{ "data": { "a": { "slug": "shopware", "name": "Shopware", "vendor": "shopware AG", "vendorUrl": "https://www.shopware.com", "kind": "http-api", "category": "commerce", "summary": "Open-source commerce platform from shopware AG in Germany, written in PHP on Symfony. Agents reach a store through its Store API for shopping, its Admin API for back-office work, and a built-in MCP server on both.", "url": "https://www.anchorterminal.com/tools/shopware", "markdownUrl": "https://www.anchorterminal.com/tools/shopware.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shopware.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shopware.json", "repo": "https://github.com/shopware/shopware", "license": "MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "packagist", "name": "shopware/core" }, { "registry": "npm", "name": "@shopware/api-client" } ], "auth": "mixed", "authNotes": "Access comes from the merchant who runs the store, with no vendor review. The Admin API takes an OAuth 2.0 bearer token from /api/oauth/token, normally by client credentials from an integration created in Settings or with `bin/console integration:create`, and tokens last 10 minutes by default. An integration gets an ACL role, or full access with --admin. The MCP endpoint at /api/_mcp also accepts the integration's `sw-access-key` and `sw-secret-access-key` headers, and each integration and user has an MCP allowlist. The Store API takes the sales channel's `sw-access-key`, which is public in a headless shop, plus an `sw-context-token` for the cart and customer session.", "pricing": "freemium", "pricingNotes": "The Community Edition is free under MIT with no account, so an agent's owner can start with `shopware-cli project create` and Docker, with no contract (the docs say no Shopware account is needed to install or run a store). Paid plans start at €600 a month for Rise and €2,400 for Evolve, excluding VAT, with Beyond on request, and the pricing page says the price depends on GMV. Shopware SaaS is priced the same as self-hosted. No trial of the paid plans was found on the pricing page (https://www.shopware.com/en/pricing/, checked 2026-10-08).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the repository or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 14, "popularity": { "githubStars": 3400, "npmWeekly": 30917, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://developer.shopware.com/docs/", "llmsTxt": "https://developer.shopware.com/llms.txt", "openapi": "https://github.com/shopware/shopware/tree/trunk/src/Core/Framework/Api/ApiDefinition/Generator/Schema", "capabilities": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "tags": [ "open-source", "self-hosted", "local", "hosted", "mcp", "openapi", "llms-txt", "oauth", "php", "typescript", "webhooks", "freemium", "eu", "bug-bounty", "iso27001", "beta" ], "lastRelease": "2026-10-02", "graded": true, "anchor": { "graded": true, "score": 71.4, "grade": "BB", "agentReady": true, "rank": 129, "ranked": true, "rankOf": 950, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 78, "maintenance": 87, "payments": 50, "reliability": 83, "schema": 85, "security": 73, "transparency": 76 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": -5, "negativeNotes": [ "GitHub lists 20 security advisories for shopware/shopware published between 19 May and 16 September 2026, four of them critical (an app script sandbox escape, stored SQL injection through app manifests, admin account takeover by host-header poisoning and a webhook permission bypass), plus a pre-authentication SQL injection in the Store API (GHSA-p37c-pm9p-7vm5, CVSS 8.6, published 25 August 2026, fixed in 6.7.13.1 and 6.6.10.23). All were disclosed in public with fixed versions, so the deduction is 5 of a possible 15 (https://github.com/shopware/shopware/security/advisories)." ], "verdict": "MIT-licensed core with OpenAPI specs for both APIs and a built-in MCP server that advertises three discovery tools, previews writes by default and limits each integration to an allowlist. The MCP server is experimental until 6.8, and 20 security advisories were published between May and September 2026, four of them critical.", "bestFor": "A merchant already on Shopware, or a team that wants an MIT PHP backend with a built-in MCP server for back-office work.", "strengths": [ "MIT core, free to self-host, with security fixes for the 6.7 line promised until 28 February 2028 in releases.json", "Built-in MCP server advertises