{ "data": { "a": { "slug": "doola-mcp", "name": "doola MCP", "vendor": "doola", "vendorUrl": "https://doola.com", "kind": "mcp", "category": "commerce", "summary": "doola's hosted MCP server lets an agent form a US LLC or C-Corp in any state or DC from a conversation, covering entity type, name, members, ownership and the state filing, and check on existing doola companies.", "url": "https://www.anchorterminal.com/tools/doola-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/doola-mcp.json", "dns": "doola-mcp.grade.anchorterminal.com", "repo": "https://github.com/doolahq/plugins", "license": "Proprietary service. The plugin repository's MIT licence covers the manifests", "transports": [ "streamable-http" ], "remoteUrl": "https://mcp.doola.com", "packages": [], "auth": "oauth", "authNotes": "OAuth with a doola account on the first tool call; tokens are held by the client and can be revoked in doola's account settings.", "pricing": "paid", "pricingNotes": "Formation plans from $297 a year plus state fees (renewing at $300), up to $1,999 a year plus state fees. The MCP server itself is free to connect (checked 2026-11-07).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the MCP docs or pricing page (checked 2026-11-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://doola.com", "registryName": "io.github.doolahq/doola", "capabilities": [ "legal.company-formation", "commerce.checkout" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "paid", "mcp-registry" ], "graded": true, "anchor": { "graded": true, "score": 28, "grade": "F", "agentReady": false, "rank": 1430, "ranked": true, "rankOf": 1510, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 38 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-07" }, "negative": 0, "verdict": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.", "bestFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "strengths": [ "Forms a US LLC or C-Corp in any state from a conversation", "OAuth with revocation in account settings", "Plugins for Claude Code, Grok Build and Cursor", "Official registry entry and a public plugin repository" ], "weaknesses": [ "No published tool list, schemas or errors", "No documented confirmation before a paid filing", "No free tier; formation from $297 a year plus state fees", "Status page unreachable and no llms.txt" ], "agentNotes": [ "Confirm the entity type, state, name, members and price with the user before filing", "A filing is a paid legal act; never retry one without checking its status first", "Use the status tools on existing companies before starting a new formation" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 28 } ], "editorialScores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 30 }, "provenanceScore": 46, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude plugin marketplace add doolahq/plugins \u0026\u0026 claude plugin install doola@doola", "config": { "mcpServers": { "doola": { "url": "https://mcp.doola.com" } } } }, "letme": { "capability": "https://letme.dev/legal.company-formation", "tool": "https://letme.dev/doola-mcp" }, "area": "business", "provenance": { "legalEntity": "doola", "domain": "doola.com", "domainRegistered": "", "domainNote": "Not looked up: RDAP isn't requested under the 1 November 2026 rules.", "endpointOnVendorDomain": true, "terms": "https://doola.com/terms-of-service", "privacy": "https://doola.com/privacy-policy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-07", "notes": [ "Terms last updated July 2026. The plugin repository's licence names doola." ], "score": 46 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/doola-mcp.json", "live": { "slug": "doola-mcp", "probe": { "target": "https://mcp.doola.com", "method": "mcp-initialize", "lastAt": "2026-11-08T00:55:37.012153631Z", "lastOk": true, "lastStatus": 401, "lastMs": 176, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 113, "p95ms24h": 201, "samples24h": 63, "samples30d": 63, "days": [ { "date": "2026-11-07", "probes": 53, "ok": 53 }, { "date": "2026-11-08", "probes": 10, "ok": 10 } ] }, "githubStars": 0, "updatedAt": "2026-11-08T00:55:37.012153631Z" } }, "answer": "Shopware scores 68.6 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "b": { "slug": "shopware", "name": "Shopware", "vendor": "shopware AG", "vendorUrl": "https://www.shopware.com", "kind": "http-api", "category": "commerce", "summary": "Open-source commerce platform from shopware AG in Germany, written in PHP on Symfony. Agents reach a store through its Store API for shopping, its Admin API for back-office work, and a built-in MCP server on both.", "url": "https://www.anchorterminal.com/tools/shopware", "markdownUrl": "https://www.anchorterminal.com/tools/shopware.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shopware.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shopware.json", "dns": "shopware.grade.anchorterminal.com", "repo": "https://github.com/shopware/shopware", "license": "MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "packagist", "name": "shopware/core" }, { "registry": "npm", "name": "@shopware/api-client" } ], "auth": "mixed", "authNotes": "Access comes from the merchant who runs the store, with no vendor review. The Admin API takes an OAuth 2.0 bearer token from /api/oauth/token, normally by client credentials from an integration created in Settings or with `bin/console integration:create`, and tokens last 10 minutes by default. An integration gets an ACL role, or full access with --admin. The MCP endpoint at /api/_mcp also accepts the integration's `sw-access-key` and `sw-secret-access-key` headers, and each integration and user has an MCP allowlist. The Store API takes the sales channel's `sw-access-key`, which is public in a headless shop, plus an `sw-context-token` for the cart and customer session.", "pricing": "freemium", "pricingNotes": "The Community Edition is free under MIT with no account, so an agent's owner can start with `shopware-cli project create` and Docker, with no contract (the docs say no Shopware account is needed to install or run a store). Paid plans start at €600 a month for Rise and €2,400 for Evolve, excluding VAT, with Beyond on request, and the pricing page says the price depends on GMV. Rise now shows the first 30 days free. Shopware SaaS is priced the same as self-hosted (https://www.shopware.com/en/pricing/, checked 2026-11-01).