commercetools vs doola MCP

commercetools 78

Graded on the HTTP API with the hosted lines. status.commercetools.com lists seven components across five regions with a dated history (20). The history pages sit under /pages/, which the status site's robots.txt disallows, so they weren't re-read on 1 November. The 8 October check read the history and found only the API errors in Europe (Google Cloud) on 10 and 30 July, which have now left the 90-day window, and nothing on the API component from 3 August to 8 October. For 9 October to 1 November, the status page's own month metrics, read on 1 November, show 100.00 per cent uptime for the APIs in all five regions and every component operational. Those metrics rule out downtime on the API but don't list partial or degraded incidents, which this run counts as minor, so the 24 days since 8 October aren't shown to be clean. Minor at most (20 of 30, was 15, cause time). The HTTP API applies rate limiting only to non-production Projects since 16 October, with RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers, but the docs say the limit varies and give no number, and production Projects have none. Numbers exist for query size (500 per page, offset 10,000), the Knowledge MCP (100 requests per 15 minutes per IP) and Managed MCP Servers (1,000,000 tool calls a project a month) (5). Retry guidance covers 429 (wait for Retry-After or RateLimit-Reset), 502 and 503 with exponential backoff, and 409 handling through resource versions. There are no idempotency keys (13). 99.9 per cent monthly availability with service credits of 10 to 50 per cent, though Managed MCP Servers are excluded (10). The API and Managed MCP Servers are not marked beta (10). 20 + 20 + 5 + 13 + 10 + 10 = 78.

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

commercetools 86

OpenAPI 3.0 file of 3.1 MB with 822 operations in commercetools/commercetools-api-reference, last changed on 29 September 2026 while the RAML beside it was updated on 30 October (the new TooManyRequests error is in the RAML, not yet in the OpenAPI file), with RAML and a GraphQL schema beside it (25). llms.txt, and every docs page is served as Markdown at the same path with .md (10). The API reference describes each resource, field and update action, and a Knowledge MCP searches the docs and validates requests. Guidance on when not to use a call is thin (14). Typed drafts and update actions with required fields, enums and length limits (13). Error codes are listed by HTTP status with type definitions, and the guides carry request and response examples. The OpenAPI file itself has few examples (12). The API is versionless by policy, with dated release notes and an RSS feed. The managed MCP server follows semver with pinned major versions (12).

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

commercetools 83

REST queries take limit, offset, sort, where predicates and reference expansion, and GraphQL selects fields. Commerce MCP lists 122 tool names, which is heavy, but an administrator picks the tools per server, read_all gives a read-only set, fields can be filtered, and the self-hosted package loads tools on demand above 30 (20). Pagination, filtering and limits on every query endpoint (20). JSON errors with named codes per status, including TooManyRequests with a 429 since 16 October. Errors from the load balancer can be HTML or empty (17). Updates and deletes need the resource version, which makes a repeated write fail safely, and MCP tools carry readOnlyHint, destructiveHint and openWorldHint from 1 October 2026. No idempotency key for creates (13). SDKs for Java, TypeScript, PHP and .NET. Changes go through typed update actions, which take more parameters than a plain patch (13).

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

commercetools 82

Closed service under a public Master Service Agreement and a public 60-day trial agreement. The SDKs are MIT or Apache 2.0 and Commerce MCP is MIT (17). A privacy notice with a section for customers, a public DPA last updated 1 October 2024 and a sub-processor list. The DPA says personal data is deleted promptly at termination without a period in days, and the security page says the DPA is available on request while it is published at commercetools.com/dpa (22). Breaking changes are announced three months ahead and removals six months ahead in release notes, and a deprecations archive gives dates. The policy keeps a right to make larger changes with direct notice (16). Sub-processors listed with purpose, hosting location and product, updated 24 August 2026 (20).

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

commercetools 70

OAuth 2.0 client credentials through API Clients with view and manage scopes per resource and per store, tokens that last 48 hours by default, an RFC 7009 revocation endpoint, and no tokens in URL parameters. Each managed MCP server has its own scope, mcp:{projectKey}:{mcpServerKey}, with tokens capped at 30 days (28). Read-only scopes and tool sets, per-server tool lists, field redaction, and an Identity mode that filters tools by the signed-in user's permissions. No confirmation step for destructive tools was found (15). Tool results carry merchant and shopper text. The docs explain the confused deputy risk and field redaction but give no prompt-injection guidance (6). Audit Log Basic records Merchant Centre changes only. Changes through the API need the Audit Log Premium add-on, and MCP usage tracking needs the Platform Insights add-on (9). SOC 2, ISO 27001 and Cyber Essentials are listed on the security page, with reports under NDA. The Commerce MCP repository has a SECURITY.md that asks for email reports. No security.txt (404) and no bug bounty found, and the trust centre refused our reader (12).

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

commercetools 85

Release notes dated 30 October 2026 (InStore), with API entries on 23 October (frozen Cart prices, Audit Log) and 22 October (Category Store assignments) (30). More than twenty dated entries between 8 and 30 October alone (20). Public release notes with RSS, and standard support with published first-response targets of 12 hours for problems and 48 hours for questions, per the 8 October check. GitHub issue handling wasn't read (12). Four official SDKs on a monthly schedule, with @commercetools/platform-sdk 9.7.0 tagged on 9 October 2026 (15). The Commerce MCP repository runs quality and release workflows with changesets, and its changelog adds 4.2.3 (a dependency update) on 23 October after six tagged releases between 3 August and 30 September 2026. Its server.json still names version 4.1.0 (8). 30 + 20 + 12 + 15 + 8 = 85.

doola MCP 70

Plugin repository commit and registry update on 3 November and 28 October 2026 (30). Several dated merges in 90 days (20 of 20). Repository issues not read (0). Official registry entry io.github.doolahq/doola (15). Plugin manifests published by a registry workflow (5 of 10). 30 + 20 + 0 + 15 + 5 = 70. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.