three discovery tools, and other tools load by toolset for the session", "MCP write tools default to dryRun=true, which runs the change in a transaction and rolls it back", "Per-integration ACL roles and MCP allowlists, with a 300 a minute limit on /api/_mcp", "OpenAPI 3 schemas for the Store API and Admin API in the repository, plus llms.txt and Markdown docs" ], "weaknesses": [ "The MCP server is marked experimental until 6.8, and 6.7.14.0 changed what tools/list returns on the Store API endpoint", "20 advisories published between 19 May and 16 September 2026, four critical, including a pre-authentication SQL injection in the Store API", "MCP tools carry no readOnlyHint or destructiveHint annotations, and criteria and payloads travel as JSON-encoded strings", "A 429 from the MCP endpoints carries the wait time in the body, with no Retry-After header", "The Store API MCP endpoint ships one domain tool, has no allowlist, and the security.txt file expired on 31 December 2025" ], "agentNotes": [ "Ask the merchant for an integration without --admin, tied to an ACL role and an MCP allowlist. Send sw-access-key and sw-secret-access-key headers to /api/_mcp", "Call shopware-tool-search first, then shopware-toolset-enable, and keep the Mcp-Session-Id header. A fresh session lists only three tools", "Pass dryRun=false to commit a write. shopware-media-upload has no dry run and uploads at once", "For shopping, call the Store API over HTTP with the sales channel's sw-access-key and keep the sw-context-token. The Store API MCP endpoint has no cart tools in core", "Send `includes` in search criteria to cut response size, and read the 429 body for the wait time" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.4 } ], "editorialScores": { "ergonomics": 78, "maintenance": 87, "payments": 50, "reliability": 83, "schema": 85, "security": 73, "transparency": 80 }, "provenanceScore": 71 }, "connect": { "install": "npx @shopware-ag/shopware-cli project create my-shop", "http": "curl -X POST \"http://localhost:8000/api/search/product\" \\\n -H \"Authorization: Bearer YOUR_ACCESS_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{}'", "claudeCode": "claude mcp add --transport http shopware http://localhost:8000/api/_mcp --header \"sw-access-key: SWIA...\" --header \"sw-secret-access-key: ...\"", "config": { "mcpServers": { "shopware": { "headers": { "sw-access-key": "SWIA...", "sw-secret-access-key": "..." }, "type": "streamable-http", "url": "https://your-shop.example.com/api/_mcp" } } } }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/shopware" }, "area": "business", "unitPrices": [ { "item": "Community Edition", "unit": "month", "usd": 0, "note": "MIT core, you pay for your own hosting" } ], "provenance": { "legalEntity": "shopware AG", "domain": "shopware.com", "domainRegistered": "1998-08-08", "endpointOnVendorDomain": false, "terms": "https://www.shopware.com/en/gtc/", "privacy": "https://www.shopware.com/en/privacy/", "statusPage": "https://status.shopware.com", "changelog": "https://github.com/shopware/shopware/releases", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "The legal notice names shopware AG, Ebbinghoff 10, 48624 Schoeppingen, Germany, Amtsgericht Coesfeld HRB 11471.", "The general terms cover every product. Part 2 covers the free Community Edition and Part 4 covers SaaS, and only the German version is binding.", "The Store API, Admin API and MCP endpoints run on each merchant's own domain or SaaS shop, not on shopware.com.", "security.txt at www.shopware.com gives Expires 31 December 2025.", "www.shopware.com answered several requests with a 503 first byte timeout on 8 October 2026. The terms loaded on a retry and the privacy page loaded once.", "status.shopware.com covers Shopware SaaS, PaaS and vendor services, not self-hosted stores.", "Verisign RDAP gives a registration date of 1998-08-08 for shopware.com." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shopware.json", "live": { "slug": "shopware", "vendorStatus": { "page": "https://status.shopware.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-10T00:51:15.768062465Z" }, "versions": [ { "registry": "github", "name": "shopware/shopware", "version": "v6.7.15.1", "released": "2026-10-07", "seenAt": "2026-10-09T17:19:52.387656255Z" }, { "registry": "npm", "name": "@shopware/api-client", "version": "1.7.0", "seenAt": "2026-10-09T17:19:49.629444815Z" } ], "githubStars": 3446, "npmWeekly": 19335, "securityTxt": { "url": "https://shopware.com/.well-known/security.txt", "state": "valid", "expires": "Wed, 31 Dec 2025 23:59 +0200", "checkedAt": "2026-10-09T15:40:35.715539761Z" }, "llmsTxt": { "url": "https://developer.shopware.