Shopware vs Swell

Shopware

MIT-licensed core with OpenAPI specs for both APIs and a built-in MCP server that advertises three discovery tools, previews writes by default and limits each integration to an allowlist. The MCP server is experimental until 6.8, and 20 security advisories were published between May and September 2026, four of them critical.

Swell

Live /:models schema with field types and descriptions for every store. One full-access secret key per environment, with no scoped or read-only key.

Shopware

1. Ask the merchant for an integration without --admin, tied to an ACL role and an MCP allowlist. Send sw-access-key and sw-secret-access-key headers to /api/_mcp
2. Call shopware-tool-search first, then shopware-toolset-enable, and keep the Mcp-Session-Id header. A fresh session lists only three tools
3. Pass dryRun=false to commit a write. shopware-media-upload has no dry run and uploads at once
4. For shopping, call the Store API over HTTP with the sales channel's sw-access-key and keep the sw-context-token. The Store API MCP endpoint has no cart tools in core
5. Send includes in search criteria to cut response size, and read the 429 body for the wait time

Swell

1. Call GET /:models once and cache it. It's the ground truth for custom fields
2. Check result.errors after every write. A failed validation still returns 200
3. Use $set to replace an array. A plain PUT merges arrays by element id and never shrinks them
4. Use an sk_test_ key while testing. A bare sk_ prefix is live
5. Keep expand and include small. Each level past the first three points adds rate-limit weight