doola MCP vs Shopify API + MCP

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Shopify API + MCP 92

Fully typed GraphQL Admin and Storefront schemas with introspection, and UCP tools defined by published JSON schemas (25). shopify.dev/llms.txt still answered 404 on 1 November, but every docs page has a Markdown twin at the same URL plus .md, served as text/markdown (10). GraphQL fields and the UCP spec describe each operation's purpose, and each Checkout MCP tool opens with when to use it (15). Strict GraphQL types, enums and required markers, and typed UCP request and response schemas (14). Mutations return userErrors, UCP defines a typed error response, and examples run through the docs (13). Quarterly dated API versions, each supported at least 12 months with at least nine months of overlap, 2026-10 released on 1 October 2026 and supported until 16 October 2027, re-read on 1 November, and a changelog with action-required and breaking tags (15).

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Shopify API + MCP 78

Atlassian Statuspage at shopifystatus.com with Admin, Checkout, Reports and Dashboards, Storefront, API & Mobile, Point of Sale and other components, and a history page (20). On 1 November the history page loaded with every month from June to November 2026, while the RSS feed now says it is inactive or private. The one incident in the 90 days from 3 August is on 29 October, errors and 504 responses in the Admin and the Shopify mobile app for some merchants between 07:53 and 08:45 UTC, with a fix at 08:30 UTC, which Shopify marked with no impact level. It was under an hour and reached some merchants, so it reads as minor. The page says issues affecting a small share of stores may not appear (20). Limits published per API. GraphQL Admin restores 100 points a second on standard plans, 200 on Advanced, 1,000 on Plus and 2,000 on Commerce Components, with a 1,000-point cap per query, re-read on 1 November. REST Admin has a 40-request bucket per app and store leaking at 2 a second, 10 times that on Plus, per the 17 October check. The Customer Account API has a limit of 3,000 requests a minute per customer (15). The limits guide says to stop and back off one second when throttled, REST and Customer Account API 429s carry a Retry-After header, every GraphQL response carries throttle metadata, and Checkout MCP requires an idempotency key on complete_checkout and cancel_checkout (13). No SLA found on the pricing page, re-read on 1 November (0). Admin and Storefront APIs are generally available (10). 20 + 20 + 15 + 13 + 0 + 10 = 78.

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Shopify API + MCP 83

GraphQL field selection sizes every Admin and Storefront response. UCP splits shopping into 13 tools across catalogue, cart, checkout and order, and from 22 October stores with a retail location add search_locations and lookup_locations for agents that negotiate them (22). Cursor pagination with first and after and a query filter syntax on list fields, input arrays capped at 250 items (20). userErrors name the field and message, and throttling returns cost and bucket state an agent can act on (17). Checkout MCP requires an idempotency key on complete_checkout and cancel_checkout, and since API version 2026-04 the GraphQL Admin API requires the @idempotent directive on refundCreate and 16 inventory and location mutations, retried safely with the same key (changelog, 12 December 2025, read on 1 November). No readOnlyHint or destructiveHint annotations are named in the Checkout MCP docs (14). Official libraries are JavaScript packages in this listing. Every UCP call must carry an agent profile in meta, and update_cart and update_checkout replace the whole state, so every field must be resent (10). 22 + 20 + 17 + 14 + 10 = 83.

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Shopify API + MCP 89

Closed platform with published terms, and open-source client libraries (15). Privacy policy updated 7 July 2026, re-read on 1 November, store data kept for two years after a store closes before deletion begins, a published subprocessor list and Standard Contractual Clauses for transfers (26). Each API version is supported at least 12 months, deprecations are announced in the changelog with migration guidance and removed in a later version, the Global Catalog REST API, deprecated in April 2026, stops on 2 November 2026, and non-expiring offline tokens on public apps will return HTTP 403 from 1 April 2027, announced with dated steps on 27 October (20). Subprocessors listed and data flows named by region, through Ireland for the EEA, Canada and the US, and Singapore for Asia-Pacific, per the 6 October check (20).

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Shopify API + MCP 78

Per-app access tokens limited by granular read and write scopes, OAuth for public apps, separate storefront tokens, and token exchange for offline tokens. Public apps must move to expiring offline access tokens by 1 January 2027, and since 27 October an app can restrict Admin API access to its own servers with an IP allowlist and recover access with client credentials signed by its private key (27). Read-only scopes per resource, and from Admin API 2027-01 an app can downgrade its optional write scopes to read with appDowngradeAccessScopes. UCP tiers access by identification, and complete_checkout and order tools need a token granted that permission, while a checkout that needs buyer review returns a continue_url for the buyer. The Dev MCP server only reads docs and schemas (16). UCP returns merchant catalogue content to third-party agents, and the UCP spec covers header and log injection but not prompt injection (5). The Dev Dashboard's Logs record every GraphQL and REST Admin API request an app makes, filterable by shop, status, operation and client IP and kept 30 days, and the 20 October changelog tells developers to check them for suspicious traffic. Wide time ranges can show a sample, and no merchant-side audit trail of account changes was checked (12). security.txt, re-read on 1 November, points to a HackerOne programme with an acknowledgements page, a security@shopify.com contact and a PGP key, but still has no Expires field. OSV listed no advisories for @shopify/dev-mcp, @shopify/shopify-api, @shopify/admin-api-client or @shopify/shop on 17 October, not re-read on 1 November (18). 27 + 16 + 5 + 12 + 18 = 78.

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

Shopify API + MCP 40

No x402, MPP or L402. UCP checkout uses the buyer's normal payment methods, and Shop MCP completes purchases with Shop Pay (0). Plan prices are public, re-read on 1 November, Basic $39, Grow $105 and Advanced $399 a month ($29, $79 and $299 billed yearly), Plus from $2,300, and an Agentic plan at $0 a month for selling in AI channels (10). Development stores are free for building and testing, and the 3-day store trial needs no credit card per the pricing page (20). Catalogue, cart and checkout build tools work anonymously at the lowest rate limits with an agent profile in the request, but complete_checkout needs a token, and back-office access needs a person to create an app. Shop MCP (mcp.shop.com) searches without an API key and builds carts without sign-in, but completing a purchase needs the shopper signed in with Shop, so the line stays (10).