{ "data": { "a": { "slug": "doola-mcp", "name": "doola MCP", "vendor": "doola", "vendorUrl": "https://doola.com", "kind": "mcp", "category": "commerce", "summary": "doola's hosted MCP server lets an agent form a US LLC or C-Corp in any state or DC from a conversation, covering entity type, name, members, ownership and the state filing, and check on existing doola companies.", "url": "https://www.anchorterminal.com/tools/doola-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/doola-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/doola-mcp.json", "dns": "doola-mcp.grade.anchorterminal.com", "repo": "https://github.com/doolahq/plugins", "license": "Proprietary service. The plugin repository's MIT licence covers the manifests", "transports": [ "streamable-http" ], "remoteUrl": "https://mcp.doola.com", "packages": [], "auth": "oauth", "authNotes": "OAuth with a doola account on the first tool call; tokens are held by the client and can be revoked in doola's account settings.", "pricing": "paid", "pricingNotes": "Formation plans from $297 a year plus state fees (renewing at $300), up to $1,999 a year plus state fees. The MCP server itself is free to connect (checked 2026-11-07).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the MCP docs or pricing page (checked 2026-11-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://doola.com", "registryName": "io.github.doolahq/doola", "capabilities": [ "legal.company-formation", "commerce.checkout" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "paid", "mcp-registry" ], "graded": true, "anchor": { "graded": true, "score": 28, "grade": "F", "agentReady": false, "rank": 1430, "ranked": true, "rankOf": 1510, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 38 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-07" }, "negative": 0, "verdict": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.", "bestFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "strengths": [ "Forms a US LLC or C-Corp in any state from a conversation", "OAuth with revocation in account settings", "Plugins for Claude Code, Grok Build and Cursor", "Official registry entry and a public plugin repository" ], "weaknesses": [ "No published tool list, schemas or errors", "No documented confirmation before a paid filing", "No free tier; formation from $297 a year plus state fees", "Status page unreachable and no llms.txt" ], "agentNotes": [ "Confirm the entity type, state, name, members and price with the user before filing", "A filing is a paid legal act; never retry one without checking its status first", "Use the status tools on existing companies before starting a new formation" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 28 } ], "editorialScores": { "ergonomics": 23, "maintenance": 70, "payments": 10, "reliability": 15, "schema": 26, "security": 36, "transparency": 30 }, "provenanceScore": 46, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude plugin marketplace add doolahq/plugins \u0026\u0026 claude plugin install doola@doola", "config": { "mcpServers": { "doola": { "url": "https://mcp.doola.com" } } } }, "letme": { "capability": "https://letme.dev/legal.company-formation", "tool": "https://letme.dev/doola-mcp" }, "area": "business", "provenance": { "legalEntity": "doola", "domain": "doola.com", "domainRegistered": "", "domainNote": "Not looked up: RDAP isn't requested under the 1 November 2026 rules.", "endpointOnVendorDomain": true, "terms": "https://doola.com/terms-of-service", "privacy": "https://doola.com/privacy-policy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-07", "notes": [ "Terms last updated July 2026. The plugin repository's licence names doola." ], "score": 46 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/doola-mcp.json", "live": { "slug": "doola-mcp", "probe": { "target": "https://mcp.doola.com", "method": "mcp-initialize", "lastAt": "2026-11-08T00:55:37.012153631Z", "lastOk": true, "lastStatus": 401, "lastMs": 176, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 113, "p95ms24h": 201, "samples24h": 63, "samples30d": 63, "days": [ { "date": "2026-11-07", "probes": 53, "ok": 53 }, { "date": "2026-11-08", "probes": 10, "ok": 10 } ] }, "githubStars": 0, "updatedAt": "2026-11-08T00:55:37.012153631Z" } }, "answer": "Vendure scores 69.2 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "b": { "slug": "vendure", "name": "Vendure", "vendor": "Vendure (Elevantiq GmbH)", "vendorUrl": "https://vendure.io", "kind": "http-api", "category": "commerce", "summary": "Open-source headless commerce framework on TypeScript, NestJS and GraphQL that you self-host.", "url": "https://www.anchorterminal.com/tools/vendure", "markdownUrl": "https://www.anchorterminal.com/tools/vendure.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/vendure.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/vendure.json", "dns": "vendure.grade.anchorterminal.com", "repo": "https://github.com/vendurehq/vendure", "license": "GPL-3.0-or-later", "transports": [ "http" ], "remoteUrl": "https://readonlydemo.vendure.io/shop-api", "packages": [ { "registry": "npm", "name": "@vendure/core" } ], "auth": "mixed", "authNotes": "Shop API is anonymous for browsing and cart, with a session token (bearer header or cookie) that carries the active order. Customer login and Admin API use the same session tokens after login. API key authentication arrived in v3.6. You set everything up on your own server; there is no vendor-hosted API for Core.", "pricing": "freemium", "pricingNotes": "Vendure Core is free under GPLv3; self-hosted you pay only for your own servers and database. Vendure Platform plans are Starter €199, Growth €599 and Scale €2,499 a month excl. VAT on a 12-month term, Enterprise from €60,000 a year, with a 30-day trial without a card on Starter and Growth and no fee on revenue, orders or users. Each plan includes the right to join the closed Vendure Cloud beta, with general availability planned for Q1 2027 (https://vendure.io/pricing).", "priceSummary": "Freemium", "where": "hosted", "x402": { "level": "no", "evidence": "No payments layer for agents; payment handlers are plugins you configure (checked 2026-09-30).