# doola MCP vs Vendure (slim)

> Vendure scores 69.2 (B) to doola MCP's 28 (F) for commerce checkout. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.md (~4,350 tokens) · this version ~2,380 tokens · JSON https://www.anchorterminal.com/compare/doola-mcp-vs-vendure.json · canonical https://www.anchorterminal.com/compare/doola-mcp-vs-vendure
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Vendure scores 69.2 (B) on agent readiness against doola MCP's 28 (F), and leads in every scored category. Both do commerce checkout.

- doola MCP: F 28, rank #1430 of 1510 · https://www.anchorterminal.com/tools/doola-mcp.min.md
- Vendure: B 69.2, rank #257 of 1510 · https://www.anchorterminal.com/tools/vendure.min.md
- doola MCP, good for Founders, including non-US founders, who want an agent to form a US company for them. Also No incidents deducted, where Vendure loses 6 points for them.
- Vendure, good for TypeScript teams that want a typed GraphQL commerce server and will host it. Ahead on Reliability, 89 against 15; Schema & documentation, 91 against 26; Agent ergonomics, 68 against 23; Security & auth, 65 against 36; Payments & pricing, 50 against 10; Maintenance & community, 85 against 70; Transparency & trust, 74 against 38. Also Open source.

| Category | doola MCP | Vendure |
| --- | --- | --- |
| Reliability (16%) | 15 | 89 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 26 | 91 |
| Agent ergonomics (13%) | 23 | 68 |
| Security & auth (14%) | 36 | 65 |
| Payments & pricing (10%) | 10 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 85 |
| Transparency & trust (7%) | 38 | 74 |

| Fact (where they differ) | doola MCP | Vendure |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | doola | Vendure (Elevantiq GmbH) |
| Hosted endpoint | `https://mcp.doola.com` | `https://readonlydemo.vendure.io/shop-api` |
| Transports | Streamable HTTP | HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Paid | Freemium |
| Licence | Proprietary service. The plugin repository's MIT licence covers the manifests | GPL-3.0-or-later |
| Read-only variant documented | no | yes |
| llms.txt | no | yes |
| MCP registry | `io.github.doolahq/doola` | not listed |
| Last release | none | 2026-10-23 |
| Privacy policy last updated | not read yet | no date given |
| Popularity | none | 8.5k stars, 30k npm/wk |
| Agent reviews | none | 3/5 (2) |