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-09T14:02:46.197314645Z" }, "pages": [ { "url": "https://www.shopware.com/en/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-09T18:54:11.558620073Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a8eeb1d7324d" }, { "url": "https://www.shopware.com/en/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-09T18:54:13.870138637Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47fcc8fa5858" }, { "url": "https://www.shopware.com/en/gtc/", "kind": "terms", "status": 200, "checkedAt": "2026-10-09T18:54:08.88600898Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "034d628e8015" } ], "updatedAt": "2026-10-10T00:51:15.768062465Z" } }, "answer": "Shopware scores 71.4 (BB) on agent readiness against Spree Commerce's 70.4 (BB), and leads in 4 of 7 scored categories. Spree Commerce leads on agent ergonomics and payments \u0026 pricing.", "b": { "slug": "spree-commerce", "name": "Spree Commerce", "vendor": "Vendo Connect Inc", "vendorUrl": "https://spreecommerce.org", "kind": "http-api", "category": "commerce", "summary": "Spree Commerce is an open-source commerce platform on Ruby on Rails, maintained by Vendo Connect Inc. A self-hosted store runs a Store API for catalogue, cart and checkout, and an Admin API for back-office work.", "url": "https://www.anchorterminal.com/tools/spree-commerce", "markdownUrl": "https://www.anchorterminal.com/tools/spree-commerce.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/spree-commerce.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/spree-commerce.json", "repo": "https://github.com/spree/spree", "license": "BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@spree/sdk" }, { "registry": "npm", "name": "@spree/cli" }, { "registry": "npm", "name": "@spree/admin-sdk" }, { "registry": "rubygems", "name": "spree" } ], "auth": "mixed", "authNotes": "Store API calls need a publishable key (`pk_`) in the `X-Spree-Api-Key` header, plus a customer JWT as a Bearer token or a cart token in `X-Spree-Token` for guests. Admin API calls take a secret key (`sk_`) with `read_*` and `write_*` scopes per resource, or an admin JWT. Keys are created by the store's operator in the dashboard or with `spree api-key create`, with no vendor approval.", "pricing": "freemium", "pricingNotes": "Free to self-host under BSD 3-Clause, with no platform or transaction fee. The Enterprise Edition is custom pricing through sales. A free hosted Sandbox lets an agent's owner try the Admin API without a contract, for evaluation with test data only (https://spreecommerce.org/enterprise/, checked 2026-10-09).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI files or the repository (checked 2026-10-09). Payments go through provider integrations such as Stripe, Adyen and PayPal.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 15750, "npmWeekly": 1576, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://spreecommerce.org/docs", "llmsTxt": "https://spreecommerce.org/docs/llms.txt", "openapi": "https://spreecommerce.org/docs/api-reference/store.yaml", "capabilities": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "tags": [ "open-source", "self-hosted", "local", "openapi", "llms-txt", "mcp", "typescript", "ruby", "webhooks", "freemium" ], "lastRelease": "2026-07-28", "graded": true, "anchor": { "graded": true, "score": 70.4, "grade": "BB", "agentReady": true, "rank": 155, "ranked": true, "rankOf": 950, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 90, "maintenance": 81, "payments": 55, "reliability": 82, "schema": 85, "security": 65, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-09" }, "negative": -5, "negativeNotes": [ "2026-07-20: six security advisories were published for `spree_api` and related gems between 8 January and 20 July 2026, four rated High, among them guest address and order disclosure without authentication (GHSA-87fh-rc96-6fr6, GHSA-p6pv-q7rc-g4h9, 5 February) and a guest cart takeover on `PATCH /api/v3/store/carts/:id/associate` (GHSA-4825-p4xm-pcf2, 20 July, fixed in 5.4.4 and 5.5.4). All are published with patched versions, so the deduction is reduced (https://github.com/spree/spree/security/advisories)." ], "verdict": "A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.", "bestFor": "Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST.", "strengths": [ "OpenAPI 3.0.3 files for the Store API (81 paths, 99 operations) and Admin API (259 paths, 417 operations), plus llms.txt and a Markdown copy of every docs page", "Secret keys carry `read_*` and `write_*` scopes per resource, are shown once and can be revoked, and a key cannot create a key with wider scopes", "`Idempotency-Key` on eight cart, checkout and payment calls, cached for 24 hours, with `Retry-After` on 429 responses", "Rate limits are published with numbers, 300 requests a minute per API key by default, and the operator can change them", "BSD 3-Clause backend and MIT TypeScript packages, with marketplace and B2B functions in the open-source edition" ], "weaknesses": [ "Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses", "The default docs and the main-branch OpenAPI files describe 6.0, a release candidate dated 8 October 2026. The stable release is 5.6.1 of 28 July 2026", "The audit trail is in the paid Enterprise Edition only, and Enterprise prices are not published", "Supported-version end dates differ between `SECURITY.md` (5.x until 26 March 2027) and the docs security policy (5.0 until 26 March 2028)", "The official MCP server searches and reads the docs only. Store and admin MCP servers are open roadmap issues" ], "agentNotes": [ "Send a publishable key in `X-Spree-Api-Key` on every Store API call. Add `X-Spree-Token` with the cart token for guest carts, or a customer JWT as a Bearer token", "Send `Idempotency-Key` with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached", "Ask for `fields` and `expand` explicitly. Relations are left out by default and `limit` stops at 100", "Use a secret key with the narrowest scopes for the Admin API. `read_all` gives a read-only key, and the CLI's auto-minted local key is read-only", "Read the docs under `/docs/v5` for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments and splits carts from orders" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.4 } ], "editorialScores": { "ergonomics": 90, "maintenance": 81, "payments": 55, "reliability": 82, "schema": 85, "security": 65, "transparency": 75 }, "provenanceScore": 45 }, "connect": { "install": "npx create-spree-app@latest my-store", "http": "curl -X GET 'http://localhost:3000/api/v3/store/products' -H 'X-Spree-Api-Key: pk_xxx'", "claudeCode": "claude mcp add --transport http spree-docs https://spreecommerce.org/docs/mcp", "config": { "mcpServers": { "spree-docs": { "url": "https://spreecommerce.org/docs/mcp" } } } }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/spree-commerce" }, "area": "business", "unitPrices": [ { "item": "Community Edition, self-hosted", "unit": "month", "usd": 0, "note": "BSD 3-Clause, the operator pays for its own servers" } ], "provenance": { "legalEntity": "Vendo Connect Inc", "domain": "spreecommerce.org", "domainRegistered": "2009-04-03", "endpointOnVendorDomain": false, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/spree/spree/releases", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The Sandbox terms name VENDO CONNECT INC, a Delaware corporation (file number 7005612), 3500 S DuPont Highway, Dover, Delaware 19901, as the company behind the Spree Commerce project. The `LICENSE` file also names Vendo Sp. z o.o. as a copyright holder.", "The API runs on the operator's own server, so there is no vendor endpoint and no vendor status page.", "No terms or privacy document governs the self-hosted software, and the BSD 3-Clause licence stands in. The published terms (https://spreecommerce.org/terms-of-service/) and privacy notice (https://spreecommerce.org/privacy-policy-sandbox/), both dated 10 July 2026, cover only the hosted Sandbox and Vendo's websites.", "https://spreecommerce.org/.well-known/security.txt returns 404. `SECURITY.md` in the repository gives a security mailbox for reports.", "RDAP for spreecommerce.org gives a registration date of 2009-04-03 and GoDaddy.com, LLC as registrar." ], "score": 45 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/spree-commerce.json", "live": { "slug": "spree-commerce", "versions": [ { "registry": "github", "name": "spree/spree", "version": "v5.6.1", "released": "2026-07-28", "seenAt": "2026-10-09T17:21:34.764539584Z" }, { "registry": "npm", "name": "@spree/admin-sdk", "version": "0.1.0", "seenAt": "2026-10-09T17:21:32.71633834Z" }, { "registry": "npm", "name": "@spree/cli", "version": "3.2.2", "seenAt": "2026-10-09T17:21:30.96599442Z" }, { "registry": "npm", "name": "@spree/sdk", "version": "1.2.1", "seenAt": "2026-10-09T17:21:28.899108995Z" } ], "githubStars": 