{ "data": { "a": { "slug": "doola-mcp", "name": "doola MCP", "vendor": "doola", "vendorUrl": "https://doola.com", "kind": "mcp", "category": "commerce", "summary": "doola's hosted MCP server lets an agent form a US LLC or C-Corp in any state or DC from a conversation, covering entity type, name, members, ownership and the state filing, and check on existing doola companies.", "url": "https://www.anchorterminal.com/tools/doola-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/doola-mcp.json", "dns": "doola-mcp.grade.anchorterminal.com", "repo": "https://github.com/doolahq/plugins", "license": "Proprietary service. The plugin repository's MIT licence covers the manifests", "transports": [ "streamable-http" ], "remoteUrl": "https://mcp.doola.com", "packages": [], "auth": "oauth", "authNotes": "OAuth with a doola account on the first tool call; tokens are held by the client and can be revoked in doola's account settings.", "pricing": "paid", "pricingNotes": "Formation plans from $297 a year plus state fees (renewing at $300), up to $1,999 a year plus state fees. The MCP server itself is free to connect (checked 2026-11-07).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the MCP docs or pricing page (checked 2026-11-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://doola.com", "registryName": "io.github.doolahq/doola", "capabilities": [ "legal.company-formation", "commerce.checkout" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "paid", "mcp-registry" ], "graded": true, "anchor": { "graded": true, "score": 28, "grade": "F", "agentReady": false, "rank": 1430, "ranked": true, "rankOf": 1510, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 38 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-07" }, "negative": 0, "verdict": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.", "bestFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "strengths": [ "Forms a US LLC or C-Corp in any state from a conversation", "OAuth with revocation in account settings", "Plugins for Claude Code, Grok Build and Cursor", "Official registry entry and a public plugin repository" ], "weaknesses": [ "No published tool list, schemas or errors", "No documented confirmation before a paid filing", "No free tier; formation from $297 a year plus state fees", "Status page unreachable and no llms.txt" ], "agentNotes": [ "Confirm the entity type, state, name, members and price with the user before filing", "A filing is a paid legal act; never retry one without checking its status first", "Use the status tools on existing companies before starting a new formation" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 28 } ], "editorialScores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 30 }, "provenanceScore": 46, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude plugin marketplace add doolahq/plugins \u0026\u0026 claude plugin install doola@doola", "config": { "mcpServers": { "doola": { "url": "https://mcp.doola.com" } } } }, "letme": { "capability": "https://letme.dev/legal.company-formation", "tool": "https://letme.dev/doola-mcp" }, "area": "business", "provenance": { "legalEntity": "doola", "domain": "doola.com", "domainRegistered": "", "domainNote": "Not looked up: RDAP isn't requested under the 1 November 2026 rules.", "endpointOnVendorDomain": true, "terms": "https://doola.com/terms-of-service", "privacy": "https://doola.com/privacy-policy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-07", "notes": [ "Terms last updated July 2026. The plugin repository's licence names doola." ], "score": 46 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/doola-mcp.json", "live": { "slug": "doola-mcp", "probe": { "target": "https://mcp.doola.com", "method": "mcp-initialize", "lastAt": "2026-11-08T00:55:37.012153631Z", "lastOk": true, "lastStatus": 401, "lastMs": 176, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 113, "p95ms24h": 201, "samples24h": 63, "samples30d": 63, "days": [ { "date": "2026-11-07", "probes": 53, "ok": 53 }, { "date": "2026-11-08", "probes": 10, "ok": 10 } ] }, "githubStars": 0, "updatedAt": "2026-11-08T00:55:37.012153631Z" } }, "answer": "Shopify API + MCP scores 74.9 (BB) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "b": { "slug": "shopify", "name": "Shopify API + MCP", "vendor": "Shopify", "vendorUrl": "https://www.shopify.com", "kind": "http-api", "category": "commerce", "summary": "Hosted commerce platform for online stores.", "url": "https://www.anchorterminal.com/tools/shopify", "markdownUrl": "https://www.anchorterminal.com/tools/shopify.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shopify.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shopify.json", "dns": "shopify.grade.anchorterminal.com", "transports": [ "http", "streamable-http", "stdio" ], "packages": [ { "registry": "npm", "name": "@shopify/shopify-api" }, { "registry": "npm", "name": "@shopify/admin-api-client" }, { "registry": "npm", "name": "@shopify/dev-mcp" } ], "auth": "mixed", "authNotes": "Admin API takes an access token in the X-Shopify-Access-Token header, issued to a custom app in the store or through OAuth for public apps, limited by access scopes such as read_products and write_orders. Public apps must use expiring offline access tokens by 1 January 2027, and apps can limit Admin API access to listed server IP addresses. Storefront API uses a public or private storefront token. UCP MCP requests carry an agent profile and are tiered as token, signed (RFC 9421) or anonymous. Catalogue, cart and checkout build tools work at every tier, while `complete_checkout` and order tools need a token. The Dev MCP server needs no auth.", "pricing": "paid", "pricingNotes": "Basic $39 a month or $29 billed yearly, Grow $105 or $79, Advanced $399 or $299, Plus from $2,300 a month on a 3-year term. An Agentic plan at $0 a month lists products in Shopify's Catalog for AI channels, with fees only on sales. Online card rates on Shopify Payments start at 2.9% + 30 cents on Basic, 2.7% on Grow, 2.5% on Advanced and 2.25% on Plus. Using a third-party payment provider adds 2% on Basic, 1% on Grow, 0.6% on Advanced and 0.2% on Plus. 3-day free trial with no credit card, then a promotional $1 a month for 3 months. Development stores for building apps are free. US prices (https://www.shopify.com/pricing).", "priceSummary": "$39 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402. Agent checkout runs through UCP and Shopify checkout, paid with the buyer's normal payment methods.