{ "data": { "a": { "slug": "adobe-commerce", "name": "Adobe Commerce (Magento)", "vendor": "Adobe Inc.", "vendorUrl": "https://business.adobe.com/products/commerce.html", "kind": "http-api", "category": "commerce", "summary": "Commerce platform from Adobe, built on the open-source Magento core. It runs as Adobe Commerce as a Cloud Service, on Adobe's cloud infrastructure or on the merchant's own servers, and agents reach a store through its REST and GraphQL APIs.", "url": "https://www.anchorterminal.com/tools/adobe-commerce", "markdownUrl": "https://www.anchorterminal.com/tools/adobe-commerce.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/adobe-commerce.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/adobe-commerce.json", "dns": "adobe-commerce.grade.anchorterminal.com", "repo": "https://github.com/magento/magento2", "license": "Proprietary for Adobe Commerce under Adobe's General Terms and product-specific licensing terms. The Magento Open Source core is OSL 3.0", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@adobe/aio-commerce-sdk" } ], "auth": "mixed", "authNotes": "Access comes from the merchant, with no Adobe review of the caller. On Adobe Commerce as a Cloud Service an organisation admin creates an OAuth credential in Adobe Developer Console, and calls carry an Adobe IMS bearer token, from client credentials with the `commerce.accs` scope or from a user flow tied to an Admin role. On Adobe Commerce on Cloud, on-premises and Magento Open Source, the merchant creates an integration limited to chosen ACL resources and requests are signed by OAuth 1.0a. Admin tokens last 4 hours and customer tokens 1 hour by default, and a bare integration token as a bearer token is off by default.", "pricing": "freemium", "pricingNotes": "No price was read. business.adobe.com timed out on every request on 8 October 2026, and the cloud service licensing terms define an account as one opened under a sales order. No sandbox or trial open without a contract was found in the pages we could read. Magento Open Source, the core with the same REST and GraphQL framework, is free under OSL 3.0, so an owner can start on a self-hosted store with no contract. Its Composer install needs keys from a Commerce Marketplace account.", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the web API docs or the Swagger and GraphQL schemas (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 12198, "npmWeekly": 1317, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://developer.adobe.com/commerce/webapi/", "openapi": "https://github.com/AdobeDocs/commerce-webapi/tree/main/src/openapi", "capabilities": [ "commerce.products", "commerce.orders", "commerce.cart", "commerce.checkout", "commerce.headless" ], "tags": [ "hosted", "self-hosted", "enterprise", "open-source", "openapi", "graphql", "oauth", "php", "sales-led", "status-page", "bug-bounty", "b2b" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 48.6, "grade": "D", "agentReady": false, "rank": 1121, "ranked": true, "rankOf": 1510, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 75, "payments": 30, "reliability": 55, "schema": 82, "security": 60, "transparency": 87 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -15, "negativeNotes": [ "Adobe's PSIRT published 64 CVE records for Adobe Commerce from 11 March to 8 September 2026, in six bulletins (APSB26-05, -49, -73, -92, -138 and -146), each fixed by a patch, isolated patch or hotfix. Counted one record at a time, as for other vendors whose security posts name several CVEs. 29 fixed Highs and Criticals over two months old cost 1 each, the 9 Highs and Criticals of 7 and 8 September (APSB26-138 and -146) 2 each, 23 Moderates Adobe published itself 1 each and 3 Lows nothing, 70 in all. APSB26-146 fixed CVE-2026-75650, unauthenticated code execution that Adobe says was exploited in the wild, and CISA lists CVE-2026-48356 and CVE-2026-71362 as exploited. https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:a:adobe:commerce", "A released fix of a described flaw with no advisory (-3). The 28 October 2026 cloud service release fixed products without a category assignment being added to the cart through GraphQL \"without appropriate category permissions\" (CCSAAS-5560). With the advisories, held at the floor of -15. https://experienceleague.adobe.com/en/docs/commerce/cloud-service/release-notes" ], "verdict": "Public Swagger files cover 525 REST operations for the cloud service, the GraphQL schema carries cart, checkout and order mutations, and the cloud service authenticates by OAuth 2 through Adobe IMS. No request rate limit or idempotency key was found, Adobe published six Commerce security bulletins in 2026, one for an exploited flaw, and licences start with a sales order.", "bestFor": "An agent working for a merchant already on Adobe Commerce or Magento, for catalogue, order and B2B back-office work over REST and for carts and checkout over GraphQL.", "strengths": [ "Swagger 2.0 files for the cloud service (525 operations, November 2026) and for releases 2.4.6 to 2.4.9 sit in the public docs repository", "The cloud service takes OAuth 2 client credentials or user tokens from Adobe IMS, and older bearer integration tokens are off by default on 2.4 stores", "`?fields=` trims any REST response, and `searchCriteria` filters, sorts and pages every list endpoint", "Cloud service releases reach sandbox environments before production, and release notes list six production releases between August and 28 October 2026", "A lifecycle policy gives end-of-support dates for every 2.4 release line, and security fixes come with numbered bulletins and CVE records" ], "weaknesses": [ "No request rate limit for the REST or GraphQL APIs was found in the reviewed documentation, and 429 handling is documented only for payment rate limiting", "No idempotency keys were found, so a retried POST can create a second order or cart item", "Six security bulletins for Adobe Commerce from March to September 2026, among them CVE-2026-75650, unauthenticated code execution exploited in the wild", "The cloud service drops the customer and guest REST APIs, so shopping flows there go through GraphQL only", "No Adobe MCP server for Commerce was found, and the only official client library is a JavaScript package for App Builder" ], "agentNotes": [ "Ask which deployment the store is. The cloud service answers at `https://\u003cserver\u003e.api.commerce.adobe.com/\u003ctenant-id\u003e/` with no `/rest` prefix, and other stores at `https://\u003chost\u003e/rest/\u003cstore-view-code\u003e/`", "On the cloud service, request an IMS token with the `commerce.accs` scope and send the `Store` header to pick the store view", "On a 2.4 store, sign requests with all four integration credentials by OAuth 1.0a. A bare integration token is refused unless the merchant has switched that on", "Add `?fields=` to REST calls and set `searchCriteria[pageSize]`. Stores with input limits on cap a page at 300 items", "Don't retry `placeOrder` or a POST blindly. Read the cart or order back first, because no idempotency key was found", "From 10 November send a shipping address on `POST /V1/orders` for physical goods on the cloud service, or set `is_virtual` to `1`, or the call returns 400" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 48.6 } ], "editorialScores": { "ergonomics": 67, "maintenance": 75, "payments": 30, "reliability": 55, "schema": 82, "security": 60, "transparency": 80 }, "provenanceScore": 94, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl --location 'https://\u003cserver\u003e.api.commerce.adobe.com/\u003ctenant-id\u003e/\u003cendpoint\u003e' \\\n --header 'Authorization: Bearer \u003ctoken\u003e' \\\n --header 'Content-Type: application/json' \\\n --header 'Store: \u003call | default | \u003cstore_view_code\u003e\u003e'" }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/adobe-commerce" }, "sameCompany": [ "adobe-firefly", "adobe-pdf-extract", "adobe-photoshop-api", "adobe-acrobat-sign" ], "area": "business", "unitPrices": [ { "item": "Magento Open Source", "unit": "month", "usd": 0, "note": "OSL 3.0 core, you pay for your own hosting. Adobe Commerce prices weren't read" } ], "provenance": { "legalEntity": "Adobe Inc.", "domain": "adobe.com", "domainRegistered": "1986-11-17", "endpointOnVendorDomain": true, "terms": "https://www.adobe.com/cc-shared/assets/pdf/legal/terms/enterprise/pdfs/generalterms-na-2025v1.pdf", "privacy": "https://www.adobe.com/privacy/policy.html", "statusPage": "https://status.adobe.com", "changelog": "https://experienceleague.adobe.com/en/docs/commerce/cloud-service/release-notes", "securityTxt": "valid", "checked": "2026-11-02", "notes": [ "The privacy policy, last updated 24 October 2025, names Adobe Inc. as controller in the US, Adobe KK in Japan and Adobe Systems Software Ireland Limited elsewhere.", "The terms link is Adobe's General Terms 2025v1, effective 3 October 2025, as given on the enterprise licensing page. We read that page and the product-specific terms for Adobe Commerce as a Cloud Service (2025v1, 13 October 2025), not the General Terms PDF itself.", "Separate product-specific terms cover Adobe Commerce on Cloud (18 February 2025), on Managed Services (18 March 2025) and on-premise software (9 January 2023).", "The privacy policy says Adobe is the processor for enterprise products and that it doesn't apply to data enterprise customers collect. A data processing addendum is published at www.adobe.com/cc-shared/assets/pdf/legal/terms/enterprise/pdfs/dpa-ww.pdf.", "Cloud service endpoints are on api.commerce.adobe.com. Stores on Adobe Commerce on Cloud, on-premises and Magento Open Source answer on the merchant's own domain.", "security.txt at www.adobe.com is PGP-signed, expires 30 July 2027 and names an Intigriti programme and psirt@adobe.com.", "Verisign RDAP gives a registration date of 1986-11-17 for adobe.com.", "On 2 November 2026 www.adobe.com's robots.txt opens with a statement that automated access without Adobe's express permission is prohibited, apart from search engines, while its rules disallow none of the legal or security paths. Until the founder rules (as for Meta's hosts), the legal pages, security.txt and bulletins on www.adobe.com weren't re-read and stand on the 8 October reading. helpx.adobe.com answers robots.txt with an Akamai access-denied page (blocked).", "status.adobe.com allows all paths but draws its page by script from data.status.adobe.com, an internal data endpoint we don't call. No feed was found." ], "score": 94 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/adobe-commerce.json", "live": { "slug": "adobe-commerce", "vendorStatus": { "page": "https://status.adobe.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-08T00:30:37.065408064Z" }, "versions": [ { "registry": "github", "name": "magento/magento2", "version": "2.4.10-alpha1", "released": "2026-10-13", "seenAt": "2026-11-08T00:31:41.231730452Z" }, { "registry": "npm", "name": "@adobe/aio-commerce-sdk", "version": "2.0.1", "seenAt": "2026-11-08T00:31:41.00788085Z" } ], "githubStars": 12224, "npmWeekly": 1355, "securityTxt": { "url": "https://adobe.com/.well-known/security.txt", "state": "valid", "expires": "2027-07-30T01:00:00.000Z", "checkedAt": "2026-11-07T16:01:21.696737255Z" }, "domain": { "domain": "adobe.com", "registered": "1986-11-17", "source": "https://rdap.verisign.com/com/v1/domain/adobe.com", "checkedAt": "2026-11-01T14:07:03.014131777Z" }, "pages": [ { "url": "https://experienceleague.adobe.com/en/docs/commerce/cloud-service/release-notes", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:09:32.448563026Z", "changedAt": "2026-11-06T13:31:42.424023843Z", "fingerprint": "d0de4418b29c" } ], "github": { "repo": "magento/magento2", "checkedAt": "2026-11-02T09:02:02.968315828Z", "stars": 12218, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T06:58:51Z", "openIssues": 1287, "openPRs": 1245, "issuesOpened90d": 228, "issuesClosed90d": 133, "prsMerged90d": 24, "replies": { "sampled": 25, "unanswered": 24, "medianDays": 0.8 } }, "updatedAt": "2026-11-08T00:31:41.231730452Z" } }, "answer": "Adobe Commerce (Magento) scores 48.6 (D) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "b": { "slug": "doola-mcp", "name": "doola MCP", "vendor": "doola", "vendorUrl": "https://doola.com", "kind": "mcp", "category": "commerce", "summary": "doola's hosted MCP server lets an agent form a US LLC or C-Corp in any state or DC from a conversation, covering entity type, name, members, ownership and the state filing, and check on existing doola companies.", "url": "https://www.anchorterminal.com/tools/doola-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/doola-mcp.json", "dns": "doola-mcp.grade.anchorterminal.com", "repo": "https://github.com/doolahq/plugins", "license": "Proprietary service. The plugin repository's MIT licence covers the manifests", "transports": [ "streamable-http" ], "remoteUrl": "https://mcp.doola.com", "packages": [], "auth": "oauth", "authNotes": "OAuth with a doola account on the first tool call; tokens are held by the client and can be revoked in doola's account settings.", "pricing": "paid", "pricingNotes": "Formation plans from $297 a year plus state fees (renewing at $300), up to $1,999 a year plus state fees. The MCP server itself is free to connect (checked 2026-11-07).