# doola MCP vs Square (slim)

> Square scores 67.4 (B) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/doola-mcp-vs-square.md (~4,100 tokens) · this version ~2,280 tokens · JSON https://www.anchorterminal.com/compare/doola-mcp-vs-square.json · canonical https://www.anchorterminal.com/compare/doola-mcp-vs-square
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Square scores 67.4 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.

- doola MCP: F 28, rank #1430 of 1510 · https://www.anchorterminal.com/tools/doola-mcp.min.md
- Square: B 67.4, rank #329 of 1510 · https://www.anchorterminal.com/tools/square.min.md
- doola MCP, good for Founders, including non-US founders, who want an agent to form a US company for them.
- Square, good for Agents working for a seller already on Square, on catalogue, inventory, orders, payment links and customers, online and in person. Ahead on Reliability, 53 against 15; Schema & documentation, 87 against 26; Agent ergonomics, 83 against 23; Security & auth, 67 against 36; Payments & pricing, 40 against 10; Transparency & trust, 71 against 38. Also Runs on your own machine.

| Category | doola MCP | Square |
| --- | --- | --- |
| Reliability (16%) | 15 | 53 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 26 | 87 |
| Agent ergonomics (13%) | 23 | 83 |
| Security & auth (14%) | 36 | 67 |
| Payments & pricing (10%) | 10 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 71 |
| Transparency & trust (7%) | 38 | 71 |

| Fact (where they differ) | doola MCP | Square |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | doola | Block, Inc. |
| Hosted endpoint | `https://mcp.doola.com` | `https://mcp.squareup.com/mcp` |
| Transports | Streamable HTTP | HTTP, Streamable HTTP, stdio |
| Auth | OAuth | OAuth or key |
| Pricing | Paid | Pay per use |
| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | Proprietary service under the Square Developer Terms of Service. The MCP server and the OpenAPI specification on GitHub are Apache 2.0, and the Node.js SDK is MIT |
| Tools exposed | none | 3 |
| llms.txt | no | yes |
| MCP registry | `io.github.doolahq/doola` | not listed |
| Last release | none | 2026-09-16 |
| Terms last updated | not read yet | 2026-09-10 |
| Privacy policy last updated | not read yet | 2026-09-15 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | none | 454k npm/wk, 72k PyPI/wk |
| Agent reviews | none | 3.3/5 (4) |

Why the edge:
- Schema & documentation, Square +61: doola MCP 26 (No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.); Square 87 (Public OpenAPI 3.0 spec in square/connect-api-specification with 332 operations and 1,476 schemas (25). developer.squareup.com/llms.txt indexes the docs and links llms-full.txt (10). 327 of 332 operations carry a description stating purpose, with little guidance on when not to use one (14). Request schemas are typed, 204 schemas are enums and required fields are marked. The MCP tool `make_api_request` takes an untyped request object, with types fetched through `get_type_info` (12). Errors are documented as category, code, detail and field with a published code list, but the spec lists only 200 responses and names endpoint errors on 82 of 332 operations (11). Dated API versions set by the `Square-Version` header and monthly release notes (15).)
- Agent ergonomics, Square +60: doola MCP 23 (Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.); Square 83 (List endpoints take `limit` and a cursor, and GraphQL selects fields for reads. The MCP server has three tools that load service and type detail on request (20). Cursor pagination, search endpoints with filters, and batch endpoints. Cursors expire after 5 minutes (18). Errors carry a category, a code and the request field at fault (18). Idempotency keys on 78 request schemas and optimistic concurrency by version. The MCP tools carry no readOnlyHint or destructiveHint annotations in the source (14). Official SDKs in seven languages. An MCP call needs two discovery calls first (13).)
- Reliability, Square +38: doola MCP 15 (status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.); Square 53 (Graded on the hosted REST API. Status page at issquareup.com, now on incident.io with a page per country, whose United States page lists components including Developer Payments and Developer Sandbox (20). Its history starts in October 2026 and lists two partial incidents, Square Card wallet provisioning on 7 October and order sync to kitchen displays on 27 October, neither on the API. The 8 October reading of 15 incidents came from the old page's /api/ path, which robots.txt disallows, so it is struck, and August and September can't be read. No readable history for most of the window gives 5. No numeric limits were found for the REST API, and the docs say endpoints might enforce different limits. GraphQL is limited to 10 queries a second (5). The docs describe 429 `RATE_LIMITED` errors, exponential backoff with jitter and idempotency keys on writes (15). No SLA found in the developer terms or docs (0). The REST API is generally available, but 97 of 332 operations in the spec are beta and the MCP server is beta (8).)
- Transparency & trust, Square +33: doola MCP 38 (Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.); Square 71 (Closed service under published developer terms. The API spec and MCP server are Apache 2.0 and the Node.js SDK is MIT (15). The privacy notice was updated on 15 September 2026 and says retention is decided case by case, with no periods given. No public DPA was found at the addresses we tried (13). APIs are typically deprecated at least 12 months before retirement, retired endpoints return 410, and deprecated items are listed with dates (20). The privacy notice names categories of service providers and processing in the US, Japan, the UK and the EU. No named sub-processor list was found (8).)
- Security & auth, Square +31: doola MCP 36 (OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.); Square 67 (OAuth with code and PKCE flows, read and write scopes for each resource, 30-day access tokens, refresh and revocation. The remote MCP server uses OAuth with registration limited to an allowlist of clients and advertises 48 scopes. Personal access tokens are unrestricted (26). Read-only scopes, and `DISALLOW_WRITES` on the local MCP server. No confirmation step for destructive calls was found (12). The API returns seller and customer text. The MCP page advises testing prompts in the sandbox, and no prompt-injection guidance was found (3). API Logs show each request and response for 28 days, with webhook event logs (12). A Bugcrowd programme is linked from the security page, which states ISO 27001 and PCI certification. squareup.com and developer.squareup.com return 404 for security.txt, and the Bugcrowd and trust centre pages didn't render for us (14).)
- Payments & pricing, Square +30: doola MCP 10 (No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.); Square 40 (No x402, MPP or L402 found in the docs index or the spec (0). Fees are public without login. The API has no charge, and card payments through the payments APIs cost 2.9% + 30 cents in the US (20). The sandbox is free, and the Square Free plan is $0 a month (20). A person must create a Square account and an application in the Developer Console, or approve OAuth in a browser (0).)