MealMe API vs Shop MCP

MealMe API 6

Read as a closed service. The newest dated change is the release note of 6 May 2025 (Get Inventory v4), more than 180 days before 3 November 2026; the pricing and dashboard pages carry no date (0 of 30). No dated change in the last 90 days (0 of 20). A support address, release notes and no community channel (6 of 15). No official SDKs (0). No package to judge (0). Total 6.

Shop MCP 66

@shopify/shop 1.2.0 is tagged in the CLI repository on 28 October 2026, and the server reports version 1.2.0+aebf0c1b9130 with 1.2.0 as the latest CLI (30 of 30). Five releases since 7 October, 1.0.2, 1.0.3, 1.1.0, 1.1.1 and 1.2.0, from the repository's tags (npm not re-read) (20 of 20). Closed service with a launch post in the Shopify developer changelog and no later post about it. The repository's issues couldn't be read, since GitHub's pages refuse our reader, and no support channel is named in the docs (8 of 15). No Shop MCP entry in the official MCP registry, searched on 1 November (0 of 15). The CLI repository runs a verify workflow on Ubuntu, macOS and Windows across Node 22, 24 and 26, and its JavaScript shell has no runtime dependencies (8 of 10). Total 66.

MealMe API 26

One API key per account in a custom Id-Token header, with no scopes, expiry, rotation or revocation documented (10 of 30). place_order defaults to false and charge_user can be turned off, so an agent can quote without buying, but there is no read-only key (8 of 20). Store descriptions, menus and support-chat messages are untrusted content with no guidance (3 of 15). Get Orders and a tracking webhook give order history; no per-call log for the operator is documented (5 of 15). No security.txt (400), disclosure policy, bug bounty or certification found; the Enterprise plan names a security review (0 of 20). Total 26.

Shop MCP 74

Shop MCP is an OAuth 2.0 protected resource with metadata at /.well-known/oauth-protected-resource. Tokens come from accounts.shop.app by authorisation code with PKCE or the device flow, can be revoked, and are refused in a query string or cookie. One scope, personal_agent, covers every signed-in tool (25 of 30). Tools are annotated read-only or destructive, the docs require the shopper to confirm merchant, items, total and instrument before complete_checkout, Shop Pay spending is governed by spend permissions the shopper grants on shop.com (since 1.2.0, with a total or per-purchase limit and a period, or no money limit at all), and spend requests need approval in Shop and return a single-use card only when get_spend_request asks for it. Confirmation before completion is guidance to the agent, and the CLI README says that within a permission the agent can complete Shop Pay purchases without asking each time (16 of 20). Results carry merchant text, and the docs and skill say to treat it as data. The server also returns next[] suggestions addressed to the agent (10 of 15). The shopper sees each connection by device name in their Shop account and can remove it there. No per-call log for an operator was found (5 of 15). www.shopify.com's security.txt (as read for the shopify listing on 1 November) and the repository's SECURITY.md route reports to HackerOne. mcp.shop.com has no security.txt (18 of 20). Total 74.

MealMe API 20

No x402, MPP or L402 (0). $0.10 per successful call and $250 a month published without login (20). No free tier or trial; a card must be added before the key is created (0). Signup is a browser form with email, password and card (0). Total 20.

Shop MCP 55

No x402, MPP or L402. Payment is through Shop Pay or a single-use card issued after the shopper approves a spend request (0 of 40). shop.dev states the service is free with no account or key, without a login (20 of 20). Search, carts and checkout need no card or account (20 of 20). Ten tools run with no credential at all. Account, order and spend request tools need the shopper to sign in with Shop in a browser or by device code (15 of 20). Total 55.

MealMe API 72

The reference pages are generated from an API description with operation ids (get_search_store_v3), named response schemas (Product_Search_Output) and typed parameters, but no spec file URL was found on the docs, llms.txt or the site (15 of 25). llms.txt at mealmeapi.readme.io and mealme.ai, and every page as Markdown (10). Each operation states its purpose and coverage; several descriptions are truncated in the index and none says when not to use it (12 of 20). Enums on sort, store_type, user_country and search_focus, required flags on latitude and longitude, conditional requirements written in prose (11 of 15). Request and response examples per endpoint, a Create Order errors page with 17 entries, and 400, 401 and 429 schemas on each operation (12 of 15). Versioned paths (v2 to v4) and dated release notes that call out breaking changes, the newest of 6 May 2025 (12 of 15). Total 72.

