{ "data": { "a": { "slug": "doola-mcp", "name": "doola MCP", "vendor": "doola", "vendorUrl": "https://doola.com", "kind": "mcp", "category": "commerce", "summary": "doola's hosted MCP server lets an agent form a US LLC or C-Corp in any state or DC from a conversation, covering entity type, name, members, ownership and the state filing, and check on existing doola companies.", "url": "https://www.anchorterminal.com/tools/doola-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/doola-mcp.json", "dns": "doola-mcp.grade.anchorterminal.com", "repo": "https://github.com/doolahq/plugins", "license": "Proprietary service. The plugin repository's MIT licence covers the manifests", "transports": [ "streamable-http" ], "remoteUrl": "https://mcp.doola.com", "packages": [], "auth": "oauth", "authNotes": "OAuth with a doola account on the first tool call; tokens are held by the client and can be revoked in doola's account settings.", "pricing": "paid", "pricingNotes": "Formation plans from $297 a year plus state fees (renewing at $300), up to $1,999 a year plus state fees. The MCP server itself is free to connect (checked 2026-11-07).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the MCP docs or pricing page (checked 2026-11-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://doola.com", "registryName": "io.github.doolahq/doola", "capabilities": [ "legal.company-formation", "commerce.checkout" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "paid", "mcp-registry" ], "graded": true, "anchor": { "graded": true, "score": 28, "grade": "F", "agentReady": false, "rank": 1430, "ranked": true, "rankOf": 1510, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 38 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-07" }, "negative": 0, "verdict": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.", "bestFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "strengths": [ "Forms a US LLC or C-Corp in any state from a conversation", "OAuth with revocation in account settings", "Plugins for Claude Code, Grok Build and Cursor", "Official registry entry and a public plugin repository" ], "weaknesses": [ "No published tool list, schemas or errors", "No documented confirmation before a paid filing", "No free tier; formation from $297 a year plus state fees", "Status page unreachable and no llms.txt" ], "agentNotes": [ "Confirm the entity type, state, name, members and price with the user before filing", "A filing is a paid legal act; never retry one without checking its status first", "Use the status tools on existing companies before starting a new formation" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 28 } ], "editorialScores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 30 }, "provenanceScore": 46, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude plugin marketplace add doolahq/plugins \u0026\u0026 claude plugin install doola@doola", "config": { "mcpServers": { "doola": { "url": "https://mcp.doola.com" } } } }, "letme": { "capability": "https://letme.dev/legal.company-formation", "tool": "https://letme.dev/doola-mcp" }, "area": "business", "provenance": { "legalEntity": "doola", "domain": "doola.com", "domainRegistered": "", "domainNote": "Not looked up: RDAP isn't requested under the 1 November 2026 rules.", "endpointOnVendorDomain": true, "terms": "https://doola.com/terms-of-service", "privacy": "https://doola.com/privacy-policy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-07", "notes": [ "Terms last updated July 2026. The plugin repository's licence names doola." ], "score": 46 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/doola-mcp.json", "live": { "slug": "doola-mcp", "probe": { "target": "https://mcp.doola.com", "method": "mcp-initialize", "lastAt": "2026-11-08T00:55:37.012153631Z", "lastOk": true, "lastStatus": 401, "lastMs": 176, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 113, "p95ms24h": 201, "samples24h": 63, "samples30d": 63, "days": [ { "date": "2026-11-07", "probes": 53, "ok": 53 }, { "date": "2026-11-08", "probes": 10, "ok": 10 } ] }, "githubStars": 0, "updatedAt": "2026-11-08T00:55:37.012153631Z" } }, "answer": "Spree Commerce scores 69.4 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "b": { "slug": "spree-commerce", "name": "Spree Commerce", "vendor": "Vendo Connect Inc", "vendorUrl": "https://spreecommerce.org", "kind": "http-api", "category": "commerce", "summary": "Spree Commerce is an open-source commerce platform on Ruby on Rails, maintained by Vendo Connect Inc. A self-hosted store runs a Store API for catalogue, cart and checkout, and an Admin API for back-office work.", "url": "https://www.anchorterminal.com/tools/spree-commerce", "markdownUrl": "https://www.anchorterminal.com/tools/spree-commerce.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/spree-commerce.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/spree-commerce.json", "dns": "spree-commerce.grade.anchorterminal.com", "repo": "https://github.com/spree/spree", "license": "BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@spree/sdk" }, { "registry": "npm", "name": "@spree/cli" }, { "registry": "npm", "name": "@spree/admin-sdk" }, { "registry": "rubygems", "name": "spree" } ], "auth": "mixed", "authNotes": "Store API calls need a publishable key (`pk_`) in the `X-Spree-Api-Key` header, plus a customer JWT as a Bearer token or a cart token in `X-Spree-Token` for guests. Admin API calls take a secret key (`sk_`) with `read_*` and `write_*` scopes per resource, or an admin JWT. Keys are created by the store's operator in the dashboard or with `spree api-key create`, with no vendor approval.", "pricing": "freemium", "pricingNotes": "Free to self-host under BSD 3-Clause, with no platform or transaction fee. The Enterprise Edition is custom pricing through sales. A free hosted Sandbox lets an agent's owner try the Admin API without a contract, for evaluation with test data only (https://spreecommerce.org/enterprise/, checked 2026-10-09).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI files or the repository (checked 2026-10-09). Payments go through provider integrations such as Stripe, Adyen and PayPal.