doola MCP vs Vendure

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Vendure 89

Graded with the self-hosted package checklist, since there's no generally available hosted API (Vendure Cloud is in a closed beta for paid subscribers, general availability planned for Q1 2027). @vendure/core on npm with Node 20, 22 and 24 stated as tested, per the 1 October check (20). Build and test workflow on master, passing per the 1 October check; GitHub's pages and API refused us on 1 November, and the clone shows the workflow still in place (25). 170 open issues per the 1 October check, not re-read on 1 November. 3.8.1 fixes the 9 September stale-surcharge bug among 33 fixes (17). Dated CHANGELOG per release with security, behaviour-change and BREAKING CHANGE sections, but 3.7.3 and 3.7.4 changed behaviour in patch releases to close security holes and 3.8.0 is a minor release that needs a database migration (12). Version 3.x (15). 20+25+17+12+15 = 89.

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Vendure 91

Typed GraphQL Shop and Admin APIs with introspection, and schema-shop.json and schema-admin.json committed to the repo (25). llms.txt at docs.vendure.io, 997 lines on 1 November, including the MCP server guides (10). Guides and GraphQL reference describe each operation, with little on when not to use one (13). Strict GraphQL input types with enums and required markers (14). Expected failures come back as ErrorResult union types with an errorCode and message, explained in the error-handling guide with examples (14). Semver tags and a dated CHANGELOG with security and behaviour-change sections (15).

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Vendure 68

GraphQL field selection sizes every response (23). List queries take take, skip, filter and sort (20). ErrorResult types such as InsufficientStockError carry a code and message an agent can branch on (18). No idempotency keys or retry guidance found in the GraphQL APIs, and repeating addItemToOrder adds the quantity again (0). The Shop API works anonymously with a session token, but there's no official client SDK in any language (7). The MCP plugin released in 3.8.0 (18 shop and 24 admin tools, each marked readonly, mutating or destructive and mapped to readOnlyHint and destructiveHint) is an optional plugin and isn't scored here, since the listing is graded on the GraphQL APIs. 23+20+18+0+7 = 68.

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

Vendure 50

No x402, MPP or L402 (0). Core is free. Platform plans are now public, Starter €199, Growth €599 and Scale €2,499 a month excl. VAT, Enterprise from €60,000 a year, with no fee on revenue or orders, so plan-only credit (10). Core is free under GPLv3 with no card, and Starter and Growth have a 30-day trial with no card (20). An agent can scaffold a store with npx @vendure/create or query the public read-only demo Shop API without an account (20). 0+10+20+20 = 50.

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Vendure 74

GPL-3.0-or-later, with a commercial licence sold through Platform (30). Terms of Service and Privacy Policy, both version 2026-10-20, name Elevantiq GmbH trading as Vendure. The policy lists processors with locations (WorkOS, Amazon SES in Frankfurt, Vercel, Northflank in Frankfurt, Plausible, Sentry in the EU and others) and retention by category, such as 7 days for package download records and 12 months for licence-check IP addresses. Section 16 of the terms is a data processing agreement under Article 28 GDPR for support access on the self-serve plans, Vendure Cloud has its own, and the subprocessor list for that processing is given on request rather than published (25). SECURITY.md says only the latest 3.x minor gets fixes, and deprecations appear in the changelog without dated end-of-life notices (10). Core sends anonymous usage telemetry on by default since 3.6.0, at startup and about every 24 hours, to telemetry.vendure.io. The telemetry guide lists the fields (installation ID, versions, database type, plugin names, ranged entity counts), and VENDURE_DISABLE_TELEMETRY or a CI environment turns it off. Licence reports from Platform's commercial plugins don't follow that switch, which the terms say (20). The 1 October note said no usage telemetry was found in core, which was wrong. 30+25+10+20 = 85.

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Vendure 65

API keys since 3.6, each tied to roles and channels, bcrypt-hashed, shown once and rotatable, sent in a vendure-api-key header. Since 3.7.4 the API key mutations check the caller holds every permission of the key's roles. No OAuth in the GraphQL APIs; the MCP plugin uses OAuth 2.1 (28). Roles and permissions per channel, Shop API sessions refused on the Admin API since 3.8.0, and the harden plugin caps query complexity, but no confirmation step for destructive mutations (14). Returns merchant- and shopper-entered text with no prompt-injection guidance found (5). The MCP plugin released in 3.8.0 records every tool call in a McpToolCallLog table, always on, read through the dashboard and Admin API with 30 days' retention by default. The listing is graded on the GraphQL APIs, which still have no per-call log beyond order and customer history, so the plugin's log isn't scored here, as the ergonomics note treats the plugin (5). SECURITY.md takes private reports through GitHub and supports only the latest 3.x minor. Advisories are published with each release, 11 in 3.7.3, two in 3.7.4, one in 3.8.0 and three in 3.8.1. No security.txt (404), bounty or certification found (13). 28+14+5+5+13 = 65.