Shop MCP 89

All 19 tools in the live tools/list on 1 November carry JSON Schema inputs with required fields (25 of 25). No llms.txt, but every shop.dev docs page has a Markdown twin at .md, and the server serves a skill as MCP resources (10 of 10). Tool descriptions say when to use each one and when not to, such as "Use search_catalog for discovery" and get_spend_request's "Omit include to read status and terms only" (18 of 20). Inputs use patterns, minimums, enums such as search_orders' status, anyOf for query or like, and minor-unit integer amounts, with several open objects such as context, and the top-level additionalProperties false seen on 17 October is no longer set (11 of 15). Curl and JavaScript examples, a worked response, and tables of HTTP, JSON-RPC and tool error codes. The tool reference now uses the server's create_spend_request names and the CLI page shows 1.2.0, the version the server reports as latest, so the 17 October mismatches are gone (15 of 15). Protocol 2026-07-28 and UCP 2026-08-25 are stated and reported in each document, and the launch is in the Shopify developer changelog, but Shop MCP has no changelog of its own and the 1.2.0 changes appear in none (10 of 15). Total 89.

MealMe API 19

Read with the hosted lines. No status page found on mealme.ai, the docs or llms.txt, and status.mealme.ai does not resolve (0). No readable incident history (5). No rate limit figures; each endpoint documents a 429 whose example message is 10 per 1 second(s)!, which the reference itself calls an example (0 of 15). The 429 is documented without Retry-After or backoff guidance, and Create Order has no idempotency key, only an order_id to update an existing order and a caller's customer_order_id to look up (4 of 15). No SLA found (0). The API is in production with versioned endpoints (10). Total 19.

Shop MCP 33

Graded with the hosted lines. No status page covers Shop MCP. shopifystatus.com, re-read on 1 November, lists merchant components such as Admin, Checkout, Storefront and API & Mobile, and none for Shop, Shop MCP or the Catalog (0 of 20). So there is no incident history for this surface (5 of 30). The order-search figures shop.dev published on 17 October (10 a minute to 200 a week) are no longer on its pages, which now say only that calls are rate limited and that anonymous calls get the lowest limits. The one figure left, 5 requests a second per API client, is for the separate Global Catalog endpoint (3 of 15). Rate-limited calls return rate_limited with retry_after in seconds (1 to 3,600), writes take an idempotency key, and the errors guide says which calls can be repeated and that complete_checkout never can (15 of 15). No SLA found (0 of 10). Live since the 13 October 2026 announcement with no beta or preview label (10 of 10). Total 33.

MealMe API 47

Closed service. The API and SDK Terms of Use (18 June 2022) and MealMe Connect terms (4 April 2025) name MealMe, Inc. under Delaware law, but the API terms license use for personal, noncommercial purposes while the product is sold to businesses (15 of 30). The privacy policy of 1 January 2025 keeps data as long as needed, names no subprocessor and no DPA; the cookie policy names Google, Adobe, LinkedIn, Twitter and Facebook (10 of 30). Release notes record breaking changes with dates but there is no deprecation policy or notice period (6 of 20). Cookie providers named, no subprocessor list or data location (4 of 20). Total 35.

Shop MCP 61

Closed hosted service under the Shopify API Terms, last updated 7 October 2026, re-read on 1 November. The CLI is MIT, but its core ships as a compiled shop.wasm file (15 of 30). Shopify's consumer privacy policy, last updated 2 March 2026, covers Shop, with retention set by business need rather than periods. shop.dev says the preference data Shop uses for personalised search never reaches the app, and the CLI docs disclose that credentials are kept in a plain-text file. No Shop MCP data statement or DPA for developers was found (15 of 30). No deprecation policy. The API Terms allow changes, removals and new fees with or without notice, the server accepts one protocol version, and the 1.2.0 tool changes came with no notice (5 of 20). The privacy policy names transfers including to Canada and Ireland. Shopify's subprocessor list is linked from its merchant privacy policy, not the consumer one, and its help-centre page refused our reader on 1 November, so it isn't read for this listing (10 of 20). Total 45.