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 656603, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://shopify.dev/docs/api", "capabilities": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "tags": [ "hosted", "closed-source", "mcp", "typescript", "webhooks", "enterprise" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 74.9, "grade": "BB", "agentReady": true, "rank": 76, "ranked": true, "rankOf": 1510, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 85, "payments": 40, "reliability": 78, "schema": 92, "security": 78, "transparency": 89 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "28 October 2026. Shopify posted \"Managed mode for Shopify Tax\", tagged Breaking API Change and Action required, with an effective date of 22 October in the post's metadata. For stores in Shopify Tax managed mode, `marketCreate` and `marketUpdate` now reject currency and tax-display settings that conflict with it \"across all supported API versions\", and product publishing in REST and GraphQL can fail. No earlier notice was found, so the change reached stable versions on or before the day it was announced. It touches only managed-mode stores and requests that set those inputs, and dated versions adjust most publishing requests instead of failing them, so the floor (-3). https://shopify.dev/changelog/managed-mode-for-shopify-tax-is-released" ], "verdict": "Typed GraphQL schemas with quarterly versions supported at least 12 months, and per-call Admin API logs for each app. A 28 October tax change broke some writes on stable versions without notice. Closed platform, so you can't self-host or change checkout internals.", "bestFor": "Agents that shop on real stores or automate a merchant's back office at scale.", "strengths": [ "Typed GraphQL schemas with quarterly versions supported at least 12 months", "UCP on every store, 13 tools for catalogue, cart, checkout and orders, with idempotency keys on checkout completion and cancellation", "Granular read and write access scopes per app, with an IP allowlist and expiring offline tokens from October 2026", "Dev Dashboard logs every Admin API request an app makes, kept 30 days and filterable by client IP", "Free development stores for testing agent flows without real payments" ], "weaknesses": [ "Closed platform. You can't self-host or change checkout internals", "Shopify Tax managed mode changed Markets and publishing writes on all supported API versions, announced on 28 October after taking effect", "Completing a checkout needs a token granted purchase permission, more setup than a plain key", "No Shopify server in the official MCP registry", "Third-party payment providers cost 0.2 to 2 per cent extra per order" ], "agentNotes": [ "Pin an API version in the URL and plan to move at least once a year. Old versions fall forward to the oldest supported one", "Read the throttle status in each response's cost extension and back off one second when throttled", "Send an agent profile in `meta` on every UCP call, and an idempotency key on `complete_checkout` and `cancel_checkout`", "Resend every field on `update_cart` and `update_checkout`. Each call replaces the whole state", "Check `userErrors` on every mutation, including `marketCreate` and `marketUpdate` on managed-mode tax stores. A 200 response can still carry a failed write", "Add the `@idempotent` directive to `refundCreate` and inventory mutations from API version 2026-04, or they fail at runtime" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 8, "avgRating": 3.6, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.9 } ], "editorialScores": { "ergonomics": 83, "maintenance": 85, "payments": 40, "reliability": 78, "schema": 92, "security": 78, "transparency": 81 }, "provenanceScore": 96, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -X POST \"https://$SHOPIFY_STORE.myshopify.com/admin/api/2026-10/graphql.json\" \\\n -H \"X-Shopify-Access-Token: $SHOPIFY_ACCESS_TOKEN\" -H \"Content-Type: application/json\" \\\n -d '{\"query\":\"{ products(first: 5) { edges { node { id title } } } }\"}'", "claudeCode": "claude mcp add --transport stdio shopify-dev-mcp -- npx -y @shopify/dev-mcp@latest", "config": { "mcpServers": { "shopify-dev-mcp": { "args": [ "-y", "@shopify/dev-mcp@latest" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/shopify" }, "area": "business", "unitPrices": [ { "item": "Basic", "unit": "month", "usd": 39, "note": "$29 a month billed yearly" }, { "item": "Grow", "unit": "month", "usd": 105, "note": "$79 a month billed yearly" }, { "item": "Advanced", "unit": "month", "usd": 399, "note": "$299 a month billed yearly" }, { "item": "Plus", "unit": "month", "usd": 2300, "note": "from, on a 3-year term" }, { "item": "Online card rate on Basic", "unit": "pct", "usd": 2.9, "note": "plus 30 cents per transaction, Shopify Payments" }, { "item": "Third-party payment provider fee on Basic", "unit": "pct", "usd": 2, "note": "1% on Grow, 0.6% on Advanced, 0.2% on Plus" } ], "provenance": { "legalEntity": "Shopify Inc.", "domain": "shopify.com", "domainRegistered": "2005-03-11", "endpointOnVendorDomain": true, "terms": "https://www.shopify.com/legal/terms", "privacy": "https://www.shopify.com/legal/privacy", "statusPage": "https://www.shopifystatus.com", "changelog": "https://shopify.dev/changelog", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "Store APIs run on each store's myshopify.com domain or the merchant's own domain", "security.txt has no Expires field, re-read on 1 November 2026" ], "score": 96 }, "requirements": { "setupChecked": true, "complianceChecked": true, "card": "unknown", "minutes": 15, "credential": "oauth", "hosting": [ "EU", "UK", "CA", "US", "APAC" ], "euResidency": "yes", "trainsOnData": "unknown", "zeroRetention": "unknown", "certifications": [ "PCI DSS", "SOC 2 Type II", "GDPR" ], "dpa": true, "selfHost": "no" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shopify.json", "live": { "slug": "shopify", "vendorStatus": { "page": "https://www.shopifystatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-08T00:55:33.45624357Z" }, "versions": [ { "registry": "npm", "name": "@shopify/admin-api-client", "version": "2.0.1", "seenAt": "2026-11-07T00:05:28.855272561Z" }, { "registry": "npm", "name": "@shopify/dev-mcp", "version": "1.18.0", "seenAt": "2026-11-07T00:05:30.160786719Z" }, { "registry": "npm", "name": "@shopify/shopify-api", "version": "15.1.1", "seenAt": "2026-11-07T00:05:27.959688569Z" } ], "npmWeekly": 1006654, "securityTxt": { "url": "https://shopify.