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 8487, "npmWeekly": 29655, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.vendure.io", "llmsTxt": "https://docs.vendure.io/llms.txt", "capabilities": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "tags": [ "open-source", "self-hosted", "local", "typescript", "llms-txt", "freemium", "enterprise" ], "lastRelease": "2026-10-23", "graded": true, "anchor": { "graded": true, "score": 69.2, "grade": "B", "agentReady": false, "rank": 257, "ranked": true, "rankOf": 1510, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 85, "payments": 50, "reliability": 89, "schema": 91, "security": 65, "transparency": 74 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -6, "negativeNotes": [ "Advisories fixed and disclosed in 2026 releases. 3.7.3 on 1 September fixed an unauthenticated takeover of SSO customer accounts through registerCustomerAccount (GHSA-wr5h-x3x6-4h23), a cross-channel IDOR in order payment, refund and fulfilment operations (GHSA-7qvr-c5vf-xxfh), and session tokens returned in Admin API job data (GHSA-32jm-mf7r-7qw5). 3.7.4, 3.8.0 and 3.8.1 (5 to 23 October) fixed six more, among them API key privilege checks (GHSA-37xp-mjp8-6f9x), stock overselling (GHSA-8ghm-q833-cmgp), Shop API sessions used against the Admin API (GHSA-5fpx-9m35-w745) and tokens in job data again (GHSA-hxvp-ff3g-qcj7). All fixed in releases and disclosed in the changelog, so the deduction stays at 3 (https://github.com/vendurehq/vendure/blob/master/CHANGELOG.md). -3", "2026-10-12. 3.8.0, a minor release of a 3.x package, carries a BREAKING CHANGE section. It requires a database migration that removes duplicate translation rows, moves to NestJS 12 and Apollo Server 5, refuses Admin API sessions created before the upgrade, and makes `ctx.session.token` undefined on workers. No advance notice was found before release day, against the contributing guide's rule that breaking changes go in a major. 3.7.4 (5 October), a patch release, also changed the contract for custom stock strategies (`super.init()` required, `shouldAllocateStock()` called more than once) on release day, read with 3.8.0 as one pattern, as kilo-code-cli's 7.8.13 and 7.8.18 were. One term at the floor, as agno 3.1.0 and microsoft-agent-framework 1.23.0 were read (https://github.com/vendurehq/vendure/blob/master/CHANGELOG.md). -3" ], "verdict": "Full cart, coupon, shipping and payment flow in the GraphQL Shop API, with ErrorResult types an agent can branch on, and an official MCP plugin since 3.8.0. No vendor-hosted API yet. Version 3.8.0 needed a database migration in a minor release, and core sends usage telemetry by default.", "bestFor": "TypeScript teams that want a typed GraphQL commerce server and will host it.", "strengths": [ "Full cart, coupon, shipping and payment flow in the GraphQL Shop API, with ErrorResult types an agent can branch on", "API keys scoped to roles and channels, bcrypt-hashed and rotatable", "Official MCP plugin since 3.8.0, 42 tools with read-only and destructive annotations, OAuth 2.1 and a tool-call log", "Five releases between 3 August and 23 October 2026, each listing its security fixes and behaviour changes", "GPLv3 core, free to self-host, and public Platform prices with no fee on revenue or orders" ], "weaknesses": [ "No vendor-hosted API. Vendure Cloud is in a closed beta for paid subscribers", "3.8.0, a minor release, needs a database migration and logs every administrator out", "Seventeen advisories fixed between 1 September and 23 October 2026, including unauthenticated SSO account takeover", "Core sends usage telemetry by default unless `VENDURE_DISABLE_TELEMETRY` is set", "No official client SDK, no idempotency support for order mutations, and no status page or security.txt" ], "agentNotes": [ "Keep the session token from the first Shop API response and send it on every call. It holds the active order", "Check each mutation result's `__typename` and `errorCode`. Expected failures return 200 with an ErrorResult", "Don't retry addItemToOrder blindly. Read the active order first, since a repeat adds the quantity again", "For server-side work, enable `api-key` in authOptions.tokenMethod and give the key one role in one channel", "Run 3.8.1 or later, and run the 3.8 migration before upgrading. Only the latest 3.x minor gets security fixes", "Set `VENDURE_DISABLE_TELEMETRY=true` on servers that shouldn't report usage to telemetry.vendure.io" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.2 } ], "editorialScores": { "ergonomics": 68, "maintenance": 85, "payments": 50, "reliability": 89, "schema": 91, "security": 65, "transparency": 85 }, "provenanceScore": 62, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://readonlydemo.vendure.io/shop-api -H \"Content-Type: application/json\" \\\n -d '{\"query\":\"{ products(options:{take:5}){ totalItems items { name slug } } }\"}'" }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/vendure" }, "area": "business", "unitPrices": [ { "item": "Vendure Core self-hosted", "unit": "month", "usd": 0, "note": "GPLv3, you pay for your own servers and database" } ], "provenance": { "legalEntity": "Elevantiq GmbH", "domain": "vendure.io", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://vendure.io/company/terms-of-service", "privacy": "https://vendure.io/company/privacy-policy", "statusPage": "", "changelog": "https://github.com/vendurehq/vendure/blob/master/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "Terms of Service and Privacy Policy, both version 2026-10-20, name Elevantiq GmbH trading as Vendure (FN 506751 y, Oberndorf in Tirol). Legal notice at https://vendure.io/company/legal-notice. LICENSE.md in the repository says Copyright Vendure GmbH.", "rdap.org has no RDAP service for .io, so the registration date is blank.", "remoteUrl is Vendure's public read-only demo; production APIs run on your own domain.", "vendure.io/.well-known/security.txt answered 404 on 2026-11-01." ], "score": 62 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/vendure.json", "live": { "slug": "vendure", "probe": { "target": "https://readonlydemo.vendure.io/shop-api", "method": "get", "lastAt": "2026-11-08T00:56:12.552972349Z", "lastOk": true, "lastStatus": 400, "lastMs": 77, "authRequired": false, "uptime24h": 99.59, "uptime30d": 99.96, "p50ms24h": 40, "p95ms24h": 147, "samples24h": 244, "samples30d": 7704, "days": [ { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 254 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 247 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 243, "ok": 242 }, { "date": "2026-11-08", "probes": 10, "ok": 10 } ] }, "versions": [ { "registry": "github", "name": "vendurehq/vendure", "version": "v3.8.1", "released": "2026-10-23", "seenAt": "2026-11-07T00:14:52.385401902Z" }, { "registry": "npm", "name": "@vendure/core", "version": "3.8.1", "seenAt": "2026-11-07T00:14:51.566369875Z" } ], "githubStars": 8565, "npmWeekly": 64849, "securityTxt": { "url": "https://vendure.