15751, "npmWeekly": 1576, "updatedAt": "2026-10-09T17:21:34.764539584Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "shopware AG", "b": "Vendo Connect Inc", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms", "b": "BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence", "name": "Licence" }, { "a": "14", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-02", "b": "2026-07-28", "name": "Last release" }, { "a": "2026-06-10", "b": "no document linked", "name": "Terms last updated" }, { "a": "couldn't be read", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "yes", "b": "", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "", "name": "Terms restrict automated access" }, { "a": "yes", "b": "", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "", "name": "Arbitration or class-action waiver" }, { "a": "3.4k stars, 31k npm/wk", "b": "16k stars, 1.6k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Shopware scores 71.4 (BB) on agent readiness against Spree Commerce's 70.4 (BB), and leads in 4 of 7 scored categories. Spree Commerce leads on agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, Shopware or Spree Commerce?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Shopware and Spree Commerce need an API key?" }, { "answer": "No hosted endpoint is listed for Shopware. No hosted endpoint is listed for Spree Commerce.", "question": "Can an agent call Shopware and Spree Commerce without installing anything?" }, { "answer": "Yes. Shopware is open source (MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms). Spree Commerce is open source (BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence).", "question": "Are Shopware and Spree Commerce open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 73 against 65", "Maintenance \u0026 community, 87 against 81", "Transparency \u0026 trust, 76 against 60" ], "also": null, "goodFor": "A merchant already on Shopware, or a team that wants an MIT PHP backend with a built-in MCP server for back-office work.", "slug": "shopware", "watchFor": "The MCP server is marked experimental until 6.8, and 6.7.14.0 changed what tools/list returns on the Store API endpoint" }, { "aheadOn": [ "Agent ergonomics, 90 against 78", "Payments \u0026 pricing, 55 against 50" ], "also": null, "goodFor": "Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST.", "slug": "spree-commerce", "watchFor": "Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses" } ], "job": { "capability": "commerce.products", "name": "Commerce catalogues" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopware.json", "title": "Adobe Commerce (Magento) vs Shopware", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.json", "title": "Adobe Commerce (Magento) vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-shopware.json", "title": "BigCommerce API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce.json", "title": "BigCommerce API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-shopware.json", "title": "Commerce Layer API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce.json", "title": "Commerce Layer API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-shopware.json", "title": "commercetools vs Shopware", "url": "https://www.anchorterminal.com/compare/commercetools-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce.json", "title": "commercetools vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-shopware.json", "title": "Ecwid by Lightspeed vs Shopware", "url": "https://www.anchorterminal.com/compare/ecwid-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce.json", "title": "Ecwid by Lightspeed vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-shopware.json", "title": "Elastic Path API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce.json", "title": "Elastic Path API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-shopware.json", "title": "Medusa API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/medusa-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-spree-commerce.json", "title": "Medusa API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/medusa-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-shopware.json", "title": "Saleor API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/saleor-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-spree-commerce.json", "title": "Saleor