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 15750, "npmWeekly": 1576, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://spreecommerce.org/docs", "llmsTxt": "https://spreecommerce.org/docs/llms.txt", "openapi": "https://spreecommerce.org/docs/api-reference/store.yaml", "capabilities": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "tags": [ "open-source", "self-hosted", "local", "openapi", "llms-txt", "mcp", "typescript", "ruby", "webhooks", "freemium" ], "lastRelease": "2026-10-29", "graded": true, "anchor": { "graded": true, "score": 69.4, "grade": "B", "agentReady": false, "rank": 244, "ranked": true, "rankOf": 1510, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 90, "maintenance": 91, "payments": 55, "reliability": 84, "schema": 87, "security": 65, "transparency": 64 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -8, "negativeNotes": [ "2026-07-20: six security advisories were published for `spree_api` and related gems between 8 January and 20 July 2026, four rated High, among them guest address and order disclosure without authentication (GHSA-87fh-rc96-6fr6, GHSA-p6pv-q7rc-g4h9, 5 February) and a guest cart takeover on `PATCH /api/v3/store/carts/:id/associate` (GHSA-4825-p4xm-pcf2, 20 July, fixed in 5.4.4 and 5.5.4). All are published with patched versions, so the deduction is reduced (https://github.com/spree/spree/security/advisories).", "2026-10-22, -3. Spree 6.0.0 (27 October) shipped 13 fixes for the Store and Admin API that the vendor describes in commit 8c56b722 (#14951), among them an admin CORS allowlist editable with the settings scope that let an allowed origin read any signed-in admin's access token, store credit spent through another customer's cart token, a newsletter subscription taken over by another customer and staff able to set a customer's password. No GitHub advisory or OSV entry was found for them on 1 November, though `SECURITY.md` says an advisory follows each fix, and the 5.6 branch, which `SECURITY.md` supports until 26 March 2027, still has the old CORS allowlist and store credit code. Fixed and described in a release, with no advisory, so a reduced deduction, as terraform-mcp (cross-tenant token reuse) and emailengine (cross-account tokens) took (https://github.com/spree/spree/pull/14951)" ], "verdict": "A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store, Admin and Seller APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and 13 further API security fixes in 6.0 carry no advisory.", "bestFor": "Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST, or through the MCP server built into 6.0.", "strengths": [ "OpenAPI 3.0.3 files for the Store API (113 operations), Admin API (537) and Seller API (135), plus llms.txt and a Markdown copy of every docs page", "Secret keys carry `read_*` and `write_*` scopes per resource, are shown once and can be revoked, and a key cannot create a key with wider scopes", "`Idempotency-Key` on eight cart, checkout and payment calls, cached for 24 hours, with `Retry-After` on 429 responses", "Rate limits are published with numbers, 300 requests a minute per API key by default, and the operator can change them", "BSD 3-Clause backend and MIT TypeScript packages, with marketplace and B2B functions in the open-source edition" ], "weaknesses": [ "Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses", "13 Store and Admin API security fixes merged on 22 October 2026 shipped in 6.0.0 without a GitHub advisory, and none was found on the 5.6 branch, which `SECURITY.md` supports until 26 March 2027", "The audit trail is in the paid Enterprise Edition only, and Enterprise prices are not published", "Supported-version end dates differ between `SECURITY.md` (6.x, and 5.6 until 26 March 2027) and the docs security policy (5.0 until 26 March 2028, 4.10 until 6 September 2027)", "Agent access to a store goes through the REST APIs or the built-in MCP server added in 6.0, which needs an admin's browser sign-in and consent for each person" ], "agentNotes": [ "Send a publishable key in `X-Spree-Api-Key` on every Store API call. Add `X-Spree-Token` with the cart token for guest carts, or a customer JWT as a Bearer token", "Send `Idempotency-Key` with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached", "Ask for `fields` and `expand` explicitly. Relations are left out by default and `limit` stops at 100", "Use a secret key with the narrowest scopes for the Admin API. `read_all` gives a read-only key, and the CLI's auto-minted local key is read-only", "Read the docs under `/docs/v5` for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments, splits carts from orders and sends money as decimal strings" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.4 } ], "editorialScores": { "ergonomics": 90, "maintenance": 91, "payments": 55, "reliability": 84, "schema": 87, "security": 65, "transparency": 75 }, "provenanceScore": 52, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx create-spree-app@latest my-store", "http": "curl -X GET 'http://localhost:3000/api/v3/store/products' -H 'X-Spree-Api-Key: pk_xxx'", "claudeCode": "claude mcp add --transport http spree-docs https://spreecommerce.org/docs/mcp", "config": { "mcpServers": { "spree-docs": { "url": "https://spreecommerce.org/docs/mcp" } } } }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/spree-commerce" }, "area": "business", "unitPrices": [ { "item": "Community Edition, self-hosted", "unit": "month", "usd": 0, "note": "BSD 3-Clause, the operator pays for its own servers" } ], "provenance": { "legalEntity": "Vendo Connect Inc", "domain": "spreecommerce.org", "domainRegistered": "2009-04-03", "endpointOnVendorDomain": false, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/spree/spree/releases", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The Sandbox terms name VENDO CONNECT INC, a Delaware corporation (file number 7005612), 3500 S DuPont Highway, Dover, Delaware 19901, as the company behind the Spree Commerce project. The `LICENSE` file also names Vendo Sp. z o.o. as a copyright holder.", "The API runs on the operator's own server, so there is no vendor endpoint and no vendor status page.", "No terms or privacy document governs the self-hosted software, and the BSD 3-Clause licence stands in. The published terms (https://spreecommerce.org/terms-of-service/) and privacy notice (https://spreecommerce.org/privacy-policy-sandbox/), both dated 10 July 2026, cover only the hosted Sandbox and Vendo's websites.", "https://spreecommerce.org/.well-known/security.txt returns 404. `SECURITY.md` in the repository gives a security mailbox for reports.", "RDAP for spreecommerce.org gives a registration date of 2009-04-03 and GoDaddy.com, LLC as registrar." ], "score": 52 