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:48.147368198Z" }, "llmsTxt": { "url": "https://docs.vendure.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:16.075500814Z" }, "domain": { "domain": "vendure.io", "checkedAt": "2026-11-01T14:16:24.508951322Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/vendurehq/vendure/master/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:23:57.076208603Z", "changedAt": "2026-10-24T02:27:15.869770762Z", "fingerprint": "4ee2ad975f38" }, { "url": "https://vendure.io/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:23:23.35936849Z", "changedAt": "2026-10-31T06:23:29.518195471Z", "fingerprint": "ce27f7b806ad" }, { "url": "https://vendure.io/company/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:23:18.83988354Z", "changedAt": "2026-10-31T06:23:27.120474493Z", "fingerprint": "f38a92a53a73" }, { "url": "https://raw.githubusercontent.com/vendurehq/vendure/master/LICENSE.md", "kind": "terms", "status": 304, "checkedAt": "2026-11-01T06:55:11.032323865Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "4fa079f39d4c" }, { "url": "https://vendure.io/company/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:23:21.324017659Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "c9782d418ba0" } ], "github": { "repo": "vendurehq/vendure", "checkedAt": "2026-11-02T09:35:24.53895472Z", "stars": 8554, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T13:57:39Z", "openIssues": 166, "openPRs": 58, "issuesOpened90d": 149, "issuesClosed90d": 148, "prsMerged90d": 343, "ci": { "branch": "master", "runs": 50, "success": 40, "failure": 8, "other": 2, "latest": "success", "latestAt": "2026-10-14T12:57:14Z" }, "advisories": [ { "ghsa": "GHSA-fw8w-3xpv-rg9p", "severity": "low", "published": "2026-10-23T15:26:02Z" }, { "ghsa": "GHSA-qmrg-wpxj-c482", "severity": "low", "published": "2026-10-23T15:25:49Z" }, { "ghsa": "GHSA-hxvp-ff3g-qcj7", "severity": "high", "published": "2026-10-23T15:25:30Z" }, { "ghsa": "GHSA-8ghm-q833-cmgp", "severity": "low", "published": "2026-10-05T10:56:27Z" }, { "ghsa": "GHSA-37xp-mjp8-6f9x", "severity": "high", "published": "2026-10-05T10:56:26Z" }, { "ghsa": "GHSA-7g8c-5hg8-348m", "severity": "medium", "published": "2026-09-30T16:59:06Z" }, { "ghsa": "GHSA-5fpx-9m35-w745", "severity": "high", "published": "2026-09-30T13:39:51Z" }, { "ghsa": "GHSA-32jm-mf7r-7qw5", "severity": "high", "published": "2026-09-02T11:37:12Z" }, { "ghsa": "GHSA-f4r3-h6jf-4m29", "severity": "medium", "published": "2026-09-02T07:52:19Z" }, { "ghsa": "GHSA-c63h-3vvx-48ph", "severity": "medium", "published": "2026-09-02T07:52:10Z" }, { "ghsa": "GHSA-vr2h-89r2-9rwv", "severity": "medium", "published": "2026-09-02T07:51:58Z" }, { "ghsa": "GHSA-gg28-cx38-jxxr", "severity": "medium", "published": "2026-09-02T07:51:36Z" }, { "ghsa": "GHSA-37j3-p93w-fq6w", "severity": "high", "published": "2026-09-02T07:51:26Z" }, { "ghsa": "GHSA-f94w-2928-x43p", "severity": "high", "published": "2026-09-02T07:51:15Z" }, { "ghsa": "GHSA-wr5h-x3x6-4h23", "severity": "critical", "published": "2026-09-02T07:51:06Z" }, { "ghsa": "GHSA-22x4-937q-5fr5", "severity": "critical", "published": "2026-09-02T07:50:57Z" }, { "ghsa": "GHSA-422x-jq57-j238", "severity": "critical", "published": "2026-09-02T07:50:47Z" }, { "ghsa": "GHSA-7qvr-c5vf-xxfh", "severity": "critical", "published": "2026-09-02T07:50:38Z" }, { "ghsa": "GHSA-88rq-mq4v-frmm", "severity": "high", "published": "2026-08-24T14:59:57Z" }, { "ghsa": "GHSA-rgjm-ff27-p2hf", "severity": "medium", "published": "2026-08-06T17:05:30Z" }, { "ghsa": "GHSA-fp4j-ff6j-9793", "severity": "medium", "published": "2026-08-06T17:05:07Z" }, { "ghsa": "GHSA-v85r-wfgv-jcqc", "severity": "critical", "published": "2026-08-03T17:50:51Z" }, { "ghsa": "GHSA-hc75-2v4j-x372", "severity": "high", "published": "2026-08-03T08:19:20Z" }, { "ghsa": "GHSA-6j36-r6pr-59x4", "cve": "CVE-2026-63472", "severity": "critical", "published": "2026-07-01T10:55:21Z" }, { "ghsa": "GHSA-xf65-r35x-wmmv", "cve": "CVE-2026-63461", "severity": "medium", "published": "2026-07-01T10:47:50Z" }, { "ghsa": "GHSA-jgm3-qmp2-c4p7", "cve": "CVE-2026-63460", "severity": "high", "published": "2026-07-01T10:47:38Z" }, { "ghsa": "GHSA-xhq9-whgq-49j5", "cve": "CVE-2026-63459", "severity": "high", "published": "2026-07-01T10:47:31Z" }, { "ghsa": "GHSA-9pp3-53p2-ww9v", "cve": "CVE-2026-40887", "severity": "critical", "published": "2026-04-13T09:38:30Z" }, { "ghsa": "GHSA-6f65-4fv2-wwch", "cve": "CVE-2026-25050", "severity": "low", "published": "2026-01-30T12:35:49Z" }, { "ghsa": "GHSA-r9mq-3c9r-fmjq", "cve": "CVE-2024-48914", "severity": "critical", "published": "2024-10-15T10:56:35Z" }, { "ghsa": "GHSA-wm63-7627-ch33", "severity": "medium", "published": "2023-11-17T13:51:16Z" }, { "ghsa": "GHSA-h9wq-xcqx-mqxm", "severity": "low", "published": "2023-07-11T09:23:28Z" }, { "ghsa": "GHSA-gm68-572p-q28r", "severity": "medium", "published": "2023-07-04T11:56:16Z" } ], "replies": { "sampled": 25, "unanswered": 10, "medianDays": 3.1 } }, "updatedAt": "2026-11-08T00:56:12.552972349Z" } }, "edges": [ { "by": 74, "category": "reliability", "leads": "vendure", "name": "Reliability", "reasons": { "a": "status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.", "b": "Graded with the self-hosted package checklist, since there's no generally available hosted API (Vendure Cloud is in a closed beta for paid subscribers, general availability planned for Q1 2027). @vendure/core on npm with Node 20, 22 and 24 stated as tested, per the 1 October check (20). Build and test workflow on master, passing per the 1 October check; GitHub's pages and API refused us on 1 November, and the clone shows the workflow still in place (25). 