API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/saleor-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-shopware.json", "title": "Shopify API + MCP vs Shopware", "url": "https://www.anchorterminal.com/compare/shopify-vs-shopware" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.json", "title": "Shopify API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-snipcart.json", "title": "Shopware vs Snipcart API + MCP", "url": "https://www.anchorterminal.com/compare/shopware-vs-snipcart" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-square.json", "title": "Shopware vs Square", "url": "https://www.anchorterminal.com/compare/shopware-vs-square" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-swell.json", "title": "Shopware vs Swell", "url": "https://www.anchorterminal.com/compare/shopware-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-vendure.json", "title": "Shopware vs Vendure", "url": "https://www.anchorterminal.com/compare/shopware-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-wix.json", "title": "Shopware vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/shopware-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-woocommerce.json", "title": "Shopware vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/shopware-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce.json", "title": "Snipcart API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-square.json", "title": "Spree Commerce vs Square", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-square" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-swell.json", "title": "Spree Commerce vs Swell", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.json", "title": "Spree Commerce vs Vendure", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-wix.json", "title": "Spree Commerce vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce.json", "title": "Spree Commerce vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce" } ], "scores": [ { "by": 1, "edge": "shopware", "key": "reliability", "name": "Reliability", "shopware": 83, "spree-commerce": 82, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 0, "edge": "", "key": "schema", "name": "Schema \u0026 documentation", "shopware": 85, "spree-commerce": 85, "weight": 13 }, { "by": 12, "edge": "spree-commerce", "key": "ergonomics", "name": "Agent ergonomics", "shopware": 78, "spree-commerce": 90, "weight": 13 }, { "by": 8, "edge": "shopware", "key": "security", "name": "Security \u0026 auth", "shopware": 73, "spree-commerce": 65, "weight": 14 }, { "by": 5, "edge": "spree-commerce", "key": "payments", "name": "Payments \u0026 pricing", "shopware": 50, "spree-commerce": 55, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 6, "edge": "shopware", "key": "maintenance", "name": "Maintenance \u0026 community", "shopware": 87, "spree-commerce": 81, "weight": 7 }, { "by": 16, "edge": "shopware", "key": "transparency", "name": "Transparency \u0026 trust", "shopware": 76, "spree-commerce": 60, "weight": 7 } ], "summary": "Shopware scores 71.4 (BB) on agent readiness against Spree Commerce's 70.4 (BB), and leads in 4 of 7 scored categories. Spree Commerce leads on agent ergonomics and payments \u0026 pricing. Both do commerce catalogues.", "verdicts": { "shopware": "MIT-licensed core with OpenAPI specs for both APIs and a built-in MCP server that advertises three discovery tools, previews writes by default and limits each integration to an allowlist. The MCP server is experimental until 6.8, and 20 security advisories were published between May and September 2026, four of them critical.", "spree-commerce": "A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce", "json": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.md", "slim": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.min.md" }, "markdown": "Shopware scores 71.4 (BB) on agent readiness against Spree Commerce's 70.4 (BB), and leads in 4 of 7 scored categories. Spree Commerce leads on agent ergonomics and payments \u0026 pricing. Both do commerce catalogues.