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/spree-commerce.json", "live": { "slug": "spree-commerce", "versions": [ { "registry": "github", "name": "spree/spree", "version": "v6.0.3", "released": "2026-11-05", "seenAt": "2026-11-07T00:07:54.566538541Z" }, { "registry": "npm", "name": "@spree/admin-sdk", "version": "6.0.3", "seenAt": "2026-11-07T00:07:52.58896228Z" }, { "registry": "npm", "name": "@spree/cli", "version": "3.6.3", "seenAt": "2026-11-07T00:07:51.163166948Z" }, { "registry": "npm", "name": "@spree/sdk", "version": "6.0.3", "seenAt": "2026-11-07T00:07:50.365845703Z" } ], "githubStars": 15813, "npmWeekly": 2591, "securityTxt": { "url": "https://spreecommerce.org/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:59.548137108Z" }, "llmsTxt": { "url": "https://spreecommerce.org/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:01.274797866Z" }, "domain": { "domain": "spreecommerce.org", "registered": "2009-04-03", "source": "https://rdap.publicinterestregistry.org/rdap/domain/spreecommerce.org", "checkedAt": "2026-11-01T14:20:43.496394943Z" }, "mcpTools": { "url": "https://spreecommerce.org/docs/mcp", "checkedAt": "2026-11-07T01:48:08.308950101Z", "status": "ok", "protocol": "2026-07-28", "tools": [ { "name": "search_spree_commerce_documentation", "title": "Search documentation", "description": "Search across the Spree Commerce documentation knowledge base to find relevant information, code examples, API references, and guides. Use this tool when you need to answer questions about Spree Commerce documentation, find specific documentation, understand how features work, or locate implementation details. The search returns contextual content with titles and direct links to the documentation pages. If you need the full content of a specific page, use the query_docs_filesystem tool to `head` or `cat` the page path (append `.mdx` to the path returned from search — e.g. a result at `/some/page` is read with `head -200 /some/page.mdx`).", "inputSchema": { "additionalProperties": false, "properties": { "query": { "description": "Search query", "type": "string" }, "version": { "description": "Filter to specific version (e.g., 'v0.7')", "type": "string" } }, "required": [ "query" ], "type": "object" }, "annotations": { "destructiveHint": false, "idempotentHint": true, "openWorldHint": false, "readOnlyHint": true, "title": "Search documentation" } }, { "name": "query_docs_filesystem_spree_commerce_documentation", "title": "Query documentation filesystem", "description": "Run a read-only shell-like query against a virtualized, in-memory filesystem rooted at `/` that contains ONLY the Spree Commerce documentation documentation pages and OpenAPI specs. This is NOT a shell on any real machine — nothing runs on the user's computer, the server host, or any network. The filesystem is a sandbox backed by documentation chunks.\n\nThis is how you read documentation pages: there is no separate \"get page\" tool. To read a page, pass its `.mdx` path to `head` or `cat` — a page at the URL path `/some/page` lives at `/some/page.mdx`. To search the docs with exact keyword or regex matches, use `rg`. To understand the docs structure, use `tree` or `ls`.\n\n**Paths are specific to this site — never guess them.** Discover real paths with `tree / -L 2`, `ls /`, or the search tool before reading. If a path does not exist, that only means the guess was wrong; it does NOT mean the topic is undocumented — use `rg -il \"keyword\" /` to find where it is covered.\n\n**Workflow:** Start with the search tool for broad or conceptual queries like \"how to authenticate\" or \"rate limiting\". Use this tool when you need exact keyword/regex matching, structural exploration, or to read the full content of a specific page by path.\n\nSupported commands: rg (ripgrep), grep, find, tree, ls, cat, head, tail, stat, wc, sort, uniq, cut, sed, awk, jq, plus basic text utilities. No writes, no network, no process control. Run `--help` on any command for usage.\n\nEach call is STATELESS: the working directory always resets to `/` and no shell variables, aliases, or history carry over between calls. If you need to operate in a subdirectory, chain commands in one call with `\u0026\u0026` or pass absolute paths (e.g., `cd /some-directory \u0026\u0026 ls` or `ls /some-directory`). Do NOT assume that `cd` in one call affects the next call.\n\nExamples (replace the placeholder paths with real ones from `tree` or search):\n- `tree / -L 2` — see the top-level directory layout\n- `rg -il \"rate limit\" /` — find all files mentioning \"rate limit\"\n- `rg -C 3 \"apiKey\" /some-directory/` — show matches with 3 lines of context around each hit\n- `head -80 /some/page.mdx` — read the top 80 lines of a specific page\n- `head -80 /page-one.mdx /page-two.mdx /section/page-three.mdx` — read multiple pages in one call\n- `cat /some/page.mdx` — read a full page when you need everything\n- `head -100 /openapi/api-reference/admin.yaml` — read the start of an OpenAPI spec\n\nOpenAPI specs for this site are mounted at: `/openapi/api-reference/admin.yaml`, `/openapi/api-reference/seller.yaml`, `/openapi/api-reference/store.yaml`, `/openapi/api-reference/storefront.yaml`, `/openapi/api-reference/oauth.yml`, `/openapi/api-reference/platform.yaml`. Use them to answer questions about endpoints, request/response schemas, parameters, and authentication.\n\nOutput is truncated to 30KB per call. Prefer targeted `rg -C` or `head -N` over broad `cat` on large files. To read only the relevant sections of a large file, use `rg -C 3 \"pattern\" /path/file.mdx`. Batch multiple file reads into a single `head` or `cat` call whenever possible.