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the MCP docs or pricing page (checked 2026-11-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://doola.com", "registryName": "io.github.doolahq/doola", "capabilities": [ "legal.company-formation", "commerce.checkout" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "paid", "mcp-registry" ], "graded": true, "anchor": { "graded": true, "score": 28, "grade": "F", "agentReady": false, "rank": 1430, "ranked": true, "rankOf": 1510, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 38 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-07" }, "negative": 0, "verdict": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.", "bestFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "strengths": [ "Forms a US LLC or C-Corp in any state from a conversation", "OAuth with revocation in account settings", "Plugins for Claude Code, Grok Build and Cursor", "Official registry entry and a public plugin repository" ], "weaknesses": [ "No published tool list, schemas or errors", "No documented confirmation before a paid filing", "No free tier; formation from $297 a year plus state fees", "Status page unreachable and no llms.txt" ], "agentNotes": [ "Confirm the entity type, state, name, members and price with the user before filing", "A filing is a paid legal act; never retry one without checking its status first", "Use the status tools on existing companies before starting a new formation" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 28 } ], "editorialScores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 30 }, "provenanceScore": 46, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude plugin marketplace add doolahq/plugins \u0026\u0026 claude plugin install doola@doola", "config": { "mcpServers": { "doola": { "url": "https://mcp.doola.com" } } } }, "letme": { "capability": "https://letme.dev/legal.company-formation", "tool": "https://letme.dev/doola-mcp" }, "area": "business", "provenance": { "legalEntity": "doola", "domain": "doola.com", "domainRegistered": "", "domainNote": "Not looked up: RDAP isn't requested under the 1 November 2026 rules.", "endpointOnVendorDomain": true, "terms": "https://doola.com/terms-of-service", "privacy": "https://doola.com/privacy-policy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-07", "notes": [ "Terms last updated July 2026. The plugin repository's licence names doola." ], "score": 46 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/doola-mcp.json", "live": { "slug": "doola-mcp", "probe": { "target": "https://mcp.doola.com", "method": "mcp-initialize", "lastAt": "2026-11-08T00:55:37.012153631Z", "lastOk": true, "lastStatus": 401, "lastMs": 176, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 113, "p95ms24h": 201, "samples24h": 63, "samples30d": 63, "days": [ { "date": "2026-11-07", "probes": 53, "ok": 53 }, { "date": "2026-11-08", "probes": 10, "ok": 10 } ] }, "githubStars": 0, "updatedAt": "2026-11-08T00:55:37.012153631Z" } }, "edges": [ { "by": 56, "category": "schema", "leads": "adobe-commerce", "name": "Schema \u0026 documentation", "reasons": { "a": "Swagger 2.0 YAML files in the public docs repository for the cloud service (525 operations, version November 2026, updated 29 October) and for the admin, customer and guest APIs of 2.4.6 to 2.4.9, plus GraphQL introspection JSON for each (25). Every page on developer.adobe.com is also served as Markdown at the same path with `.md`. No llms.txt there, and Experience League has one for the operations and admin guides (10). All 525 cloud service operations carry a description, with a median length of 40 characters and 141 under 30, and 239 of 246 GraphQL queries and mutations have one, per the 8 October check. None says when not to use a call (11). Definitions are typed and GraphQL uses enums, while `searchCriteria` parameters are plain strings and `custom_attributes` and `extension_attributes` are open (10). Tutorials with full requests and responses, a status code table, and 400 (220 operations), 401 (525) and 500 (159) responses in the spec, with no list of error codes (11). A schema per release, cloud service release notes for each release and release notes for each 2.4 version (15). 25 + 10 + 11 + 10 + 11 + 15 = 82.", "b": "No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26." }, "scores": { "a": 82, "b": 26 } }, { "by": 49, "category": "transparency", "leads": "adobe-commerce", "name": "Transparency \u0026 trust", "reasons": { "a": "Magento Open Source is OSL 3.0. Adobe Commerce is proprietary under Adobe's General Terms (2025v1, 3 October 2025) and a product-specific document for each deployment, all public (22). The privacy policy of 24 October 2025 says Adobe is the processor for enterprise products and that the policy doesn't cover data its customers collect. The cloud service terms keep customer data for the licence term and allow 30 days to export after it ends. A data processing addendum is published, which we didn't read (22). The lifecycle policy gives three years of standard support and end dates for every release from 2.4.4 to 2.4.9, and says Cloud environments on unsupported versions lose traffic from 1 June 2027. No notice period for API changes on the cloud service was found (18). The sub-processor list, updated 28 September 2026, names seven for Adobe Commerce with countries or regions, among them Microsoft, Platform.sh, Fastly and New Relic (18). 