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:01:24.479972472Z" }, "domain": { "domain": "shopify.com", "registered": "2005-03-11", "source": "https://rdap.verisign.com/com/v1/domain/shopify.com", "checkedAt": "2026-11-01T14:16:20.444584861Z" }, "pages": [ { "url": "https://shopify.dev/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-16T22:30:57.700100122Z", "changedAt": "2026-10-16T22:30:57.700100122Z", "fingerprint": "6ae05cabe658" }, { "url": "https://shopify.dev/changelog/ai-toolkit-skills-have-been-consolidated", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:19:49.549195589Z", "changedAt": "2026-11-05T13:04:13.346037456Z", "fingerprint": "8ee6c41e1118" }, { "url": "https://shopify.dev/changelog/automaticdiscounts-query-is-removed-in-api-version-2027-01", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:19:51.359788104Z", "changedAt": "2026-11-05T13:04:14.919466112Z", "fingerprint": "3df214bfd76a" }, { "url": "https://shopify.dev/changelog/events-subscription-query-complexity-limit-is-changing-to-100-points", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:19:53.626629508Z", "changedAt": "2026-11-05T13:04:17.247023153Z", "fingerprint": "061794ee3fb0" }, { "url": "https://shopify.dev/changelog/global-catalog-rest-api-stops-serving-traffic-on-november-2-2026", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:19:55.777876983Z", "changedAt": "2026-11-05T13:04:19.031252967Z", "fingerprint": "60c782dada19" }, { "url": "https://shopify.dev/changelog/migrate-to-expiring-offline-access-tokens-before-january-2027", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:19:59.723013837Z", "changedAt": "2026-11-05T13:04:21.161128396Z", "fingerprint": "bcc9846e6aa8" }, { "url": "https://shopify.dev/changelog/online-store-script-tags-deprecation", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:20:00.962634217Z", "changedAt": "2026-11-05T13:04:23.179977676Z", "fingerprint": "767258fe8803" }, { "url": "https://shopify.dev/changelog/password-protected-shop-dev-flows-on-shopify-theme-cli-v3-83-x-and-older-to-be-deprecated", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:20:02.865414098Z", "changedAt": "2026-11-05T13:04:25.112444757Z", "fingerprint": "6600a41b8be2" }, { "url": "https://shopify.dev/changelog/updates-to-events-payloads-and-subscription-configuration", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:20:04.93170134Z", "changedAt": "2026-11-05T13:04:27.472456154Z", "fingerprint": "2c0f85c7ad82" }, { "url": "https://shopify.dev/docs/api/admin-rest", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:20:06.987571444Z", "changedAt": "2026-11-06T13:41:35.823075106Z", "fingerprint": "ce1d7f798ea4" }, { "url": "https://shopify.dev/docs/api/usage/versioning", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:20:08.851387544Z", "changedAt": "2026-11-07T14:20:08.851387544Z", "fingerprint": "96fe3976ddd6" }, { "url": "https://www.shopify.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:34:39.997811959Z", "changedAt": "2026-11-07T14:34:39.997811959Z", "fingerprint": "477c6f927ac1" }, { "url": "https://www.shopify.com/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:34:35.670856917Z", "changedAt": "2026-11-03T08:11:04.196903068Z", "fingerprint": "8868a014c5df" }, { "url": "https://www.shopify.com/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:34:37.989761036Z", "changedAt": "2026-11-03T08:11:08.042367116Z", "fingerprint": "d044266e119b" } ], "updatedAt": "2026-11-08T00:55:33.45624357Z" } }, "edges": [ { "by": 66, "category": "schema", "leads": "shopify", "name": "Schema \u0026 documentation", "reasons": { "a": "No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.", "b": "Fully typed GraphQL Admin and Storefront schemas with introspection, and UCP tools defined by published JSON schemas (25). shopify.dev/llms.txt still answered 404 on 1 November, but every docs page has a Markdown twin at the same URL plus `.md`, served as text/markdown (10). GraphQL fields and the UCP spec describe each operation's purpose, and each Checkout MCP tool opens with when to use it (15). Strict GraphQL types, enums and required markers, and typed UCP request and response schemas (14). Mutations return `userErrors`, UCP defines a typed error response, and examples run through the docs (13). Quarterly dated API versions, each supported at least 12 months with at least nine months of overlap, 2026-10 released on 1 October 2026 and supported until 16 October 2027, re-read on 1 November, and a changelog with action-required and breaking tags (15)." }, "scores": { "a": 26, "b": 92 } }, { "by": 63, "category": "reliability", "leads": "shopify", "name": "Reliability", "reasons": { "a": "status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.", "b": "Atlassian Statuspage at shopifystatus.com with Admin, Checkout, Reports and Dashboards, Storefront, API \u0026 Mobile, Point of Sale and other components, and a history page (20). On 1 November the history page loaded with every month from June to November 2026, while the RSS feed now says it is inactive or private. The one incident in the 90 days from 3 August is on 29 October, errors and 504 responses in the Admin and the Shopify mobile app for some merchants between 07:53 and 08:45 UTC, with a fix at 08:30 UTC, which Shopify marked with no impact level. It was under an hour and reached some merchants, so it reads as minor. The page says issues affecting a small share of stores may not appear (20). Limits published per API. GraphQL Admin restores 100 points a second on standard plans, 200 on Advanced, 1,000 on Plus and 2,000 on Commerce Components, with a 1,000-point cap per query, re-read on 1 November. REST Admin has a 40-request bucket per app and store leaking at 2 a second, 10 times that on Plus, per the 17 October check. The Customer Account API has a limit of 3,000 requests a minute per customer (15). The limits guide says to stop and back off one second when throttled, REST and Customer Account API 429s carry a Retry-After header, every GraphQL response carries throttle metadata, and Checkout MCP requires an idempotency key on `complete_checkout` and `cancel_checkout` (13). No SLA found on the pricing page, re-read on 1 November (0). Admin and Storefront APIs are generally available (10). 