Agentzon vs doola MCP

Agentzon 5

No dated API release, changelog or version history was found. The policy pages carry an effective date of 8 October 2026, but those are changes to terms, not to the API. Between 10 October and 4 November the catalogue grew from 500 to 1,045 items and search results gained pack sizes and a reference price, with no dated entry, so the time-since-change line scores 0 (0 of 30). No dated changelog entries in the last 90 days (0 of 20). Responsiveness. A support address is published, agentzon-support@merit.systems, but replies were not tested. No changelog (5 of 15 for a closed service). No MCP registry presence was read in this run (0 of 15). No public repository, CI or SDK package was found (0 of 10). 0 + 0 + 5 + 0 + 0 = 5.

doola MCP 70

Plugin repository commit and registry update on 3 November and 28 October 2026 (30). Several dated merges in 90 days (20 of 20). Repository issues not read (0). Official registry entry io.github.doolahq/doola (15). Plugin manifests published by a registry workflow (5 of 10). 30 + 20 + 0 + 15 + 5 = 70. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Agentzon 83

OpenAPI 3.1.0 at /openapi.json, valid JSON, with request and response schemas for every route (25 of 25). llms.txt at /llms.txt and agents.md in Markdown, both linked from the home page (10 of 10). The descriptions say when not to act. Creating a session is not payment, a paid status confirms payment and not shipment, a null price is unavailable and never free, and purchase needs the buyer's authorisation (18 of 20). No MCP tool definitions exist to read. Inputs are typed, with enums for category and sort, length limits, a pattern on Idempotency-Key and required items at checkout (15 of 15). Examples are given in curl and JSON. Responses are listed for 400, 404, 409 and 429, but the error body is one text field with no machine-readable code (10 of 15). The info block has version 1.0.0 and UCP is dated, but there is no public changelog and the URLs carry no version (5 of 15). 25 + 10 + 18 + 15 + 10 + 5 = 83.

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Agentzon 78

Responses can be limited (limit 1 to 100, offset) but not reduced field by field, and each item carries its details and pack sizes (15 of 25). Pagination with offset and nextOffset, filters for category and brand, and four sort orders (20 of 20). Errors carry HTTP codes and a short message, and agents.md gives a recovery step for 400, 415, 409, 429 and network failure, but there are no error codes in the body (15 of 20). Idempotency-Key is required on checkout and catalogue suggestions, with safe-retry guidance (20 of 20). Sensible defaults (limit 20, sort featured) and one required field at checkout. No official SDKs, so the SDK half of the line is unmet (8 of 15). 15 + 20 + 15 + 20 + 8 = 78.

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Agentzon 40

No machine payment protocol (x402, MPP or L402) on any endpoint. UCP is a commerce protocol, and llms.txt says UCP checkouts always end at the same payment page, so it earns nothing here (0 of 40). Item prices are shown without a login on the home and product pages and in search results. Prices exclude sales tax, which is added at checkout (20 of 20). No free tier, trial or test mode was found, and llms.txt says production checkout accepts real payments (0 of 20). No account, registration or key is needed to search or to create a checkout, so an agent gets access without a signup flow (20 of 20). 0 + 20 + 0 + 20 = 40. The buyer still enters card details by hand, which the security note covers.

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

Agentzon 40

No status page. status.agentzon.co answered Vercel's DEPLOYMENT_NOT_FOUND (404) on 4 November 2026, and agentzon.co/status returned 404 on 10 October, so the status page line scores 0 (0 of 20). No readable incident history exists, which takes the 5-point default (5 of 30). Catalogue reads have published figures, 120 a minute per process and client IP, with Retry-After on 429. Checkout and order limits have no figure, so the line is held as a partial (10 of 15). 429 handling is documented with Retry-After, and a required Idempotency-Key covers checkout, the core write, with retry guidance in agents.md (15 of 15). No SLA and no paid tier (0 of 10). llms.txt says production checkout accepts real payments, and no beta or preview label was found (10 of 10). 0 + 5 + 10 + 15 + 0 + 10 = 40.

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Agentzon 45

Read endpoints and checkout creation take no credential (no points for a key model). The order token is a bearer secret that reads one order, never expires and cannot be revoked (15 of 30, between the 10 for one all-powerful key and the 20 for a revocable key). The checkout URL is a payment credential passed in the URL fragment, not the query string, so the 10-point deduction does not apply. Read-only and least-privilege. Catalogue reads and checkout creation cannot take money. The privacy policy says Stripe handles card details and the checkout application never receives them, and the API says never to send them to Agentzon, so an agent cannot pay alone (20 of 20). Prompt injection. The catalogue returns product names and descriptions written by the seller, and no guidance on treating them as data was found (5 of 15). Operator visibility. The buyer has no call log. Agentzon keeps checkout diagnostics for 90 days and aggregate request counters, which the buyer cannot see (5 of 15). Programme. security.txt returned 404 on 4 November 2026, and no bug bounty, certification or advisory page was found (0 of 20). 15 + 20 + 5 + 5 + 0 = 45.

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.