# doola MCP vs Saleor API + MCP (slim)

> Saleor scores 73.6 (BB) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.md (~4,150 tokens) · this version ~2,180 tokens · JSON https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.json · canonical https://www.anchorterminal.com/compare/doola-mcp-vs-saleor
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Saleor API + MCP scores 73.6 (BB) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.

- doola MCP: F 28, rank #1430 of 1510 · https://www.anchorterminal.com/tools/doola-mcp.min.md
- Saleor API + MCP: BB 73.6, rank #106 of 1510 · https://www.anchorterminal.com/tools/saleor.min.md
- doola MCP, good for Founders, including non-US founders, who want an agent to form a US company for them. Also A hosted endpoint, with nothing to install.
- Saleor API + MCP, good for Teams that want an open-source GraphQL backend with multi-channel pricing and an agent that reads store data safely. Ahead on Reliability, 75 against 15; Schema & documentation, 89 against 26; Agent ergonomics, 86 against 23; Security & auth, 71 against 36; Payments & pricing, 45 against 10; Maintenance & community, 85 against 70; Transparency & trust, 76 against 38. Also Agent-ready, a grade of BB or better; Open source.

| Category | doola MCP | Saleor API + MCP |
| --- | --- | --- |
| Reliability (16%) | 15 | 75 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 26 | 89 |
| Agent ergonomics (13%) | 23 | 86 |
| Security & auth (14%) | 36 | 71 |
| Payments & pricing (10%) | 10 | 45 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 85 |
| Transparency & trust (7%) | 38 | 76 |

| Fact (where they differ) | doola MCP | Saleor API + MCP |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | doola | Saleor |
| Hosted endpoint | `https://mcp.doola.com` | no (local only) |
| Transports | Streamable HTTP | HTTP, Streamable HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Paid | Freemium |
| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | BSD-3-Clause |
| Tools exposed | none | 8 |
| Read-only variant documented | no | yes |
| llms.txt | no | yes |
| MCP registry | `io.github.doolahq/doola` | not listed |
| Last release | none | 2026-10-28 |
| Terms last updated | not read yet | no date given |
| Privacy policy last updated | not read yet | no date given |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | none | 23k stars, 7.3k npm/wk |
| Agent reviews | none | 3.5/5 (2) |

Why the edge:
- Schema & documentation, Saleor API + MCP +63: doola MCP 26 (No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.); Saleor API + MCP 89 (One GraphQL schema with introspection, and a 954 KB SDL copy in the MCP repo (25). llms.txt split into per-section indexes (10). Fields and mutations carry descriptions, doc categories and deprecation reasons, but rarely say when not to use them (13). Strict GraphQL types with 78 error-code enums and required markers (14). Typed error codes on every mutation payload, with examples in the docs (12). CHANGELOG with a breaking changes section per minor version, GitHub releases, and 464 `@deprecated` markers in the schema (15).)
- Agent ergonomics, Saleor API + MCP +63: doola MCP 23 (Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.); Saleor API + MCP 86 (GraphQL field selection sizes every response, and the MCP server has 8 compact tools (25). Cursor pagination capped at 100, with `filter`, `where`, `search` and sort inputs (20). Mutations return typed `errors` with a code, field and message (18). Payment transaction mutations take an `idempotencyKey`, and 7 of the 8 MCP tools declare readOnlyHint and idempotentHint (the eighth only returns the API URL) (15). MCP tools default to 100 items and need only a channel. The official SDK is a TypeScript app SDK, with no general client in a second language (8).)
- Reliability, Saleor API + MCP +60: doola MCP 15 (status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.); Saleor API + MCP 75 (Graded on Saleor Cloud. Status page at status.saleor.io with an incident feed and history (20). One incident in the 90 days to 1 November, elevated GraphQL error rates, mostly 503s, for some EU stores from 18:01 to 18:23 UTC on 25 October, caused by an OIDC bug fixed in 3.23.45. Partial and 22 minutes, so minor (20). The usage limits page gives sandboxes 120 requests a minute on the free plan and 2,000 on paid plans, with production unlimited, plus a 50,000 query-cost cap, 100 items a page and 4 mutations per request (15). Requests over the limit get HTTP 429, and since 30 October the page says throttled production traffic also gets 429 and should be retried with backoff. Payment transaction mutations take an `idempotencyKey`, other writes don't, and no Retry-After is documented (10). No SLA on the pricing page (0). Generally available (10).)
- Transparency & trust, Saleor API + MCP +38: doola MCP 38 (Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.); Saleor API + MCP 76 (BSD-3-Clause core, with the MCP server under AGPL-3.0 (30). Privacy policy updated 8 August 2025 names Saleor Commerce sp. z o.o. in Wrocław, links a subprocessor list and states 30 days for cookies, but no DPA is linked from it and other retention is "not longer than necessary" (20). Deprecations are marked in the schema and removed in a named later version, with upgrade guides, but notices carry versions rather than dates (15). Self-hosted servers send daily usage telemetry by default (counts of products, attributes and models, plus version), described on a Usage Telemetry docs page and turned off with SEND_USAGE_TELEMETRY=False. Cloud subprocessors are listed (18).)
- Security & auth, Saleor API + MCP +35: doola MCP 36 (OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.); Saleor API + MCP 71 (App tokens limited to named permissions such as MANAGE_PRODUCTS and MANAGE_ORDERS, revocable through the API, and short-lived staff JWTs with refresh. Tokens travel in headers, never the URL (27). The MCP server never runs mutations, and a self-run copy can pin allowed API domains with ALLOWED_DOMAIN_PATTERN (16). Tools return merchant- and shopper-entered text, marked openWorldHint, with no prompt-injection guidance found (5). Observability webhooks can report API calls, but no operator audit log of who did what was found (8). SECURITY.md routes reports through GitHub advisories or security@saleor.io, nine advisories were published between January and July 2026, and the pricing page lists SOC 2, PCI DSS and GDPR. No security.txt and no bounty (15).)
- Payments & pricing, Saleor API + MCP +35: doola MCP 10 (No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.); Saleor API + MCP 45 (No x402, MPP or L402 (0). Cloud plans are public, Select $1,599 a month to $200,000 GMV and Volume $3,999 to $1,000,000, with 0.8% and 0.4% overage, but there's no per-call or per-unit price (10). The BSD core is free to self-host, and Cloud sandboxes are free for non-commercial use with no card mentioned (20). An agent can run the core from the Docker image with no account, but Cloud needs a browser signup (15).)