with the hosted rubric. No x402, MPP or L402 (0). The API page gives a from price of $0.03 a tracked order and three unlabelled figures, and the pricing page's plan prices render by script, so per-unit pricing is partly public (8 of 20). A Free plan and a 14-day trial are offered, and whether a card is asked for was not established (15 of 20). A person signs up in a browser and generates the key there (0). 0 + 8 + 15 + 0 = 23.

Ship24 37

API keys are sent as a Bearer token in the Authorization header. An account can hold up to 20, managed in the dashboard, and the plugin's security note advises a dedicated key so it can be revoked alone. Keys have no scopes and no secret travels in a query string (20 of 30). No read-only key or approval step was found. The API has no delete operation, the MCP server registers tools by plan and marks resend_webhooks as destructive, and that is the only least-privilege control (5 of 20). Results carry courier event text, which is untrusted, and no prompt-injection guidance was found in the docs or the plugin (3 of 15). GET /trackers/:trackerId/webhook-history/download returns every webhook push with its response, but no log of API calls or key use was found (4 of 15). SECURITY.md in the plugin repository gives contact@ship24.com for reports on the API and MCP server. No security.txt, bug bounty, SOC 2 or ISO 27001 statement was found, and webhooks are checked by a static shared secret with no signature (5 of 20).

TrackingMore 31

One API key in the Tracking-Api-Key header, shown once, at most four per account, deleted in the web app. No scopes or expiry (20 of 30). No read-only key or least-privilege mode, and delete is one call (4 of 20). Tracking checkpoints are carrier text returned to the model, and no guidance was found (3 of 15). A webhook notification log exists in the web app; no log of API calls or key use was found (4 of 15). No security.txt (404), no security page on trackingmore.com, no certification, bug bounty or disclosure policy found. The CWILL privacy policy points to a trust site that was not read (0 of 20). 20 + 4 + 3 + 4 + 0 = 31.