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the repository or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 14, "popularity": { "githubStars": 3400, "npmWeekly": 30917, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://developer.shopware.com/docs/", "llmsTxt": "https://developer.shopware.com/llms.txt", "openapi": "https://github.com/shopware/shopware/tree/trunk/src/Core/Framework/Api/ApiDefinition/Generator/Schema", "capabilities": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "tags": [ "open-source", "self-hosted", "local", "hosted", "mcp", "openapi", "llms-txt", "oauth", "php", "typescript", "webhooks", "freemium", "eu", "bug-bounty", "iso27001", "beta" ], "lastRelease": "2026-10-19", "graded": true, "anchor": { "graded": true, "score": 68.6, "grade": "B", "agentReady": false, "rank": 281, "ranked": true, "rankOf": 1510, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 78, "maintenance": 87, "payments": 50, "reliability": 83, "schema": 85, "security": 73, "transparency": 78 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -8, "negativeNotes": [ "GitHub lists 20 security advisories for shopware/shopware published between 19 May and 16 September 2026, four of them critical (an app script sandbox escape, stored SQL injection through app manifests, admin account takeover by host-header poisoning and a webhook permission bypass), plus a pre-authentication SQL injection in the Store API (GHSA-p37c-pm9p-7vm5, CVSS 8.6, published 25 August 2026, fixed in 6.7.13.1 and 6.6.10.23). All were disclosed in public with fixed versions, so the deduction is 5 of a possible 15 (https://github.com/shopware/shopware/security/advisories).", "10 September 2026, -3. 6.7.14.1, a patch release, lists under Security Fixes that the `user.recovery.request`, `customer.recovery.request`, `mail.before.send` and `mail.after.create.message` events are no longer sent to webhooks, that `contextToken`, `confirmUrl` and a newsletter `url` are dropped from webhook payloads, and that `PATCH /api/_info/me` now refuses any `avatarMedia` other than an id with a 403. Apps that read these from webhooks stop receiving them, with no earlier notice found and against the written promise that minor and patch updates stay backward compatible. Each closes a security gap and names Flow Builder as the way out, so the floor, as firecrawl-mcp 3.36.0 and docker-agent were read (https://github.com/shopware/shopware/blob/trunk/RELEASE_INFO-6.7.md)" ], "verdict": "MIT-licensed core with OpenAPI specs for both APIs and a built-in MCP server that advertises three discovery tools, previews writes by default and limits each integration to an allowlist. The MCP server is experimental until 6.8, four critical advisories were published in 2026, and a September patch release removed webhook payload fields without notice.", "bestFor": "A merchant already on Shopware, or a team that wants an MIT PHP backend with a built-in MCP server for back-office work.", "strengths": [ "MIT core, free to self-host, with security fixes for 6.7.15 promised until 1 June 2031 in releases.json", "Built-in MCP server advertises three discovery tools, and other tools load by toolset for the session", "MCP write tools default to dryRun=true, which runs the change in a transaction and rolls it back", "Per-integration ACL roles and MCP allowlists, with a 300 a minute limit on /api/_mcp", "OpenAPI 3 schemas for the Store API and Admin API in the repository, plus llms.txt and Markdown docs" ], "weaknesses": [ "The MCP server is marked experimental until 6.8, and 6.7.14.0 changed what tools/list returns on the Store API endpoint", "20 advisories published between 19 May and 16 September 2026, four critical, including a pre-authentication SQL injection in the Store API", "MCP tools carry no readOnlyHint or destructiveHint annotations, and criteria and payloads travel as JSON-encoded strings", "A 429 from the MCP endpoints carries the wait time in the body, with no Retry-After header", "The Store API MCP endpoint ships one domain tool, has no allowlist, and the security.txt file expired on 31 December 2025", "6.7.14.1, a patch release, stopped sending four events and three values to webhooks with no earlier notice" ], "agentNotes": [ "Ask the merchant for an integration without --admin, tied to an ACL role and an MCP allowlist. Send sw-access-key and sw-secret-access-key headers to /api/_mcp", "Call shopware-tool-search first, then shopware-toolset-enable, and keep the Mcp-Session-Id header. A fresh session lists only three tools", "Pass dryRun=false to commit a write. shopware-media-upload has no dry run and uploads at once", "For shopping, call the Store API over HTTP with the sales channel's sw-access-key and keep the sw-context-token. The Store API MCP endpoint has no cart tools in core", "Send `includes` in search criteria to cut response size, and read the 429 body for the wait time", "Don't rely on webhooks for password recovery, mail events, contextToken or confirmUrl on 6.7.14.1 or later. Use Flow Builder or the Admin API instead" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.6 } ], "editorialScores": { "ergonomics": 78, "maintenance": 87, "payments": 50, "reliability": 83, "schema": 85, "security": 73, "transparency": 80 }, "provenanceScore": 75, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @shopware-ag/shopware-cli project create my-shop", "http": "curl -X POST \"http://localhost:8000/api/search/product\" \\\n -H \"Authorization: Bearer YOUR_ACCESS_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{}'", "claudeCode": "claude mcp add --transport http shopware http://localhost:8000/api/_mcp --header \"sw-access-key: SWIA...\" --header \"sw-secret-access-key: ...\"", "config": { "mcpServers": { "shopware": { "headers": { "sw-access-key": "SWIA...", "sw-secret-access-key": "..." }, "type": "streamable-http", "url": "https://your-shop.example.com/api/_mcp" } } } }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/shopware" }, "area": "business", "unitPrices": [ { "item": "Community Edition", "unit": "month", "usd": 0, "note": "MIT core, you pay for your own hosting" } ], "provenance": { "legalEntity": "shopware AG", "domain": "shopware.com", "domainRegistered": "1998-08-08", "endpointOnVendorDomain": false, "terms": "https://www.shopware.com/en/gtc/", "privacy": "https://www.shopware.com/en/privacy/", "statusPage": "https://status.shopware.com", "changelog": "https://github.com/shopware/shopware/releases", "securityTxt": "expired", "checked": "2026-11-01", "notes": [ "The legal notice names shopware AG, Ebbinghoff 10, 48624 Schoeppingen, Germany, Amtsgericht Coesfeld HRB 11471.", "The general terms cover every product. Part 2 covers the free Community Edition and Part 4 covers SaaS, and only the German version is binding.", "The Store API, Admin API and MCP endpoints run on each merchant's own domain or SaaS shop, not on shopware.com.", "security.txt at www.shopware.com still gives Expires 31 December 2025 (re-read on 1 November 2026).", "www.shopware.com answered several requests with a 503 first byte timeout on 8 October 2026; on 1 November 2026 the pricing page and security.txt loaded first time.", "status.shopware.com covers Shopware SaaS, PaaS and vendor services, not self-hosted stores.", "Verisign RDAP gives a registration date of 1998-08-08 for shopware.com." ], "score": 75 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shopware.json", "live": { "slug": "shopware", "vendorStatus": { "page": "https://status.shopware.