170 open issues per the 1 October check, not re-read on 1 November. 3.8.1 fixes the 9 September stale-surcharge bug among 33 fixes (17). Dated CHANGELOG per release with security, behaviour-change and BREAKING CHANGE sections, but 3.7.3 and 3.7.4 changed behaviour in patch releases to close security holes and 3.8.0 is a minor release that needs a database migration (12). Version 3.x (15). 20+25+17+12+15 = 89." }, "scores": { "a": 15, "b": 89 } }, { "by": 65, "category": "schema", "leads": "vendure", "name": "Schema \u0026 documentation", "reasons": { "a": "No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.", "b": "Typed GraphQL Shop and Admin APIs with introspection, and schema-shop.json and schema-admin.json committed to the repo (25). llms.txt at docs.vendure.io, 997 lines on 1 November, including the MCP server guides (10). Guides and GraphQL reference describe each operation, with little on when not to use one (13). Strict GraphQL input types with enums and required markers (14). Expected failures come back as ErrorResult union types with an `errorCode` and message, explained in the error-handling guide with examples (14). Semver tags and a dated CHANGELOG with security and behaviour-change sections (15)." }, "scores": { "a": 26, "b": 91 } }, { "by": 45, "category": "ergonomics", "leads": "vendure", "name": "Agent ergonomics", "reasons": { "a": "Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.", "b": "GraphQL field selection sizes every response (23). List queries take `take`, `skip`, `filter` and `sort` (20). ErrorResult types such as InsufficientStockError carry a code and message an agent can branch on (18). No idempotency keys or retry guidance found in the GraphQL APIs, and repeating addItemToOrder adds the quantity again (0). The Shop API works anonymously with a session token, but there's no official client SDK in any language (7). The MCP plugin released in 3.8.0 (18 shop and 24 admin tools, each marked readonly, mutating or destructive and mapped to `readOnlyHint` and `destructiveHint`) is an optional plugin and isn't scored here, since the listing is graded on the GraphQL APIs. 23+20+18+0+7 = 68." }, "scores": { "a": 23, "b": 68 } }, { "by": 40, "category": "payments", "leads": "vendure", "name": "Payments \u0026 pricing", "reasons": { "a": "No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.", "b": "No x402, MPP or L402 (0). Core is free. Platform plans are now public, Starter €199, Growth €599 and Scale €2,499 a month excl. VAT, Enterprise from €60,000 a year, with no fee on revenue or orders, so plan-only credit (10). Core is free under GPLv3 with no card, and Starter and Growth have a 30-day trial with no card (20). An agent can scaffold a store with `npx @vendure/create` or query the public read-only demo Shop API without an account (20). 0+10+20+20 = 50." }, "scores": { "a": 10, "b": 50 } }, { "by": 36, "category": "transparency", "leads": "vendure", "name": "Transparency \u0026 trust", "reasons": { "a": "Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.", "b": "GPL-3.0-or-later, with a commercial licence sold through Platform (30). Terms of Service and Privacy Policy, both version 2026-10-20, name Elevantiq GmbH trading as Vendure. The policy lists processors with locations (WorkOS, Amazon SES in Frankfurt, Vercel, Northflank in Frankfurt, Plausible, Sentry in the EU and others) and retention by category, such as 7 days for package download records and 12 months for licence-check IP addresses. Section 16 of the terms is a data processing agreement under Article 28 GDPR for support access on the self-serve plans, Vendure Cloud has its own, and the subprocessor list for that processing is given on request rather than published (25). SECURITY.md says only the latest 3.x minor gets fixes, and deprecations appear in the changelog without dated end-of-life notices (10). Core sends anonymous usage telemetry on by default since 3.6.0, at startup and about every 24 hours, to telemetry.vendure.io. The telemetry guide lists the fields (installation ID, versions, database type, plugin names, ranged entity counts), and `VENDURE_DISABLE_TELEMETRY` or a CI environment turns it off. Licence reports from Platform's commercial plugins don't follow that switch, which the terms say (20). The 1 October note said no usage telemetry was found in core, which was wrong. 30+25+10+20 = 85." }, "scores": { "a": 38, "b": 74 } }, { "by": 29, "category": "security", "leads": "vendure", "name": "Security \u0026 auth", "reasons": { "a": "OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.", "b": "API keys since 3.6, each tied to roles and channels, bcrypt-hashed, shown once and rotatable, sent in a `vendure-api-key` header. Since 3.7.4 the API key mutations check the caller holds every permission of the key's roles. No OAuth in the GraphQL APIs; the MCP plugin uses OAuth 2.1 (28). Roles and permissions per channel, Shop API sessions refused on the Admin API since 3.8.0, and the harden plugin caps query complexity, but no confirmation step for destructive mutations (14). Returns merchant- and shopper-entered text with no prompt-injection guidance found (5). The MCP plugin released in 3.8.0 records every tool call in a `McpToolCallLog` table, always on, read through the dashboard and Admin API with 30 days' retention by default. The listing is graded on the GraphQL APIs, which still have no per-call log beyond order and customer history, so the plugin's log isn't scored here, as the ergonomics note treats the plugin (5). SECURITY.md takes private reports through GitHub and supports only the latest 3.x minor. Advisories are published with each release, 11 in 3.7.3, two in 3.7.4, one in 3.8.0 and three in 3.8.1. No security.txt (404), bounty or certification found (13). 