doola MCP vs Square

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Square 87

Public OpenAPI 3.0 spec in square/connect-api-specification with 332 operations and 1,476 schemas (25). developer.squareup.com/llms.txt indexes the docs and links llms-full.txt (10). 327 of 332 operations carry a description stating purpose, with little guidance on when not to use one (14). Request schemas are typed, 204 schemas are enums and required fields are marked. The MCP tool make_api_request takes an untyped request object, with types fetched through get_type_info (12). Errors are documented as category, code, detail and field with a published code list, but the spec lists only 200 responses and names endpoint errors on 82 of 332 operations (11). Dated API versions set by the Square-Version header and monthly release notes (15).

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Square 83

List endpoints take limit and a cursor, and GraphQL selects fields for reads. The MCP server has three tools that load service and type detail on request (20). Cursor pagination, search endpoints with filters, and batch endpoints. Cursors expire after 5 minutes (18). Errors carry a category, a code and the request field at fault (18). Idempotency keys on 78 request schemas and optimistic concurrency by version. The MCP tools carry no readOnlyHint or destructiveHint annotations in the source (14). Official SDKs in seven languages. An MCP call needs two discovery calls first (13).

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Square 53

Graded on the hosted REST API. Status page at issquareup.com, now on incident.io with a page per country, whose United States page lists components including Developer Payments and Developer Sandbox (20). Its history starts in October 2026 and lists two partial incidents, Square Card wallet provisioning on 7 October and order sync to kitchen displays on 27 October, neither on the API. The 8 October reading of 15 incidents came from the old page's /api/ path, which robots.txt disallows, so it is struck, and August and September can't be read. No readable history for most of the window gives 5. No numeric limits were found for the REST API, and the docs say endpoints might enforce different limits. GraphQL is limited to 10 queries a second (5). The docs describe 429 RATE_LIMITED errors, exponential backoff with jitter and idempotency keys on writes (15). No SLA found in the developer terms or docs (0). The REST API is generally available, but 97 of 332 operations in the spec are beta and the MCP server is beta (8).

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Square 71

Closed service under published developer terms. The API spec and MCP server are Apache 2.0 and the Node.js SDK is MIT (15). The privacy notice was updated on 15 September 2026 and says retention is decided case by case, with no periods given. No public DPA was found at the addresses we tried (13). APIs are typically deprecated at least 12 months before retirement, retired endpoints return 410, and deprecated items are listed with dates (20). The privacy notice names categories of service providers and processing in the US, Japan, the UK and the EU. No named sub-processor list was found (8).

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Square 67

OAuth with code and PKCE flows, read and write scopes for each resource, 30-day access tokens, refresh and revocation. The remote MCP server uses OAuth with registration limited to an allowlist of clients and advertises 48 scopes. Personal access tokens are unrestricted (26). Read-only scopes, and DISALLOW_WRITES on the local MCP server. No confirmation step for destructive calls was found (12). The API returns seller and customer text. The MCP page advises testing prompts in the sandbox, and no prompt-injection guidance was found (3). API Logs show each request and response for 28 days, with webhook event logs (12). A Bugcrowd programme is linked from the security page, which states ISO 27001 and PCI certification. squareup.com and developer.squareup.com return 404 for security.txt, and the Bugcrowd and trust centre pages didn't render for us (14).

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

Square 40

No x402, MPP or L402 found in the docs index or the spec (0). Fees are public without login. The API has no charge, and card payments through the payments APIs cost 2.9% + 30 cents in the US (20). The sandbox is free, and the Square Free plan is $0 a month (20). A person must create a Square account and an application in the Developer Console, or approve OAuth in a browser (0).