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-08T00:32:21.572991961Z" }, "versions": [ { "registry": "github", "name": "shopware/shopware", "version": "v6.7.16.0", "released": "2026-11-02", "seenAt": "2026-11-07T00:05:34.769624215Z" }, { "registry": "npm", "name": "@shopware/api-client", "version": "1.7.0", "seenAt": "2026-11-07T00:05:32.154119977Z" } ], "githubStars": 3469, "npmWeekly": 40117, "securityTxt": { "url": "https://shopware.com/.well-known/security.txt", "state": "valid", "expires": "Wed, 31 Dec 2025 23:59 +0200", "checkedAt": "2026-11-07T16:00:48.089720453Z" }, "llmsTxt": { "url": "https://developer.shopware.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:55.030980773Z" }, "domain": { "domain": "shopware.com", "registered": "1998-08-08", "source": "https://rdap.verisign.com/com/v1/domain/shopware.com", "checkedAt": "2026-11-01T14:27:24.93970148Z" }, "pages": [ { "url": "https://www.shopware.com/en/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:34:35.670904827Z", "changedAt": "2026-10-14T21:17:18.078306974Z", "fingerprint": "4a2e470148be" }, { "url": "https://www.shopware.com/en/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:34:36.415896252Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47fcc8fa5858" }, { "url": "https://www.shopware.com/en/gtc/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:34:31.936400793Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "034d628e8015" } ], "github": { "repo": "shopware/shopware", "checkedAt": "2026-11-02T09:25:28.191067826Z", "stars": 3465, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:21:35Z", "openIssues": 1253, "openPRs": 354, "issuesOpened90d": 1331, "issuesClosed90d": 1173, "prsMerged90d": 1577, "ci": { "branch": "trunk", "runs": 50, "success": 47, "failure": 2, "other": 1, "latest": "success", "latestAt": "2026-11-02T08:58:35Z" }, "advisories": [ { "ghsa": "GHSA-mch6-932v-3cm8", "severity": "medium", "published": "2026-09-16T08:14:07Z" }, { "ghsa": "GHSA-p589-2ff8-3wfw", "severity": "medium", "published": "2026-09-16T08:14:06Z" }, { "ghsa": "GHSA-2qxr-vvj4-5934", "severity": "high", "published": "2026-09-16T08:14:05Z" }, { "ghsa": "GHSA-8xfc-pww7-3rm5", "severity": "high", "published": "2026-09-16T08:14:04Z" }, { "ghsa": "GHSA-r432-q883-wgvf", "severity": "critical", "published": "2026-09-16T08:14:03Z" }, { "ghsa": "GHSA-f497-xgx3-22hq", "severity": "low", "published": "2026-08-25T14:26:51Z" }, { "ghsa": "GHSA-rrc3-p9vx-5373", "severity": "low", "published": "2026-08-25T14:26:42Z" }, { "ghsa": "GHSA-fgjq-45xv-rj8r", "severity": "medium", "published": "2026-08-25T14:26:33Z" }, { "ghsa": "GHSA-p67w-3mq7-rw2g", "severity": "high", "published": "2026-08-25T14:26:25Z" }, { "ghsa": "GHSA-674c-5376-96rv", "severity": "medium", "published": "2026-08-25T14:26:14Z" }, { "ghsa": "GHSA-4wpv-5fvv-c3xp", "severity": "medium", "published": "2026-08-25T14:26:00Z" }, { "ghsa": "GHSA-p37c-pm9p-7vm5", "severity": "high", "published": "2026-08-25T14:25:50Z" }, { "ghsa": "GHSA-xrcf-c96g-q5hr", "severity": "critical", "published": "2026-08-25T14:25:42Z" }, { "ghsa": "GHSA-xj2c-8fw5-mr6m", "severity": "critical", "published": "2026-08-25T14:25:33Z" }, { "ghsa": "GHSA-6qhw-38wm-7g7h", "severity": "critical", "published": "2026-08-25T14:25:21Z" }, { "ghsa": "GHSA-gq96-5pfx-f4vc", "cve": "CVE-2026-48013", "severity": "medium", "published": "2026-05-19T16:07:35Z" }, { "ghsa": "GHSA-xvhc-gm7j-mhmc", "cve": "CVE-2026-48015", "severity": "medium", "published": "2026-05-19T16:07:25Z" }, { "ghsa": "GHSA-9v5m-39wh-5chq", "cve": "CVE-2026-48016", "severity": "medium", "published": "2026-05-19T16:07:16Z" }, { "ghsa": "GHSA-f8q6-3g5w-jjr6", "cve": "CVE-2026-48014", "severity": "medium", "published": "2026-05-19T16:07:04Z" }, { "ghsa": "GHSA-4x3x-869w-xx3m", "cve": "CVE-2026-48012", "severity": "medium", "published": "2026-05-19T16:06:53Z" }, { "ghsa": "GHSA-v39m-97p8-gqg7", "cve": "CVE-2026-48010", "severity": "medium", "published": "2026-05-19T16:06:41Z" }, { "ghsa": "GHSA-7w52-7jvm-m9vw", "cve": "CVE-2026-48011", "severity": "low", "published": "2026-05-19T16:06:31Z" }, { "ghsa": "GHSA-8v9p-g828-v98f", "cve": "CVE-2026-48009", "severity": "medium", "published": "2026-05-19T16:06:17Z" }, { "ghsa": "GHSA-gv8p-48fr-4fxg", "cve": "CVE-2026-48008", "severity": "medium", "published": "2026-05-19T16:06:03Z" }, { "ghsa": "GHSA-gvmv-9f74-mhwp", "cve": "CVE-2026-32142", "severity": "medium", "published": "2026-03-11T13:00:22Z" }, { "ghsa": "GHSA-64rg-pgjv-4v33", "cve": "CVE-2026-32100", "severity": "medium", "published": "2026-03-11T13:00:09Z" }, { "ghsa": "GHSA-7vvp-j573-5584", "cve": "CVE-2026-31887", "severity": "high", "published": "2026-03-11T11:27:22Z" }, { "ghsa": "GHSA-gqc5-xv7m-gcjq", "cve": "CVE-2026-31888", "severity": "medium", "published": "2026-03-11T11:27:08Z" }, { "ghsa": "GHSA-c4p7-rwrg-pf6p", "cve": "CVE-2026-31889", "severity": "high", "published": "2026-03-11T11:26:58Z" }, { "ghsa": "GHSA-7cw6-7h3h-v8pf", "cve": "CVE-2026-23498", "severity": "high", "published": "2026-01-14T14:23:12Z" }, { "ghsa": "GHSA-6w82-v552-wjw2", "cve": "CVE-2025-67648", "severity": "medium", "published": "2025-12-09T12:26:55Z" }, { "ghsa": "GHSA-2w46-vq8h-98vh", "severity": "medium", "published": "2025-11-12T12:30:04Z" }, { "ghsa": "GHSA-h2x3-h9qr-cf82", "severity": "low", "published": "2025-10-21T12:23:49Z" }, { "ghsa": "GHSA-r2vg-hvjm-fg38", "severity": "medium", "published": "2025-10-21T09:36:22Z" }, { "ghsa": "GHSA-6wh5-mw9h-5c3w", "severity": "low", "published": "2025-10-21T09:36:17Z" }, { "ghsa": "GHSA-3cpp-fv95-mpr5", "severity": "low", "published": "2025-10-21T09:36:11Z" }, { "ghsa": "GHSA-27c9-vp3w-6ww8", "severity": "medium", "published": "2025-10-21T09:36:06Z" }, { "ghsa": "GHSA-m895-2hj3-8cg9", "severity": "medium", "published": "2025-10-21T09:36:00Z" }, { "ghsa": "GHSA-9v82-vcjx-m76j", "severity": "high", "published": "2025-09-09T08:28:35Z" }, { "ghsa": "GHSA-q5qc-g5xc-2p8f", "cve": "CVE-2025-27892", "severity": "high", "published": "2025-05-12T08:13:11Z" }, { "ghsa": "GHSA-4h9w-7vfp-px8m", "cve": "CVE-2025-32378", "severity": "low", "published": "2025-04-08T11:03:44Z" }, { "ghsa": "GHSA-68wv-g3fw-pq7q", "severity": "medium", "published": "2025-04-08T08:17:36Z" }, { "ghsa": "GHSA-hh7j-6x3q-f52h", "cve": "CVE-2025-30150", "severity": "low", "published": "2025-04-08T08:17:20Z" }, { "ghsa": "GHSA-cgfj-hj93-rmh2", "cve": "CVE-2025-30151", "severity": "high", "published": "2025-04-08T08:17:13Z" }, { "ghsa": "GHSA-8g35-7rmw-7f59", "cve": "CVE-2025-27892", "severity": "high", "published": "2025-04-08T08:17:06Z" }, { "ghsa": "GHSA-p6w9-r443-r752", "cve": "CVE-2024-42357", "severity": "high", "published": "2024-08-08T13:20:36Z" }, { "ghsa": "GHSA-35jp-8cgg-p4wj", "cve": "CVE-2024-42356", "severity": "high", "published": "2024-08-08T13:20:29Z" }, { "ghsa": "GHSA-27wp-jvhw-v4xp", "cve": "CVE-2024-42355", "severity": "high", "published": "2024-08-08T13:20:22Z" }, { "ghsa": "GHSA-hhcq-ph6w-494g", "cve": "CVE-2024-42354", "severity": "medium", "published": "2024-08-08T13:20:14Z" }, { "ghsa": "GHSA-5297-wrrp-rcj7", "cve": "CVE-2024-31447", "severity": "medium", "published": "2024-04-08T11:50:02Z" }, { "ghsa": "GHSA-c2f9-4jmm-v45m", "cve": "CVE-2024-27917", "severity": "critical", "published": "2024-03-06T10:22:50Z" }, { "ghsa": "GHSA-3535-m8vh-vrmw", "cve": "CVE-2024-22408", "severity": "high", "published": "2024-01-16T14:22:00Z" }, { "ghsa": "GHSA-qmp9-2xwj-m6m9", "cve": "CVE-2024-22406", "severity": "critical", "published": "2024-01-16T14:21:56Z" }, { "ghsa": "GHSA-3867-jc5c-66qf", "cve": "CVE-2024-22407", "severity": "medium", "published": "2024-01-16T14:21:50Z" }, { "ghsa": "GHSA-7v2v-9rm4-7m8f", "cve": "CVE-2023-2017", "severity": "high", "published": "2023-04-17T09:22:46Z" }, { "ghsa": "GHSA-46h7-vj7x-fxg2", "cve": "CVE-2023-22734", "severity": "medium", "published": "2023-01-17T13:20:19Z" }, { "ghsa": "GHSA-7cp7-jfp6-jh4f", "cve": "CVE-2023-22733", "severity": "low", "published": "2023-01-17T13:19:31Z" }, { "ghsa": "GHSA-59qg-93jg-236f", "cve": "CVE-2023-22732", "severity": "low", "published": "2023-01-17T13:18:42Z" }, { "ghsa": "GHSA-93cw-f5jj-x85w", "cve": "CVE-2023-22731", "severity": "critical", "published": "2023-01-17T13:18:08Z" }, { "ghsa": "GHSA-8r6h-m72v-38fg", "cve": "CVE-2023-22730", "severity": "medium", "published": "2023-01-17T13:17:10Z" }, { "ghsa": "GHSA-9wrv-g75h-8ccc", "cve": "CVE-2022-24872", "severity": "high", "published": "2022-04-20T11:53:50Z" }, { "ghsa": "GHSA-7gm7-8q8v-9gf2", "cve": "CVE-2022-24871", "severity": "medium", "published": "2022-04-20T11:52:49Z" }, { "ghsa": "GHSA-83vp-6jqg-6cmr", "cve": "CVE-2022-24748", "severity": "low", "published": "2022-03-09T08:52:49Z" }, { "ghsa": "GHSA-6wrh-279j-6hvw", "cve": "CVE-2022-24747", "severity": "high", "published": "2022-03-09T08:51:58Z" }, { "ghsa": "GHSA-952p-fqcp-g8pc", "cve": "CVE-2022-24746", "severity": "medium", "published": "2022-03-09T08:48:45Z" }, { "ghsa": "GHSA-w267-m9c4-8555", "cve": "CVE-2022-24744", "severity": "medium", "published": "2022-03-09T08:46:15Z" }, { "ghsa": "GHSA-jp6h-mxhx-pgqh", "cve": "CVE-2022-24745", "severity": "critical", "published": "2022-03-09T08:43:02Z" }, { "ghsa": "GHSA-r64m-qchj-hrjp", "cve": "CVE-2021-41267", "severity": "critical", "published": "2021-11-24T09:40:46Z" }, { "ghsa": "GHSA-gcvv-gq92-x94r", "cve": "CVE-2021-37711", "severity": "low", "published": "2021-08-16T12:07:13Z" }, { "ghsa": "GHSA-fc38-mxwr-pfhx", "cve": "CVE-2021-37710", "severity": "low", "published": "2021-08-16T12:06:47Z" }, { "ghsa": "GHSA-54gp-qff8-946c", "cve": "CVE-2021-37709", "severity": "medium", "published": "2021-08-16T12:06:16Z" }, { "ghsa": "GHSA-xh55-2fqp-p775", "cve": "CVE-2021-37708", "severity": "medium", "published": "2021-08-16T12:06:00Z" }, { "ghsa": "GHSA-9f8f-574q-8jmf", "cve": "CVE-2021-37707", "severity": "medium", "published": "2021-08-16T12:05:34Z" }, { "ghsa": "GHSA-243q-g9j3-qf6r", "severity": "medium", "published": "2021-06-24T09:03:55Z" }, { "ghsa": "GHSA-gpmh-g94g-qrhr", "cve": "CVE-2021-32716", "severity": "medium", "published": "2021-06-24T09:03:43Z" }, { "ghsa": "GHSA-vrf2-xghr-j52v", "cve": "CVE-2021-32717", "severity": "high", "published": "2021-06-24T09:02:56Z" }, { "ghsa": "GHSA-wq3r-jwrq-xg6w", "severity": "medium", "published": "2021-06-24T09:00:42Z" }, { "ghsa": "GHSA-g7w8-pp9w-7p32", "cve": "CVE-2021-32709", "severity": "low", "published": "2021-06-24T08:59:15Z" }, { "ghsa": "GHSA-88rc-3p98-rgvx", "severity": "critical", "published": "2021-04-12T13:20:53Z" }, { "ghsa": "GHSA-3pcr-4982-548m", "severity": "medium", "published": "2021-04-12T13:20:34Z" }, { "ghsa": "GHSA-qg7c-q3vq-rgxr", "severity": "critical", "published": "2021-04-12T13:20:13Z" }, { "ghsa": "GHSA-pjj4-jjgc-h3r8", "severity": "medium", "published": "2021-03-08T12:55:33Z" }, { "ghsa": "GHSA-h9q8-5gv2-v6mg", "cve": "CVE-2021-32710", "severity": "low", "published": "2021-03-08T12:51:25Z" }, { "ghsa": "GHSA-jvg4-9rc2-wvcr", "severity": "low", "published": "2021-02-08T12:51:09Z" }, { "ghsa": "GHSA-f2vv-h5x4-57gr", "cve": "CVE-2021-32711", "severity": "critical", "published": "2021-02-08T10:02:48Z" }, { "ghsa": "GHSA-cq6h-w3mc-57f4", "severity": "low", "published": "2020-12-15T09:00:21Z" }, { "ghsa": "GHSA-8pfh-mm2g-hmc3", "severity": "low", "published": "2020-12-15T09:00:08Z" }, { "ghsa": "GHSA-5q58-x5h2-v5rx", "severity": "low", "published": "2020-12-15T08:59:51Z" }, { "ghsa": "GHSA-p68v-frgx-4rjp", "severity": "low", "published": "2020-10-19T13:53:07Z" }, { "ghsa": "GHSA-8xv9-qcr9-ww9j", "severity": "low", "published": "2020-10-19T13:47:45Z" }, { "ghsa": "GHSA-qvc5-cfrr-384v", "severity": "low", "published": "2020-09-21T09:06:16Z" }, { "ghsa": "GHSA-qvhr-55hg-3qwv", "severity": "low", "published": "2020-09-21T09:03:38Z" } ], "replies": { "sampled": 25, "unanswered": 19, "medianDays": 3.5 } }, "updatedAt": "2026-11-08T00:32:21.572991961Z" } }, "edges": [ { "by": 68, "category": "reliability", "leads": "shopware", "name": "Reliability", "reasons": { "a": "status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.", "b": "Graded with the self-hosted package lines, because each store's APIs run on the merchant's own server or SaaS shop. Composer packages on Packagist with PHP 8.2 to 8.5 stated in composer.json (20). Nightly workflow on trunk, the last 10 scheduled runs all passing (25). 1,169 open issues, with bugs opened on 8 October 2026 already answered the same day and a triage labeller in the workflows (10). Semantic versioning with a written backward compatibility promise and UPGRADE and RELEASE_INFO files, but 6.7.14.0 changed what tools/list returns on the experimental Store API MCP endpoint in a minor release, and the 6.7.14.1 patch release removed fields from webhook payloads as a security fix (13). 6.7 is stable, while the MCP server is experimental until 6.8 (15). Shopware SaaS has a status page at status.shopware.com, which lists a 36 minute outage of storefront and administration on 6 August 2026 and 1 hour 49 minutes of raised errors on 17 August. That isn't scored here." }, "scores": { "a": 15, "b": 83 } }, { "by": 59, "category": "schema", "leads": "shopware", "name": "Schema \u0026 documentation", "reasons": { "a": "No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.", "b": "OpenAPI 3 for both APIs, as JSON in the repository, on a hosted Stoplight reference and from each instance at /_info/openapi3.json in dev mode. MCP tools have typed inputs (25). llms.txt with every docs page as Markdown (10). 