\n\n- Shopware: grade BB, 71.4/100, rank #129 of 950. Markdown https://www.anchorterminal.com/tools/shopware.md · JSON https://www.anchorterminal.com/api/v1/tools/shopware.json\n- Spree Commerce: grade BB, 70.4/100, rank #155 of 950. Markdown https://www.anchorterminal.com/tools/spree-commerce.md · JSON https://www.anchorterminal.com/api/v1/tools/spree-commerce.json\n- Best commerce platforms and checkout APIs for AI agents: https://www.anchorterminal.com/best/commerce/index.md\n- All 136 commerce comparisons: https://www.anchorterminal.com/compare/commerce/index.md\n\n## Which one, for what\n\n### Shopware (BB)\n\nGood for: A merchant already on Shopware, or a team that wants an MIT PHP backend with a built-in MCP server for back-office work.\n\nAhead on:\n- Security \u0026 auth, 73 against 65\n- Maintenance \u0026 community, 87 against 81\n- Transparency \u0026 trust, 76 against 60\n\nWatch for: The MCP server is marked experimental until 6.8, and 6.7.14.0 changed what tools/list returns on the Store API endpoint\n\n### Spree Commerce (BB)\n\nGood for: Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST.\n\nAhead on:\n- Agent ergonomics, 90 against 78\n- Payments \u0026 pricing, 55 against 50\n\nWatch for: Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses\n\n\n## Score by category\n\n| Category | Weight | Shopware | Spree Commerce | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 83 | 82 | Shopware +1 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 85 | even |\n| Agent ergonomics | 13% (16.2 this run) | 78 | 90 | Spree Commerce +12 |\n| Security \u0026 auth | 14% (17.5 this run) | 73 | 65 | Shopware +8 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 55 | Spree Commerce +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 81 | Shopware +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 76 | 60 | Shopware +16 |\n| Negative events | ≤15 | -5 | -5 | |\n| **Total** | | **71.4 · BB** | **70.4 · BB** | |\n\n## Facts side by side\n\n| Fact | Shopware | Spree Commerce |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | shopware AG | Vendo Connect Inc |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms | BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence |\n| Tools exposed | 14 | none |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| Last release | 2026-10-02 | 2026-07-28 |\n| Terms last updated | 2026-06-10 | no document linked |\n| Privacy policy last updated | couldn't be read | no document linked |\n| Customer content may train models | yes | |\n| Terms restrict automated access | not found in the text | |\n| Terms restrict benchmarking | yes | |\n| Terms or service can change without notice | not found in the text | |\n| Arbitration or class-action waiver | not found in the text | |\n| Popularity | 3.4k stars, 31k npm/wk | 16k stars, 1.6k npm/wk |\n\n## Verdicts\n\n**Shopware.** MIT-licensed core with OpenAPI specs for both APIs and a built-in MCP server that advertises three discovery tools, previews writes by default and limits each integration to an allowlist. The MCP server is experimental until 6.8, and 20 security advisories were published between May and September 2026, four of them critical.\n\n**Spree Commerce.** A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.\n\n## Before you call either\n\n### Shopware\n\n1. Ask the merchant for an integration without --admin, tied to an ACL role and an MCP allowlist. Send sw-access-key and sw-secret-access-key headers to /api/_mcp\n2. Call shopware-tool-search first, then shopware-toolset-enable, and keep the Mcp-Session-Id header. A fresh session lists only three tools\n3. Pass dryRun=false to commit a write. shopware-media-upload has no dry run and uploads at once\n4. For shopping, call the Store API over HTTP with the sales channel's sw-access-key and keep the sw-context-token. The Store API MCP endpoint has no cart tools in core\n5. Send `includes` in search criteria to cut response size, and read the 429 body for the wait time\n\n### Spree Commerce\n\n1. Send a publishable key in `X-Spree-Api-Key` on every Store API call. Add `X-Spree-Token` with the cart token for guest carts, or a customer JWT as a Bearer token\n2. Send `Idempotency-Key` with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached\n3. Ask for `fields` and `expand` explicitly. Relations are left out by default and `limit` stops at 100\n4. Use a secret key with the narrowest scopes for the Admin API. `read_all` gives a read-only key, and the CLI's auto-minted local key is read-only\n5. Read the docs under `/docs/v5` for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments and splits carts from orders\n\n## Questions\n\n### Which is better for AI agents, Shopware or Spree Commerce?