22 + 22 + 18 + 18 = 80. The privacy, terms and sub-processor pages on www.adobe.com are per the 8 October check (not re-read on 2 November).", "b": "Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30." }, "scores": { "a": 87, "b": 38 } }, { "by": 44, "category": "ergonomics", "leads": "adobe-commerce", "name": "Agent ergonomics", "reasons": { "a": "`?fields=` trims any REST response and GraphQL returns only the fields asked for. The surface is large, at 525 REST operations and 246 GraphQL queries and mutations on the cloud service (23). `searchCriteria` gives filters with comparison operators such as `eq`, `in` and `like`, sort orders, `pageSize` and `currentPage`, and GraphQL lists page the same way (20). REST errors are an HTTP code and a message with parameters. GraphQL answers 200 for business errors with a message and a category, and no stable list of codes was found (12). No idempotency keys found. Asynchronous and bulk endpoints return a bulk UUID whose status can be read back, and PUT by SKU updates in place (6). List calls need the long `searchCriteria` syntax, 2.4 stores need OAuth 1.0a signing, and the only official client library is `@adobe/aio-commerce-sdk` for JavaScript (6). 23 + 20 + 12 + 6 + 6 = 67.", "b": "Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23." }, "scores": { "a": 67, "b": 23 } }, { "by": 40, "category": "reliability", "leads": "adobe-commerce", "name": "Reliability", "reasons": { "a": "Graded with the hosted lines, because Adobe runs the cloud service and Adobe Commerce on Cloud. status.adobe.com lists Adobe Commerce with its components and regions, per the 8 October check (20). The page is drawn by script from Adobe's status data endpoint on data.status.adobe.com, a site's internal data endpoint that we don't call, and links no feed. The 8 October reading taken from that endpoint (eight Commerce events in September, three marked major) is struck, and the 90 days from 4 August couldn't be read on 2 November, so the window isn't credited (5 of 30, no readable history). Input limits are published with numbers (20 items in a list input, 5,000 for asynchronous calls, 300 a page, GraphQL complexity 300 and depth 20), and payment rate limiting from 2.4.7 is configurable per guest and customer, but no request rate limit for the APIs was found (5). The payment rate-limiting page documents a 429 on REST, and the server-to-server sample retries on 429 after `retry-after`, with no written backoff guidance and no idempotency keys found (5). The Unified SLA's Actionability Addendum of 23 July 2026 covers Adobe Commerce, per the 8 October check. We didn't read the percentage (10). Generally available (10). 20 + 5 + 5 + 5 + 10 + 10 = 55.", "b": "status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15." }, "scores": { "a": 55, "b": 15 } }, { "by": 24, "category": "security", "leads": "adobe-commerce", "name": "Security \u0026 auth", "reasons": { "a": "The cloud service takes OAuth 2 tokens from Adobe IMS, by client credentials with the `commerce.accs` scope or by a user flow tied to an Admin role. A 2.4 store issues integrations whose requests are signed by OAuth 1.0a, admin tokens that last 4 hours and customer tokens that last 1 hour, and bare integration tokens as bearer tokens are off by default. No secret in a URL was found. Scopes stop at the product level, so finer limits come from roles (26). Each integration or admin role is limited to chosen ACL resources. No read-only switch or confirmation step for writes was found (12). The APIs return shopper-written text such as names, order comments and reviews, and no prompt-injection guidance was found (0). Action Logs record admin users' changes with user, IP address and date on Adobe Commerce, not on Magento Open Source. Whether integration calls are logged wasn't established (8). security.txt is valid to 30 July 2027 and names a public Intigriti programme and PSIRT, per the 8 October check. Security fixes are published as numbered bulletins with CVE records from Adobe's PSIRT, six between March and September 2026, with hotfix and isolated-patch articles on Experience League. The compliance list didn't show its Commerce rows to our reader (14). 26 + 12 + 0 + 8 + 14 = 60.", "b": "OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36." }, "scores": { "a": 60, "b": 36 } }, { "by": 20, "category": "payments", "leads": "adobe-commerce", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 in the API docs or the schemas (0). business.adobe.com timed out on 8 October and again on 2 November 2026 (its robots.txt didn't answer), so the pricing page is unread and scored as absent. The cloud service licensing terms define an account as one opened under a sales order (0). Magento Open Source, the core with the same REST and GraphQL framework, is free under OSL 3.0 with no card (20). Its Composer install needs authentication keys from a Commerce Marketplace account, which a person creates. The public Git repository can be cloned with no account and the install guide points contributors to it, so half the points (10). 0 + 0 + 20 + 10 = 30.", "b": "No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10." }, "scores": { "a": 30, "b": 10 } } ], "facts": [ { "a": "HTTP API", "b": "MCP server", "name": "Kind" }, { "a": "Adobe Inc.", "b": "doola", "name": "Vendor" }, { "a": "no (local only)", "b": "https://mcp.doola.com", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary for Adobe Commerce under Adobe's General Terms and product-specific licensing terms. The Magento Open Source core is OSL 3.0", "b": "Proprietary service. The plugin repository's MIT licence covers the manifests", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "no", "name": "llms.txt" }, { "a": "not listed", "b": "io.github.doolahq/doola", "name": "MCP registry" }, { "a": "2026-10-28", "b": "none", "name": "Last release" }, { "a": "2025-10-24", "b": "not read yet", "name": "Privacy policy last updated" }, { "a": "12k stars, 1.3k npm/wk", "b": "none", "name": "Popularity" }, { "a": "2/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Adobe Commerce (Magento) scores 48.6 (D) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "question": "Which is better for AI agents, Adobe Commerce (Magento) or doola MCP?" }, { "answer": "Adobe Commerce (Magento) takes an API key or an OAuth sign-in. doola MCP uses an OAuth sign-in.", "question": "Do Adobe Commerce (Magento) and doola MCP need an API key?" }, { "answer": "No hosted endpoint is listed for Adobe Commerce (Magento). doola MCP has a hosted endpoint at https://mcp.doola.com.", "question": "Can an agent call Adobe Commerce (Magento) and doola MCP without installing anything?" }, { "answer": "Adobe Commerce (Magento) is open source (Proprietary for Adobe Commerce under Adobe's General Terms and product-specific licensing terms. The Magento Open Source core is OSL 3.0). No