109 of 116 Store API operations and 105 of 108 Admin API operations in the repository schema carry a description, and the MCP tool reference says when to use search, read or aggregate (16). Types and required fields are set, but the MCP tools take criteria, payload, aggregations and ids as JSON-encoded strings, and Admin API entity routes accept open criteria objects (9). Request examples in the guides, a JSON:API error schema and a fixed success and error envelope for MCP tools (12). No API version in the path since 2020, so the contract follows the product version, with release notes on GitHub and RELEASE_INFO files (13)." }, "scores": { "a": 26, "b": 85 } }, { "by": 55, "category": "ergonomics", "leads": "shopware", "name": "Agent ergonomics", "reasons": { "a": "Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.", "b": "A fresh MCP session advertises three discovery tools and loads the rest by toolset. `includes` selects fields, and MCP results over 100 KB come back as a resource reference (25). page, limit, total-count-mode, filters, sorting and aggregations in one criteria object (20). MCP errors are a message written to say what to do next, and the APIs return JSON:API errors with codes. A 429 on MCP has no Retry-After header (16). No idempotency keys found. Write tools default to dryRun=true, but no MCP tool carries readOnlyHint or destructiveHint in the source (8). Few required parameters and sensible defaults (limit 25, maxResults 3). One official API client, @shopware/api-client for TypeScript, and none found in a second language (9)." }, "scores": { "a": 23, "b": 78 } }, { "by": 40, "category": "payments", "leads": "shopware", "name": "Payments \u0026 pricing", "reasons": { "a": "No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.", "b": "No x402, MPP or L402 (0). The paid plans have public starting prices, Rise from €600 and Evolve from €2,400 a month, with the real price set by GMV and Beyond on request (10). The MIT Community Edition is free with no card (20). An agent's owner can install it with Shopware CLI and Docker, and the install guide says no Shopware account is needed. A paid plan or SaaS shop needs a browser signup or sales (20)." }, "scores": { "a": 10, "b": 50 } }, { "by": 40, "category": "transparency", "leads": "shopware", "name": "Transparency \u0026 trust", "reasons": { "a": "Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.", "b": "MIT licence for the core (30). A self-hosted store keeps its data on the merchant's server. The privacy page, updated 18 August 2026, names shopware AG and links a data processing agreement, but no retention periods or sub-processors were found on it (18). A backward compatibility promise, `@deprecated` markers that name the major version of removal, and releases.json with an end date for security fixes on every version (18). A telemetry page lists what Shopware CLI, the Deployment Helper and the web installer send, by unencrypted UDP to a server in Frankfurt, with DO_NOT_TRACK as the opt-out. The core has a usage data module with consent that we didn't read (14)." }, "scores": { "a": 38, "b": 78 } }, { "by": 37, "category": "security", "leads": "shopware", "name": "Security \u0026 auth", "reasons": { "a": "OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.", "b": "Admin API by OAuth 2.0 client credentials from a revocable integration with an ACL role and 10 minute tokens, or the integration's key and secret in headers on MCP. No secret in a URL was found in the docs. No OAuth scopes beyond ACL roles, and key rotation wasn't found (25). ACL checks on every MCP call, allowlists per integration and per user, a global allowed_tools switch and dry run by default on write tools. shopware-media-upload has no dry run and the Store API MCP endpoint has no allowlist (17). The MCP best practices page has a section on prompt injection through order notes, names and product text and advises read-only integrations for such data (11). An integration records when it was last used, and no audit log of API or MCP calls was found (4). Bug bounty through the security reporting form per SECURITY.md, ISO/IEC 27001:2022 on the trust centre, and advisories published on GitHub. The security.txt file expired on 31 December 2025 (16)." }, "scores": { "a": 36, "b": 73 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "doola", "b": "shopware AG", "name": "Vendor" }, { "a": "https://mcp.doola.com", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service. The plugin repository's MIT licence covers the manifests", "b": "MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms", "name": "Licence" }, { "a": "none", "b": "14", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "io.github.doolahq/doola", "b": "not listed", "name": "MCP registry" }, { "a": "none", "b": "2026-10-19", "name": "Last release" }, { "a": "not read yet", "b": "2026-06-10", "name": "Terms last updated" }, { "a": "not read yet", "b": "couldn't be read", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "3.4k stars, 31k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Shopware scores 68.6 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "question": "Which is better for AI agents, doola MCP or Shopware?" }, { "answer": "doola MCP uses an OAuth sign-in. Shopware takes an API key or an OAuth sign-in.", "question": "Do doola MCP and Shopware need an API key?" }, { "answer": "doola MCP has a hosted endpoint at https://mcp.doola.com. No hosted endpoint is listed for Shopware.", "question": "Can an agent call doola MCP and Shopware without installing anything?" }, { "answer": "No open-source release is listed for doola MCP. Shopware is open source (MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms).", "question": "Are doola MCP and Shopware open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install", "No incidents deducted, where Shopware loses 8 points for them" ], "goodFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "slug": "doola-mcp", "watchFor": "No published tool list, schemas or errors" }, { "aheadOn": [ "Reliability, 83 against 15", "Schema \u0026 documentation, 85 against 26", "Agent ergonomics, 78 against 23", "Security \u0026 auth, 73 against 36", "Payments \u0026 pricing, 50 against 10", "Maintenance \u0026 community, 87 against 70", "Transparency \u0026 trust, 78 against 38" ], "also": [ "Open source" ], "goodFor": "A merchant already on Shopware, or a team that wants an MIT PHP backend with a built-in MCP server for back-office work.", "slug": "shopware", "watchFor": "The MCP server is marked experimental until 6.8, and 6.7.14.0 changed what tools/list returns on the Store API endpoint" } ], "history": { "doola-mcp": null, "shopware": [ { "causes": [ "event" ], "date": "2026-11-01", "delta": -3, "from": 71.6, "fromGrade": "BB", "to": 68.6, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 71.4, "fromGrade": "BB", "to": 71.6, "toGrade": "BB" } ] }, "job": { "capability": "commerce.checkout", "name": "Commerce checkout" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopware.json", "title": "Adobe Commerce (Magento) vs Shopware", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/agentzon-vs-shopware.json", "title": "Agentzon vs