doola MCP vs Wix Stores and eCommerce API

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

Wix Stores and eCommerce API 76

No public OpenAPI file was found. The contract is the Markdown reference, which the MCP tools ReadFullDocsMethodSchema and SearchWixAPISpec also serve, and the MCP tools have typed inputs (12). llms.txt, llms-full.txt and a .md twin of every docs page (10). Method pages state purpose and limits, for example that Query Products supports a narrow set of filters and that Search Products is the route for name lookups (15). REST fields carry types, enums and minimum and maximum values, but the MCP's CallWixSiteAPI takes a free-form URL, method and body (11). Each method page has a curl example and a list of HTTP and application error codes, and a general errors article documents the error format (13). Versions are per module, and dev.wix.com/changelog is dated, with entries to 29 October 2026 (15).

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Wix Stores and eCommerce API 61

Atlassian Statuspage at status.wix.com with 119 components, Stores and Payments among them, and an incident feed (20). From 4 August to 2 November 2026 the feed holds six incidents, none since 1 October. The two that touch the API surface read as partial. On 15 September some users in Europe had errors on sign-in, live sites, Stores and Payments for about 30 minutes, per the postmortem, after an infrastructure change in one European region. On 1 October some users had issues for 25 minutes on Stores, Payments and Site Editing. The others are editor and dashboard access (12 August), site loading in some regions (19 August), a Twilio SMS delay (1 September) and missing elements on Harmony sites (7 September). The 1 August critical incident of 3 hours 17 minutes has left the window. Minor incidents only (20). No numeric limit for REST calls was found. The docs publish per-minute quotas only for site data requests and tell callers to space some writes one second apart (3). The 429 guidance is to wait a minute and retry, updates are guarded by revision numbers that return 409, and idempotency keys exist on a few methods only (8). The trust centre FAQ states a service level objective and a 99.99 per cent figure for 2021, with no SLA found, per the 8 October check (0). The REST APIs are released, and Cart V2 shipped on 5 August 2026 without a preview label (10). 20 + 20 + 3 + 8 + 0 + 10 = 61.

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

Wix Stores and eCommerce API 68

The MCP listed 18 tools on 8 October, all on by default (the docs now describe them by kind and no longer name them, and the live list needs a token), with no toolsets or read-only subset documented. Most calls need a docs lookup first, and the Query Products page alone is 327 KB of Markdown (15). Cursor and offset paging, a query language with filters and sorting, and a fields parameter for projection. Query Products returns at most 100 a page (18). Errors use one format with application codes and per-field violations, though system errors are empty by design (16). Revision numbers guard updates, idempotency keys cover a few methods, and the @wix/mcp package sets annotations, with destructiveHint true on CallWixSiteAPI (12). Every site call needs a site ID header, and the only official SDK is JavaScript (7).

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

Wix Stores and eCommerce API 77

Closed platform under the Wix Terms of Use. @wix/sdk and @wix/stores are MIT and wix/skills is MIT (15). Privacy policy effective 18 June 2026 and a data processing addendum effective 1 December 2025. Retention is stated as the time reasonably necessary, with no fixed periods found (20). The versioning article says deprecated APIs are marked, logged in the changelog and not removed, and Developer Preview lasts at most 6 months (16). A sub-processor list names Wix entities and third parties with locations, and the security page names AWS, Google Cloud and Equinix as hosts (18).

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

Wix Stores and eCommerce API 61

API keys carry permission scopes and a list of sites they may target, and stay valid until revoked or rotated in the dashboard. App tokens come from OAuth client credentials and last 4 hours. The MCP uses OAuth with dynamic client registration, advertises only offline_access as a scope and still accepts the plain PKCE method (26). Read and admin scopes are separate (SCOPE.STORES.PRODUCT_READ and SCOPE.STORES.PRODUCT_READ_ADMIN), but no read-only mode or confirmation step for the MCP was found (11). The API returns merchant and customer content, and no prompt-injection guidance was found. The @wix/mcp package limits call URLs to five Wix hostnames (4). No audit log or per-call log for API keys was found in the developer docs. Responses carry x-wix-request-id (2). The security page lists SOC 2 Type 2, PCI DSS Level 1 and several ISO certificates and a bug bounty at bugbounty@wix.com. /security.txt has a contact (security-report@wix.com) but no Expires field, and /.well-known/security.txt returns 404, both re-read on 2 November (18). The programme line matches cloudflare-r2's 18 for certifications and a bounty.

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

Wix Stores and eCommerce API 30

No x402, MPP or L402 found (0). Plan prices are public on wix.com/plans but shown in the reader's currency, with nothing per call (10). A free plan, marked no credit card required, with eCommerce on Core and above (20). A person signs up in a browser and creates the API key in the API Keys Manager (0).