\n\nWhen referencing pages in your response to the user, convert filesystem paths to URL paths by removing the `.mdx` extension. For example, `/some/page.mdx` becomes `/some/page`.", "inputSchema": { "additionalProperties": false, "properties": { "command": { "description": "A shell command to run against the virtualized documentation filesystem (e.g., `rg -il \"keyword\" /`, `tree / -L 2`, `head -80 /path/file.mdx`).", "type": "string" } }, "required": [ "command" ], "type": "object" }, "annotations": { "destructiveHint": false, "idempotentHint": true, "openWorldHint": false, "readOnlyHint": true, "title": "Query documentation filesystem" } }, { "name": "submit_feedback", "title": "Submit documentation feedback", "description": "Report a problem with this documentation site so the docs team can fix it. Use when a documentation page is incorrect, outdated, confusing, incomplete, or has a broken example. This is for feedback about the documentation content itself — not for product support requests or feedback about this tool or assistant.", "inputSchema": { "additionalProperties": false, "properties": { "feedback": { "description": "A clear description of the documentation issue or suggestion — what is incorrect, outdated, missing, or confusing.", "minLength": 1, "type": "string" }, "path": { "description": "The URL path of the documentation page the feedback is about (the page you were reading, without the `.mdx` extension).", "minLength": 1, "type": "string" } }, "required": [ "path", "feedback" ], "type": "object" }, "annotations": { "destructiveHint": false, "idempotentHint": false, "openWorldHint": true, "readOnlyHint": false, "title": "Submit documentation feedback" } } ], "schemaTokens": 1501, "changedAt": "2026-11-07T01:48:08.308950101Z", "check": { "checker": "anchor-check/1.0", "totalTokens": 1501, "counts": { "error": 0, "note": 2, "warn": 1 }, "findings": [ { "rule": "TC07", "severity": "warn", "tool": "query_docs_filesystem_spree_commerce_documentation", "message": "the description is about 824 tokens", "fix": "Keep the description to what a model needs to choose and call the tool; move the manual to a resource or the docs." }, { "rule": "TC03", "severity": "note", "tool": "query_docs_filesystem_spree_commerce_documentation", "message": "the name is 50 characters", "fix": "Keep names under 40 characters so the client's prefix fits." }, { "rule": "TC24", "severity": "note", "message": "3 of 3 tools have no outputSchema", "fix": "Declare outputSchema for tools that return structured data, and return structuredContent that matches it." } ] } }, "github": { "repo": "spree/spree", "checkedAt": "2026-11-02T09:27:22.160648878Z", "stars": 15805, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T08:49:37Z", "openIssues": 94, "openPRs": 97, "issuesOpened90d": 58, "issuesClosed90d": 46, "prsMerged90d": 535, "ci": { "branch": "main", "runs": 50, "success": 39, "failure": 1, "other": 10, "latest": "success", "latestAt": "2026-11-02T08:25:36Z" }, "advisories": [ { "ghsa": "GHSA-4825-p4xm-pcf2", "cve": "CVE-2026-94462", "severity": "high", "published": "2026-07-20T13:11:43Z" }, { "ghsa": "GHSA-xf4v-w5x5-pv79", "severity": "medium", "published": "2026-05-19T14:24:12Z" }, { "ghsa": "GHSA-87fh-rc96-6fr6", "cve": "CVE-2026-25758", "severity": "high", "published": "2026-02-05T13:49:28Z" }, { "ghsa": "GHSA-p6pv-q7rc-g4h9", "cve": "CVE-2026-25757", "severity": "high", "published": "2026-02-05T13:46:30Z" }, { "ghsa": "GHSA-3ghg-3787-w2xr", "cve": "CVE-2026-22589", "severity": "high", "published": "2026-01-08T11:25:09Z" }, { "ghsa": "GHSA-g268-72p7-9j6j", "cve": "CVE-2026-22588", "severity": "medium", "published": "2026-01-08T11:19:34Z" }, { "ghsa": "GHSA-m2jr-hmc3-qmpr", "cve": "CVE-2020-26223", "severity": "high", "published": "2020-11-12T15:09:20Z" }, { "ghsa": "GHSA-f8cm-364f-q9qh", "cve": "CVE-2020-15269", "severity": "high", "published": "2020-10-20T17:51:37Z" } ], "replies": { "sampled": 25, "unanswered": 6, "medianDays": 2 } }, "updatedAt": "2026-11-07T16:01:59.548137108Z" } }, "edges": [ { "by": 69, "category": "reliability", "leads": "spree-commerce", "name": "Reliability", "reasons": { "a": "status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.", "b": "Graded as software the owner runs. Installs with `npx create-spree-app@latest` or the `spree` gem, with Node, Docker, Ruby 3.2 or later and Rails 8.1 stated (20). A public Tests workflow runs on Postgres and MySQL; per the 9 October check most of the 25 latest runs completed successfully, with two failures on pull-request branches, and the runs were not re-read on 1 November (22). 95 open issues against 1,798 commits from 10 July to 9 October 2026, per the 9 October check, many of them roadmap items. Reply times were not read (18). The release policy is a shifted semantic versioning in which minor releases may break, with an upgrade guide per minor and `CHANGELOG.md` pointing to GitHub releases (9). Spree 6.0.0 became the stable release on 27 October 2026 and 6.0.1 followed on 29 October, the default docs now describe that stable line, and the TypeScript packages share its version, `@spree/admin-sdk` at 6.0.1 in the repository (15)." }, "scores": { "a": 15, "b": 84 } }, { "by": 67, "category": "ergonomics", "leads": "spree-commerce", "name": "Agent ergonomics", "reasons": { "a": "Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.", "b": "`fields` trims a response, `expand` adds relations that are left out by default, and `limit` caps a page (23). `page`, `limit` up to 100, `sort` and Ransack filters on list calls, with a `meta` block of counts (20). Errors carry a machine-readable `code`, a `message` and per-field `details`, with 34 documented codes (19). `Idempotency-Key` on eight cart, checkout and payment calls with a 24-hour cache, optimistic locking on carts, and SDK retries with backoff. Guest cart creation is not covered (18). Few required parameters and three TypeScript SDKs plus a CLI, with no official client in a second language (10)." }, "scores": { "a": 23, "b": 90 } }, { "by": 61, "category": "schema", "leads": "spree-commerce", "name": "Schema \u0026 documentation", "reasons": { "a": "No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.", "b": "OpenAPI 3.0.3 files for the Store API (91 paths, 113 operations), Admin API (352 paths, 537 operations) and Seller API (101 paths, 135 operations) are public and linked from llms.txt (25). llms.txt and a Markdown copy of each page (10). Every Admin operation and 105 of 113 Store operations carry a description, which says what the call does and rarely when not to use it (13). Typed parameters with required fields and 94 enums in the Store file, though `fields`, `expand` and Ransack `q[...]