# doola MCP vs Shopware (slim)

> Shopware scores 68.6 (B) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.md (~4,400 tokens) · this version ~2,380 tokens · JSON https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.json · canonical https://www.anchorterminal.com/compare/doola-mcp-vs-shopware
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Shopware scores 68.6 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.

- doola MCP: F 28, rank #1430 of 1510 · https://www.anchorterminal.com/tools/doola-mcp.min.md
- Shopware: B 68.6, rank #281 of 1510 · https://www.anchorterminal.com/tools/shopware.min.md
- doola MCP, good for Founders, including non-US founders, who want an agent to form a US company for them. Also A hosted endpoint, with nothing to install; No incidents deducted, where Shopware loses 8 points for them.
- Shopware, good for A merchant already on Shopware, or a team that wants an MIT PHP backend with a built-in MCP server for back-office work. Ahead on Reliability, 83 against 15; Schema & documentation, 85 against 26; Agent ergonomics, 78 against 23; Security & auth, 73 against 36; Payments & pricing, 50 against 10; Maintenance & community, 87 against 70; Transparency & trust, 78 against 38. Also Open source.

| Category | doola MCP | Shopware |
| --- | --- | --- |
| Reliability (16%) | 15 | 83 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 26 | 85 |
| Agent ergonomics (13%) | 23 | 78 |
| Security & auth (14%) | 36 | 73 |
| Payments & pricing (10%) | 10 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 87 |
| Transparency & trust (7%) | 38 | 78 |

| Fact (where they differ) | doola MCP | Shopware |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | doola | shopware AG |
| Hosted endpoint | `https://mcp.doola.com` | no (local only) |
| Transports | Streamable HTTP | HTTP, Streamable HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Paid | Freemium |
| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms |
| Tools exposed | none | 14 |
| llms.txt | no | yes |
| MCP registry | `io.github.doolahq/doola` | not listed |
| Last release | none | 2026-10-19 |
| Terms last updated | not read yet | 2026-06-10 |
| Privacy policy last updated | not read yet | couldn't be read |
| Customer content may train models | not read yet | yes |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | none | 3.4k stars, 31k npm/wk |
| Agent reviews | none | 3.3/5 (4) |

Why the edge:
- Reliability, Shopware +68: doola MCP 15 (status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.); Shopware 83 (Graded with the self-hosted package lines, because each store's APIs run on the merchant's own server or SaaS shop. Composer packages on Packagist with PHP 8.2 to 8.5 stated in composer.json (20). Nightly workflow on trunk, the last 10 scheduled runs all passing (25). 1,169 open issues, with bugs opened on 8 October 2026 already answered the same day and a triage labeller in the workflows (10). Semantic versioning with a written backward compatibility promise and UPGRADE and RELEASE_INFO files, but 6.7.14.0 changed what tools/list returns on the experimental Store API MCP endpoint in a minor release, and the 6.7.14.1 patch release removed fields from webhook payloads as a security fix (13). 6.7 is stable, while the MCP server is experimental until 6.8 (15). Shopware SaaS has a status page at status.shopware.com, which lists a 36 minute outage of storefront and administration on 6 August 2026 and 1 hour 49 minutes of raised errors on 17 August. That isn't scored here.)
- Schema & documentation, Shopware +59: doola MCP 26 (No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.); Shopware 85 (OpenAPI 3 for both APIs, as JSON in the repository, on a hosted Stoplight reference and from each instance at /_info/openapi3.json in dev mode. MCP tools have typed inputs (25). llms.txt with every docs page as Markdown (10). 109 of 116 Store API operations and 105 of 108 Admin API operations in the repository schema carry a description, and the MCP tool reference says when to use search, read or aggregate (16). Types and required fields are set, but the MCP tools take criteria, payload, aggregations and ids as JSON-encoded strings, and Admin API entity routes accept open criteria objects (9). Request examples in the guides, a JSON:API error schema and a fixed success and error envelope for MCP tools (12). No API version in the path since 2020, so the contract follows the product version, with release notes on GitHub and RELEASE_INFO files (13).)
- Agent ergonomics, Shopware +55: doola MCP 23 (Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.); Shopware 78 (A fresh MCP session advertises three discovery tools and loads the rest by toolset. `includes` selects fields, and MCP results over 100 KB come back as a resource reference (25). page, limit, total-count-mode, filters, sorting and aggregations in one criteria object (20). MCP errors are a message written to say what to do next, and the APIs return JSON:API errors with codes. A 429 on MCP has no Retry-After header (16). No idempotency keys found. Write tools default to dryRun=true, but no MCP tool carries readOnlyHint or destructiveHint in the source (8). Few required parameters and sensible defaults (limit 25, maxResults 3). One official API client, @shopware/api-client for TypeScript, and none found in a second language (9).)
- Payments & pricing, Shopware +40: doola MCP 10 (No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.); Shopware 50 (No x402, MPP or L402 (0). The paid plans have public starting prices, Rise from €600 and Evolve from €2,400 a month, with the real price set by GMV and Beyond on request (10). The MIT Community Edition is free with no card (20). An agent's owner can install it with Shopware CLI and Docker, and the install guide says no Shopware account is needed. A paid plan or SaaS shop needs a browser signup or sales (20).)
- Transparency & trust, Shopware +40: doola MCP 38 (Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.); Shopware 78 (MIT licence for the core (30). A self-hosted store keeps its data on the merchant's server. The privacy page, updated 18 August 2026, names shopware AG and links a data processing agreement, but no retention periods or sub-processors were found on it (18). A backward compatibility promise, `@deprecated` markers that name the major version of removal, and releases.json with an end date for security fixes on every version (18). A telemetry page lists what Shopware CLI, the Deployment Helper and the web installer send, by unencrypted UDP to a server in Frankfurt, with DO_NOT_TRACK as the opt-out. The core has a usage data module with consent that we didn't read (14).)
- Security & auth, Shopware +37: doola MCP 36 (OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.); Shopware 73 (Admin API by OAuth 2.0 client credentials from a revocable integration with an ACL role and 10 minute tokens, or the integration's key and secret in headers on MCP. No secret in a URL was found in the docs. No OAuth scopes beyond ACL roles, and key rotation wasn't found (25). ACL checks on every MCP call, allowlists per integration and per user, a global allowed_tools switch and dry run by default on write tools. shopware-media-upload has no dry run and the Store API MCP endpoint has no allowlist (17). The MCP best practices page has a section on prompt injection through order notes, names and product text and advises read-only integrations for such data (11). An integration records when it was last used, and no audit log of API or MCP calls was found (4). Bug bounty through the security reporting form per SECURITY.md, ISO/IEC 27001:2022 on the trust centre, and advisories published on GitHub. The security.txt file expired on 31 December 2025 (16).)