doola MCP vs Fabric

doola MCP 70

Plugin repository commit and registry update on 3 November and 28 October 2026 (30). Several dated merges in 90 days (20 of 20). Repository issues not read (0). Official registry entry io.github.doolahq/doola (15). Plugin manifests published by a registry workflow (5 of 10). 30 + 20 + 0 + 15 + 5 = 70. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Fabric 15

No dated API release since the July 2025 release notes. The Product Agent OpenAPI file returned a Last-Modified header of 9 June 2026, 127 days before this check, which is the newest dated change found (10 of 30). No dated release notes or changelog entries in the last 90 days (0 of 20). Support runs through a ticket portal at support.fabric.inc, which was not tested, and the public changelog has stopped (5 of 15). No official SDKs and no MCP server for the commerce APIs. The docs MCP server only searches documentation (0 of 15). No public repository, package or CI to inspect (0 of 10). Total 15.

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Fabric 79

69 public OpenAPI 3.0 files listed in llms.txt, about 980 operations (25 of 25). llms.txt, and every docs page served as Markdown at its path plus .md (10 of 10). Operation descriptions state purpose and filters, such as the order search explaining that filters go in the body and that 10 orders return by default, but few say when not to use an endpoint (12 of 20). Typed schemas with required fields and more than 1,000 enum declarations across the files (12 of 15). Request and response examples throughout, and standardised error codes with a published code list, implemented only for Orders and Inventory (12 of 15). Versions are in the path (v1, v2, v3) and release notes are dated, but the newest are from July 2025 and the Product Agent release notes link returned 404 (8 of 15). Total 79.

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Fabric 57

Responses are sized with offset and limit, with no field selection found (15 of 25). Order search takes filters for type, status and date range in the body, with offset and limit paging (18 of 20). Orders and Inventory errors carry a type, a stable errorCode, a message and the service and endpoint, while other services do not yet use the framework (14 of 20). No idempotency keys or safe-retry guidance were found for writes. Order, shipment and allocation documents carry a version number, and SERVICE-4006 reports a concurrent modification (5 of 20). Every call needs a bearer token and a tenant header, the defaults are sensible, and no official SDK was found (5 of 15). Total 57.

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Fabric 62

OpenID Connect client credentials for system apps with one role each, 10-minute tokens and no refresh token, and the authorisation code flow with PKCE for shopper apps. Apps are created and managed by a merchant admin in Copilot. Roles are coarse rather than per-endpoint scopes (25 of 30). Least privilege is possible with the Viewer and Developer Viewer roles and editors limited to one module, but no confirmation step for destructive calls was found (14 of 20). The APIs return the merchant's own catalogue, order and customer data rather than outside content (10 of 15). The data security page says access logs and system changes are recorded, but no operator-facing API audit log was found, beyond a webhook event log in the v2 orders API (5 of 15). SOC 2 Type I and Type II and PCI DSS SAQ-A are listed in the docs. No security.txt, disclosure policy or bug bounty was found (8 of 20). Total 62.

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Fabric 55

Closed service with published terms (Terms and Conditions of 1 January 2026, SLA, website terms of use) (15 of 30). Data handling statements disagree in places. The terms delete customer content 90 days after termination, while the security page says data is kept for one month after the contract ends. The privacy policy dates from 14 January 2021, and the Data Processing Addendum it relies on returned 404. The terms say inputs may go to third-party language models and that Fabric may keep de-identified derived data (10 of 30). Deprecated v2 endpoints are marked in the reference and beta services carry 30 days' notice of discontinuation, but the legacy label on the v3 docs carries no dates (5 of 20). Hosting on AWS and third-party language models are disclosed, with no subprocessor list or data locations (5 of 20). Total 35.

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

Fabric 0

No x402, MPP or L402 on any endpoint (0 of 40). No public prices. fabric.inc/pricing returns 404 and the sites link to a demo request (0 of 20). The docs say to reach out for a trial account, so no free tier or trial is available without sales contact (0 of 20). A person signs an order form and an admin creates the app credentials in Copilot (0 of 20). Total 0.