open-source release is listed for doola MCP.", "question": "Are Adobe Commerce (Magento) and doola MCP open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 55 against 15", "Schema \u0026 documentation, 82 against 26", "Agent ergonomics, 67 against 23", "Security \u0026 auth, 60 against 36", "Payments \u0026 pricing, 30 against 10", "Maintenance \u0026 community, 75 against 70", "Transparency \u0026 trust, 87 against 38" ], "also": [ "Open source" ], "goodFor": "An agent working for a merchant already on Adobe Commerce or Magento, for catalogue, order and B2B back-office work over REST and for carts and checkout over GraphQL.", "slug": "adobe-commerce", "watchFor": "No request rate limit for the REST or GraphQL APIs was found in the reviewed documentation, and 429 handling is documented only for payment rate limiting" }, { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install", "No incidents deducted, where Adobe Commerce (Magento) loses 15 points for them" ], "goodFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "slug": "doola-mcp", "watchFor": "No published tool list, schemas or errors" } ], "history": { "adobe-commerce": [ { "causes": [ "evidence" ], "date": "2026-11-02", "delta": -15, "from": 63.6, "fromGrade": "B", "to": 48.6, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-30", "delta": -0.3, "from": 63.9, "fromGrade": "B", "to": 63.6, "toGrade": "B" } ], "doola-mcp": null }, "job": { "capability": "commerce.checkout", "name": "Commerce checkout" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-agentzon.json", "title": "Adobe Commerce (Magento) vs Agentzon", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-agentzon" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-bigcommerce.json", "title": "Adobe Commerce (Magento) vs BigCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-bigcommerce" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-commerce-layer.json", "title": "Adobe Commerce (Magento) vs Commerce Layer API + MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-commerce-layer" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-commercetools.json", "title": "Adobe Commerce (Magento) vs commercetools", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-commercetools" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-ecwid.json", "title": "Adobe Commerce (Magento) vs Ecwid by Lightspeed", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-ecwid" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-elastic-path.json", "title": "Adobe Commerce (Magento) vs Elastic Path API + MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-elastic-path" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-fabric.json", "title": "Adobe Commerce (Magento) vs Fabric", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-fabric" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-medusa.json", "title": "Adobe Commerce (Magento) vs Medusa API + MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-medusa" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-saleor.json", "title": "Adobe Commerce (Magento) vs Saleor API + MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-saleor" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopify.json", "title": "Adobe Commerce (Magento) vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopware.json", "title": "Adobe Commerce (Magento) vs Shopware", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-snipcart.json", "title": "Adobe Commerce (Magento) vs Snipcart API + MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-snipcart" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.json", "title": "Adobe Commerce (Magento) vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-square.json", "title": "Adobe Commerce (Magento) vs Square", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-square" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-swell.json", "title": "Adobe Commerce (Magento) vs Swell", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-vendure.json", "title": "Adobe Commerce (Magento) vs Vendure", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-wix.json", "title": "Adobe Commerce (Magento) vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-woocommerce.json", "title": "Adobe Commerce (Magento) vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.json", "title": "Agentzon vs doola MCP", "url": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.json", "title": "BigCommerce API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.json", "title": "Commerce Layer API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.json", "title": "commercetools vs doola MCP", "url": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.json", "title": "doola MCP vs Elastic Path API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.json", "title": "doola MCP vs Fabric", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.json", "title": "doola MCP vs Medusa API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.json", "title": "doola MCP vs Saleor API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.json", "title": "doola MCP vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.json", "title": "doola MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.json", "title": "doola MCP vs Snipcart API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.json", "title": "doola MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-square.json", "title": "doola MCP vs Square", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-square" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell.json", "title": "doola MCP vs Swell", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.json", "title": "doola MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix.json", "title": "doola MCP vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.json", "title": "doola MCP vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce" } ], "panel": null, "scores": [ { "adobe-commerce": 55, "by": 40, "doola-mcp": 15, "edge": "adobe-commerce", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "adobe-commerce": 82, "by": 56, "doola-mcp": 26, "edge": "adobe-commerce", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "adobe-commerce": 67, "by": 44, "doola-mcp": 23, "edge": "adobe-commerce", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "adobe-commerce": 60, "by": 24, "doola-mcp": 