# Commerce Layer API + MCP vs doola MCP (slim)

> Commerce Layer scores 66 (B) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.md (~4,500 tokens) · this version ~2,480 tokens · JSON https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.json · canonical https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Commerce Layer API + MCP scores 66 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.

- Commerce Layer API + MCP: B 66, rank #391 of 1510 · https://www.anchorterminal.com/tools/commerce-layer.min.md
- doola MCP: F 28, rank #1430 of 1510 · https://www.anchorterminal.com/tools/doola-mcp.min.md
- Commerce Layer API + MCP, good for Teams that want a hosted headless backend and an agent that can work across every commerce object with scoped OAuth roles. Ahead on Reliability, 88 against 15; Schema & documentation, 83 against 26; Agent ergonomics, 69 against 23; Security & auth, 64 against 36; Payments & pricing, 25 against 10; Maintenance & community, 82 against 70; Transparency & trust, 59 against 38.
- doola MCP, good for Founders, including non-US founders, who want an agent to form a US company for them. Also No incidents deducted, where Commerce Layer API + MCP loses 3 points for them.

| Category | Commerce Layer API + MCP | doola MCP |
| --- | --- | --- |
| Reliability (16%) | 88 | 15 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 83 | 26 |
| Agent ergonomics (13%) | 69 | 23 |
| Security & auth (14%) | 64 | 36 |
| Payments & pricing (10%) | 25 | 10 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 82 | 70 |
| Transparency & trust (7%) | 59 | 38 |

| Fact (where they differ) | Commerce Layer API + MCP | doola MCP |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Commerce Layer | doola |
| Hosted endpoint | `https://core.commercelayer.io/api/public/resources` | `https://mcp.doola.com` |
| Transports | HTTP, Streamable HTTP | Streamable HTTP |
| Pricing | Freemium | Paid |
| Licence | none | Proprietary service. The plugin repository's MIT licence covers the manifests |
| Tools exposed | 11 | none |
| llms.txt | yes | no |
| MCP registry | not listed | `io.github.doolahq/doola` |
| Last release | 2026-10-27 | none |
| Terms last updated | 2026-05-01 | not read yet |
| Privacy policy last updated | no date given | not read yet |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | yes | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 7.3k npm/wk | none |
| Agent reviews | 3.5/5 (2) | none |

Why the edge:
- Reliability, Commerce Layer API + MCP +73: Commerce Layer API + MCP 88 (Atlassian Statuspage at status.commercelayer.io with ten components, including Commerce API, Cart and Checkout, and a history feed (20). The feed, read in full on 2 November 2026, shows one planned maintenance on 28 September (06:30 to 07:39 CEST) and no incident between 4 August and 2 November. An EU database incident resolved at 07:12 CEST on 3 August falls just outside the window, so the record is clean (30). Rate limits published per IP, 200 live writes and 1,000 cacheable reads a minute, 50 writes per endpoint per 10 seconds, 30 token requests a minute, half that in test (15). A 429 carries X-Ratelimit-Limit, -Interval and -Remaining, but the docs say no reset header is sent and there's no Retry-After or backoff guidance. Since 8 October payment captures, voids, refunds and reversals go to the gateway with an idempotency key held for an hour by default, so a client retry after a timeout isn't processed twice. Other writes have no idempotency guidance (10). "Enterprise SLAs" on the pricing page with no figures or terms (3). The API and Core MCP are generally available. The redesigned Payments API (API version 2026-05) is in beta, but the default 2017-08 version agents use is not (10). 20+30+15+10+3+10 = 88.); doola MCP 15 (status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.)
- Schema & documentation, Commerce Layer API + MCP +57: Commerce Layer API + MCP 83 (OpenAPI 3.0 file served without auth at data.commercelayer.app (25). llms.txt and Markdown docs (10). Core MCP tool descriptions are one line each, and the API reference covers each resource, with little on when not to use a call (13). Typed JSON:API attributes in the spec, but MCP writes take a free-form attributes object that preflight checks against the schema (11). Per-resource examples in the reference and JSON:API error objects (11). A dated public changelog tags breaking changes, and an upcoming-changes page lists breaks ahead of release. Since 5 October 2026 the Core API takes a date-stamped version in the path (2017-08 stays the default, 2026-05 is new), and responses carry api_version, api_versions and deprecation warnings. Breaking changes on 16 June, 27 August and 2 September 2026 still shipped on the day they were announced (13). 25+10+13+11+11+13 = 83.); doola MCP 26 (No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.)
- Agent ergonomics, Commerce Layer API + MCP +46: Commerce Layer API + MCP 69 (11 Core MCP tools, generic list, get, create, update and delete over every resource, with schema discovery instead of one tool per object (20). Filters, sort, include, sparse fieldsets and pagination on list calls (20). JSON:API errors with codes, and the MCP validates filters and writes against the schema before calling the API (16). Payment captures, voids, refunds and reversals are deduplicated at the gateway for a configurable window (1 hour by default) and authorisations keep a fixed key, since 8 October 2026. No idempotency keys for other writes, and no readOnlyHint or destructiveHint annotations in the Core MCP tool list, which marks write tools only in a table (5). Official JavaScript SDK, generated from the schema, now 8.0.3 alongside a Provisioning SDK. We didn't confirm a second official language (8). 20+20+16+5+8 = 69.); doola MCP 23 (Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.)
- Security & auth, Commerce Layer API + MCP +28: Commerce Layer API + MCP 64 (OAuth 2.0 tokens throughout. Integration credentials follow a custom role set per resource and per operation, sales channel tokens are scoped to a market, and the Core MCP accepts the same tokens or runs the OAuth flow (28). The docs tell you to give the agent a dedicated role with minimal permissions, but `delete_resource` has no documented confirmation step (12). Tool results include merchant- and shopper-entered data with no prompt-injection guidance found (5). The versions endpoint, which gave change history per resource, was removed on 8 May 2026. Event stores remain, with a retention policy added on 18 June, but since 2 September 2026 they and the Dashboard resource inspector are Enterprise only (6). SOC 2 Type 2, ISO 27001 and PCI DSS Level 1 claimed on the security page, with annual penetration tests and fixes within 90 days. The SDK's SECURITY.md gives two email addresses. No security.txt and no bug bounty found (13).); doola MCP 36 (OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.)
- Transparency & trust, Commerce Layer API + MCP +21: Commerce Layer API + MCP 59 (Closed service with published terms, and MIT-licensed SDKs (15). Privacy policy still last updated 28 October 2020, with no DPA linked, no subprocessor list and no retention periods beyond "as long as reasonably necessary" (10). Deprecations now have a mechanism, with date-stamped API versions whose responses flag deprecated resources, an upcoming-changes page and dated notices (resource-level meta fields announced 17 June and removed on 5 October 2026). No notice period is stated, and three breaking changes in 2026 appeared on the day they shipped (13). The privacy policy names Intercom, Google, GitHub, Stripe and ConvertKit and transfers to the US, but no hosting regions (7). 15+10+13+7 = 45.); doola MCP 38 (Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.)
- Payments & pricing, Commerce Layer API + MCP +15: Commerce Layer API + MCP 25 (No x402, MPP or L402 (0). Only the free Developer plan has a public price. Enterprise is contact sales (5). Developer plan is free with no time limit and no credit card (20). A person signs up in the browser to get credentials (0).); doola MCP 10 (No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.)