Shopware", "url": "https://www.anchorterminal.com/compare/agentzon-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-shopware.json", "title": "BigCommerce API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-shopware.json", "title": "Commerce Layer API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-shopware.json", "title": "commercetools vs Shopware", "url": "https://www.anchorterminal.com/compare/commercetools-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-shopware.json", "title": "Ecwid by Lightspeed vs Shopware", "url": "https://www.anchorterminal.com/compare/ecwid-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-shopware.json", "title": "Elastic Path API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-shopware.json", "title": "Medusa API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/medusa-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-shopware.json", "title": "Saleor API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/saleor-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-shopware.json", "title": "Shopify API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/shopify-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-snipcart.json", "title": "Shopware vs Snipcart API + MCP", "url": "https://www.anchorterminal.com/compare/shopware-vs-snipcart" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.json", "title": "Shopware vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-square.json", "title": "Shopware vs Square", "url": "https://www.anchorterminal.com/compare/shopware-vs-square" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-swell.json", "title": "Shopware vs Swell", "url": "https://www.anchorterminal.com/compare/shopware-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-vendure.json", "title": "Shopware vs Vendure", "url": "https://www.anchorterminal.com/compare/shopware-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-wix.json", "title": "Shopware vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/shopware-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-woocommerce.json", "title": "Shopware vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/shopware-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.json", "title": "Adobe Commerce (Magento) vs doola MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.json", "title": "Agentzon vs doola MCP", "url": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.json", "title": "BigCommerce API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.json", "title": "Commerce Layer API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.json", "title": "commercetools vs doola MCP", "url": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.json", "title": "doola MCP vs Elastic Path API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.json", "title": "doola MCP vs Fabric", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.json", "title": "doola MCP vs Medusa API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.json", "title": "doola MCP vs Saleor API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.json", "title": "doola MCP vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.json", "title": "doola MCP vs Snipcart API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.json", "title": "doola MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-square.json", "title": "doola MCP vs Square", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-square" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell.json", "title": "doola MCP vs Swell", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.json", "title": "doola MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix.json", "title": "doola MCP vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.json", "title": "doola MCP vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/fabric-vs-shopware.json", "title": "Fabric vs Shopware", "url": "https://www.anchorterminal.com/compare/fabric-vs-shopware" } ], "panel": null, "scores": [ { "by": 68, "doola-mcp": 15, "edge": "shopware", "key": "reliability", "name": "Reliability", "shopware": 83, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 59, "doola-mcp": 26, "edge": "shopware", "key": "schema", "name": "Schema \u0026 documentation", "shopware": 85, "weight": 13 }, { "by": 55, "doola-mcp": 23, "edge": "shopware", "key": "ergonomics", "name": "Agent ergonomics", "shopware": 78, "weight": 13 }, { "by": 37, "doola-mcp": 36, "edge": "shopware", "key": "security", "name": "Security \u0026 auth", "shopware": 73, "weight": 14 }, { "by": 40, "doola-mcp": 10, "edge": "shopware", "key": "payments", "name": "Payments \u0026 pricing", "shopware": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 17, "doola-mcp": 70, "edge": "shopware", "key": "maintenance", "name": "Maintenance \u0026 community", "shopware": 87, "weight": 7 }, { "by": 40, "doola-mcp": 38, "edge": "shopware", "key": "transparency", "name": "Transparency \u0026 trust", "shopware": 78, "weight": 7 } ], "summary": "Shopware scores 68.6 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.", "tasks": null, "tutorials": [], "verdicts": { "doola-mcp": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.", "shopware": "MIT-licensed core with OpenAPI specs for both APIs and a built-in MCP server that advertises three discovery tools, previews writes by default and limits each integration to an allowlist. The MCP server is experimental until 6.8, four critical advisories were published in 2026, and a September patch release removed webhook payload fields without notice." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware", "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.min.md" }, "markdown": "Shopware scores 68.6 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.\n\n- doola MCP: grade F, 28/100, rank #1430 of 1510. Markdown https://www.anchorterminal.com/tools/doola-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/doola-mcp.json\n- Shopware: grade B, 68.6/100, rank #281 of 1510. Markdown https://www.anchorterminal.com/tools/shopware.md · JSON https://www.anchorterminal.com/api/v1/tools/shopware.json\n- Best commerce platforms and checkout APIs for AI agents: https://www.anchorterminal.com/best/commerce/index.md\n- All 189 commerce comparisons: https://www.anchorterminal.com/compare/commerce/index.md\n\n## Which one, for what\n\n### doola MCP (F)\n\nGood for: Founders, including non-US founders, who want an agent to form a US company for them.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- No incidents deducted, where Shopware loses 8 points for them\n\nWatch for: No published tool list, schemas or errors\n\n### Shopware (B)\n\nGood for: A merchant already on Shopware, or a team that wants an MIT PHP backend with a built-in MCP server for back-office work.