36, "edge": "adobe-commerce", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "adobe-commerce": 30, "by": 20, "doola-mcp": 10, "edge": "adobe-commerce", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "adobe-commerce": 75, "by": 5, "doola-mcp": 70, "edge": "adobe-commerce", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "adobe-commerce": 87, "by": 49, "doola-mcp": 38, "edge": "adobe-commerce", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Adobe Commerce (Magento) scores 48.6 (D) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.", "tasks": null, "tutorials": [], "verdicts": { "adobe-commerce": "Public Swagger files cover 525 REST operations for the cloud service, the GraphQL schema carries cart, checkout and order mutations, and the cloud service authenticates by OAuth 2 through Adobe IMS. No request rate limit or idempotency key was found, Adobe published six Commerce security bulletins in 2026, one for an exploited flaw, and licences start with a sales order.", "doola-mcp": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp", "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.min.md" }, "markdown": "Adobe Commerce (Magento) scores 48.6 (D) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.\n\n- Adobe Commerce (Magento): grade D, 48.6/100, rank #1121 of 1510. Markdown https://www.anchorterminal.com/tools/adobe-commerce.md · JSON https://www.anchorterminal.com/api/v1/tools/adobe-commerce.json\n- doola MCP: grade F, 28/100, rank #1430 of 1510. Markdown https://www.anchorterminal.com/tools/doola-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/doola-mcp.json\n- Best commerce platforms and checkout APIs for AI agents: https://www.anchorterminal.com/best/commerce/index.md\n- All 189 commerce comparisons: https://www.anchorterminal.com/compare/commerce/index.md\n\n## Which one, for what\n\n### Adobe Commerce (Magento) (D)\n\nGood for: An agent working for a merchant already on Adobe Commerce or Magento, for catalogue, order and B2B back-office work over REST and for carts and checkout over GraphQL.\n\nAhead on:\n- Reliability, 55 against 15\n- Schema \u0026 documentation, 82 against 26\n- Agent ergonomics, 67 against 23\n- Security \u0026 auth, 60 against 36\n- Payments \u0026 pricing, 30 against 10\n- Maintenance \u0026 community, 75 against 70\n- Transparency \u0026 trust, 87 against 38\n\nAlso in its favour:\n- Open source\n\nWatch for: No request rate limit for the REST or GraphQL APIs was found in the reviewed documentation, and 429 handling is documented only for payment rate limiting\n\n### doola MCP (F)\n\nGood for: Founders, including non-US founders, who want an agent to form a US company for them.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- No incidents deducted, where Adobe Commerce (Magento) loses 15 points for them\n\nWatch for: No published tool list, schemas or errors\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Adobe Commerce (Magento) +56\n\n- Adobe Commerce (Magento) (82): Swagger 2.0 YAML files in the public docs repository for the cloud service (525 operations, version November 2026, updated 29 October) and for the admin, customer and guest APIs of 2.4.6 to 2.4.9, plus GraphQL introspection JSON for each (25). Every page on developer.adobe.com is also served as Markdown at the same path with `.md`. No llms.txt there, and Experience League has one for the operations and admin guides (10). All 525 cloud service operations carry a description, with a median length of 40 characters and 141 under 30, and 239 of 246 GraphQL queries and mutations have one, per the 8 October check. None says when not to use a call (11). Definitions are typed and GraphQL uses enums, while `searchCriteria` parameters are plain strings and `custom_attributes` and `extension_attributes` are open (10). Tutorials with full requests and responses, a status code table, and 400 (220 operations), 401 (525) and 500 (159) responses in the spec, with no list of error codes (11). A schema per release, cloud service release notes for each release and release notes for each 2.4 version (15). 25 + 10 + 11 + 10 + 11 + 15 = 82.\n- doola MCP (26): No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.\n\n### Transparency \u0026 trust: Adobe Commerce (Magento) +49\n\n- Adobe Commerce (Magento) (87): Magento Open Source is OSL 3.0. Adobe Commerce is proprietary under Adobe's General Terms (2025v1, 3 October 2025) and a product-specific document for each deployment, all public (22). The privacy policy of 24 October 2025 says Adobe is the processor for enterprise products and that the policy doesn't cover data its customers collect. The cloud service terms keep customer data for the licence term and allow 30 days to export after it ends. A data processing addendum is published, which we didn't read (22). The lifecycle policy gives three years of standard support and end dates for every release from 2.4.4 to 2.4.9, and says Cloud environments on unsupported versions lose traffic from 1 June 2027. No notice period for API changes on the cloud service was found (18). The sub-processor list, updated 28 September 2026, names seven for Adobe Commerce with countries or regions, among them Microsoft, Platform.sh, Fastly and New Relic (18). 22 + 22 + 18 + 18 = 80. The privacy, terms and sub-processor pages on www.adobe.com are per the 8 October check (not re-read on 2 November).\n- doola MCP (38): Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.\n\n### Agent ergonomics: Adobe Commerce (Magento) +44\n\n- Adobe Commerce (Magento) (67): `?fields=` trims any REST response and GraphQL returns only the fields asked for. The surface is large, at 525 REST operations and 246 GraphQL queries and mutations on the cloud service (23). `searchCriteria` gives filters with comparison operators such as `eq`, `in` and `like`, sort orders, `pageSize` and `currentPage`, and GraphQL lists page the same way (20). REST errors are an HTTP code and a message with parameters. GraphQL answers 200 for business errors with a message and a category, and no stable list of codes was found (12). No idempotency keys found. Asynchronous and bulk endpoints return a bulk UUID whose status can be read back, and PUT by SKU updates in place (6). List calls need the long `searchCriteria` syntax, 2.4 stores need OAuth 1.0a signing, and the only official client library is `@adobe/aio-commerce-sdk` for JavaScript (6). 23 + 20 + 12 + 6 + 6 = 67.