# doola MCP vs Shopify API + MCP (slim)

> Shopify scores 74.9 (BB) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.md (~5,000 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.json · canonical https://www.anchorterminal.com/compare/doola-mcp-vs-shopify
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Shopify API + MCP scores 74.9 (BB) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.

- doola MCP: F 28, rank #1430 of 1510 · https://www.anchorterminal.com/tools/doola-mcp.min.md
- Shopify API + MCP: BB 74.9, rank #76 of 1510 · https://www.anchorterminal.com/tools/shopify.min.md
- doola MCP, good for Founders, including non-US founders, who want an agent to form a US company for them. Also A hosted endpoint, with nothing to install; No incidents deducted, where Shopify API + MCP loses 3 points for them.
- Shopify API + MCP, good for Agents that shop on real stores or automate a merchant's back office at scale. Ahead on Reliability, 78 against 15; Schema & documentation, 92 against 26; Agent ergonomics, 83 against 23; Security & auth, 78 against 36; Payments & pricing, 40 against 10; Maintenance & community, 85 against 70; Transparency & trust, 89 against 38. Also Agent-ready, a grade of BB or better; Runs on your own machine.

| Category | doola MCP | Shopify API + MCP |
| --- | --- | --- |
| Reliability (16%) | 15 | 78 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 26 | 92 |
| Agent ergonomics (13%) | 23 | 83 |
| Security & auth (14%) | 36 | 78 |
| Payments & pricing (10%) | 10 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 85 |
| Transparency & trust (7%) | 38 | 89 |

| Fact (where they differ) | doola MCP | Shopify API + MCP |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | doola | Shopify |
| Hosted endpoint | `https://mcp.doola.com` | no (local only) |
| Transports | Streamable HTTP | HTTP, Streamable HTTP, stdio |
| Auth | OAuth | OAuth or key |
| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | none |
| MCP registry | `io.github.doolahq/doola` | not listed |
| Last release | none | 2026-10-30 |
| Terms last updated | not read yet | 2026-08-01 |
| Privacy policy last updated | not read yet | 2026-07-07 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | none | 657k npm/wk |
| Agent reviews | none | 3.6/5 (8) |