` filters are free strings (11). Error codes are tabled with JSON examples, and the Store file documents 401, 404 and 422 responses but not 429 (13). The path carries `/api/v3`, docs are split into v5.x and v6.x with 6.x, now stable, as the default, and a dated changelog has an RSS feed (15)." }, "scores": { "a": 26, "b": 87 } }, { "by": 45, "category": "payments", "leads": "spree-commerce", "name": "Payments \u0026 pricing", "reasons": { "a": "No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.", "b": "Read with the self-hosted rule. No x402, MPP or L402 (0). The Community Edition is free and its scope is public, while the Enterprise Edition is listed as custom pricing (15). Nothing to pay and no card for the open-source edition (20). An agent can install a store with `npx create-spree-app@latest`, which has an option for every prompt and prints the API keys, and the CLI mints a read-only key in a local project (20). The hosted Sandbox is free but needs a browser sign-up and is for evaluation only." }, "scores": { "a": 10, "b": 55 } }, { "by": 29, "category": "security", "leads": "spree-commerce", "name": "Security \u0026 auth", "reasons": { "a": "OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.", "b": "Publishable keys for the Store API and secret keys with `read_*` and `write_*` scopes per resource for the Admin API, shown once, revocable, with last-used dates. Keys travel in headers and have no expiry (28). `read_all` gives a read-only key, the CLI mints only read-only keys by itself, and a key cannot create a key with wider scopes. No confirmation step for destructive calls was found (15). The API returns merchant and shopper text, and no prompt-injection guidance was found in the reviewed documentation (5). The audit trail is Enterprise only. The open-source edition has last-used dates on keys and a webhook delivery log (5). `SECURITY.md` with a security mailbox, a 72-hour acknowledgement target, advisories published on GitHub, Dependabot and a weekly audit workflow. 13 Store and Admin API security fixes merged on 22 October shipped in 6.0.0 with no GitHub advisory found, and the 5.6 branch, still supported, keeps the old CORS allowlist and store credit code. No bounty, no security.txt and no certification (12). The MCP server added in 6.0 (OAuth with PKCE, per-person consent, confirmation on writes) is not scored here, since the listing is graded on the REST APIs." }, "scores": { "a": 36, "b": 65 } }, { "by": 26, "category": "transparency", "leads": "spree-commerce", "name": "Transparency \u0026 trust", "reasons": { "a": "Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.", "b": "BSD 3-Clause for the backend, MIT for the npm packages and CC BY 4.0 for the docs. Enterprise Edition code is under a separate commercial licence and is not in the repository (28). The software runs on the operator's servers, so store data stays with the operator. Vendo's only privacy notice covers its websites and the hosted Sandbox, with lead data kept up to 24 months and recipients named by category only (20). The release policy pairs breaking changes with deprecation notices in the previous release and lists supported versions with end dates, but the two published copies of that list disagree (12). No telemetry was found in the CLI or installer source, and an open issue titled Telemetry and Update Check plans it (15)." }, "scores": { "a": 38, "b": 64 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "doola", "b": "Vendo Connect Inc", "name": "Vendor" }, { "a": "https://mcp.doola.com", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service. The plugin repository's MIT licence covers the manifests", "b": "BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence", "name": "Licence" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "io.github.doolahq/doola", "b": "not listed", "name": "MCP registry" }, { "a": "none", "b": "2026-10-29", "name": "Last release" }, { "a": "not read yet", "b": "no document linked", "name": "Terms last updated" }, { "a": "not read yet", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "none", "b": "16k stars, 1.6k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.8/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Spree Commerce scores 69.4 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "question": "Which is better for AI agents, doola MCP or Spree Commerce?" }, { "answer": "doola MCP uses an OAuth sign-in. Spree Commerce takes an API key or an OAuth sign-in.", "question": "Do doola MCP and Spree Commerce need an API key?" }, { "answer": "doola MCP has a hosted endpoint at https://mcp.doola.com. No hosted endpoint is listed for Spree Commerce.", "question": "Can an agent call doola MCP and Spree Commerce without installing anything?" }, { "answer": "No open-source release is listed for doola MCP. Spree Commerce is open source (BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence).", "question": "Are doola MCP and Spree Commerce open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install", "No incidents deducted, where Spree Commerce loses 8 points for them" ], "goodFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "slug": "doola-mcp", "watchFor": "No published tool list, schemas or errors" }, { "aheadOn": [ "Reliability, 84 against 15", "Schema \u0026 documentation, 87 against 26", "Agent ergonomics, 90 against 23", "Security \u0026 auth, 65 against 36", "Payments \u0026 pricing, 55 against 10", "Maintenance \u0026 community, 91 against 70", "Transparency \u0026 trust, 64 against 38" ], "also": [ "Open source" ], "goodFor": "Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST, or through the MCP server built into 6.0.", "slug": "spree-commerce", "watchFor": "Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses" } ], "history": { "doola-mcp": null, "spree-commerce": [ { "causes": [ "product", "event" ], "date": "2026-11-01", "delta": -1.4, "from": 70.8, "fromGrade": "BB", "to": 69.4, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.4, "from": 70.4, "fromGrade": "BB", "to": 70.8, "toGrade": "BB" } ] }, "job": { "capability": "commerce.checkout", "name": "Commerce checkout" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.json", "title": "Adobe Commerce (Magento) vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/agentzon-vs-spree-commerce.json", "title": "Agentzon vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/agentzon-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce.json", "title": "BigCommerce API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce.json", "title": "Commerce Layer API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce.json", "title": "commercetools vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce.json", "title": "Ecwid by Lightspeed vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce.json", "title": "Elastic Path API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-spree-commerce.json", "title": "Medusa