# doola MCP vs Elastic Path API + MCP (slim)

> Elastic Path scores 55.6 (C) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.md (~4,550 tokens) · this version ~2,530 tokens · JSON https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.json · canonical https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Elastic Path API + MCP scores 55.6 (C) on agent readiness against doola MCP's 28 (F), and leads in 6 of 7 scored categories. doola MCP leads on payments & pricing. Both do commerce checkout.

- doola MCP: F 28, rank #1430 of 1510 · https://www.anchorterminal.com/tools/doola-mcp.min.md
- Elastic Path API + MCP: C 55.6, rank #863 of 1510 · https://www.anchorterminal.com/tools/elastic-path.min.md
- doola MCP, good for Founders, including non-US founders, who want an agent to form a US company for them. Ahead on Payments & pricing, 10 against 5.
- Elastic Path API + MCP, good for Enterprises already buying composable commerce who want an agent with broad back-office reach. Ahead on Reliability, 75 against 15; Schema & documentation, 83 against 26; Agent ergonomics, 41 against 23; Security & auth, 44 against 36; Maintenance & community, 77 against 70; Transparency & trust, 62 against 38. Also Runs on your own machine.

| Category | doola MCP | Elastic Path API + MCP |
| --- | --- | --- |
| Reliability (16%) | 15 | 75 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 26 | 83 |
| Agent ergonomics (13%) | 23 | 41 |
| Security & auth (14%) | 36 | 44 |
| Payments & pricing (10%) | 10 | 5 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 77 |
| Transparency & trust (7%) | 38 | 62 |

| Fact (where they differ) | doola MCP | Elastic Path API + MCP |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | doola | Elastic Path |
| Hosted endpoint | `https://mcp.doola.com` | `https://useast.api.elasticpath.com/v2` |
| Transports | Streamable HTTP | HTTP, stdio |
| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | none |
| Tools exposed | none | 95 |
| llms.txt | no | yes |
| MCP registry | `io.github.doolahq/doola` | not listed |
| Last release | none | 2026-09-29 |
| Terms last updated | not read yet | couldn't be read |
| Privacy policy last updated | not read yet | couldn't be read |
| Customer content may train models | not read yet | couldn't be read |
| Terms restrict automated access | not read yet | couldn't be read |
| Terms restrict benchmarking | not read yet | couldn't be read |
| Terms or service can change without notice | not read yet | couldn't be read |
| Arbitration or class-action waiver | not read yet | couldn't be read |
| Popularity | none | 754 npm/wk |
| Agent reviews | none | 2/5 (2) |

