doola MCP vs WooCommerce API + MCP

doola MCP 15

status.doola.com wasn't reachable (0). No history (5). No rate limits found (0). No retry or idempotency guidance for filings (0). No SLA found (0). Not labelled beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

WooCommerce API + MCP 80

Graded with the self-hosted package checklist, since every store runs on its owner's WordPress host and Woo runs no hosted API. Official plugin on wordpress.org, requiring PHP 7.4 and WordPress 7.0, per the 11.2.1 readme re-read on 1 November (20). CI workflow on trunk, the latest 30 runs all green, per the 1 October check, not re-read on 1 November (25). About 1,300 open issues, with recent bugs such as an 11.1.0 release candidate showing $0 flat-rate shipping as "Free!" in emails (fixed in 11.2.0) and a database connection bug, per the 1 October check (10). Monthly major.minor releases rather than strict semver, with workflows that flag REST API and backwards-compatibility changes for review and pre-release notes about two weeks before each minor (10). Stable 11.x (15). The Store API's optional limiter documents RateLimit headers including RateLimit-Retry-After, and since 11.2.0 answers 429 rather than 400 when the limit is exceeded. 20 + 25 + 10 + 10 + 15 = 80.

doola MCP 23

Tool count not published (5). Nothing on paging or output size (5 of 20). No documented errors (0). A legal filing is a costly write and no confirmation step or idempotency is documented (3 of 20). Plugins for Claude Code, Grok Build and Cursor and one URL (10 of 15). 5 + 5 + 0 + 3 + 10 = 23.

WooCommerce API + MCP 83

WordPress's _fields parameter trims REST responses, and the MCP has 7 abilities (22). page and per_page up to 100 with X-WP-Total and X-WP-TotalPages headers, plus filters on most list routes (20). Errors carry a code, message and data.status, and the Store API documents its status codes (16). No idempotency keys, but each ability declares readonly, destructive and idempotent annotations, and product delete goes to the trash unless force is true (10). Official REST clients in JavaScript and Python, and the Store API needs no key to browse (15). From 11.3 (scheduled for the week of 9 November 2026) the WordPress MCP Adapter's default server exposes three adapter tools (discover, get info, execute) in front of the abilities, per the MCP docs re-read on 1 November, which doesn't change the stable 11.2 reading. 22 + 20 + 16 + 10 + 15 = 83.

doola MCP 26

No tool list or schemas published; tools not read without sign-in (10 of 25). No llms.txt found (0). The README describes the flow, not the tools (5 of 20). Inputs not verifiable (3 of 15). Install examples only (3 of 15). Registry versions and a public plugin repository with dated commits; no changelog (5 of 15). 10 + 0 + 5 + 3 + 3 + 5 = 26.

WooCommerce API + MCP 77

No OpenAPI file. Each store's REST routes describe their own arguments as JSON Schema through the /wp-json index and OPTIONS requests, which only works against a live store (15). llms.txt on developer.woocommerce.com per the 30 September check (10). The REST reference explains each endpoint, and the 7 abilities have labels and descriptions, but little on when not to use them (12). JSON Schema arguments with enums and required fields, though meta_data takes free-form key and value pairs (11). Examples in curl, Node.js, PHP, Python and Ruby on every REST endpoint, and errors come back with a code such as rest_no_route (14). Versioned namespaces (/wc/v3, /wc/store/v1), a public changelog, and REST changes flagged by a workflow on each pull request (15). llms.txt on developer.woocommerce.com re-read on 1 November. 15 + 10 + 12 + 11 + 14 + 15 = 77.

doola MCP 10

No machine payment protocol (0). Plan prices public (10). No free tier (0). A person signs up and approves OAuth (0). 0 + 10 + 0 + 0 = 10.

WooCommerce API + MCP 60

No x402, MPP or L402 in core (0). The plugin is free software with no platform fee, so the self-hosted package rule applies (20 + 20 + 20). Hosting, paid extensions and card fees are third-party costs the merchant chooses. 0 + 20 + 20 + 20 = 60.

doola MCP 38

Plugin repository MIT (copyright 2026 doola); service closed under terms updated July 2026 (15). Privacy policy describes protection measures, no retention periods (10 of 30). No deprecation policy (0). Subprocessors not found (5 of 20). 15 + 10 + 0 + 5 = 30.

WooCommerce API + MCP 76

GPL-3.0 (30). Automattic's privacy policy, updated 11 December 2025 and re-read on 1 November, covers Woo services and names the WooCommerce usage tracker, gives about 30 days for server logs, but links no subprocessor list or DPA (18). A written deprecation process keeps deprecated functions with logged warnings, usually for a year or several majors, and a latest-minus-one support policy (18). Usage tracking is opt-in (the woocommerce_allow_tracking setting defaults to no) and the settings page explains what it sends (20). 30 + 18 + 18 + 20 = 86.

doola MCP 36

OAuth with revocation; scopes not published (20 of 30). No read-only mode; no documented confirmation before a filing (3 of 20). Inputs are the user's own details (10). No audit log found (0). No security.txt or programme found (3 of 20). 20 + 3 + 10 + 0 + 3 = 36.

WooCommerce API + MCP 55

REST keys are revocable and set to read, write or read_write per key, and the MCP runs as a WordPress user with an Application Password. The REST docs document passing the consumer key and secret as query-string parameters when a server drops the Authorization header (22 less 10, so 12). Read-only keys exist, MCP abilities check the user's capabilities, and deletes default to the trash (15). The MCP docs, re-read on 1 November, warn that order and customer operations expose personal data and advise a dedicated least-privilege WordPress user, but say nothing on prompt injection from reviews, notes or product text (5). Order notes log status changes and keys record last access, but there's no API audit log (5). SECURITY.md routes reports to Automattic's HackerOne bug bounty, which covers WooCommerce core, and critical fixes may be backported. 11.1.1 (18 September), 11.1.2 (22 September) and 11.2.0 (7 October) were marked security releases in their notes, and 11.2.0's notes describe each hardening change. No security.txt on woocommerce.com, which answered 404 on 1 November (18). 12 + 15 + 5 + 5 + 18 = 55.