Why the edge:
- Schema & documentation, Shopify API + MCP +66: doola MCP 26 (No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.); Shopify API + MCP 92 (Fully typed GraphQL Admin and Storefront schemas with introspection, and UCP tools defined by published JSON schemas (25). shopify.dev/llms.txt still answered 404 on 1 November, but every docs page has a Markdown twin at the same URL plus `.md`, served as text/markdown (10). GraphQL fields and the UCP spec describe each operation's purpose, and each Checkout MCP tool opens with when to use it (15). Strict GraphQL types, enums and required markers, and typed UCP request and response schemas (14). Mutations return `userErrors`, UCP defines a typed error response, and examples run through the docs (13). Quarterly dated API versions, each supported at least 12 months with at least nine months of overlap, 2026-10 released on 1 October 2026 and supported until 16 October 2027, re-read on 1 November, and a changelog with action-required and breaking tags (15).)
- Reliability, Shopify API + MCP +63: doola MCP 15 (status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.); Shopify API + MCP 78 (Atlassian Statuspage at shopifystatus.com with Admin, Checkout, Reports and Dashboards, Storefront, API & Mobile, Point of Sale and other components, and a history page (20). On 1 November the history page loaded with every month from June to November 2026, while the RSS feed now says it is inactive or private. The one incident in the 90 days from 3 August is on 29 October, errors and 504 responses in the Admin and the Shopify mobile app for some merchants between 07:53 and 08:45 UTC, with a fix at 08:30 UTC, which Shopify marked with no impact level. It was under an hour and reached some merchants, so it reads as minor. The page says issues affecting a small share of stores may not appear (20). Limits published per API. GraphQL Admin restores 100 points a second on standard plans, 200 on Advanced, 1,000 on Plus and 2,000 on Commerce Components, with a 1,000-point cap per query, re-read on 1 November. REST Admin has a 40-request bucket per app and store leaking at 2 a second, 10 times that on Plus, per the 17 October check. The Customer Account API has a limit of 3,000 requests a minute per customer (15). The limits guide says to stop and back off one second when throttled, REST and Customer Account API 429s carry a Retry-After header, every GraphQL response carries throttle metadata, and Checkout MCP requires an idempotency key on `complete_checkout` and `cancel_checkout` (13). No SLA found on the pricing page, re-read on 1 November (0). Admin and Storefront APIs are generally available (10). 20 + 20 + 15 + 13 + 0 + 10 = 78.)
- Agent ergonomics, Shopify API + MCP +60: doola MCP 23 (Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.); Shopify API + MCP 83 (GraphQL field selection sizes every Admin and Storefront response. UCP splits shopping into 13 tools across catalogue, cart, checkout and order, and from 22 October stores with a retail location add `search_locations` and `lookup_locations` for agents that negotiate them (22). Cursor pagination with `first` and `after` and a `query` filter syntax on list fields, input arrays capped at 250 items (20). `userErrors` name the field and message, and throttling returns cost and bucket state an agent can act on (17). Checkout MCP requires an idempotency key on `complete_checkout` and `cancel_checkout`, and since API version 2026-04 the GraphQL Admin API requires the `@idempotent` directive on `refundCreate` and 16 inventory and location mutations, retried safely with the same key (changelog, 12 December 2025, read on 1 November). No readOnlyHint or destructiveHint annotations are named in the Checkout MCP docs (14). Official libraries are JavaScript packages in this listing. Every UCP call must carry an agent profile in `meta`, and `update_cart` and `update_checkout` replace the whole state, so every field must be resent (10). 22 + 20 + 17 + 14 + 10 = 83.)
- Transparency & trust, Shopify API + MCP +51: doola MCP 38 (Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.); Shopify API + MCP 89 (Closed platform with published terms, and open-source client libraries (15). Privacy policy updated 7 July 2026, re-read on 1 November, store data kept for two years after a store closes before deletion begins, a published subprocessor list and Standard Contractual Clauses for transfers (26). Each API version is supported at least 12 months, deprecations are announced in the changelog with migration guidance and removed in a later version, the Global Catalog REST API, deprecated in April 2026, stops on 2 November 2026, and non-expiring offline tokens on public apps will return HTTP 403 from 1 April 2027, announced with dated steps on 27 October (20). Subprocessors listed and data flows named by region, through Ireland for the EEA, Canada and the US, and Singapore for Asia-Pacific, per the 6 October check (20).)
- Security & auth, Shopify API + MCP +42: doola MCP 36 (OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.); Shopify API + MCP 78 (Per-app access tokens limited by granular read and write scopes, OAuth for public apps, separate storefront tokens, and token exchange for offline tokens. Public apps must move to expiring offline access tokens by 1 January 2027, and since 27 October an app can restrict Admin API access to its own servers with an IP allowlist and recover access with client credentials signed by its private key (27). Read-only scopes per resource, and from Admin API 2027-01 an app can downgrade its optional write scopes to read with `appDowngradeAccessScopes`. UCP tiers access by identification, and `complete_checkout` and order tools need a token granted that permission, while a checkout that needs buyer review returns a `continue_url` for the buyer. The Dev MCP server only reads docs and schemas (16). UCP returns merchant catalogue content to third-party agents, and the UCP spec covers header and log injection but not prompt injection (5). The Dev Dashboard's Logs record every GraphQL and REST Admin API request an app makes, filterable by shop, status, operation and client IP and kept 30 days, and the 20 October changelog tells developers to check them for suspicious traffic. Wide time ranges can show a sample, and no merchant-side audit trail of account changes was checked (12). security.txt, re-read on 1 November, points to a HackerOne programme with an acknowledgements page, a security@shopify.com contact and a PGP key, but still has no Expires field. OSV listed no advisories for @shopify/dev-mcp, @shopify/shopify-api, @shopify/admin-api-client or @shopify/shop on 17 October, not re-read on 1 November (18). 27 + 16 + 5 + 12 + 18 = 78.)
- Payments & pricing, Shopify API + MCP +30: doola MCP 10 (No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.); Shopify API + MCP 40 (No x402, MPP or L402. UCP checkout uses the buyer's normal payment methods, and Shop MCP completes purchases with Shop Pay (0). Plan prices are public, re-read on 1 November, Basic $39, Grow $105 and Advanced $399 a month ($29, $79 and $299 billed yearly), Plus from $2,300, and an Agentic plan at $0 a month for selling in AI channels (10). Development stores are free for building and testing, and the 3-day store trial needs no credit card per the pricing page (20). Catalogue, cart and checkout build tools work anonymously at the lowest rate limits with an agent profile in the request, but `complete_checkout` needs a token, and back-office access needs a person to create an app. Shop MCP (mcp.shop.com) searches without an API key and builds carts without sign-in, but completing a purchase needs the shopper signed in with Shop, so the line stays (10).)