Why the edge:
- Reliability, Elastic Path API + MCP +60: doola MCP 15 (status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.); Elastic Path API + MCP 75 (Atlassian Statuspage at status.elasticpath.com with Admin API, Shopper API, Commerce Manager and Webhooks components for the EU and US regions per the 1 October check, and a history feed (20). The feed read on 4 November covers the whole window from 6 August. A proportion of US API requests saw elevated errors for 4 minutes on 21 September (EU unaffected), and Commerce Manager was degraded for 5 minutes on 1 October. Both are partial, so minor. Database maintenance on 13 October was scheduled maintenance, not an incident (20). Published limits of 100 requests a second for production stores and organisations and 50 for development stores (15). The rate-limits page documents 429 and says to wait a few seconds and retry, and the JS SDK retries in the browser. No Retry-After header or idempotency keys, so backoff guidance alone (10). No SLA found (0). The API and the Composable Commerce MCP server are generally available (10).)
- Schema & documentation, Elastic Path API + MCP +57: doola MCP 26 (No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.); Elastic Path API + MCP 83 (Each API reference section has an Export OpenAPI Spec link to a downloadable OpenAPI 3.1 file, for example the Carts, Checkout, Orders file with 65 operations (25). llms.txt with about 1,050 lines, linking HTML pages rather than Markdown (10). Reference pages say what each endpoint does. We didn't read the 95 MCP tool descriptions, since the source isn't public (10). Typed REST parameters in the reference (11). Examples in the reference, and an errors guide with the JSON:API error shape and example bodies for 400, 401, 403, 404, 409, 429 and 500 (12 of 15). Dated changelog tagged MAJOR and MINOR, with deprecations carrying removal dates (15).)
- Transparency & trust, Elastic Path API + MCP +24: doola MCP 38 (Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.); Elastic Path API + MCP 62 (Closed platform. The terms of use were read on 30 September from www.elasticpath.com, whose robots.txt now answers a Cloudflare bot check, so that reading is struck. The JS SDK is MIT (LICENSE in the repository, 4 November), and the npm package for the MCP server states no licence per the 30 September check. Partly met, so the earlier 10 is kept (10 of 30). The privacy policy was read only on the same host, so that reading is struck and nothing else on the line stands (0). The API Contract guide says Elastic Path gives 90 days' notice before discontinuing or removing API functions, with less only for security risk or legal compliance, and names the deprecating API and its replacement. The changelog keeps to it, with per_application promotion codes announced 16 June for 14 September and removed 6 October, and cm_search announced 8 July for 6 October and removed 21 October. A written policy with a stated notice period (20). Regions are named in the base URLs (useast, euwest), and no subprocessor list was found (7). 10 + 0 + 20 + 7 = 37.)
- Agent ergonomics, Elastic Path API + MCP +18: doola MCP 23 (Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.); Elastic Path API + MCP 41 (The MCP server has 95 tools by its own npm description per the 30 September check, with no toolsets or filtering documented (5), and JSON:API includes let REST calls size responses a little (3). List operations take `page[limit]`, `page[offset]` and `filter` in the OpenAPI files (20). The errors guide documents the JSON:API error array (status, title, detail) with example bodies for 400, 401, 403, 404, 409, 429 and 500, and a request ID on 500s. It is a generic guide that points to each call's page, and the bodies carry no error codes of their own, so the line is partly met and keeps its earlier 5 (5 of 20). No idempotency keys and no MCP annotations found (0). Official JavaScript SDK (36.1.0 on 26 October 2026) and generated @epcc-sdk packages, one language (8). 5 + 3 + 20 + 5 + 0 + 8 = 41.)
- Security & auth, Elastic Path API + MCP +8: doola MCP 36 (OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.); Elastic Path API + MCP 44 (OAuth tokens from Application Keys. client_credentials gives full CRUD, the implicit grant reads the live catalogue only, and custom API role policies can narrow what a key does (24). The implicit token is a read-only path for shopping, but the MCP server runs on client_credentials with full CRUD and documents no read-only mode or confirmation (10). Returns merchant and shopper content with no prompt-injection guidance found (5). The Personal Data API logs every change to a user's personal data and returns the logs per resource. No general audit log of API calls found (5 of 15). No disclosure policy or security.txt found. developer.elasticpath.com serves its app page at /.well-known/security.txt, and earlier readings from www.elasticpath.com are struck, since its robots.txt answers a Cloudflare bot check (0).)
- Maintenance & community, Elastic Path API + MCP +7: doola MCP 70 (Plugin repository commit and registry update on 3 November and 28 October 2026 (30). Several dated merges in 90 days (20 of 20). Repository issues not read (0). Official registry entry io.github.doolahq/doola (15). Plugin manifests published by a registry workflow (5 of 10). 30 + 20 + 0 + 15 + 5 = 70. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.); Elastic Path API + MCP 77 (Changelog entry on 2 November 2026 for Catalog Search API changes, 2 days before the check (30). Eleven dated API entries since 6 August, on 10 August (two), 27 August, 25 and 29 September, 6, 7, 21, 22 and 28 October and 2 November, with entries only about Commerce Manager screens left out (20). Public changelog with RSS, Atom and JSON feeds; support channel not checked (10). @elasticpath/js-sdk tagged 35.2.0 to 36.1.0 between 5 and 26 October 2026 (clone). The MCP on npm couldn't be re-read, and it isn't in the official registry (12). The MCP source isn't public, so its tests and CI can't be seen. The JS SDK's CI runs lint and build (5).)