doola MCP vs Snipcart API + MCP

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Snipcart API + MCP 58

status.snipcart.com runs Upptime from the public snipcart/status repo, checking four URLs, the merchant dashboard host (app.snipcart.com, which also serves the API), the website, the docs and the support forum. Neither the API path nor the MCP endpoint at ai.snipcart.com is checked on its own (15). Since 3 July the dashboard host shows no downtime, at 100% for the month and year in the summary file, and the docs went down twice, on 21 and 24 September (25). REST rate limits aren't published beyond per-endpoint limits on discount listing and order notifications, and the MCP server defaults to 100 requests a minute and 10 concurrent per key (8). No 429 or retry guidance found (0). No SLA in the terms (0). The REST API and MCP server are both live, not beta (10).

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

Snipcart API + MCP 35

No x402, MPP or L402 (0). Public pricing, 2 per cent of sales, or $20 a month for stores under $1,000 in monthly sales, which is per-sale rather than per-call (15). Test mode is free with no card (20). A person signs up in the browser (0).

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Snipcart API + MCP 61

Closed service with published terms (15). Privacy is a section of the terms, last updated 14 March 2022, linking a DPA PDF but giving no retention periods or postal address (10). The additive-only change policy is stated, with no deprecation notices found (10). Payment gateways (Stripe, PayPal, Paymill) and advertising networks are named, with no hosting provider or subprocessor list (4).

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Snipcart API + MCP 20

One secret key per mode (test or live) with full account access, sent as Basic auth or, for the MCP, in an X-Snipcart-Api-Key header. The MCP docs say OAuth 2.1 isn't supported (12). No scoped or read-only keys, and refund, stock and archive tools carry no documented confirmation (3). Tools return customer and order data, with no prompt-injection guidance found (5). Order logs are notes, not an audit trail (0). No security.txt per the 30 September check, and no disclosure contact in the terms (0).

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Snipcart API + MCP 37

No OpenAPI file, and the MCP source isn't public, so we couldn't read the tool schemas (5). No llms.txt per the 30 September check (0). The MCP docs describe the 38 tools in nine groups by what they do, with no when-not-to-use guidance (8). Tool input types couldn't be checked (5). The REST reference has examples per endpoint, but errors are only described as "a JSON error body on 4xx" (7). Dated release notes every few weeks and a stated change policy, new fields may appear without notice but existing ones aren't renamed or removed (12).