Saleor API + MCP vs Spree Commerce

Saleor API + MCP

One GraphQL schema with 78 typed error-code enums and 464 marked deprecations. The MCP server can't create checkouts or orders.

Spree Commerce

A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.

Saleor API + MCP

1. Pass the channel slug on product and checkout queries. Prices and availability are per channel
2. Send X-Saleor-API-URL and X-Saleor-Auth-Token on every MCP request, with a token holding MANAGE_PRODUCTS and MANAGE_ORDERS
3. Read the errors array in every mutation payload. A 200 response can still carry a CheckoutErrorCode
4. Keep queries under the 50,000 complexity cap and 100 items a page, and send at most 4 mutations per request
5. The 3.24 changelog removes the old dummy payment plugins, so test checkouts should use a payment app

Spree Commerce

1. Send a publishable key in X-Spree-Api-Key on every Store API call. Add X-Spree-Token with the cart token for guest carts, or a customer JWT as a Bearer token
2. Send Idempotency-Key with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached
3. Ask for fields and expand explicitly. Relations are left out by default and limit stops at 100
4. Use a secret key with the narrowest scopes for the Admin API. read_all gives a read-only key, and the CLI's auto-minted local key is read-only
5. Read the docs under /docs/v5 for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments and splits carts from orders