28+14+5+5+13 = 65." }, "scores": { "a": 36, "b": 65 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "doola", "b": "Vendure (Elevantiq GmbH)", "name": "Vendor" }, { "a": "https://mcp.doola.com", "b": "https://readonlydemo.vendure.io/shop-api", "name": "Hosted endpoint" }, { "a": "Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service. The plugin repository's MIT licence covers the manifests", "b": "GPL-3.0-or-later", "name": "Licence" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "io.github.doolahq/doola", "b": "not listed", "name": "MCP registry" }, { "a": "none", "b": "2026-10-23", "name": "Last release" }, { "a": "not read yet", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "none", "b": "8.5k stars, 30k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Vendure scores 69.2 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category.", "question": "Which is better for AI agents, doola MCP or Vendure?" }, { "answer": "doola MCP uses an OAuth sign-in. Vendure takes an API key or an OAuth sign-in.", "question": "Do doola MCP and Vendure need an API key?" }, { "answer": "Yes. doola MCP has a hosted endpoint at https://mcp.doola.com and Vendure at https://readonlydemo.vendure.io/shop-api.", "question": "Can an agent call doola MCP and Vendure without installing anything?" }, { "answer": "No open-source release is listed for doola MCP. Vendure is open source (GPL-3.0-or-later).", "question": "Are doola MCP and Vendure open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where Vendure loses 6 points for them" ], "goodFor": "Founders, including non-US founders, who want an agent to form a US company for them.", "slug": "doola-mcp", "watchFor": "No published tool list, schemas or errors" }, { "aheadOn": [ "Reliability, 89 against 15", "Schema \u0026 documentation, 91 against 26", "Agent ergonomics, 68 against 23", "Security \u0026 auth, 65 against 36", "Payments \u0026 pricing, 50 against 10", "Maintenance \u0026 community, 85 against 70", "Transparency \u0026 trust, 74 against 38" ], "also": [ "Open source" ], "goodFor": "TypeScript teams that want a typed GraphQL commerce server and will host it.", "slug": "vendure", "watchFor": "No vendor-hosted API. Vendure Cloud is in a closed beta for paid subscribers" } ], "history": { "doola-mcp": null, "vendure": [ { "causes": [ "terms", "pricing", "event" ], "date": "2026-11-01", "delta": -2, "from": 71.2, "fromGrade": "BB", "to": 69.2, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.3, "from": 70.9, "fromGrade": "BB", "to": 71.2, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.5, "from": 71.4, "fromGrade": "BB", "to": 70.9, "toGrade": "BB" } ] }, "job": { "capability": "commerce.checkout", "name": "Commerce checkout" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-vendure.json", "title": "Adobe Commerce (Magento) vs Vendure", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/agentzon-vs-vendure.json", "title": "Agentzon vs Vendure", "url": "https://www.anchorterminal.com/compare/agentzon-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-vendure.json", "title": "BigCommerce API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-vendure.json", "title": "Commerce Layer API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-vendure.json", "title": "commercetools vs Vendure", "url": "https://www.anchorterminal.com/compare/commercetools-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-vendure.json", "title": "Ecwid by Lightspeed vs Vendure", "url": "https://www.anchorterminal.com/compare/ecwid-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-vendure.json", "title": "Elastic Path API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-vendure.json", "title": "Medusa API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/medusa-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-vendure.json", "title": "Saleor API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/saleor-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-vendure.json", "title": "Shopify API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/shopify-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-vendure.json", "title": "Shopware vs Vendure", "url": "https://www.anchorterminal.com/compare/shopware-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/snipcart-vs-vendure.json", "title": "Snipcart API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/snipcart-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.json", "title": "Spree Commerce vs Vendure", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/square-vs-vendure.json", "title": "Square vs Vendure", "url": "https://www.anchorterminal.com/compare/square-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/swell-vs-vendure.json", "title": "Swell vs Vendure", "url": "https://www.anchorterminal.com/compare/swell-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/vendure-vs-wix.json", "title": "Vendure vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/vendure-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/vendure-vs-woocommerce.json", "title": "Vendure vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/vendure-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.json", "title": "Adobe Commerce (Magento) vs doola MCP", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.json", "title": "Agentzon vs doola MCP", "url": "https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.json", "title": "BigCommerce API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.json", "title": "Commerce Layer API + MCP vs doola MCP", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.json", "title": "commercetools vs doola MCP", "url": "https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.json", "title": "doola MCP vs Elastic Path API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.json", "title": "doola MCP vs Fabric", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-fabric" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.json", "title": "doola MCP vs Medusa