MealMe API vs opencommerce

MealMe API 6

Read as a closed service. The newest dated change is the release note of 6 May 2025 (Get Inventory v4), more than 180 days before 3 November 2026; the pricing and dashboard pages carry no date (0 of 30). No dated change in the last 90 days (0 of 20). A support address, release notes and no community channel (6 of 15). No official SDKs (0). No package to judge (0). Total 6.

opencommerce 75

@agent-cards/commerce-sdk 0.18.6 was published on 30 October 2026, per the 30 October check, not re-read on 2 November (30 of 30). 19 versions from 16 to 30 October 2026 (20 of 20). Closed service. Agentcard's changelog is dated almost daily, newest 27 October on 2 November too, and support runs through agent-cards support chat and support@agentcard.sh. Neither was tested (10 of 15). The TypeScript SDK is current, with no SDK in a second language (10 of 15). The SDK has no dependencies. The CLI has 10, among them PostHog and the Claude Agent SDK, needs Node 22, and its repository is private, so CI isn't visible (5 of 10). The product is two weeks old. Total 75.

MealMe API 26

One API key per account in a custom Id-Token header, with no scopes, expiry, rotation or revocation documented (10 of 30). place_order defaults to false and charge_user can be turned off, so an agent can quote without buying, but there is no read-only key (8 of 20). Store descriptions, menus and support-chat messages are untrusted content with no guidance (3 of 15). Get Orders and a tracking webhook give order history; no per-call log for the operator is documented (5 of 15). No security.txt (400), disclosure policy, bug bounty or certification found; the Enterprise plan names a security review (0 of 20). Total 26.

opencommerce 68

OAuth client credentials exchanged for a one-hour platform token, separate sandbox and production clients, and a per-shopper access token as an alternative. Agentcard's platform tokens carry the single scope api, per the agentcard listing, and init writes production credentials to the env file by default (22 of 30). Every payment not covered by an auto-approval rule needs the shopper's passkey, the docs say neither the app nor the model approves for the shopper, and the model cannot change the shopper or address. init runs Agentcard's coding agent with permissions bypassed and unsandboxed commands, which the docs disclose. Two less for that (15 of 20). Answers carry store and product text, links are stripped before the model reads them, and preset rules ignore merchant text an agent sends, but no guidance naming untrusted content or prompt injection was found (10 of 15). Order and purchase events by webhook or stream, with logged deliveries and stored approval records of who, when and where (11 of 15). agentcard.com serves a valid security.txt, the Vault Enterprise plan lists a SOC 2 report and pen-test summary, and the Trust Centre was not read. No bug bounty or disclosure policy found (10 of 20). Total 68.

MealMe API 20

No x402, MPP or L402 (0). $0.10 per successful call and $250 a month published without login (20). No free tier or trial; a card must be added before the key is created (0). Signup is a browser form with email, password and card (0). Total 20.

opencommerce 40

No x402, MPP or L402. Purchases are paid with the shopper's card from the Vault, and agentcard.com's FAQ answers Not yet on agent payment protocols (0 of 40). 1 per cent of each completed order is published on opencommerce.sh without a login (20 of 20). Sandbox credentials run the whole flow, stop before payment and are never billed, with no card needed (20 of 20). A person signs in through app.agentcard.sh or an emailed code, and since 27 October 2026 the CLI says sign-ups are by invitation (0 of 20). Total 40.

MealMe API 47

Closed service. The API and SDK Terms of Use (18 June 2022) and MealMe Connect terms (4 April 2025) name MealMe, Inc. under Delaware law, but the API terms license use for personal, noncommercial purposes while the product is sold to businesses (15 of 30). The privacy policy of 1 January 2025 keeps data as long as needed, names no subprocessor and no DPA; the cookie policy names Google, Adobe, LinkedIn, Twitter and Facebook (10 of 30). Release notes record breaking changes with dates but there is no deprecation policy or notice period (6 of 20). Cookie providers named, no subprocessor list or data location (4 of 20). Total 35.

