doola MCP vs Saleor API + MCP

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Saleor API + MCP 89

One GraphQL schema with introspection, and a 954 KB SDL copy in the MCP repo (25). llms.txt split into per-section indexes (10). Fields and mutations carry descriptions, doc categories and deprecation reasons, but rarely say when not to use them (13). Strict GraphQL types with 78 error-code enums and required markers (14). Typed error codes on every mutation payload, with examples in the docs (12). CHANGELOG with a breaking changes section per minor version, GitHub releases, and 464 @deprecated markers in the schema (15).

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Saleor API + MCP 86

GraphQL field selection sizes every response, and the MCP server has 8 compact tools (25). Cursor pagination capped at 100, with filter, where, search and sort inputs (20). Mutations return typed errors with a code, field and message (18). Payment transaction mutations take an idempotencyKey, and 7 of the 8 MCP tools declare readOnlyHint and idempotentHint (the eighth only returns the API URL) (15). MCP tools default to 100 items and need only a channel. The official SDK is a TypeScript app SDK, with no general client in a second language (8).

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Saleor API + MCP 75

Graded on Saleor Cloud. Status page at status.saleor.io with an incident feed and history (20). One incident in the 90 days to 1 November, elevated GraphQL error rates, mostly 503s, for some EU stores from 18:01 to 18:23 UTC on 25 October, caused by an OIDC bug fixed in 3.23.45. Partial and 22 minutes, so minor (20). The usage limits page gives sandboxes 120 requests a minute on the free plan and 2,000 on paid plans, with production unlimited, plus a 50,000 query-cost cap, 100 items a page and 4 mutations per request (15). Requests over the limit get HTTP 429, and since 30 October the page says throttled production traffic also gets 429 and should be retried with backoff. Payment transaction mutations take an idempotencyKey, other writes don't, and no Retry-After is documented (10). No SLA on the pricing page (0). Generally available (10).

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Saleor API + MCP 76

BSD-3-Clause core, with the MCP server under AGPL-3.0 (30). Privacy policy updated 8 August 2025 names Saleor Commerce sp. z o.o. in Wrocław, links a subprocessor list and states 30 days for cookies, but no DPA is linked from it and other retention is "not longer than necessary" (20). Deprecations are marked in the schema and removed in a named later version, with upgrade guides, but notices carry versions rather than dates (15). Self-hosted servers send daily usage telemetry by default (counts of products, attributes and models, plus version), described on a Usage Telemetry docs page and turned off with SEND_USAGE_TELEMETRY=False. Cloud subprocessors are listed (18).

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Saleor API + MCP 71

App tokens limited to named permissions such as MANAGE_PRODUCTS and MANAGE_ORDERS, revocable through the API, and short-lived staff JWTs with refresh. Tokens travel in headers, never the URL (27). The MCP server never runs mutations, and a self-run copy can pin allowed API domains with ALLOWED_DOMAIN_PATTERN (16). Tools return merchant- and shopper-entered text, marked openWorldHint, with no prompt-injection guidance found (5). Observability webhooks can report API calls, but no operator audit log of who did what was found (8). SECURITY.md routes reports through GitHub advisories or security@saleor.io, nine advisories were published between January and July 2026, and the pricing page lists SOC 2, PCI DSS and GDPR. No security.txt and no bounty (15).

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

Saleor API + MCP 45

No x402, MPP or L402 (0). Cloud plans are public, Select $1,599 a month to $200,000 GMV and Volume $3,999 to $1,000,000, with 0.8% and 0.4% overage, but there's no per-call or per-unit price (10). The BSD core is free to self-host, and Cloud sandboxes are free for non-commercial use with no card mentioned (20). An agent can run the core from the Docker image with no account, but Cloud needs a browser signup (15).