API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-medusa" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.json", "title": "doola MCP vs Saleor API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-saleor" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.json", "title": "doola MCP vs Shopify API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopify" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.json", "title": "doola MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.json", "title": "doola MCP vs Snipcart API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.json", "title": "doola MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-square.json", "title": "doola MCP vs Square", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-square" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell.json", "title": "doola MCP vs Swell", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix.json", "title": "doola MCP vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.json", "title": "doola MCP vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/fabric-vs-vendure.json", "title": "Fabric vs Vendure", "url": "https://www.anchorterminal.com/compare/fabric-vs-vendure" } ], "panel": null, "scores": [ { "by": 74, "doola-mcp": 15, "edge": "vendure", "key": "reliability", "name": "Reliability", "vendure": 89, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 65, "doola-mcp": 26, "edge": "vendure", "key": "schema", "name": "Schema \u0026 documentation", "vendure": 91, "weight": 13 }, { "by": 45, "doola-mcp": 23, "edge": "vendure", "key": "ergonomics", "name": "Agent ergonomics", "vendure": 68, "weight": 13 }, { "by": 29, "doola-mcp": 36, "edge": "vendure", "key": "security", "name": "Security \u0026 auth", "vendure": 65, "weight": 14 }, { "by": 40, "doola-mcp": 10, "edge": "vendure", "key": "payments", "name": "Payments \u0026 pricing", "vendure": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 15, "doola-mcp": 70, "edge": "vendure", "key": "maintenance", "name": "Maintenance \u0026 community", "vendure": 85, "weight": 7 }, { "by": 36, "doola-mcp": 38, "edge": "vendure", "key": "transparency", "name": "Transparency \u0026 trust", "vendure": 74, "weight": 7 } ], "summary": "Vendure scores 69.2 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.", "tasks": null, "tutorials": [], "verdicts": { "doola-mcp": "doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.", "vendure": "Full cart, coupon, shipping and payment flow in the GraphQL Shop API, with ErrorResult types an agent can branch on, and an official MCP plugin since 3.8.0. No vendor-hosted API yet. Version 3.8.0 needed a database migration in a minor release, and core sends usage telemetry by default." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure", "json": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.min.md" }, "markdown": "Vendure scores 69.2 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.\n\n- doola MCP: grade F, 28/100, rank #1430 of 1510. Markdown https://www.anchorterminal.com/tools/doola-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/doola-mcp.json\n- Vendure: grade B, 69.2/100, rank #257 of 1510. Markdown https://www.anchorterminal.com/tools/vendure.md · JSON https://www.anchorterminal.com/api/v1/tools/vendure.json\n- Best commerce platforms and checkout APIs for AI agents: https://www.anchorterminal.com/best/commerce/index.md\n- All 189 commerce comparisons: https://www.anchorterminal.com/compare/commerce/index.md\n\n## Which one, for what\n\n### doola MCP (F)\n\nGood for: Founders, including non-US founders, who want an agent to form a US company for them.\n\nAlso in its favour:\n- No incidents deducted, where Vendure loses 6 points for them\n\nWatch for: No published tool list, schemas or errors\n\n### Vendure (B)\n\nGood for: TypeScript teams that want a typed GraphQL commerce server and will host it.\n\nAhead on:\n- Reliability, 89 against 15\n- Schema \u0026 documentation, 91 against 26\n- Agent ergonomics, 68 against 23\n- Security \u0026 auth, 65 against 36\n- Payments \u0026 pricing, 50 against 10\n- Maintenance \u0026 community, 85 against 70\n- Transparency \u0026 trust, 74 against 38\n\nAlso in its favour:\n- Open source\n\nWatch for: No vendor-hosted API. Vendure Cloud is in a closed beta for paid subscribers\n\n\n## Why the edge\n\n### Reliability: Vendure +74\n\n- doola MCP (15): status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.\n- Vendure (89): Graded with the self-hosted package checklist, since there's no generally available hosted API (Vendure Cloud is in a closed beta for paid subscribers, general availability planned for Q1 2027). @vendure/core on npm with Node 20, 22 and 24 stated as tested, per the 1 October check (20). Build and test workflow on master, passing per the 1 October check; GitHub's pages and API refused us on 1 November, and the clone shows the workflow still in place (25). 170 open issues per the 1 October check, not re-read on 1 November. 3.8.1 fixes the 9 September stale-surcharge bug among 33 fixes (17). Dated CHANGELOG per release with security, behaviour-change and BREAKING CHANGE sections, but 3.7.3 and 3.7.4 changed behaviour in patch releases to close security holes and 3.8.0 is a minor release that needs a database migration (12). Version 3.x (15). 20+25+17+12+15 = 89.\n\n### Schema \u0026 documentation: Vendure +65\n\n- doola MCP (26): No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.\n- Vendure (91): Typed GraphQL Shop and Admin APIs with introspection, and schema-shop.json and schema-admin.json committed to the repo (25). llms.txt at docs.vendure.io, 997 lines on 1 November, including the MCP server guides (10). Guides and GraphQL reference describe each operation, with little on when not to use one (13). Strict GraphQL input types with enums and required markers (14). Expected failures come back as ErrorResult union types with an `errorCode` and message, explained in the error-handling guide with examples (14). Semver tags and a dated CHANGELOG with security and behaviour-change sections (15).\n\n### Agent ergonomics: Vendure +45\n\n- doola MCP (23): Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.