\n\nShopware scores 71.4 (BB) on agent readiness against Spree Commerce's 70.4 (BB), and leads in 4 of 7 scored categories. Spree Commerce leads on agent ergonomics and payments \u0026 pricing.\n\n### Do Shopware and Spree Commerce need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Shopware and Spree Commerce without installing anything?\n\nNo hosted endpoint is listed for Shopware. No hosted endpoint is listed for Spree Commerce.\n\n### Are Shopware and Spree Commerce open source?\n\nYes. Shopware is open source (MIT for the Community Edition core. Paid plans add proprietary extensions under shopware AG's general terms). Spree Commerce is open source (BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.json, and with the fewest tokens: https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"shopware\", \"b\": \"spree-commerce\"}`. From a terminal: `anchor compare shopware spree-commerce`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/shopware.json and https://www.anchorterminal.com/api/v1/tools/spree-commerce.json\n\n## Other comparisons with Shopware or Spree Commerce\n\n- [Adobe Commerce (Magento) vs Shopware](https://www.anchorterminal.com/compare/adobe-commerce-vs-shopware.md)\n- [Adobe Commerce (Magento) vs Spree Commerce](https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.md)\n- [BigCommerce API + MCP vs Shopware](https://www.anchorterminal.com/compare/bigcommerce-vs-shopware.md)\n- [BigCommerce API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce.md)\n- [Commerce Layer API + MCP vs Shopware](https://www.anchorterminal.com/compare/commerce-layer-vs-shopware.md)\n- [Commerce Layer API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce.md)\n- [commercetools vs Shopware](https://www.anchorterminal.com/compare/commercetools-vs-shopware.md)\n- [commercetools vs Spree Commerce](https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce.md)\n- [Ecwid by Lightspeed vs Shopware](https://www.anchorterminal.com/compare/ecwid-vs-shopware.md)\n- [Ecwid by Lightspeed vs Spree Commerce](https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce.md)\n- [Elastic Path API + MCP vs Shopware](https://www.anchorterminal.com/compare/elastic-path-vs-shopware.md)\n- [Elastic Path API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce.md)\n- [Medusa API + MCP vs Shopware](https://www.anchorterminal.com/compare/medusa-vs-shopware.md)\n- [Medusa API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/medusa-vs-spree-commerce.md)\n- [Saleor API + MCP vs Shopware](https://www.anchorterminal.com/compare/saleor-vs-shopware.md)\n- [Saleor API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/saleor-vs-spree-commerce.md)\n- [Shopify API + MCP vs Shopware](https://www.anchorterminal.com/compare/shopify-vs-shopware.md)\n- [Shopify API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.md)\n- [Shopware vs Snipcart API + MCP](https://www.anchorterminal.com/compare/shopware-vs-snipcart.md)\n- [Shopware vs Square](https://www.anchorterminal.com/compare/shopware-vs-square.md)\n- [Shopware vs Swell](https://www.anchorterminal.com/compare/shopware-vs-swell.md)\n- [Shopware vs Vendure](https://www.anchorterminal.com/compare/shopware-vs-vendure.md)\n- [Shopware vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/shopware-vs-wix.md)\n- [Shopware vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/shopware-vs-woocommerce.md)\n- [Snipcart API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce.md)\n- [Spree Commerce vs Square](https://www.anchorterminal.com/compare/spree-commerce-vs-square.md)\n- [Spree Commerce vs Swell](https://www.anchorterminal.com/compare/spree-commerce-vs-swell.md)\n- [Spree Commerce vs Vendure](https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.md)\n- [Spree Commerce vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/spree-commerce-vs-wix.md)\n- [Spree Commerce vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Shopware vs Spree Commerce", "url": "" } ], "description": "Shopware scores 71.4 (BB) to Spree Commerce's 70.4 (BB) for commerce catalogues. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Shopware BB 71.4", "Spree Commerce BB 70.4", "scores" ], "h1": "Shopware vs Spree Commerce", "image": "https://www.anchorterminal.com/assets/og/compare-shopware-vs-spree-commerce.png", "path": "/compare/shopware-vs-spree-commerce", "published": "2026-10-01", "section": "tools", "title": "Shopware vs Spree Commerce for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce" }, "tokens": { "markdown": 2800, "slim": 680 }, "version": 1 }