API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/medusa-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-spree-commerce.json", "title": "Saleor API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/saleor-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.json", "title": "Shopify API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.json", "title": "Shopware vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce.json", "title": "Snipcart API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-square.json", "title": "Spree Commerce vs Square", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-square" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-swell.json", "title": "Spree Commerce vs Swell", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.json", "title": "Spree Commerce vs Vendure", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-wix.json", "title": "Spree Commerce vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce.json", "title": "Spree Commerce vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.json", "title": "Adobe Commerce (Magento) vs doola MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.json", "title": "Agentzon vs doola MCP", "url": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.json", "title": "BigCommerce API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.json", "title": "Commerce Layer API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.json", "title": "commercetools vs doola MCP", "url": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.json", "title": "doola MCP vs Elastic Path API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.json", "title": "doola MCP vs Fabric", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.json", "title": "doola MCP vs Medusa API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.json", "title": "doola MCP vs Saleor API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.json", "title": "doola MCP vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.json", "title": "doola MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.json", "title": "doola MCP vs Snipcart API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-square.json", "title": "doola MCP vs Square", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-square" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell.json", "title": "doola MCP vs Swell", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.json", "title": "doola MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix.json", "title": "doola MCP vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.json", "title": "doola MCP vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/fabric-vs-spree-commerce.json", "title": "Fabric vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/fabric-vs-spree-commerce" } ], "panel": null, "scores": [ { "by": 69, "doola-mcp": 15, "edge": "spree-commerce", "key": "reliability", "name": "Reliability", "spree-commerce": 84, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 61, "doola-mcp": 26, "edge": "spree-commerce", "key": "schema", "name": "Schema \u0026 documentation", "spree-commerce": 87, "weight": 13 }, { "by": 67, "doola-mcp": 23, "edge": "spree-commerce", "key": "ergonomics", "name": "Agent ergonomics", "spree-commerce": 90, "weight": 13 }, { "by": 29, "doola-mcp": 36, "edge": "spree-commerce", "key": "security", "name": "Security \u0026 auth", "spree-commerce": 65, "weight": 14 }, { "by": 45, "doola-mcp": 10, "edge": "spree-commerce", "key": "payments", "name": "Payments \u0026 pricing", "spree-commerce": 55, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 21, "doola-mcp": 70, "edge": "spree-commerce", "key": "maintenance", "name": "Maintenance \u0026 community", "spree-commerce": 91, "weight": 7 }, { "by": 26, "doola-mcp": 38, "edge": "spree-commerce", "key": "transparency", "name": "Transparency \u0026 trust", "spree-commerce": 64, "weight": 7 } ], "summary": "Spree Commerce scores 69.4 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.", "tasks": null, "tutorials": [], "verdicts": { "doola-mcp": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.", "spree-commerce": "A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store, Admin and Seller APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and 13 further API security fixes in 6.0 carry no advisory." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce", "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.min.md" }, "markdown": "Spree Commerce scores 69.4 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.\n\n- doola MCP: grade F, 28/100, rank #1430 of 1510. Markdown https://www.anchorterminal.com/tools/doola-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/doola-mcp.json\n- Spree Commerce: grade B, 69.4/100, rank #244 of 1510. Markdown https://www.anchorterminal.com/tools/spree-commerce.md · JSON https://www.anchorterminal.com/api/v1/tools/spree-commerce.json\n- Best commerce platforms and checkout APIs for AI agents: https://www.anchorterminal.com/best/commerce/index.md\n- All 189 commerce comparisons: https://www.anchorterminal.com/compare/commerce/index.md\n\n## Which one, for what\n\n### doola MCP (F)\n\nGood for: Founders, including non-US founders, who want an agent to form a US company for them.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- No incidents deducted, where Spree Commerce loses 8 points for them\n\nWatch for: No published tool list, schemas or errors\n\n### Spree Commerce (B)\n\nGood for: Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST, or through the MCP server built into 6.0.\n\nAhead on:\n- Reliability, 84 against 15\n- Schema \u0026 documentation, 87 against 26\n- Agent ergonomics, 90 against 23\n- Security \u0026 auth, 65 against 36\n- Payments \u0026 pricing, 55 against 10\n- Maintenance \u0026 community, 91 against 70\n- Transparency \u0026 trust, 64 against 38\n\nAlso in its favour:\n- Open source\n\nWatch for: Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses\n\n\n## Why the edge\n\n### Reliability: Spree Commerce +69\n\n- doola MCP (15): status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.\n- Spree Commerce (84): Graded as software the owner runs. Installs with `npx create-spree-app@latest` or the `spree` gem, with Node, Docker, Ruby 3.2 or later and Rails 8.1 stated (20). A public Tests workflow runs on Postgres and MySQL; per the 9 October check most of the 25 latest runs completed successfully, with two failures on pull-request branches, and the runs were not re-read on 1 November (22). 