\n- Vendure (68): GraphQL field selection sizes every response (23). List queries take `take`, `skip`, `filter` and `sort` (20). ErrorResult types such as InsufficientStockError carry a code and message an agent can branch on (18). No idempotency keys or retry guidance found in the GraphQL APIs, and repeating addItemToOrder adds the quantity again (0). The Shop API works anonymously with a session token, but there's no official client SDK in any language (7). The MCP plugin released in 3.8.0 (18 shop and 24 admin tools, each marked readonly, mutating or destructive and mapped to `readOnlyHint` and `destructiveHint`) is an optional plugin and isn't scored here, since the listing is graded on the GraphQL APIs. 23+20+18+0+7 = 68.\n\n### Payments \u0026 pricing: Vendure +40\n\n- doola MCP (10): No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.\n- Vendure (50): No x402, MPP or L402 (0). Core is free. Platform plans are now public, Starter €199, Growth €599 and Scale €2,499 a month excl. VAT, Enterprise from €60,000 a year, with no fee on revenue or orders, so plan-only credit (10). Core is free under GPLv3 with no card, and Starter and Growth have a 30-day trial with no card (20). An agent can scaffold a store with `npx @vendure/create` or query the public read-only demo Shop API without an account (20). 0+10+20+20 = 50.\n\n### Transparency \u0026 trust: Vendure +36\n\n- doola MCP (38): Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.\n- Vendure (74): GPL-3.0-or-later, with a commercial licence sold through Platform (30). Terms of Service and Privacy Policy, both version 2026-10-20, name Elevantiq GmbH trading as Vendure. The policy lists processors with locations (WorkOS, Amazon SES in Frankfurt, Vercel, Northflank in Frankfurt, Plausible, Sentry in the EU and others) and retention by category, such as 7 days for package download records and 12 months for licence-check IP addresses. Section 16 of the terms is a data processing agreement under Article 28 GDPR for support access on the self-serve plans, Vendure Cloud has its own, and the subprocessor list for that processing is given on request rather than published (25). SECURITY.md says only the latest 3.x minor gets fixes, and deprecations appear in the changelog without dated end-of-life notices (10). Core sends anonymous usage telemetry on by default since 3.6.0, at startup and about every 24 hours, to telemetry.vendure.io. The telemetry guide lists the fields (installation ID, versions, database type, plugin names, ranged entity counts), and `VENDURE_DISABLE_TELEMETRY` or a CI environment turns it off. Licence reports from Platform's commercial plugins don't follow that switch, which the terms say (20). The 1 October note said no usage telemetry was found in core, which was wrong. 30+25+10+20 = 85.\n\n### Security \u0026 auth: Vendure +29\n\n- doola MCP (36): OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.\n- Vendure (65): API keys since 3.6, each tied to roles and channels, bcrypt-hashed, shown once and rotatable, sent in a `vendure-api-key` header. Since 3.7.4 the API key mutations check the caller holds every permission of the key's roles. No OAuth in the GraphQL APIs; the MCP plugin uses OAuth 2.1 (28). Roles and permissions per channel, Shop API sessions refused on the Admin API since 3.8.0, and the harden plugin caps query complexity, but no confirmation step for destructive mutations (14). Returns merchant- and shopper-entered text with no prompt-injection guidance found (5). The MCP plugin released in 3.8.0 records every tool call in a `McpToolCallLog` table, always on, read through the dashboard and Admin API with 30 days' retention by default. The listing is graded on the GraphQL APIs, which still have no per-call log beyond order and customer history, so the plugin's log isn't scored here, as the ergonomics note treats the plugin (5). SECURITY.md takes private reports through GitHub and supports only the latest 3.x minor. Advisories are published with each release, 11 in 3.7.3, two in 3.7.4, one in 3.8.0 and three in 3.8.1. No security.txt (404), bounty or certification found (13). 28+14+5+5+13 = 65.\n\n## Score by category\n\n| Category | Weight | doola MCP | Vendure | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 89 | Vendure +74 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 26 | 91 | Vendure +65 |\n| Agent ergonomics | 13% (16.2 this run) | 23 | 68 | Vendure +45 |\n| Security \u0026 auth | 14% (17.5 this run) | 36 | 65 | Vendure +29 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 10 | 50 | Vendure +40 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 85 | Vendure +15 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 38 | 74 | Vendure +36 |\n| Negative events | ≤15 | 0 | -6 | |\n| **Total** | | **28 · F** | **69.2 · B** | |\n\n## Facts side by side\n\n| Fact | doola MCP | Vendure |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | doola | Vendure (Elevantiq GmbH) |\n| Hosted endpoint | `https://mcp.doola.com` | `https://readonlydemo.vendure.io/shop-api` |\n| Transports | Streamable HTTP | HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | GPL-3.0-or-later |\n| Read-only variant documented | no | yes |\n| llms.txt | no | yes |\n| MCP registry | `io.github.doolahq/doola` | not listed |\n| Last release | none | 2026-10-23 |\n| Privacy policy last updated | not read yet | no date given |\n| Popularity | none | 8.5k stars, 30k npm/wk |\n| Agent reviews | none | 3/5 (2) |\n\n## How the scores have moved\n\n### doola MCP\n\nNo score change since it was listed.\n\n### Vendure\n\n- -2.0 on 1 November 2026 (BB to B): terms, pricing, negative event\n- +0.3 on 27 October 2026: checklist\n- -0.5 on 8 October 2026: checklist\n\n## Verdicts\n\n**doola MCP.** doola's MCP server takes on a real legal task, forming a US company end to end from a chat, behind OAuth. Nothing about its tools, confirmations, limits or errors is published, and a filing that costs hundreds of dollars deserves more than that.\n\n**Vendure.