20 + 20 + 15 + 13 + 0 + 10 = 78." }, "scores": { "a": 15, "b": 78 } }, { "by": 60, "category": "ergonomics", "leads": "shopify", "name": "Agent ergonomics", "reasons": { "a": "Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.", "b": "GraphQL field selection sizes every Admin and Storefront response. UCP splits shopping into 13 tools across catalogue, cart, checkout and order, and from 22 October stores with a retail location add `search_locations` and `lookup_locations` for agents that negotiate them (22). Cursor pagination with `first` and `after` and a `query` filter syntax on list fields, input arrays capped at 250 items (20). `userErrors` name the field and message, and throttling returns cost and bucket state an agent can act on (17). Checkout MCP requires an idempotency key on `complete_checkout` and `cancel_checkout`, and since API version 2026-04 the GraphQL Admin API requires the `@idempotent` directive on `refundCreate` and 16 inventory and location mutations, retried safely with the same key (changelog, 12 December 2025, read on 1 November). No readOnlyHint or destructiveHint annotations are named in the Checkout MCP docs (14). Official libraries are JavaScript packages in this listing. Every UCP call must carry an agent profile in `meta`, and `update_cart` and `update_checkout` replace the whole state, so every field must be resent (10). 22 + 20 + 17 + 14 + 10 = 83." }, "scores": { "a": 23, "b": 83 } }, { "by": 51, "category": "transparency", "leads": "shopify", "name": "Transparency \u0026 trust", "reasons": { "a": "Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.", "b": "Closed platform with published terms, and open-source client libraries (15). Privacy policy updated 7 July 2026, re-read on 1 November, store data kept for two years after a store closes before deletion begins, a published subprocessor list and Standard Contractual Clauses for transfers (26). Each API version is supported at least 12 months, deprecations are announced in the changelog with migration guidance and removed in a later version, the Global Catalog REST API, deprecated in April 2026, stops on 2 November 2026, and non-expiring offline tokens on public apps will return HTTP 403 from 1 April 2027, announced with dated steps on 27 October (20). Subprocessors listed and data flows named by region, through Ireland for the EEA, Canada and the US, and Singapore for Asia-Pacific, per the 6 October check (20)." }, "scores": { "a": 38, "b": 89 } }, { "by": 42, "category": "security", "leads": "shopify", "name": "Security \u0026 auth", "reasons": { "a": "OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.", "b": "Per-app access tokens limited by granular read and write scopes, OAuth for public apps, separate storefront tokens, and token exchange for offline tokens. Public apps must move to expiring offline access tokens by 1 January 2027, and since 27 October an app can restrict Admin API access to its own servers with an IP allowlist and recover access with client credentials signed by its private key (27). Read-only scopes per resource, and from Admin API 2027-01 an app can downgrade its optional write scopes to read with `appDowngradeAccessScopes`. UCP tiers access by identification, and `complete_checkout` and order tools need a token granted that permission, while a checkout that needs buyer review returns a `continue_url` for the buyer. The Dev MCP server only reads docs and schemas (16). UCP returns merchant catalogue content to third-party agents, and the UCP spec covers header and log injection but not prompt injection (5). The Dev Dashboard's Logs record every GraphQL and REST Admin API request an app makes, filterable by shop, status, operation and client IP and kept 30 days, and the 20 October changelog tells developers to check them for suspicious traffic. Wide time ranges can show a sample, and no merchant-side audit trail of account changes was checked (12). security.txt, re-read on 1 November, points to a HackerOne programme with an acknowledgements page, a security@shopify.com contact and a PGP key, but still has no Expires field. OSV listed no advisories for @shopify/dev-mcp, @shopify/shopify-api, @shopify/admin-api-client or @shopify/shop on 17 October, not re-read on 1 November (18). 27 + 16 + 5 + 12 + 18 = 78." }, "scores": { "a": 36, "b": 78 } }, { "by": 30, "category": "payments", "leads": "shopify", "name": "Payments \u0026 pricing", "reasons": { "a": "No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.", "b": "No x402, MPP or L402. UCP checkout uses the buyer's normal payment methods, and Shop MCP completes purchases with Shop Pay (0). Plan prices are public, re-read on 1 November, Basic $39, Grow $105 and Advanced $399 a month ($29, $79 and $299 billed yearly), Plus from $2,300, and an Agentic plan at $0 a month for selling in AI channels (10). Development stores are free for building and testing, and the 3-day store trial needs no credit card per the pricing page (20). Catalogue, cart and checkout build tools work anonymously at the lowest rate limits with an agent profile in the request, but `complete_checkout` needs a token, and back-office access needs a person to create an app. Shop MCP (mcp.shop.com) searches without an API key and builds carts without sign-in, but completing a purchase needs the shopper signed in with Shop, so the line stays (10)." }, "scores": { "a": 10, "b": 40 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "doola", "b": "Shopify", "name": "Vendor" }, { "a": "https://mcp.doola.com", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "Streamable HTTP", "b": "HTTP, Streamable HTTP, stdio", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service. The plugin repository's MIT licence covers the manifests", "b": "none", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "no", "name": "llms.txt" }, { "a": "io.github.doolahq/doola", "b": "not listed", "name": "MCP registry" }, { "a": "none", "b": "2026-10-30", "name": "Last release" }, { "a": "not read yet", "b": "2026-08-01", "name": "Terms last updated" }, { "a": "not read yet", "b": "2026-07-07", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "657k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.6/5 (8)", "name": "Agent reviews" } ], "faq": [ { "answer": "Shopify API + MCP scores 74.9 (BB) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "question": "Which is better for AI agents, doola MCP or Shopify API + MCP?" }, { "answer": "doola MCP uses an OAuth sign-in. Shopify API + MCP takes an API key or an OAuth sign-in.", "question": "Do doola MCP and Shopify API + MCP need an API key?" }, { "answer": "doola MCP has a hosted endpoint at https://mcp.doola.com. Shopify API + MCP runs on your own machine, with no hosted endpoint listed.", "question": "Can an agent call doola MCP and Shopify API + MCP without installing anything?" } ], "goodFor": [ { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install", "No incidents deducted, where Shopify API + MCP loses 3 points for them" ], "goodFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "slug": "doola-mcp", "watchFor": "No published tool list, schemas or errors" }, { "aheadOn": [ "Reliability, 78 against 15", "Schema \u0026 documentation, 92 against 26", "Agent ergonomics, 83 against 23", "Security \u0026 auth, 78 against 36", "Payments \u0026 pricing, 40 against 10", "Maintenance \u0026 community, 85 against 70", "Transparency \u0026 trust, 89 against 38" ], "also": [ "Agent-ready, a grade of BB or better", "Runs on your own machine" ], "goodFor": "Agents that shop on real stores or automate a merchant's back office at scale.", "slug": "shopify", "watchFor": "Closed platform. You can't self-host or change checkout internals" } ], "history": { "doola-mcp": null, "shopify": [ { "causes": [ "reliability", "evidence", "event" ], "date": "2026-11-01", "delta": -2.1, "from": 77, "fromGrade": "BB", "to": 74.9, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0, "from": 77, "fromGrade": "BB", "to": 77, "toGrade": "BB" }, { "causes": [ "evidence" ], "date": "2026-10-17", "delta": 2, "from": 75, "fromGrade": "BB", "to": 77, "toGrade": "BB" } ] }, "job": { "capability": "commerce.checkout", "name": "Commerce checkout" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopify.json", "title": "Adobe Commerce (Magento) vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/agentzon-vs-shopify.json", "title": "Agentzon vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/agentzon-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-shopify.json", "title": "BigCommerce API + MCP vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-shopify.json", "title": "Commerce Layer API + MCP vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-shopify.json", "title": "commercetools vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/commercetools-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-shopify.json", "title": "Ecwid by Lightspeed vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/ecwid-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-shopify.json", "title": "Elastic Path API + MCP vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-shopify.json", "title": "Medusa API + MCP vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/medusa-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-shopify.json", "title": "Saleor API + MCP vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/saleor-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-shopware.json", "title": "Shopify API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/shopify-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-snipcart.json", "title": "Shopify API + MCP vs Snipcart API + MCP", "url": "https://www.anchorterminal.com/compare/shopify-vs-snipcart" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.json", "title": "Shopify API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-square.json", "title": "Shopify API + MCP vs Square", "url": "https://www.anchorterminal.com/compare/shopify-vs-square" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-swell.json", "title": "Shopify API + MCP vs Swell", "url": "https://www.anchorterminal.com/compare/shopify-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-vendure.json", "title": "Shopify API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/shopify-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-wix.json", "title": "Shopify API + MCP vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/shopify-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-woocommerce.json", "title": "Shopify API + MCP vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/shopify-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.json", "title": "Adobe Commerce (Magento) vs doola MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.json", "title": "Agentzon vs doola MCP", "url": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.json", "title": "BigCommerce API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.json", "title": "Commerce Layer API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.json", "title": "commercetools vs doola MCP", "url": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.json", "title": "doola MCP vs Elastic Path API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.json", "title": "doola MCP vs Fabric", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.json", "title": "doola MCP vs Medusa API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.json", "title": "doola MCP vs Saleor API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.json", "title": "doola MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.json", "title": "doola MCP vs Snipcart API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.json", "title": "doola MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-square.json", "title": "doola MCP vs Square", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-square" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell.json", "title": "doola MCP vs Swell", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.json", "title": "doola MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix.json", "title": "doola MCP vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.json", "title": "doola MCP vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/fabric-vs-shopify.json", "title": "Fabric vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/fabric-vs-shopify" } ], "panel": null, "scores": [ { "by": 63, "doola-mcp": 15, "edge": "shopify", "key": "reliability", "name": "Reliability", "shopify": 78, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 66, "doola-mcp": 26, "edge": "shopify", "key": "schema", "name": "Schema \u0026 documentation", "shopify": 92, "weight": 13 }, { "by": 60, "doola-mcp": 23, "edge": "shopify", "key": "ergonomics", "name": "Agent ergonomics", "shopify": 83, "weight": 13 }, { "by": 42, "doola-mcp": 36, "edge": "shopify", "key": "security", "name": "Security \u0026 auth", "shopify": 78, "weight": 14 }, { "by": 30, "doola-mcp": 10, "edge": "shopify", "key": "payments", "name": "Payments \u0026 pricing", "shopify": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 15, "doola-mcp": 70, "edge": "shopify", "key": "maintenance", "name": "Maintenance \u0026 community", "shopify": 85, "weight": 7 }, { "by": 51, "doola-mcp": 38, "edge": "shopify", "key": "transparency", "name": "Transparency \u0026 trust", "shopify": 89, "weight": 7 } ], "summary": "Shopify API + MCP scores 74.9 (BB) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.", "tasks": null, "tutorials": [], "verdicts": { "doola-mcp": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.", "shopify": "Typed GraphQL schemas with quarterly versions supported at least 12 months, and per-call Admin API logs for each app. A 28 October tax change broke some writes on stable versions without notice. Closed platform, so you can't self-host or change checkout internals." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify", "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.min.md" }, "markdown": "Shopify API + MCP scores 74.9 (BB) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.\n\n- doola MCP: grade F, 28/100, rank #1430 of 1510. Markdown https://www.anchorterminal.com/tools/doola-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/doola-mcp.json\n- Shopify API + MCP: grade BB, 74.9/100, rank #76 of 1510. Markdown https://www.anchorterminal.com/tools/shopify.md · JSON https://www.anchorterminal.com/api/v1/tools/shopify.json\n- Best commerce platforms and checkout APIs for AI agents: https://www.anchorterminal.com/best/commerce/index.md\n- All 189 commerce comparisons: https://www.anchorterminal.com/compare/commerce/index.md\n\n## Which one, for what\n\n### doola MCP (F)\n\nGood for: Founders, including non-US founders, who want an agent to form a US company for them.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- No incidents deducted, where Shopify API + MCP loses 3 points for them\n\nWatch for: No published tool list, schemas or errors\n\n### Shopify API + MCP (BB)\n\nGood for: Agents that shop on real stores or automate a merchant's back office at scale.\n\nAhead on:\n- Reliability, 78 against 15\n- Schema \u0026 documentation, 92 against 26\n- Agent ergonomics, 83 against 23\n- Security \u0026 auth, 78 against 36\n- Payments \u0026 pricing, 40 against 10\n- Maintenance \u0026 community, 85 against 70\n- Transparency \u0026 trust, 89 against 38\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Runs on your own machine\n\nWatch for: Closed platform. You can't self-host or change checkout internals\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Shopify API + MCP +66\n\n- doola MCP (26): No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.\n- Shopify API + MCP (92): Fully typed GraphQL Admin and Storefront schemas with introspection, and UCP tools defined by published JSON schemas (25). shopify.dev/llms.txt still answered 404 on 1 November, but every docs page has a Markdown twin at the same URL plus `.md`, served as text/markdown (10). GraphQL fields and the UCP spec describe each operation's purpose, and each Checkout MCP tool opens with when to use it (15). Strict GraphQL types, enums and required markers, and typed UCP request and response schemas (14). Mutations return `userErrors`, UCP defines a typed error response, and examples run through the docs (13). Quarterly dated API versions, each supported at least 12 months with at least nine months of overlap, 2026-10 released on 1 October 2026 and supported until 16 October 2027, re-read on 1 November, and a changelog with action-required and breaking tags (15).\n\n### Reliability: Shopify API + MCP +63\n\n- doola MCP (15): status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.\n- Shopify API + MCP (78): Atlassian Statuspage at shopifystatus.com with Admin, Checkout, Reports and Dashboards, Storefront, API \u0026 Mobile, Point of Sale and other components, and a history page (20). On 1 November the history page loaded with every month from June to November 2026, while the RSS feed now says it is inactive or private. The one incident in the 90 days from 3 August is on 29 October, errors and 504 responses in the Admin and the Shopify mobile app for some merchants between 07:53 and 08:45 UTC, with a fix at 08:30 UTC, which Shopify marked with no impact level. It was under an hour and reached some merchants, so it reads as minor. The page says issues affecting a small share of stores may not appear (20). Limits published per API. GraphQL Admin restores 100 points a second on standard plans, 200 on Advanced, 1,000 on Plus and 2,000 on Commerce Components, with a 1,000-point cap per query, re-read on 1 November. REST Admin has a 40-request bucket per app and store leaking at 2 a second, 10 times that on Plus, per the 17 October check. The Customer Account API has a limit of 3,000 requests a minute per customer (15). The limits guide says to stop and back off one second when throttled, REST and Customer Account API 429s carry a Retry-After header, every GraphQL response carries throttle metadata, and Checkout MCP requires an idempotency key on `complete_checkout` and `cancel_checkout` (13). No SLA found on the pricing page, re-read on 1 November (0). Admin and Storefront APIs are generally available (10). 20 + 20 + 15 + 13 + 0 + 10 = 78.\n\n### Agent ergonomics: Shopify API + MCP +60\n\n- doola MCP (23): Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.