# doola MCP vs Spree Commerce (slim)

> Spree Commerce scores 69.4 (B) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.md (~4,500 tokens) · this version ~2,380 tokens · JSON https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.json · canonical https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Spree Commerce scores 69.4 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.

- doola MCP: F 28, rank #1430 of 1510 · https://www.anchorterminal.com/tools/doola-mcp.min.md
- Spree Commerce: B 69.4, rank #244 of 1510 · https://www.anchorterminal.com/tools/spree-commerce.min.md
- doola MCP, good for Founders, including non-US founders, who want an agent to form a US company for them. Also A hosted endpoint, with nothing to install; No incidents deducted, where Spree Commerce loses 8 points for them.
- Spree Commerce, good for Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST, or through the MCP server built into 6.0. Ahead on Reliability, 84 against 15; Schema & documentation, 87 against 26; Agent ergonomics, 90 against 23; Security & auth, 65 against 36; Payments & pricing, 55 against 10; Maintenance & community, 91 against 70; Transparency & trust, 64 against 38. Also Open source.

| Category | doola MCP | Spree Commerce |
| --- | --- | --- |
| Reliability (16%) | 15 | 84 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 26 | 87 |
| Agent ergonomics (13%) | 23 | 90 |
| Security & auth (14%) | 36 | 65 |
| Payments & pricing (10%) | 10 | 55 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 91 |
| Transparency & trust (7%) | 38 | 64 |

| Fact (where they differ) | doola MCP | Spree Commerce |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | doola | Vendo Connect Inc |
| Hosted endpoint | `https://mcp.doola.com` | no (local only) |
| Transports | Streamable HTTP | HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Paid | Freemium |
| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence |
| Read-only variant documented | no | yes |
| llms.txt | no | yes |
| MCP registry | `io.github.doolahq/doola` | not listed |
| Last release | none | 2026-10-29 |
| Terms last updated | not read yet | no document linked |
| Privacy policy last updated | not read yet | no document linked |
| Popularity | none | 16k stars, 1.6k npm/wk |
| Agent reviews | none | 3.8/5 (4) |

Why the edge:
- Reliability, Spree Commerce +69: doola MCP 15 (status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.); Spree Commerce 84 (Graded as software the owner runs. Installs with `npx create-spree-app@latest` or the `spree` gem, with Node, Docker, Ruby 3.2 or later and Rails 8.1 stated (20). A public Tests workflow runs on Postgres and MySQL; per the 9 October check most of the 25 latest runs completed successfully, with two failures on pull-request branches, and the runs were not re-read on 1 November (22). 95 open issues against 1,798 commits from 10 July to 9 October 2026, per the 9 October check, many of them roadmap items. Reply times were not read (18). The release policy is a shifted semantic versioning in which minor releases may break, with an upgrade guide per minor and `CHANGELOG.md` pointing to GitHub releases (9). Spree 6.0.0 became the stable release on 27 October 2026 and 6.0.1 followed on 29 October, the default docs now describe that stable line, and the TypeScript packages share its version, `@spree/admin-sdk` at 6.0.1 in the repository (15).)
- Agent ergonomics, Spree Commerce +67: doola MCP 23 (Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.); Spree Commerce 90 (`fields` trims a response, `expand` adds relations that are left out by default, and `limit` caps a page (23). `page`, `limit` up to 100, `sort` and Ransack filters on list calls, with a `meta` block of counts (20). Errors carry a machine-readable `code`, a `message` and per-field `details`, with 34 documented codes (19). `Idempotency-Key` on eight cart, checkout and payment calls with a 24-hour cache, optimistic locking on carts, and SDK retries with backoff. Guest cart creation is not covered (18). Few required parameters and three TypeScript SDKs plus a CLI, with no official client in a second language (10).)
- Schema & documentation, Spree Commerce +61: doola MCP 26 (No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.); Spree Commerce 87 (OpenAPI 3.0.3 files for the Store API (91 paths, 113 operations), Admin API (352 paths, 537 operations) and Seller API (101 paths, 135 operations) are public and linked from llms.txt (25). llms.txt and a Markdown copy of each page (10). Every Admin operation and 105 of 113 Store operations carry a description, which says what the call does and rarely when not to use it (13). Typed parameters with required fields and 94 enums in the Store file, though `fields`, `expand` and Ransack `q[...]` filters are free strings (11). Error codes are tabled with JSON examples, and the Store file documents 401, 404 and 422 responses but not 429 (13). The path carries `/api/v3`, docs are split into v5.x and v6.x with 6.x, now stable, as the default, and a dated changelog has an RSS feed (15).)
- Payments & pricing, Spree Commerce +45: doola MCP 10 (No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.); Spree Commerce 55 (Read with the self-hosted rule. No x402, MPP or L402 (0). The Community Edition is free and its scope is public, while the Enterprise Edition is listed as custom pricing (15). Nothing to pay and no card for the open-source edition (20). An agent can install a store with `npx create-spree-app@latest`, which has an option for every prompt and prints the API keys, and the CLI mints a read-only key in a local project (20). The hosted Sandbox is free but needs a browser sign-up and is for evaluation only.)
- Security & auth, Spree Commerce +29: doola MCP 36 (OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.); Spree Commerce 65 (Publishable keys for the Store API and secret keys with `read_*` and `write_*` scopes per resource for the Admin API, shown once, revocable, with last-used dates. Keys travel in headers and have no expiry (28). `read_all` gives a read-only key, the CLI mints only read-only keys by itself, and a key cannot create a key with wider scopes. No confirmation step for destructive calls was found (15). The API returns merchant and shopper text, and no prompt-injection guidance was found in the reviewed documentation (5). The audit trail is Enterprise only. The open-source edition has last-used dates on keys and a webhook delivery log (5). `SECURITY.md` with a security mailbox, a 72-hour acknowledgement target, advisories published on GitHub, Dependabot and a weekly audit workflow. 13 Store and Admin API security fixes merged on 22 October shipped in 6.0.0 with no GitHub advisory found, and the 5.6 branch, still supported, keeps the old CORS allowlist and store credit code. No bounty, no security.txt and no certification (12). The MCP server added in 6.0 (OAuth with PKCE, per-person consent, confirmation on writes) is not scored here, since the listing is graded on the REST APIs.)
- Transparency & trust, Spree Commerce +26: doola MCP 38 (Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.); Spree Commerce 64 (BSD 3-Clause for the backend, MIT for the npm packages and CC BY 4.0 for the docs. Enterprise Edition code is under a separate commercial licence and is not in the repository (28). The software runs on the operator's servers, so store data stays with the operator. Vendo's only privacy notice covers its websites and the hosted Sandbox, with lead data kept up to 24 months and recipients named by category only (20). The release policy pairs breaking changes with deprecation notices in the previous release and lists supported versions with end dates, but the two published copies of that list disagree (12). No telemetry was found in the CLI or installer source, and an open issue titled Telemetry and Update Check plans it (15).)