** Full cart, coupon, shipping and payment flow in the GraphQL Shop API, with ErrorResult types an agent can branch on, and an official MCP plugin since 3.8.0. No vendor-hosted API yet. Version 3.8.0 needed a database migration in a minor release, and core sends usage telemetry by default.\n\n## Before you call either\n\n### doola MCP\n\n1. Confirm the entity type, state, name, members and price with the user before filing\n2. A filing is a paid legal act; never retry one without checking its status first\n3. Use the status tools on existing companies before starting a new formation\n\n### Vendure\n\n1. Keep the session token from the first Shop API response and send it on every call. It holds the active order\n2. Check each mutation result's `__typename` and `errorCode`. Expected failures return 200 with an ErrorResult\n3. Don't retry addItemToOrder blindly. Read the active order first, since a repeat adds the quantity again\n4. For server-side work, enable `api-key` in authOptions.tokenMethod and give the key one role in one channel\n5. Run 3.8.1 or later, and run the 3.8 migration before upgrading. Only the latest 3.x minor gets security fixes\n6. Set `VENDURE_DISABLE_TELEMETRY=true` on servers that shouldn't report usage to telemetry.vendure.io\n\n## Questions\n\n### Which is better for AI agents, doola MCP or Vendure?\n\nVendure scores 69.2 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category.\n\n### Do doola MCP and Vendure need an API key?\n\ndoola MCP uses an OAuth sign-in. Vendure takes an API key or an OAuth sign-in.\n\n### Can an agent call doola MCP and Vendure without installing anything?\n\nYes. doola MCP has a hosted endpoint at https://mcp.doola.com and Vendure at https://readonlydemo.vendure.io/shop-api.\n\n### Are doola MCP and Vendure open source?\n\nNo open-source release is listed for doola MCP. Vendure is open source (GPL-3.0-or-later).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.json, and with the fewest tokens: https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"doola-mcp\", \"b\": \"vendure\"}`. From a terminal: `anchor compare doola-mcp vendure`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/doola-mcp.json and https://www.anchorterminal.com/api/v1/tools/vendure.json\n\n## Other comparisons with doola MCP or Vendure\n\n- [Adobe Commerce (Magento) vs Vendure](https://www.anchorterminal.com/compare/adobe-commerce-vs-vendure.md)\n- [Agentzon vs Vendure](https://www.anchorterminal.com/compare/agentzon-vs-vendure.md)\n- [BigCommerce API + MCP vs Vendure](https://www.anchorterminal.com/compare/bigcommerce-vs-vendure.md)\n- [Commerce Layer API + MCP vs Vendure](https://www.anchorterminal.com/compare/commerce-layer-vs-vendure.md)\n- [commercetools vs Vendure](https://www.anchorterminal.com/compare/commercetools-vs-vendure.md)\n- [Ecwid by Lightspeed vs Vendure](https://www.anchorterminal.com/compare/ecwid-vs-vendure.md)\n- [Elastic Path API + MCP vs Vendure](https://www.anchorterminal.com/compare/elastic-path-vs-vendure.md)\n- [Medusa API + MCP vs Vendure](https://www.anchorterminal.com/compare/medusa-vs-vendure.md)\n- [Saleor API + MCP vs Vendure](https://www.anchorterminal.com/compare/saleor-vs-vendure.md)\n- [Shopify API + MCP vs Vendure](https://www.anchorterminal.com/compare/shopify-vs-vendure.md)\n- [Shopware vs Vendure](https://www.anchorterminal.com/compare/shopware-vs-vendure.md)\n- [Snipcart API + MCP vs Vendure](https://www.anchorterminal.com/compare/snipcart-vs-vendure.md)\n- [Spree Commerce vs Vendure](https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.md)\n- [Square vs Vendure](https://www.anchorterminal.com/compare/square-vs-vendure.md)\n- [Swell vs Vendure](https://www.anchorterminal.com/compare/swell-vs-vendure.md)\n- [Vendure vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/vendure-vs-wix.md)\n- [Vendure vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/vendure-vs-woocommerce.md)\n- [Adobe Commerce (Magento) vs doola MCP](https://www.anchorterminal.com/compare/adobe-commerce-vs-doola-mcp.md)\n- [Agentzon vs doola MCP](https://www.anchorterminal.com/compare/agentzon-vs-doola-mcp.md)\n- [BigCommerce API + MCP vs doola MCP](https://www.anchorterminal.com/compare/bigcommerce-vs-doola-mcp.md)\n- [Commerce Layer API + MCP vs doola MCP](https://www.anchorterminal.com/compare/commerce-layer-vs-doola-mcp.md)\n- [commercetools vs doola MCP](https://www.anchorterminal.com/compare/commercetools-vs-doola-mcp.md)\n- [doola MCP vs Elastic Path API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-elastic-path.md)\n- [doola MCP vs Fabric](https://www.anchorterminal.com/compare/doola-mcp-vs-fabric.md)\n- [doola MCP vs Medusa API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-medusa.md)\n- [doola MCP vs Saleor API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-saleor.md)\n- [doola MCP vs Shopify API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-shopify.md)\n- [doola MCP vs Shopware](https://www.anchorterminal.com/compare/doola-mcp-vs-shopware.md)\n- [doola MCP vs Snipcart API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-snipcart.md)\n- [doola MCP vs Spree Commerce](https://www.anchorterminal.com/compare/doola-mcp-vs-spree-commerce.md)\n- [doola MCP vs Square](https://www.anchorterminal.com/compare/doola-mcp-vs-square.md)\n- [doola MCP vs Swell](https://www.anchorterminal.com/compare/doola-mcp-vs-swell.md)\n- [doola MCP vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/doola-mcp-vs-wix.md)\n- [doola MCP vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/doola-mcp-vs-woocommerce.md)\n- [Fabric vs Vendure](https://www.anchorterminal.com/compare/fabric-vs-vendure.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "doola MCP vs Vendure", "url": "" } ], "description": "Vendure scores 69.2 (B) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "doola MCP F 28", "Vendure B 69.2", "scores" ], "h1": "doola MCP vs Vendure", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/doola-mcp-vs-vendure", "published": "2026-10-01", "section": "tools", "title": "doola MCP vs Vendure for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/doola-mcp-vs-vendure" }, "tokens": { "markdown": 4350, "slim": 2380 }, "version": 1 }