Shippo vs TrackingMore

Shippo 77

The API release notes were last updated on 20 October 2026, and the shippo npm SDK 2.19.1 was tagged on 27 October 2026 (30). Six dated entries from 4 August, the latest on 1, 8, 14 and 20 October, plus TypeScript SDK 2.19.0 and 2.19.1 (20). Closed service with dated release notes and a support portal. Open issue counts weren't re-read (9 of 15). The MCP server is in the official registry as com.shippo/shippo-mcp, verified by DNS. Official SDKs exist in five languages. The TypeScript SDK was regenerated in October, while the Python SDK's latest stable tag is 3.9.0 from 26 November 2024, with 5.0.0 in beta since 22 October 2026 (12 of 15). SDKs are generated and validated by CI workflows, and goshippo/ai has test and validation workflows, last tagged 23 July (6 of 10).

TrackingMore 19

Read as a closed service. No dated API change was found. The SDKs were last pushed between February and December 2024, the support articles are dated 2023 and 2024, and the reference is undated (0 of 30). No releases or dated entries in the last 90 days were found (0). Support by email and chat with a help centre; GitHub issues were not read (6 of 15). Seven official SDKs exist but none has changed since December 2024 (10 of 15). The Node SDK has tests and no CI workflow (3 of 10). 0 + 0 + 6 + 10 + 3 = 19.

Shippo 83

OpenAPI 3.1 spec for the main API with 71 operations, and six further specs for addresses v2, estimates, reporting, invoices and surcharges (25). llms.txt at docs.goshippo.com and a Markdown copy of each page (10). Descriptions state purpose and some conditions, such as the 390-day limit on shipments and when a batch is asynchronous, but rarely when not to use an endpoint (13 of 20). 94 enums and required fields marked. The 400 response schema is an open object, and weights and dimensions are strings (11 of 15). 427 examples in the spec and samples in six languages. The spec documents 400 on 66 operations, 401 and 404 once each and never 429, and the status-code page is one line per code (9 of 15). Dated API versions set by the Shippo-API-Version header and dated release notes (15).

TrackingMore 31

No OpenAPI or similar file was found in the docs, the SDK repositories or a search, and the reference at trackingmore.com/docs renders by script so its schemas were not read (0 of 25). No llms.txt or Markdown docs (0). The official SDK READMEs give one line per call, and the support centre explains when to pair create with get or a webhook and that the create response carries the result (8 of 20). Field names and the required tracking_number and courier_code appear in the SDK examples, with no types, enums or constraints readable (5 of 15). Examples in seven SDK languages and a table of HTTP and meta codes with messages (12 of 15). v4 in the path with v2 and v3 still served, and the support centre says there is no changelog for switching versions. No dated API changelog was found (6 of 15). 0 + 0 + 8 + 5 + 12 + 6 = 31.

Shippo 40

No x402, MPP or L402 (0). Per-unit prices are public without a login. API Starter is 7 cents a label after 30 free a month, 1 cent a rate request, 2 cents a tracking request, 2 cents a US address validation and 8 cents elsewhere, plus the postage itself (20). Signup is free, and test keys create test labels and mock tracking at no charge. The docs say billing details are needed only for live label purchase. We didn't open an account to confirm (20). A person signs up in a browser and creates the key in the portal, or signs in through OAuth for the MCP server (0).

TrackingMore 23

Read with the hosted rubric. No x402, MPP or L402 (0). The API page gives a from price of $0.03 a tracked order and three unlabelled figures, and the pricing page's plan prices render by script, so per-unit pricing is partly public (8 of 20). A Free plan and a 14-day trial are offered, and whether a card is asked for was not established (15 of 20). A person signs up in a browser and generates the key there (0). 0 + 8 + 15 + 0 = 23.

Shippo 42

Self-serve API keys, live and test kept apart, shown once, deletable in the portal, with no scopes and no documented expiry. The OAuth flow for platforms has one scope, "*". JWTs for client-side use last 12 hours (20 of 30). A webhook can carry a self-made token in its URL query string. That is the receiver's secret, not the API credential, so we noted it without the deduction. No read-only key. Test keys can't spend money, and the MCP server separates reads from writes and its docs say writes ask for confirmation (9 of 20). Tracking events, metadata and address text come from carriers and other parties. The AI repository's security policy puts prompt injection in scope for reports, with no guidance in the API docs (5 of 15). The API portal is described as showing usage. No audit log was found in the docs (3 of 15). The AI repository's security policy gives security@goshippo.com and names goshippo.com/security as the disclosure page, which returns 404, as does security.txt. The trust centre at trust.goshippo.com, where the 7 October check read SOC 2 Type II, PCI DSS, a penetration test and a bug bounty, now refuses our crawler, so those readings are set aside and unscored (5 of 20).

TrackingMore 31

One API key in the Tracking-Api-Key header, shown once, at most four per account, deleted in the web app. No scopes or expiry (20 of 30). No read-only key or least-privilege mode, and delete is one call (4 of 20). Tracking checkpoints are carrier text returned to the model, and no guidance was found (3 of 15). A webhook notification log exists in the web app; no log of API calls or key use was found (4 of 15). No security.txt (404), no security page on trackingmore.com, no certification, bug bounty or disclosure policy found. The CWILL privacy policy points to a trust site that was not read (0 of 20). 20 + 4 + 3 + 4 + 0 = 31.

Shippo 64

Scored on the REST API, with the MCP server noted. List calls take results and page, and expand controls nested objects, but there's no field selection and a shipment returns every rate. The MCP server has four tools (list, describe, read-execute, write-execute) over 73 operations, which keeps definitions small (17 of 25). Pagination on every list. Date filters exist only on shipments, within a 90-day range (14 of 20). Status codes are documented in general terms and the error body is untyped. The goshippo/ai repository has an error reference with recovery steps for MCP use (12 of 20). No idempotency key on shipments, transactions or refunds. The Reporting API accepts idempotency_key. The MCP read and write split lets a client approve writes. Its annotations sit behind sign-in and weren't read (8 of 20). Official SDKs for Python, TypeScript, Java, C# and PHP. Shipments and transactions default to asynchronous, and objects can't be edited after creation (13 of 15).

TrackingMore 54

trackings/get filters by tracking numbers, courier and created date range, and batch create takes 40 at once. No field selection was found, and the unread reference may document more (10 of 25). Date and courier filters exist; pagination parameters were not found in what was read (8 of 20). Every response carries an HTTP code and a meta code with a message, such as 4121 for an undetected courier and 4190 for a reached quota (14 of 20). No idempotency key. A repeated create is rejected with 4101, so the write is safe to retry, and delete and retrack take ids (10 of 20). Create needs only tracking_number and courier_code, detect is free, and official SDKs cover seven languages (12 of 15). 10 + 8 + 14 + 10 + 12 = 54.