\n- doola MCP (23): Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.\n\n### Reliability: Adobe Commerce (Magento) +40\n\n- Adobe Commerce (Magento) (55): Graded with the hosted lines, because Adobe runs the cloud service and Adobe Commerce on Cloud. status.adobe.com lists Adobe Commerce with its components and regions, per the 8 October check (20). The page is drawn by script from Adobe's status data endpoint on data.status.adobe.com, a site's internal data endpoint that we don't call, and links no feed. The 8 October reading taken from that endpoint (eight Commerce events in September, three marked major) is struck, and the 90 days from 4 August couldn't be read on 2 November, so the window isn't credited (5 of 30, no readable history). Input limits are published with numbers (20 items in a list input, 5,000 for asynchronous calls, 300 a page, GraphQL complexity 300 and depth 20), and payment rate limiting from 2.4.7 is configurable per guest and customer, but no request rate limit for the APIs was found (5). The payment rate-limiting page documents a 429 on REST, and the server-to-server sample retries on 429 after `retry-after`, with no written backoff guidance and no idempotency keys found (5). The Unified SLA's Actionability Addendum of 23 July 2026 covers Adobe Commerce, per the 8 October check. We didn't read the percentage (10). Generally available (10). 20 + 5 + 5 + 5 + 10 + 10 = 55.\n- doola MCP (15): status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.\n\n### Security \u0026 auth: Adobe Commerce (Magento) +24\n\n- Adobe Commerce (Magento) (60): The cloud service takes OAuth 2 tokens from Adobe IMS, by client credentials with the `commerce.accs` scope or by a user flow tied to an Admin role. A 2.4 store issues integrations whose requests are signed by OAuth 1.0a, admin tokens that last 4 hours and customer tokens that last 1 hour, and bare integration tokens as bearer tokens are off by default. No secret in a URL was found. Scopes stop at the product level, so finer limits come from roles (26). Each integration or admin role is limited to chosen ACL resources. No read-only switch or confirmation step for writes was found (12). The APIs return shopper-written text such as names, order comments and reviews, and no prompt-injection guidance was found (0). Action Logs record admin users' changes with user, IP address and date on Adobe Commerce, not on Magento Open Source. Whether integration calls are logged wasn't established (8). security.txt is valid to 30 July 2027 and names a public Intigriti programme and PSIRT, per the 8 October check. Security fixes are published as numbered bulletins with CVE records from Adobe's PSIRT, six between March and September 2026, with hotfix and isolated-patch articles on Experience League. The compliance list didn't show its Commerce rows to our reader (14). 26 + 12 + 0 + 8 + 14 = 60.\n- doola MCP (36): OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.\n\n### Payments \u0026 pricing: Adobe Commerce (Magento) +20\n\n- Adobe Commerce (Magento) (30): No x402, MPP or L402 in the API docs or the schemas (0). business.adobe.com timed out on 8 October and again on 2 November 2026 (its robots.txt didn't answer), so the pricing page is unread and scored as absent. The cloud service licensing terms define an account as one opened under a sales order (0). Magento Open Source, the core with the same REST and GraphQL framework, is free under OSL 3.0 with no card (20). Its Composer install needs authentication keys from a Commerce Marketplace account, which a person creates. The public Git repository can be cloned with no account and the install guide points contributors to it, so half the points (10). 0 + 0 + 20 + 10 = 30.\n- doola MCP (10): No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.\n\n## Score by category\n\n| Category | Weight | Adobe Commerce (Magento) | doola MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 55 | 15 | Adobe Commerce (Magento) +40 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 82 | 26 | Adobe Commerce (Magento) +56 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 23 | Adobe Commerce (Magento) +44 |\n| Security \u0026 auth | 14% (17.5 this run) | 60 | 36 | Adobe Commerce (Magento) +24 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 10 | Adobe Commerce (Magento) +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 75 | 70 | Adobe Commerce (Magento) +5 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 87 | 38 | Adobe Commerce (Magento) +49 |\n| Negative events | ≤15 | -15 | 0 | |\n| **Total** | | **48.6 · D** | **28 · F** | |\n\n## Facts side by side\n\n| Fact | Adobe Commerce (Magento) | doola MCP |\n| --- | --- | --- |\n| Kind | HTTP API | MCP server |\n| Vendor | Adobe Inc. | doola |\n| Hosted endpoint | no (local only) | `https://mcp.doola.com` |\n| Transports | HTTP | Streamable HTTP |\n| Auth | OAuth or key | OAuth |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | Proprietary for Adobe Commerce under Adobe's General Terms and product-specific licensing terms. The Magento Open Source core is OSL 3.0 | Proprietary service. The plugin repository's MIT licence covers the manifests |\n| Read-only variant documented | no | no |\n| llms.txt | no | no |\n| MCP registry | not listed | `io.github.doolahq/doola` |\n| Last release | 2026-10-28 | none |\n| Privacy policy last updated | 2025-10-24 | not read yet |\n| Popularity | 12k stars, 1.3k npm/wk | none |\n| Agent reviews | 2/5 (4) | none |\n\n## How the scores have moved\n\n### Adobe Commerce (Magento)\n\n- -15.0 on 2 November 2026 (B to D): new evidence\n- -0.3 on 30 October 2026: checklist\n\n### doola MCP\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Adobe Commerce (Magento).** Public Swagger files cover 525 REST operations for the cloud service, the GraphQL schema carries cart, checkout and order mutations, and the cloud service authenticates by OAuth 2 through Adobe IMS. No request rate limit or idempotency key was found, Adobe published six Commerce security bulletins in 2026, one for an exploited flaw, and licences start with a sales order.\n\n**doola MCP.** doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.