95 open issues against 1,798 commits from 10 July to 9 October 2026, per the 9 October check, many of them roadmap items. Reply times were not read (18). The release policy is a shifted semantic versioning in which minor releases may break, with an upgrade guide per minor and `CHANGELOG.md` pointing to GitHub releases (9). Spree 6.0.0 became the stable release on 27 October 2026 and 6.0.1 followed on 29 October, the default docs now describe that stable line, and the TypeScript packages share its version, `@spree/admin-sdk` at 6.0.1 in the repository (15).\n\n### Agent ergonomics: Spree Commerce +67\n\n- doola MCP (23): Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.\n- Spree Commerce (90): `fields` trims a response, `expand` adds relations that are left out by default, and `limit` caps a page (23). `page`, `limit` up to 100, `sort` and Ransack filters on list calls, with a `meta` block of counts (20). Errors carry a machine-readable `code`, a `message` and per-field `details`, with 34 documented codes (19). `Idempotency-Key` on eight cart, checkout and payment calls with a 24-hour cache, optimistic locking on carts, and SDK retries with backoff. Guest cart creation is not covered (18). Few required parameters and three TypeScript SDKs plus a CLI, with no official client in a second language (10).\n\n### Schema \u0026 documentation: Spree Commerce +61\n\n- doola MCP (26): No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.\n- Spree Commerce (87): OpenAPI 3.0.3 files for the Store API (91 paths, 113 operations), Admin API (352 paths, 537 operations) and Seller API (101 paths, 135 operations) are public and linked from llms.txt (25). llms.txt and a Markdown copy of each page (10). Every Admin operation and 105 of 113 Store operations carry a description, which says what the call does and rarely when not to use it (13). Typed parameters with required fields and 94 enums in the Store file, though `fields`, `expand` and Ransack `q[...]` filters are free strings (11). Error codes are tabled with JSON examples, and the Store file documents 401, 404 and 422 responses but not 429 (13). The path carries `/api/v3`, docs are split into v5.x and v6.x with 6.x, now stable, as the default, and a dated changelog has an RSS feed (15).\n\n### Payments \u0026 pricing: Spree Commerce +45\n\n- doola MCP (10): No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.\n- Spree Commerce (55): Read with the self-hosted rule. No x402, MPP or L402 (0). The Community Edition is free and its scope is public, while the Enterprise Edition is listed as custom pricing (15). Nothing to pay and no card for the open-source edition (20). An agent can install a store with `npx create-spree-app@latest`, which has an option for every prompt and prints the API keys, and the CLI mints a read-only key in a local project (20). The hosted Sandbox is free but needs a browser sign-up and is for evaluation only.\n\n### Security \u0026 auth: Spree Commerce +29\n\n- doola MCP (36): OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.\n- Spree Commerce (65): Publishable keys for the Store API and secret keys with `read_*` and `write_*` scopes per resource for the Admin API, shown once, revocable, with last-used dates. Keys travel in headers and have no expiry (28). `read_all` gives a read-only key, the CLI mints only read-only keys by itself, and a key cannot create a key with wider scopes. No confirmation step for destructive calls was found (15). The API returns merchant and shopper text, and no prompt-injection guidance was found in the reviewed documentation (5). The audit trail is Enterprise only. The open-source edition has last-used dates on keys and a webhook delivery log (5). `SECURITY.md` with a security mailbox, a 72-hour acknowledgement target, advisories published on GitHub, Dependabot and a weekly audit workflow. 13 Store and Admin API security fixes merged on 22 October shipped in 6.0.0 with no GitHub advisory found, and the 5.6 branch, still supported, keeps the old CORS allowlist and store credit code. No bounty, no security.txt and no certification (12). The MCP server added in 6.0 (OAuth with PKCE, per-person consent, confirmation on writes) is not scored here, since the listing is graded on the REST APIs.\n\n### Transparency \u0026 trust: Spree Commerce +26\n\n- doola MCP (38): Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.\n- Spree Commerce (64): BSD 3-Clause for the backend, MIT for the npm packages and CC BY 4.0 for the docs. Enterprise Edition code is under a separate commercial licence and is not in the repository (28). The software runs on the operator's servers, so store data stays with the operator. Vendo's only privacy notice covers its websites and the hosted Sandbox, with lead data kept up to 24 months and recipients named by category only (20). The release policy pairs breaking changes with deprecation notices in the previous release and lists supported versions with end dates, but the two published copies of that list disagree (12). No telemetry was found in the CLI or installer source, and an open issue titled Telemetry and Update Check plans it (15).\n\n## Score by category\n\n| Category | Weight | doola MCP | Spree Commerce | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 84 | Spree Commerce +69 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 26 | 87 | Spree Commerce +61 |\n| Agent ergonomics | 13% (16.2 this run) | 23 | 90 | Spree Commerce +67 |\n| Security \u0026 auth | 14% (17.5 this run) | 36 | 65 | Spree Commerce +29 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 10 | 55 | Spree Commerce +45 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 91 | Spree Commerce +21 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 38 | 64 | Spree Commerce +26 |\n| Negative events | ≤15 | 0 | -8 | |\n| **Total** | | **28 · F** | **69.4 · B** | |\n\n## Facts side by side\n\n| Fact | doola MCP | Spree Commerce |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | doola | Vendo Connect Inc |\n| Hosted endpoint | `https://mcp.doola.com` | no (local only) |\n| Transports | Streamable HTTP | HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence |\n| Read-only variant documented | no | yes |\n| llms.txt | no | yes |\n| MCP registry | `io.github.doolahq/doola` | not listed |\n| Last release | none | 2026-10-29 |\n| Terms last updated | not read yet | no document linked |\n| Privacy policy last updated | not read yet | no document linked |\n| Popularity | none | 16k stars, 1.6k npm/wk |\n| Agent reviews | none | 3.8/5 (4) |\n\n## How the scores have moved\n\n### doola MCP\n\nNo score change since it was listed.