opencommerce 63

Closed. The packages' licence allows running them only to use Agentcard's services and forbids benchmarking a competing product. The terms of use (10 July 2026) name Agentcard Corporation and cover the API, MCP server and CLI, but not the Commerce SDK or its 1 per cent fee, and the opencommerce.sh footer names Agentcard, Inc. (12 of 30). Agentcard's own privacy policy (21 October 2026) covers orders, delivery addresses, store accounts it links or creates with their encrypted sign-ins, a one-time card credential held at most 45 minutes, and session recordings of what is typed into dashboard forms. Retention is as long as the account is active, with no periods and no public DPA (14 of 30). No deprecation policy. The SDK keeps deprecated names with notes, such as toAnthropicTool and ackFor, and the changelog marks one breaking change of 10 September 2026 (6 of 20). The privacy policy names Crossmint, Coinbase, Third National, Sumsub, Visa and Stripe and the kinds of other providers, with transfers to the United States. The CLI's PostHog telemetry honours DO_NOT_TRACK and AGENT_CARDS_TELEMETRY, found in its code (10 of 20). Total 42.

MealMe API 72

The reference pages are generated from an API description with operation ids (get_search_store_v3), named response schemas (Product_Search_Output) and typed parameters, but no spec file URL was found on the docs, llms.txt or the site (15 of 25). llms.txt at mealmeapi.readme.io and mealme.ai, and every page as Markdown (10). Each operation states its purpose and coverage; several descriptions are truncated in the index and none says when not to use it (12 of 20). Enums on sort, store_type, user_country and search_focus, required flags on latitude and longitude, conditional requirements written in prose (11 of 15). Request and response examples per endpoint, a Create Order errors page with 17 entries, and 400, 401 and 429 schemas on each operation (12 of 15). Versioned paths (v2 to v4) and dated release notes that call out breaking changes, the newest of 6 May 2025 (12 of 15). Total 72.

opencommerce 81

The buy tool's input is a strict JSON Schema with five required fields and additionalProperties false, and the package ships TypeScript declarations. The purchase endpoints under it are missing from the OpenAPI file at docs.agentcard.com/openapi.json, which holds 18 operations for tokens, connections, identity checks and cards (20 of 25). llms.txt on opencommerce.sh and on docs.agentcard.com, with a Markdown twin for each docs page (10 of 10). The description's 57 rules say when to call the tool, when to set confirm and what each answer means, such as "Show the shopper the cart before you confirm it" (18 of 20). Two booleans and two nullable ids, but the main input ask is free text (9 of 15). Code for Anthropic, Vercel AI SDK, OpenAI and OpenRouter, a sandbox walkthrough script, error tables with what to do next and captured error bodies (14 of 15). npm versions follow 0.x semver, and Agentcard's changelog is dated almost daily, newest 27 October 2026, but it covers every Agentcard product and the SDK has no changelog of its own (10 of 15). Total 81.

MealMe API 19

Read with the hosted lines. No status page found on mealme.ai, the docs or llms.txt, and status.mealme.ai does not resolve (0). No readable incident history (5). No rate limit figures; each endpoint documents a 429 whose example message is 10 per 1 second(s)!, which the reference itself calls an example (0 of 15). The 429 is documented without Retry-After or backoff guidance, and Create Order has no idempotency key, only an order_id to update an existing order and a caller's customer_order_id to look up (4 of 15). No SLA found (0). The API is in production with versioned endpoints (10). Total 19.

opencommerce 25

Read on the local-package lines for its listed kind, sdk. The official npm package @agent-cards/commerce-sdk runs on Node 18 or later and the browser, as the quickstart states (20). The repository the package names is private and no public CI or test suite was found. The only public repository is the example app, tiny-agent-company/commerce-sdk-example, with four commits on 29 October 2026 and no workflows (0). There is no public issue tracker, and reports go to agent-cards support chat and support@agentcard.sh, so the crash and regression line has nothing to read (0). Versions are 0.x semver on npm, deprecated names such as toAnthropicTool are kept with notes, and Agentcard's shared changelog marks breaking platform changes, but the SDK has no changelog of its own (5 of 15). 0.18.6 per the 30 October check, not declared stable (0). 20 + 0 + 0 + 5 + 0 = 25.