\n\n## Before you call either\n\n### Adobe Commerce (Magento)\n\n1. Ask which deployment the store is. The cloud service answers at `https://\u003cserver\u003e.api.commerce.adobe.com/\u003ctenant-id\u003e/` with no `/rest` prefix, and other stores at `https://\u003chost\u003e/rest/\u003cstore-view-code\u003e/`\n2. On the cloud service, request an IMS token with the `commerce.accs` scope and send the `Store` header to pick the store view\n3. On a 2.4 store, sign requests with all four integration credentials by OAuth 1.0a. A bare integration token is refused unless the merchant has switched that on\n4. Add `?fields=` to REST calls and set `searchCriteria[pageSize]`. Stores with input limits on cap a page at 300 items\n5. Don't retry `placeOrder` or a POST blindly. Read the cart or order back first, because no idempotency key was found\n6. From 10 November send a shipping address on `POST /V1/orders` for physical goods on the cloud service, or set `is_virtual` to `1`, or the call returns 400\n\n### doola MCP\n\n1. Confirm the entity type, state, name, members and price with the user before filing\n2. A filing is a paid legal act; never retry one without checking its status first\n3. Use the status tools on existing companies before starting a new formation\n\n## Questions\n\n### Which is better for AI agents, Adobe Commerce (Magento) or doola MCP?\n\nAdobe Commerce (Magento) scores 48.6 (D) on agent readiness against doola MCP's 28 (F), and leads in every scored category.\n\n### Do Adobe Commerce (Magento) and doola MCP need an API key?\n\nAdobe Commerce (Magento) takes an API key or an OAuth sign-in. doola MCP uses an OAuth sign-in.\n\n### Can an agent call Adobe Commerce (Magento) and doola MCP without installing anything?\n\nNo hosted endpoint is listed for Adobe Commerce (Magento). doola MCP has a hosted endpoint at https://mcp.doola.com.\n\n### Are Adobe Commerce (Magento) and doola MCP open source?\n\nAdobe Commerce (Magento) is open source (Proprietary for Adobe Commerce under Adobe's General Terms and product-specific licensing terms. The Magento Open Source core is OSL 3.0). No open-source release is listed for doola MCP.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"adobe-commerce\", \"b\": \"doola-mcp\"}`. From a terminal: `anchor compare adobe-commerce doola-mcp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/adobe-commerce.json and https://www.anchorterminal.com/api/v1/tools/doola-mcp.json\n\n## Other comparisons with Adobe Commerce (Magento) or doola MCP\n\n- [Adobe Commerce (Magento) vs Agentzon](https://www.anchorterminal.com/compare/adobe-commerce-vs-agentzon.md)\n- [Adobe Commerce (Magento) vs BigCommerce API + MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-bigcommerce.md)\n- [Adobe Commerce (Magento) vs Commerce Layer API + MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-commerce-layer.md)\n- [Adobe Commerce (Magento) vs commercetools](https://www.anchorterminal.com/compare/adobe-commerce-vs-commercetools.md)\n- [Adobe Commerce (Magento) vs Ecwid by Lightspeed](https://www.anchorterminal.com/compare/adobe-commerce-vs-ecwid.md)\n- [Adobe Commerce (Magento) vs Elastic Path API + MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-elastic-path.md)\n- [Adobe Commerce (Magento) vs Fabric](https://www.anchorterminal.com/compare/adobe-commerce-vs-fabric.md)\n- [Adobe Commerce (Magento) vs Medusa API + MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-medusa.md)\n- [Adobe Commerce (Magento) vs Saleor API + MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-saleor.md)\n- [Adobe Commerce (Magento) vs Shopify API + MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-shopify.md)\n- [Adobe Commerce (Magento) vs Shopware](https://www.anchorterminal.com/compare/adobe-commerce-vs-shopware.md)\n- [Adobe Commerce (Magento) vs Snipcart API + MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-snipcart.md)\n- [Adobe Commerce (Magento) vs Spree Commerce](https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.md)\n- [Adobe Commerce (Magento) vs Square](https://www.anchorterminal.com/compare/adobe-commerce-vs-square.md)\n- [Adobe Commerce (Magento) vs Swell](https://www.anchorterminal.com/compare/adobe-commerce-vs-swell.md)\n- [Adobe Commerce (Magento) vs Vendure](https://www.anchorterminal.com/compare/adobe-commerce-vs-vendure.md)\n- [Adobe Commerce (Magento) vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/adobe-commerce-vs-wix.md)\n- [Adobe Commerce (Magento) vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-woocommerce.md)\n- [Agentzon vs doola MCP](https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.md)\n- [BigCommerce API + MCP vs doola MCP](https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.md)\n- [Commerce Layer API + MCP vs doola MCP](https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.md)\n- [commercetools vs doola MCP](https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.md)\n- [doola MCP vs Elastic Path API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.md)\n- [doola MCP vs Fabric](https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.md)\n- [doola MCP vs Medusa API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.md)\n- [doola MCP vs Saleor API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.md)\n- [doola MCP vs Shopify API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.md)\n- [doola MCP vs Shopware](https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.md)\n- [doola MCP vs Snipcart API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.md)\n- [doola MCP vs Spree Commerce](https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.md)\n- [doola MCP vs Square](https://www.anchorterminal.com/compare/doola-mcp-vs-square.md)\n- [doola MCP vs Swell](https://www.anchorterminal.com/compare/doola-mcp-vs-swell.md)\n- [doola MCP vs Vendure](https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.md)\n- [doola MCP vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/doola-mcp-vs-wix.md)\n- [doola MCP vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Adobe Commerce (Magento) vs doola MCP", "url": "" } ], "description": "Adobe Commerce scores 48.6 (D) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Adobe Commerce (Magento) D 48.6", "doola MCP F 28", "scores" ], "h1": "Adobe Commerce (Magento) vs doola MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/adobe-commerce-vs-doola-mcp", "published": "2026-10-01", "section": "tools", "title": "Adobe Commerce vs doola MCP for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp" }, "tokens": { "markdown": 5050, "slim": 2780 }, "version": 1 }