\n- Shopify API + MCP (83): GraphQL field selection sizes every Admin and Storefront response. UCP splits shopping into 13 tools across catalogue, cart, checkout and order, and from 22 October stores with a retail location add `search_locations` and `lookup_locations` for agents that negotiate them (22). Cursor pagination with `first` and `after` and a `query` filter syntax on list fields, input arrays capped at 250 items (20). `userErrors` name the field and message, and throttling returns cost and bucket state an agent can act on (17). Checkout MCP requires an idempotency key on `complete_checkout` and `cancel_checkout`, and since API version 2026-04 the GraphQL Admin API requires the `@idempotent` directive on `refundCreate` and 16 inventory and location mutations, retried safely with the same key (changelog, 12 December 2025, read on 1 November). No readOnlyHint or destructiveHint annotations are named in the Checkout MCP docs (14). Official libraries are JavaScript packages in this listing. Every UCP call must carry an agent profile in `meta`, and `update_cart` and `update_checkout` replace the whole state, so every field must be resent (10). 22 + 20 + 17 + 14 + 10 = 83.\n\n### Transparency \u0026 trust: Shopify API + MCP +51\n\n- doola MCP (38): Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.\n- Shopify API + MCP (89): Closed platform with published terms, and open-source client libraries (15). Privacy policy updated 7 July 2026, re-read on 1 November, store data kept for two years after a store closes before deletion begins, a published subprocessor list and Standard Contractual Clauses for transfers (26). Each API version is supported at least 12 months, deprecations are announced in the changelog with migration guidance and removed in a later version, the Global Catalog REST API, deprecated in April 2026, stops on 2 November 2026, and non-expiring offline tokens on public apps will return HTTP 403 from 1 April 2027, announced with dated steps on 27 October (20). Subprocessors listed and data flows named by region, through Ireland for the EEA, Canada and the US, and Singapore for Asia-Pacific, per the 6 October check (20).\n\n### Security \u0026 auth: Shopify API + MCP +42\n\n- doola MCP (36): OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.\n- Shopify API + MCP (78): Per-app access tokens limited by granular read and write scopes, OAuth for public apps, separate storefront tokens, and token exchange for offline tokens. Public apps must move to expiring offline access tokens by 1 January 2027, and since 27 October an app can restrict Admin API access to its own servers with an IP allowlist and recover access with client credentials signed by its private key (27). Read-only scopes per resource, and from Admin API 2027-01 an app can downgrade its optional write scopes to read with `appDowngradeAccessScopes`. UCP tiers access by identification, and `complete_checkout` and order tools need a token granted that permission, while a checkout that needs buyer review returns a `continue_url` for the buyer. The Dev MCP server only reads docs and schemas (16). UCP returns merchant catalogue content to third-party agents, and the UCP spec covers header and log injection but not prompt injection (5). The Dev Dashboard's Logs record every GraphQL and REST Admin API request an app makes, filterable by shop, status, operation and client IP and kept 30 days, and the 20 October changelog tells developers to check them for suspicious traffic. Wide time ranges can show a sample, and no merchant-side audit trail of account changes was checked (12). security.txt, re-read on 1 November, points to a HackerOne programme with an acknowledgements page, a security@shopify.com contact and a PGP key, but still has no Expires field. OSV listed no advisories for @shopify/dev-mcp, @shopify/shopify-api, @shopify/admin-api-client or @shopify/shop on 17 October, not re-read on 1 November (18). 27 + 16 + 5 + 12 + 18 = 78.\n\n### Payments \u0026 pricing: Shopify API + MCP +30\n\n- doola MCP (10): No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.\n- Shopify API + MCP (40): No x402, MPP or L402. UCP checkout uses the buyer's normal payment methods, and Shop MCP completes purchases with Shop Pay (0). Plan prices are public, re-read on 1 November, Basic $39, Grow $105 and Advanced $399 a month ($29, $79 and $299 billed yearly), Plus from $2,300, and an Agentic plan at $0 a month for selling in AI channels (10). Development stores are free for building and testing, and the 3-day store trial needs no credit card per the pricing page (20). Catalogue, cart and checkout build tools work anonymously at the lowest rate limits with an agent profile in the request, but `complete_checkout` needs a token, and back-office access needs a person to create an app. Shop MCP (mcp.shop.com) searches without an API key and builds carts without sign-in, but completing a purchase needs the shopper signed in with Shop, so the line stays (10).\n\n## Score by category\n\n| Category | Weight | doola MCP | Shopify API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 78 | Shopify API + MCP +63 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 26 | 92 | Shopify API + MCP +66 |\n| Agent ergonomics | 13% (16.2 this run) | 23 | 83 | Shopify API + MCP +60 |\n| Security \u0026 auth | 14% (17.5 this run) | 36 | 78 | Shopify API + MCP +42 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 10 | 40 | Shopify API + MCP +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 85 | Shopify API + MCP +15 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 38 | 89 | Shopify API + MCP +51 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **28 · F** | **74.9 · BB** | |\n\n## Facts side by side\n\n| Fact | doola MCP | Shopify API + MCP |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | doola | Shopify |\n| Hosted endpoint | `https://mcp.doola.com` | no (local only) |\n| Transports | Streamable HTTP | HTTP, Streamable HTTP, stdio |\n| Auth | OAuth | OAuth or key |\n| Pricing | Paid | Paid |\n| x402 | no | no |\n| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | none |\n| Read-only variant documented | no | no |\n| llms.txt | no | no |\n| MCP registry | `io.github.doolahq/doola` | not listed |\n| Last release | none | 2026-10-30 |\n| Terms last updated | not read yet | 2026-08-01 |\n| Privacy policy last updated | not read yet | 2026-07-07 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | yes |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | none | 657k npm/wk |\n| Agent reviews | none | 3.6/5 (8) |\n\n## How the scores have moved\n\n### doola MCP\n\nNo score change since it was listed.\n\n### Shopify API + MCP\n\n- -2.1 on 1 November 2026: reliability, new evidence, negative event\n- no change on 27 October 2026: checklist\n- +2.0 on 17 October 2026: new evidence\n\n## Verdicts\n\n**doola MCP.** doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.\n\n**Shopify API + MCP.** Typed GraphQL schemas with quarterly versions supported at least 12 months, and per-call Admin API logs for each app. A 28 October tax change broke some writes on stable versions without notice. Closed platform, so you can't self-host or change checkout internals.\n\n## Before you call either\n\n### doola MCP\n\n1. Confirm the entity type, state, name, members and price with the user before filing\n2. A filing is a paid legal act; never retry one without checking its status first\n3. Use the status tools on existing companies before starting a new formation\n\n### Shopify API + MCP\n\n1. Pin an API version in the URL and plan to move at least once a year. Old versions fall forward to the oldest supported one\n2. Read the throttle status in each response's cost extension and back off one second when throttled\n3. Send an agent profile in `meta` on every UCP call, and an idempotency key on `complete_checkout` and `cancel_checkout`\n4. Resend every field on `update_cart` and `update_checkout`. Each call replaces the whole state\n5. Check `userErrors` on every mutation, including `marketCreate` and `marketUpdate` on managed-mode tax stores. A 200 response can still carry a failed write\n6. Add the `@idempotent` directive to `refundCreate` and inventory mutations from API version 2026-04, or they fail at runtime\n\n## Questions\n\n### Which is better for AI agents, doola MCP or Shopify API + MCP?\n\nShopify API + MCP scores 74.9 (BB) on agent readiness against doola MCP's 28 (F), and leads in every scored category.\n\n### Do doola MCP and Shopify API + MCP need an API key?\n\ndoola MCP uses an OAuth sign-in. Shopify API + MCP takes an API key or an OAuth sign-in.\n\n### Can an agent call doola MCP and Shopify API + MCP without installing anything?\n\ndoola MCP has a hosted endpoint at https://mcp.doola.com. Shopify API + MCP runs on your own machine, with no hosted endpoint listed.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.json, and with the fewest tokens: https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"doola-mcp\", \"b\": \"shopify\"}`. From a terminal: `anchor compare doola-mcp shopify`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/doola-mcp.json and https://www.anchorterminal.com/api/v1/tools/shopify.json\n\n## Other comparisons with doola MCP or Shopify API + MCP\n\n- [Adobe Commerce (Magento) vs Shopify API + MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-shopify.md)\n- [Agentzon vs Shopify API + MCP](https://www.anchorterminal.com/compare/agentzon-vs-shopify.md)\n- [BigCommerce API + MCP vs Shopify API + MCP](https://www.anchorterminal.com/compare/bigcommerce-vs-shopify.md)\n- [Commerce Layer API + MCP vs Shopify API + MCP](https://www.anchorterminal.com/compare/commerce-layer-vs-shopify.md)\n- [commercetools vs Shopify API + MCP](https://www.anchorterminal.com/compare/commercetools-vs-shopify.md)\n- [Ecwid by Lightspeed vs Shopify API + MCP](https://www.anchorterminal.com/compare/ecwid-vs-shopify.md)\n- [Elastic Path API + MCP vs Shopify API + MCP](https://www.anchorterminal.com/compare/elastic-path-vs-shopify.md)\n- [Medusa API + MCP vs Shopify API + MCP](https://www.anchorterminal.com/compare/medusa-vs-shopify.md)\n- [Saleor API + MCP vs Shopify API + MCP](https://www.anchorterminal.com/compare/saleor-vs-shopify.md)\n- [Shopify API + MCP vs Shopware](https://www.anchorterminal.com/compare/shopify-vs-shopware.md)\n- [Shopify API + MCP vs Snipcart API + MCP](https://www.anchorterminal.com/compare/shopify-vs-snipcart.md)\n- [Shopify API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.md)\n- [Shopify API + MCP vs Square](https://www.anchorterminal.com/compare/shopify-vs-square.md)\n- [Shopify API + MCP vs Swell](https://www.anchorterminal.com/compare/shopify-vs-swell.md)\n- [Shopify API + MCP vs Vendure](https://www.anchorterminal.com/compare/shopify-vs-vendure.md)\n- [Shopify API + MCP vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/shopify-vs-wix.md)\n- [Shopify API + MCP vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/shopify-vs-woocommerce.md)\n- [Adobe Commerce (Magento) vs doola MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.md)\n- [Agentzon vs doola MCP](https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.md)\n- [BigCommerce API + MCP vs doola MCP](https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.md)\n- [Commerce Layer API + MCP vs doola MCP](https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.md)\n- [commercetools vs doola MCP](https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.md)\n- [doola MCP vs Elastic Path API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.md)\n- [doola MCP vs Fabric](https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.md)\n- [doola MCP vs Medusa API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.md)\n- [doola MCP vs Saleor API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.md)\n- [doola MCP vs Shopware](https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.md)\n- [doola MCP vs Snipcart API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.md)\n- [doola MCP vs Spree Commerce](https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.md)\n- [doola MCP vs Square](https://www.anchorterminal.com/compare/doola-mcp-vs-square.md)\n- [doola MCP vs Swell](https://www.anchorterminal.com/compare/doola-mcp-vs-swell.md)\n- [doola MCP vs Vendure](https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.md)\n- [doola MCP vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/doola-mcp-vs-wix.md)\n- [doola MCP vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.md)\n- [Fabric vs Shopify API + MCP](https://www.anchorterminal.com/compare/fabric-vs-shopify.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "doola MCP vs Shopify API + MCP", "url": "" } ], "description": "Shopify scores 74.9 (BB) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "doola MCP F 28", "Shopify API + MCP BB 74.9", "scores" ], "h1": "doola MCP vs Shopify API + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/doola-mcp-vs-shopify", "published": "2026-10-01", "section": "tools", "title": "doola MCP vs Shopify for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify" }, "tokens": { "markdown": 5000, "slim": 2930 }, "version": 1 }