doola MCP vs Spree Commerce

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Spree Commerce 84

Graded as software the owner runs. Installs with npx create-spree-app@latest or the spree gem, with Node, Docker, Ruby 3.2 or later and Rails 8.1 stated (20). A public Tests workflow runs on Postgres and MySQL; per the 9 October check most of the 25 latest runs completed successfully, with two failures on pull-request branches, and the runs were not re-read on 1 November (22). 95 open issues against 1,798 commits from 10 July to 9 October 2026, per the 9 October check, many of them roadmap items. Reply times were not read (18). The release policy is a shifted semantic versioning in which minor releases may break, with an upgrade guide per minor and CHANGELOG.md pointing to GitHub releases (9). Spree 6.0.0 became the stable release on 27 October 2026 and 6.0.1 followed on 29 October, the default docs now describe that stable line, and the TypeScript packages share its version, @spree/admin-sdk at 6.0.1 in the repository (15).

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Spree Commerce 90

fields trims a response, expand adds relations that are left out by default, and limit caps a page (23). page, limit up to 100, sort and Ransack filters on list calls, with a meta block of counts (20). Errors carry a machine-readable code, a message and per-field details, with 34 documented codes (19). Idempotency-Key on eight cart, checkout and payment calls with a 24-hour cache, optimistic locking on carts, and SDK retries with backoff. Guest cart creation is not covered (18). Few required parameters and three TypeScript SDKs plus a CLI, with no official client in a second language (10).

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Spree Commerce 87

OpenAPI 3.0.3 files for the Store API (91 paths, 113 operations), Admin API (352 paths, 537 operations) and Seller API (101 paths, 135 operations) are public and linked from llms.txt (25). llms.txt and a Markdown copy of each page (10). Every Admin operation and 105 of 113 Store operations carry a description, which says what the call does and rarely when not to use it (13). Typed parameters with required fields and 94 enums in the Store file, though fields, expand and Ransack q[...] filters are free strings (11). Error codes are tabled with JSON examples, and the Store file documents 401, 404 and 422 responses but not 429 (13). The path carries /api/v3, docs are split into v5.x and v6.x with 6.x, now stable, as the default, and a dated changelog has an RSS feed (15).

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

Spree Commerce 55

Read with the self-hosted rule. No x402, MPP or L402 (0). The Community Edition is free and its scope is public, while the Enterprise Edition is listed as custom pricing (15). Nothing to pay and no card for the open-source edition (20). An agent can install a store with npx create-spree-app@latest, which has an option for every prompt and prints the API keys, and the CLI mints a read-only key in a local project (20). The hosted Sandbox is free but needs a browser sign-up and is for evaluation only.

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Spree Commerce 65

Publishable keys for the Store API and secret keys with read_* and write_* scopes per resource for the Admin API, shown once, revocable, with last-used dates. Keys travel in headers and have no expiry (28). read_all gives a read-only key, the CLI mints only read-only keys by itself, and a key cannot create a key with wider scopes. No confirmation step for destructive calls was found (15). The API returns merchant and shopper text, and no prompt-injection guidance was found in the reviewed documentation (5). The audit trail is Enterprise only. The open-source edition has last-used dates on keys and a webhook delivery log (5). SECURITY.md with a security mailbox, a 72-hour acknowledgement target, advisories published on GitHub, Dependabot and a weekly audit workflow. 13 Store and Admin API security fixes merged on 22 October shipped in 6.0.0 with no GitHub advisory found, and the 5.6 branch, still supported, keeps the old CORS allowlist and store credit code. No bounty, no security.txt and no certification (12). The MCP server added in 6.0 (OAuth with PKCE, per-person consent, confirmation on writes) is not scored here, since the listing is graded on the REST APIs.

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Spree Commerce 64

BSD 3-Clause for the backend, MIT for the npm packages and CC BY 4.0 for the docs. Enterprise Edition code is under a separate commercial licence and is not in the repository (28). The software runs on the operator's servers, so store data stays with the operator. Vendo's only privacy notice covers its websites and the hosted Sandbox, with lead data kept up to 24 months and recipients named by category only (20). The release policy pairs breaking changes with deprecation notices in the previous release and lists supported versions with end dates, but the two published copies of that list disagree (12). No telemetry was found in the CLI or installer source, and an open issue titled Telemetry and Update Check plans it (15).