\n\nAhead on:\n- Reliability, 83 against 15\n- Schema \u0026 documentation, 85 against 26\n- Agent ergonomics, 78 against 23\n- Security \u0026 auth, 73 against 36\n- Payments \u0026 pricing, 50 against 10\n- Maintenance \u0026 community, 87 against 70\n- Transparency \u0026 trust, 78 against 38\n\nAlso in its favour:\n- Open source\n\nWatch for: The MCP server is marked experimental until 6.8, and 6.7.14.0 changed what tools/list returns on the Store API endpoint\n\n\n## Why the edge\n\n### Reliability: Shopware +68\n\n- doola MCP (15): status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.\n- Shopware (83): Graded with the self-hosted package lines, because each store's APIs run on the merchant's own server or SaaS shop. Composer packages on Packagist with PHP 8.2 to 8.5 stated in composer.json (20). Nightly workflow on trunk, the last 10 scheduled runs all passing (25). 1,169 open issues, with bugs opened on 8 October 2026 already answered the same day and a triage labeller in the workflows (10). Semantic versioning with a written backward compatibility promise and UPGRADE and RELEASE_INFO files, but 6.7.14.0 changed what tools/list returns on the experimental Store API MCP endpoint in a minor release, and the 6.7.14.1 patch release removed fields from webhook payloads as a security fix (13). 6.7 is stable, while the MCP server is experimental until 6.8 (15). Shopware SaaS has a status page at status.shopware.com, which lists a 36 minute outage of storefront and administration on 6 August 2026 and 1 hour 49 minutes of raised errors on 17 August. That isn't scored here.\n\n### Schema \u0026 documentation: Shopware +59\n\n- doola MCP (26): No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.\n- Shopware (85): OpenAPI 3 for both APIs, as JSON in the repository, on a hosted Stoplight reference and from each instance at /_info/openapi3.json in dev mode. MCP tools have typed inputs (25). llms.txt with every docs page as Markdown (10). 109 of 116 Store API operations and 105 of 108 Admin API operations in the repository schema carry a description, and the MCP tool reference says when to use search, read or aggregate (16). Types and required fields are set, but the MCP tools take criteria, payload, aggregations and ids as JSON-encoded strings, and Admin API entity routes accept open criteria objects (9). Request examples in the guides, a JSON:API error schema and a fixed success and error envelope for MCP tools (12). No API version in the path since 2020, so the contract follows the product version, with release notes on GitHub and RELEASE_INFO files (13).\n\n### Agent ergonomics: Shopware +55\n\n- doola MCP (23): Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.\n- Shopware (78): A fresh MCP session advertises three discovery tools and loads the rest by toolset. `includes` selects fields, and MCP results over 100 KB come back as a resource reference (25). page, limit, total-count-mode, filters, sorting and aggregations in one criteria object (20). MCP errors are a message written to say what to do next, and the APIs return JSON:API errors with codes. A 429 on MCP has no Retry-After header (16). No idempotency keys found. Write tools default to dryRun=true, but no MCP tool carries readOnlyHint or destructiveHint in the source (8). Few required parameters and sensible defaults (limit 25, maxResults 3). One official API client, @shopware/api-client for TypeScript, and none found in a second language (9).\n\n### Payments \u0026 pricing: Shopware +40\n\n- doola MCP (10): No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.\n- Shopware (50): No x402, MPP or L402 (0). The paid plans have public starting prices, Rise from €600 and Evolve from €2,400 a month, with the real price set by GMV and Beyond on request (10). The MIT Community Edition is free with no card (20). An agent's owner can install it with Shopware CLI and Docker, and the install guide says no Shopware account is needed. A paid plan or SaaS shop needs a browser signup or sales (20).\n\n### Transparency \u0026 trust: Shopware +40\n\n- doola MCP (38): Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.\n- Shopware (78): MIT licence for the core (30). A self-hosted store keeps its data on the merchant's server. The privacy page, updated 18 August 2026, names shopware AG and links a data processing agreement, but no retention periods or sub-processors were found on it (18). A backward compatibility promise, `@deprecated` markers that name the major version of removal, and releases.json with an end date for security fixes on every version (18). A telemetry page lists what Shopware CLI, the Deployment Helper and the web installer send, by unencrypted UDP to a server in Frankfurt, with DO_NOT_TRACK as the opt-out. The core has a usage data module with consent that we didn't read (14).\n\n### Security \u0026 auth: Shopware +37\n\n- doola MCP (36): OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.\n- Shopware (73): Admin API by OAuth 2.0 client credentials from a revocable integration with an ACL role and 10 minute tokens, or the integration's key and secret in headers on MCP. No secret in a URL was found in the docs. No OAuth scopes beyond ACL roles, and key rotation wasn't found (25). ACL checks on every MCP call, allowlists per integration and per user, a global allowed_tools switch and dry run by default on write tools. shopware-media-upload has no dry run and the Store API MCP endpoint has no allowlist (17). The MCP best practices page has a section on prompt injection through order notes, names and product text and advises read-only integrations for such data (11). An integration records when it was last used, and no audit log of API or MCP calls was found (4). Bug bounty through the security reporting form per SECURITY.md, ISO/IEC 27001:2022 on the trust centre, and advisories published on GitHub. The security.txt file expired on 31 December 2025 (16).\n\n## Score by category\n\n| Category | Weight | doola MCP | Shopware | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 83 | Shopware +68 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 26 | 85 | Shopware +59 |\n| Agent ergonomics | 13% (16.2 this run) | 23 | 78 | Shopware +55 |\n| Security \u0026 auth | 14% (17.5 this run) | 36 | 73 | Shopware +37 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 10 | 50 | Shopware +40 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 87 | Shopware +17 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 38 | 78 | Shopware +40 |\n| Negative events | ≤15 | 0 | -8 | |\n| **Total** | | **28 · F** | **68.6 · B** | |\n\n## Facts side by side\n\n| Fact | doola MCP | Shopware |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | doola | shopware AG |\n| Hosted endpoint | `https://mcp.doola.com` | no (local only) |\n| Transports | Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms |\n| Tools exposed | none | 14 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| MCP registry | `io.github.doolahq/doola` | not listed |\n| Last release | none | 2026-10-19 |\n| Terms last updated | not read yet | 2026-06-10 |\n| Privacy policy last updated | not read yet | couldn't be read |\n| Customer content may train models | not read yet | yes |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | none | 3.4k stars, 31k npm/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### doola MCP\n\nNo score change since it was listed.