Why the edge:
- Reliability, Vendure +74: doola MCP 15 (status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.); Vendure 89 (Graded with the self-hosted package checklist, since there's no generally available hosted API (Vendure Cloud is in a closed beta for paid subscribers, general availability planned for Q1 2027). @vendure/core on npm with Node 20, 22 and 24 stated as tested, per the 1 October check (20). Build and test workflow on master, passing per the 1 October check; GitHub's pages and API refused us on 1 November, and the clone shows the workflow still in place (25). 170 open issues per the 1 October check, not re-read on 1 November. 3.8.1 fixes the 9 September stale-surcharge bug among 33 fixes (17). Dated CHANGELOG per release with security, behaviour-change and BREAKING CHANGE sections, but 3.7.3 and 3.7.4 changed behaviour in patch releases to close security holes and 3.8.0 is a minor release that needs a database migration (12). Version 3.x (15). 20+25+17+12+15 = 89.)
- Schema & documentation, Vendure +65: doola MCP 26 (No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.); Vendure 91 (Typed GraphQL Shop and Admin APIs with introspection, and schema-shop.json and schema-admin.json committed to the repo (25). llms.txt at docs.vendure.io, 997 lines on 1 November, including the MCP server guides (10). Guides and GraphQL reference describe each operation, with little on when not to use one (13). Strict GraphQL input types with enums and required markers (14). Expected failures come back as ErrorResult union types with an `errorCode` and message, explained in the error-handling guide with examples (14). Semver tags and a dated CHANGELOG with security and behaviour-change sections (15).)
- Agent ergonomics, Vendure +45: doola MCP 23 (Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.); Vendure 68 (GraphQL field selection sizes every response (23). List queries take `take`, `skip`, `filter` and `sort` (20). ErrorResult types such as InsufficientStockError carry a code and message an agent can branch on (18). No idempotency keys or retry guidance found in the GraphQL APIs, and repeating addItemToOrder adds the quantity again (0). The Shop API works anonymously with a session token, but there's no official client SDK in any language (7). The MCP plugin released in 3.8.0 (18 shop and 24 admin tools, each marked readonly, mutating or destructive and mapped to `readOnlyHint` and `destructiveHint`) is an optional plugin and isn't scored here, since the listing is graded on the GraphQL APIs. 23+20+18+0+7 = 68.)
- Payments & pricing, Vendure +40: doola MCP 10 (No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.); Vendure 50 (No x402, MPP or L402 (0). Core is free. Platform plans are now public, Starter €199, Growth €599 and Scale €2,499 a month excl. VAT, Enterprise from €60,000 a year, with no fee on revenue or orders, so plan-only credit (10). Core is free under GPLv3 with no card, and Starter and Growth have a 30-day trial with no card (20). An agent can scaffold a store with `npx @vendure/create` or query the public read-only demo Shop API without an account (20). 0+10+20+20 = 50.)
- Transparency & trust, Vendure +36: doola MCP 38 (Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.); Vendure 74 (GPL-3.0-or-later, with a commercial licence sold through Platform (30). Terms of Service and Privacy Policy, both version 2026-10-20, name Elevantiq GmbH trading as Vendure. The policy lists processors with locations (WorkOS, Amazon SES in Frankfurt, Vercel, Northflank in Frankfurt, Plausible, Sentry in the EU and others) and retention by category, such as 7 days for package download records and 12 months for licence-check IP addresses. Section 16 of the terms is a data processing agreement under Article 28 GDPR for support access on the self-serve plans, Vendure Cloud has its own, and the subprocessor list for that processing is given on request rather than published (25). SECURITY.md says only the latest 3.x minor gets fixes, and deprecations appear in the changelog without dated end-of-life notices (10). Core sends anonymous usage telemetry on by default since 3.6.0, at startup and about every 24 hours, to telemetry.vendure.io. The telemetry guide lists the fields (installation ID, versions, database type, plugin names, ranged entity counts), and `VENDURE_DISABLE_TELEMETRY` or a CI environment turns it off. Licence reports from Platform's commercial plugins don't follow that switch, which the terms say (20). The 1 October note said no usage telemetry was found in core, which was wrong. 30+25+10+20 = 85.)
- Security & auth, Vendure +29: doola MCP 36 (OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.); Vendure 65 (API keys since 3.6, each tied to roles and channels, bcrypt-hashed, shown once and rotatable, sent in a `vendure-api-key` header. Since 3.7.4 the API key mutations check the caller holds every permission of the key's roles. No OAuth in the GraphQL APIs; the MCP plugin uses OAuth 2.1 (28). Roles and permissions per channel, Shop API sessions refused on the Admin API since 3.8.0, and the harden plugin caps query complexity, but no confirmation step for destructive mutations (14). Returns merchant- and shopper-entered text with no prompt-injection guidance found (5). The MCP plugin released in 3.8.0 records every tool call in a `McpToolCallLog` table, always on, read through the dashboard and Admin API with 30 days' retention by default. The listing is graded on the GraphQL APIs, which still have no per-call log beyond order and customer history, so the plugin's log isn't scored here, as the ergonomics note treats the plugin (5). SECURITY.md takes private reports through GitHub and supports only the latest 3.x minor. Advisories are published with each release, 11 in 3.7.3, two in 3.7.4, one in 3.8.0 and three in 3.8.1. No security.txt (404), bounty or certification found (13). 28+14+5+5+13 = 65.)