Commerce Layer API + MCP vs doola MCP

Commerce Layer API + MCP 88

Atlassian Statuspage at status.commercelayer.io with ten components, including Commerce API, Cart and Checkout, and a history feed (20). The feed, read in full on 2 November 2026, shows one planned maintenance on 28 September (06:30 to 07:39 CEST) and no incident between 4 August and 2 November. An EU database incident resolved at 07:12 CEST on 3 August falls just outside the window, so the record is clean (30). Rate limits published per IP, 200 live writes and 1,000 cacheable reads a minute, 50 writes per endpoint per 10 seconds, 30 token requests a minute, half that in test (15). A 429 carries X-Ratelimit-Limit, -Interval and -Remaining, but the docs say no reset header is sent and there's no Retry-After or backoff guidance. Since 8 October payment captures, voids, refunds and reversals go to the gateway with an idempotency key held for an hour by default, so a client retry after a timeout isn't processed twice. Other writes have no idempotency guidance (10). "Enterprise SLAs" on the pricing page with no figures or terms (3). The API and Core MCP are generally available. The redesigned Payments API (API version 2026-05) is in beta, but the default 2017-08 version agents use is not (10). 20+30+15+10+3+10 = 88.

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Commerce Layer API + MCP 83

OpenAPI 3.0 file served without auth at data.commercelayer.app (25). llms.txt and Markdown docs (10). Core MCP tool descriptions are one line each, and the API reference covers each resource, with little on when not to use a call (13). Typed JSON:API attributes in the spec, but MCP writes take a free-form attributes object that preflight checks against the schema (11). Per-resource examples in the reference and JSON:API error objects (11). A dated public changelog tags breaking changes, and an upcoming-changes page lists breaks ahead of release. Since 5 October 2026 the Core API takes a date-stamped version in the path (2017-08 stays the default, 2026-05 is new), and responses carry api_version, api_versions and deprecation warnings. Breaking changes on 16 June, 27 August and 2 September 2026 still shipped on the day they were announced (13). 25+10+13+11+11+13 = 83.

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Commerce Layer API + MCP 69

11 Core MCP tools, generic list, get, create, update and delete over every resource, with schema discovery instead of one tool per object (20). Filters, sort, include, sparse fieldsets and pagination on list calls (20). JSON:API errors with codes, and the MCP validates filters and writes against the schema before calling the API (16). Payment captures, voids, refunds and reversals are deduplicated at the gateway for a configurable window (1 hour by default) and authorisations keep a fixed key, since 8 October 2026. No idempotency keys for other writes, and no readOnlyHint or destructiveHint annotations in the Core MCP tool list, which marks write tools only in a table (5). Official JavaScript SDK, generated from the schema, now 8.0.3 alongside a Provisioning SDK. We didn't confirm a second official language (8). 20+20+16+5+8 = 69.

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Commerce Layer API + MCP 64

OAuth 2.0 tokens throughout. Integration credentials follow a custom role set per resource and per operation, sales channel tokens are scoped to a market, and the Core MCP accepts the same tokens or runs the OAuth flow (28). The docs tell you to give the agent a dedicated role with minimal permissions, but delete_resource has no documented confirmation step (12). Tool results include merchant- and shopper-entered data with no prompt-injection guidance found (5). The versions endpoint, which gave change history per resource, was removed on 8 May 2026. Event stores remain, with a retention policy added on 18 June, but since 2 September 2026 they and the Dashboard resource inspector are Enterprise only (6). SOC 2 Type 2, ISO 27001 and PCI DSS Level 1 claimed on the security page, with annual penetration tests and fixes within 90 days. The SDK's SECURITY.md gives two email addresses. No security.txt and no bug bounty found (13).

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Commerce Layer API + MCP 59

Closed service with published terms, and MIT-licensed SDKs (15). Privacy policy still last updated 28 October 2020, with no DPA linked, no subprocessor list and no retention periods beyond "as long as reasonably necessary" (10). Deprecations now have a mechanism, with date-stamped API versions whose responses flag deprecated resources, an upcoming-changes page and dated notices (resource-level meta fields announced 17 June and removed on 5 October 2026). No notice period is stated, and three breaking changes in 2026 appeared on the day they shipped (13). The privacy policy names Intercom, Google, GitHub, Stripe and ConvertKit and transfers to the US, but no hosting regions (7). 15+10+13+7 = 45.

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Commerce Layer API + MCP 25

No x402, MPP or L402 (0). Only the free Developer plan has a public price. Enterprise is contact sales (5). Developer plan is free with no time limit and no credit card (20). A person signs up in the browser to get credentials (0).

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.