\n\n### Shopware\n\n- -3.0 on 1 November 2026 (BB to B): negative event\n- +0.2 on 27 October 2026: checklist\n\n## Verdicts\n\n**doola MCP.** doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.\n\n**Shopware.** MIT-licensed core with OpenAPI specs for both APIs and a built-in MCP server that advertises three discovery tools, previews writes by default and limits each integration to an allowlist. The MCP server is experimental until 6.8, four critical advisories were published in 2026, and a September patch release removed webhook payload fields without notice.\n\n## Before you call either\n\n### doola MCP\n\n1. Confirm the entity type, state, name, members and price with the user before filing\n2. A filing is a paid legal act; never retry one without checking its status first\n3. Use the status tools on existing companies before starting a new formation\n\n### Shopware\n\n1. Ask the merchant for an integration without --admin, tied to an ACL role and an MCP allowlist. Send sw-access-key and sw-secret-access-key headers to /api/_mcp\n2. Call shopware-tool-search first, then shopware-toolset-enable, and keep the Mcp-Session-Id header. A fresh session lists only three tools\n3. Pass dryRun=false to commit a write. shopware-media-upload has no dry run and uploads at once\n4. For shopping, call the Store API over HTTP with the sales channel's sw-access-key and keep the sw-context-token. The Store API MCP endpoint has no cart tools in core\n5. Send `includes` in search criteria to cut response size, and read the 429 body for the wait time\n6. Don't rely on webhooks for password recovery, mail events, contextToken or confirmUrl on 6.7.14.1 or later. Use Flow Builder or the Admin API instead\n\n## Questions\n\n### Which is better for AI agents, doola MCP or Shopware?\n\nShopware scores 68.6 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category.\n\n### Do doola MCP and Shopware need an API key?\n\ndoola MCP uses an OAuth sign-in. Shopware takes an API key or an OAuth sign-in.\n\n### Can an agent call doola MCP and Shopware without installing anything?\n\ndoola MCP has a hosted endpoint at https://mcp.doola.com. No hosted endpoint is listed for Shopware.\n\n### Are doola MCP and Shopware open source?\n\nNo open-source release is listed for doola MCP. Shopware is open source (MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.json, and with the fewest tokens: https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"doola-mcp\", \"b\": \"shopware\"}`. From a terminal: `anchor compare doola-mcp shopware`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/doola-mcp.json and https://www.anchorterminal.com/api/v1/tools/shopware.json\n\n## Other comparisons with doola MCP or Shopware\n\n- [Adobe Commerce (Magento) vs Shopware](https://www.anchorterminal.com/compare/adobe-commerce-vs-shopware.md)\n- [Agentzon vs Shopware](https://www.anchorterminal.com/compare/agentzon-vs-shopware.md)\n- [BigCommerce API + MCP vs Shopware](https://www.anchorterminal.com/compare/bigcommerce-vs-shopware.md)\n- [Commerce Layer API + MCP vs Shopware](https://www.anchorterminal.com/compare/commerce-layer-vs-shopware.md)\n- [commercetools vs Shopware](https://www.anchorterminal.com/compare/commercetools-vs-shopware.md)\n- [Ecwid by Lightspeed vs Shopware](https://www.anchorterminal.com/compare/ecwid-vs-shopware.md)\n- [Elastic Path API + MCP vs Shopware](https://www.anchorterminal.com/compare/elastic-path-vs-shopware.md)\n- [Medusa API + MCP vs Shopware](https://www.anchorterminal.com/compare/medusa-vs-shopware.md)\n- [Saleor API + MCP vs Shopware](https://www.anchorterminal.com/compare/saleor-vs-shopware.md)\n- [Shopify API + MCP vs Shopware](https://www.anchorterminal.com/compare/shopify-vs-shopware.md)\n- [Shopware vs Snipcart API + MCP](https://www.anchorterminal.com/compare/shopware-vs-snipcart.md)\n- [Shopware vs Spree Commerce](https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.md)\n- [Shopware vs Square](https://www.anchorterminal.com/compare/shopware-vs-square.md)\n- [Shopware vs Swell](https://www.anchorterminal.com/compare/shopware-vs-swell.md)\n- [Shopware vs Vendure](https://www.anchorterminal.com/compare/shopware-vs-vendure.md)\n- [Shopware vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/shopware-vs-wix.md)\n- [Shopware vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/shopware-vs-woocommerce.md)\n- [Adobe Commerce (Magento) vs doola MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.md)\n- [Agentzon vs doola MCP](https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.md)\n- [BigCommerce API + MCP vs doola MCP](https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.md)\n- [Commerce Layer API + MCP vs doola MCP](https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.md)\n- [commercetools vs doola MCP](https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.md)\n- [doola MCP vs Elastic Path API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.md)\n- [doola MCP vs Fabric](https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.md)\n- [doola MCP vs Medusa API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.md)\n- [doola MCP vs Saleor API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.md)\n- [doola MCP vs Shopify API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.md)\n- [doola MCP vs Snipcart API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.md)\n- [doola MCP vs Spree Commerce](https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.md)\n- [doola MCP vs Square](https://www.anchorterminal.com/compare/doola-mcp-vs-square.md)\n- [doola MCP vs Swell](https://www.anchorterminal.com/compare/doola-mcp-vs-swell.md)\n- [doola MCP vs Vendure](https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.md)\n- [doola MCP vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/doola-mcp-vs-wix.md)\n- [doola MCP vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.md)\n- [Fabric vs Shopware](https://www.anchorterminal.com/compare/fabric-vs-shopware.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "doola MCP vs Shopware", "url": "" } ], "description": "Shopware scores 68.6 (B) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "doola MCP F 28", "Shopware B 68.6", "scores" ], "h1": "doola MCP vs Shopware", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/doola-mcp-vs-shopware", "published": "2026-10-01", "section": "tools", "title": "doola MCP vs Shopware for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware" }, "tokens": { "markdown": 4400, "slim": 2380 }, "version": 1 }