Adobe Commerce (Magento) vs doola MCP

Adobe Commerce (Magento) 82

Swagger 2.0 YAML files in the public docs repository for the cloud service (525 operations, version November 2026, updated 29 October) and for the admin, customer and guest APIs of 2.4.6 to 2.4.9, plus GraphQL introspection JSON for each (25). Every page on developer.adobe.com is also served as Markdown at the same path with .md. No llms.txt there, and Experience League has one for the operations and admin guides (10). All 525 cloud service operations carry a description, with a median length of 40 characters and 141 under 30, and 239 of 246 GraphQL queries and mutations have one, per the 8 October check. None says when not to use a call (11). Definitions are typed and GraphQL uses enums, while searchCriteria parameters are plain strings and custom_attributes and extension_attributes are open (10). Tutorials with full requests and responses, a status code table, and 400 (220 operations), 401 (525) and 500 (159) responses in the spec, with no list of error codes (11). A schema per release, cloud service release notes for each release and release notes for each 2.4 version (15). 25 + 10 + 11 + 10 + 11 + 15 = 82.

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Adobe Commerce (Magento) 87

Magento Open Source is OSL 3.0. Adobe Commerce is proprietary under Adobe's General Terms (2025v1, 3 October 2025) and a product-specific document for each deployment, all public (22). The privacy policy of 24 October 2025 says Adobe is the processor for enterprise products and that the policy doesn't cover data its customers collect. The cloud service terms keep customer data for the licence term and allow 30 days to export after it ends. A data processing addendum is published, which we didn't read (22). The lifecycle policy gives three years of standard support and end dates for every release from 2.4.4 to 2.4.9, and says Cloud environments on unsupported versions lose traffic from 1 June 2027. No notice period for API changes on the cloud service was found (18). The sub-processor list, updated 28 September 2026, names seven for Adobe Commerce with countries or regions, among them Microsoft, Platform.sh, Fastly and New Relic (18). 22 + 22 + 18 + 18 = 80. The privacy, terms and sub-processor pages on www.adobe.com are per the 8 October check (not re-read on 2 November).

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Adobe Commerce (Magento) 67

?fields= trims any REST response and GraphQL returns only the fields asked for. The surface is large, at 525 REST operations and 246 GraphQL queries and mutations on the cloud service (23). searchCriteria gives filters with comparison operators such as eq, in and like, sort orders, pageSize and currentPage, and GraphQL lists page the same way (20). REST errors are an HTTP code and a message with parameters. GraphQL answers 200 for business errors with a message and a category, and no stable list of codes was found (12). No idempotency keys found. Asynchronous and bulk endpoints return a bulk UUID whose status can be read back, and PUT by SKU updates in place (6). List calls need the long searchCriteria syntax, 2.4 stores need OAuth 1.0a signing, and the only official client library is @adobe/aio-commerce-sdk for JavaScript (6). 23 + 20 + 12 + 6 + 6 = 67.

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Adobe Commerce (Magento) 55

Graded with the hosted lines, because Adobe runs the cloud service and Adobe Commerce on Cloud. status.adobe.com lists Adobe Commerce with its components and regions, per the 8 October check (20). The page is drawn by script from Adobe's status data endpoint on data.status.adobe.com, a site's internal data endpoint that we don't call, and links no feed. The 8 October reading taken from that endpoint (eight Commerce events in September, three marked major) is struck, and the 90 days from 4 August couldn't be read on 2 November, so the window isn't credited (5 of 30, no readable history). Input limits are published with numbers (20 items in a list input, 5,000 for asynchronous calls, 300 a page, GraphQL complexity 300 and depth 20), and payment rate limiting from 2.4.7 is configurable per guest and customer, but no request rate limit for the APIs was found (5). The payment rate-limiting page documents a 429 on REST, and the server-to-server sample retries on 429 after retry-after, with no written backoff guidance and no idempotency keys found (5). The Unified SLA's Actionability Addendum of 23 July 2026 covers Adobe Commerce, per the 8 October check. We didn't read the percentage (10). Generally available (10). 20 + 5 + 5 + 5 + 10 + 10 = 55.

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Adobe Commerce (Magento) 60

The cloud service takes OAuth 2 tokens from Adobe IMS, by client credentials with the commerce.accs scope or by a user flow tied to an Admin role. A 2.4 store issues integrations whose requests are signed by OAuth 1.0a, admin tokens that last 4 hours and customer tokens that last 1 hour, and bare integration tokens as bearer tokens are off by default. No secret in a URL was found. Scopes stop at the product level, so finer limits come from roles (26). Each integration or admin role is limited to chosen ACL resources. No read-only switch or confirmation step for writes was found (12). The APIs return shopper-written text such as names, order comments and reviews, and no prompt-injection guidance was found (0). Action Logs record admin users' changes with user, IP address and date on Adobe Commerce, not on Magento Open Source. Whether integration calls are logged wasn't established (8). security.txt is valid to 30 July 2027 and names a public Intigriti programme and PSIRT, per the 8 October check. Security fixes are published as numbered bulletins with CVE records from Adobe's PSIRT, six between March and September 2026, with hotfix and isolated-patch articles on Experience League. The compliance list didn't show its Commerce rows to our reader (14). 26 + 12 + 0 + 8 + 14 = 60.

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Adobe Commerce (Magento) 30

No x402, MPP or L402 in the API docs or the schemas (0). business.adobe.com timed out on 8 October and again on 2 November 2026 (its robots.txt didn't answer), so the pricing page is unread and scored as absent. The cloud service licensing terms define an account as one opened under a sales order (0). Magento Open Source, the core with the same REST and GraphQL framework, is free under OSL 3.0 with no card (20). Its Composer install needs authentication keys from a Commerce Marketplace account, which a person creates. The public Git repository can be cloned with no account and the install guide points contributors to it, so half the points (10). 0 + 0 + 20 + 10 = 30.

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.