\n\n### Spree Commerce\n\n- -1.4 on 1 November 2026 (BB to B): product, negative event\n- +0.4 on 27 October 2026: checklist\n\n## Verdicts\n\n**doola MCP.** doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.\n\n**Spree Commerce.** A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store, Admin and Seller APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and 13 further API security fixes in 6.0 carry no advisory.\n\n## Before you call either\n\n### doola MCP\n\n1. Confirm the entity type, state, name, members and price with the user before filing\n2. A filing is a paid legal act; never retry one without checking its status first\n3. Use the status tools on existing companies before starting a new formation\n\n### Spree Commerce\n\n1. Send a publishable key in `X-Spree-Api-Key` on every Store API call. Add `X-Spree-Token` with the cart token for guest carts, or a customer JWT as a Bearer token\n2. Send `Idempotency-Key` with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached\n3. Ask for `fields` and `expand` explicitly. Relations are left out by default and `limit` stops at 100\n4. Use a secret key with the narrowest scopes for the Admin API. `read_all` gives a read-only key, and the CLI's auto-minted local key is read-only\n5. Read the docs under `/docs/v5` for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments, splits carts from orders and sends money as decimal strings\n\n## Questions\n\n### Which is better for AI agents, doola MCP or Spree Commerce?\n\nSpree Commerce scores 69.4 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category.\n\n### Do doola MCP and Spree Commerce need an API key?\n\ndoola MCP uses an OAuth sign-in. Spree Commerce takes an API key or an OAuth sign-in.\n\n### Can an agent call doola MCP and Spree Commerce without installing anything?\n\ndoola MCP has a hosted endpoint at https://mcp.doola.com. No hosted endpoint is listed for Spree Commerce.\n\n### Are doola MCP and Spree Commerce open source?\n\nNo open-source release is listed for doola MCP. Spree Commerce is open source (BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.json, and with the fewest tokens: https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"doola-mcp\", \"b\": \"spree-commerce\"}`. From a terminal: `anchor compare doola-mcp spree-commerce`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/doola-mcp.json and https://www.anchorterminal.com/api/v1/tools/spree-commerce.json\n\n## Other comparisons with doola MCP or Spree Commerce\n\n- [Adobe Commerce (Magento) vs Spree Commerce](https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.md)\n- [Agentzon vs Spree Commerce](https://www.anchorterminal.com/compare/agentzon-vs-spree-commerce.md)\n- [BigCommerce API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce.md)\n- [Commerce Layer API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce.md)\n- [commercetools vs Spree Commerce](https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce.md)\n- [Ecwid by Lightspeed vs Spree Commerce](https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce.md)\n- [Elastic Path API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce.md)\n- [Medusa API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/medusa-vs-spree-commerce.md)\n- [Saleor API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/saleor-vs-spree-commerce.md)\n- [Shopify API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.md)\n- [Shopware vs Spree Commerce](https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.md)\n- [Snipcart API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce.md)\n- [Spree Commerce vs Square](https://www.anchorterminal.com/compare/spree-commerce-vs-square.md)\n- [Spree Commerce vs Swell](https://www.anchorterminal.com/compare/spree-commerce-vs-swell.md)\n- [Spree Commerce vs Vendure](https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.md)\n- [Spree Commerce vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/spree-commerce-vs-wix.md)\n- [Spree Commerce vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce.md)\n- [Adobe Commerce (Magento) vs doola MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.md)\n- [Agentzon vs doola MCP](https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.md)\n- [BigCommerce API + MCP vs doola MCP](https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.md)\n- [Commerce Layer API + MCP vs doola MCP](https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.md)\n- [commercetools vs doola MCP](https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.md)\n- [doola MCP vs Elastic Path API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.md)\n- [doola MCP vs Fabric](https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.md)\n- [doola MCP vs Medusa API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.md)\n- [doola MCP vs Saleor API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.md)\n- [doola MCP vs Shopify API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.md)\n- [doola MCP vs Shopware](https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.md)\n- [doola MCP vs Snipcart API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.md)\n- [doola MCP vs Square](https://www.anchorterminal.com/compare/doola-mcp-vs-square.md)\n- [doola MCP vs Swell](https://www.anchorterminal.com/compare/doola-mcp-vs-swell.md)\n- [doola MCP vs Vendure](https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.md)\n- [doola MCP vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/doola-mcp-vs-wix.md)\n- [doola MCP vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.md)\n- [Fabric vs Spree Commerce](https://www.anchorterminal.com/compare/fabric-vs-spree-commerce.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "doola MCP vs Spree Commerce", "url": "" } ], "description": "Spree Commerce scores 69.4 (B) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "doola MCP F 28", "Spree Commerce B 69.4", "scores" ], "h1": "doola MCP vs Spree Commerce", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/doola-mcp-vs-spree-commerce", "published": "2026-10-01", "section": "tools", "title": "doola MCP vs Spree Commerce for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce" }, "tokens": { "markdown": 4500, "slim": 2380 }, "version": 1 }