{ "data": { "a": { "slug": "spree-commerce", "name": "Spree Commerce", "vendor": "Vendo Connect Inc", "vendorUrl": "https://spreecommerce.org", "kind": "http-api", "category": "commerce", "summary": "Spree Commerce is an open-source commerce platform on Ruby on Rails, maintained by Vendo Connect Inc. A self-hosted store runs a Store API for catalogue, cart and checkout, and an Admin API for back-office work.", "url": "https://www.anchorterminal.com/tools/spree-commerce", "markdownUrl": "https://www.anchorterminal.com/tools/spree-commerce.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/spree-commerce.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/spree-commerce.json", "repo": "https://github.com/spree/spree", "license": "BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@spree/sdk" }, { "registry": "npm", "name": "@spree/cli" }, { "registry": "npm", "name": "@spree/admin-sdk" }, { "registry": "rubygems", "name": "spree" } ], "auth": "mixed", "authNotes": "Store API calls need a publishable key (`pk_`) in the `X-Spree-Api-Key` header, plus a customer JWT as a Bearer token or a cart token in `X-Spree-Token` for guests. Admin API calls take a secret key (`sk_`) with `read_*` and `write_*` scopes per resource, or an admin JWT. Keys are created by the store's operator in the dashboard or with `spree api-key create`, with no vendor approval.", "pricing": "freemium", "pricingNotes": "Free to self-host under BSD 3-Clause, with no platform or transaction fee. The Enterprise Edition is custom pricing through sales. A free hosted Sandbox lets an agent's owner try the Admin API without a contract, for evaluation with test data only (https://spreecommerce.org/enterprise/, checked 2026-10-09).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI files or the repository (checked 2026-10-09). Payments go through provider integrations such as Stripe, Adyen and PayPal.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 15750, "npmWeekly": 1576, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://spreecommerce.org/docs", "llmsTxt": "https://spreecommerce.org/docs/llms.txt", "openapi": "https://spreecommerce.org/docs/api-reference/store.yaml", "capabilities": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "tags": [ "open-source", "self-hosted", "local", "openapi", "llms-txt", "mcp", "typescript", "ruby", "webhooks", "freemium" ], "lastRelease": "2026-07-28", "graded": true, "anchor": { "graded": true, "score": 70.4, "grade": "BB", "agentReady": true, "rank": 155, "ranked": true, "rankOf": 950, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 90, "maintenance": 81, "payments": 55, "reliability": 82, "schema": 85, "security": 65, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-09" }, "negative": -5, "negativeNotes": [ "2026-07-20: six security advisories were published for `spree_api` and related gems between 8 January and 20 July 2026, four rated High, among them guest address and order disclosure without authentication (GHSA-87fh-rc96-6fr6, GHSA-p6pv-q7rc-g4h9, 5 February) and a guest cart takeover on `PATCH /api/v3/store/carts/:id/associate` (GHSA-4825-p4xm-pcf2, 20 July, fixed in 5.4.4 and 5.5.4). All are published with patched versions, so the deduction is reduced (https://github.com/spree/spree/security/advisories)." ], "verdict": "A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.", "bestFor": "Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST.", "strengths": [ "OpenAPI 3.0.3 files for the Store API (81 paths, 99 operations) and Admin API (259 paths, 417 operations), plus llms.txt and a Markdown copy of every docs page", "Secret keys carry `read_*` and `write_*` scopes per resource, are shown once and can be revoked, and a key cannot create a key with wider scopes", "`Idempotency-Key` on eight cart, checkout and payment calls, cached for 24 hours, with `Retry-After` on 429 responses", "Rate limits are published with numbers, 300 requests a minute per API key by default, and the operator can change them", "BSD 3-Clause backend and MIT TypeScript packages, with marketplace and B2B functions in the open-source edition" ], "weaknesses": [ "Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses", "The default docs and the main-branch OpenAPI files describe 6.0, a release candidate dated 8 October 2026. The stable release is 5.6.1 of 28 July 2026", "The audit trail is in the paid Enterprise Edition only, and Enterprise prices are not published", "Supported-version end dates differ between `SECURITY.md` (5.x until 26 March 2027) and the docs security policy (5.0 until 26 March 2028)", "The official MCP server searches and reads the docs only. Store and admin MCP servers are open roadmap issues" ], "agentNotes": [ "Send a publishable key in `X-Spree-Api-Key` on every Store API call. Add `X-Spree-Token` with the cart token for guest carts, or a customer JWT as a Bearer token", "Send `Idempotency-Key` with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached", "Ask for `fields` and `expand` explicitly. Relations are left out by default and `limit` stops at 100", "Use a secret key with the narrowest scopes for the Admin API. `read_all` gives a read-only key, and the CLI's auto-minted local key is read-only", "Read the docs under `/docs/v5` for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments and splits carts from orders" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.4 } ], "editorialScores": { "ergonomics": 90, "maintenance": 81, "payments": 55, "reliability": 82, "schema": 85, "security": 65, "transparency": 75 }, "provenanceScore": 45 }, "connect": { "install": "npx create-spree-app@latest my-store", "http": "curl -X GET 'http://localhost:3000/api/v3/store/products' -H 'X-Spree-Api-Key: pk_xxx'", "claudeCode": "claude mcp add --transport http spree-docs https://spreecommerce.org/docs/mcp", "config": { "mcpServers": { "spree-docs": { "url": "https://spreecommerce.org/docs/mcp" } } } }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/spree-commerce" }, "area": "business", "unitPrices": [ { "item": "Community Edition, self-hosted", "unit": "month", "usd": 0, "note": "BSD 3-Clause, the operator pays for its own servers" } ], "provenance": { "legalEntity": "Vendo Connect Inc", "domain": "spreecommerce.org", "domainRegistered": "2009-04-03", "endpointOnVendorDomain": false, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/spree/spree/releases", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The Sandbox terms name VENDO CONNECT INC, a Delaware corporation (file number 7005612), 3500 S DuPont Highway, Dover, Delaware 19901, as the company behind the Spree Commerce project. The `LICENSE` file also names Vendo Sp. z o.o. as a copyright holder.", "The API runs on the operator's own server, so there is no vendor endpoint and no vendor status page.", "No terms or privacy document governs the self-hosted software, and the BSD 3-Clause licence stands in. The published terms (https://spreecommerce.org/terms-of-service/) and privacy notice (https://spreecommerce.org/privacy-policy-sandbox/), both dated 10 July 2026, cover only the hosted Sandbox and Vendo's websites.", "https://spreecommerce.org/.well-known/security.txt returns 404. `SECURITY.md` in the repository gives a security mailbox for reports.", "RDAP for spreecommerce.org gives a registration date of 2009-04-03 and GoDaddy.com, LLC as registrar." ], "score": 45 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/spree-commerce.json", "live": { "slug": "spree-commerce", "versions": [ { "registry": "github", "name": "spree/spree", "version": "v5.6.1", "released": "2026-07-28", "seenAt": "2026-10-09T17:21:34.764539584Z" }, { "registry": "npm", "name": "@spree/admin-sdk", "version": "0.1.0", "seenAt": "2026-10-09T17:21:32.71633834Z" }, { "registry": "npm", "name": "@spree/cli", "version": "3.2.2", "seenAt": "2026-10-09T17:21:30.96599442Z" }, { "registry": "npm", "name": "@spree/sdk", "version": "1.2.1", "seenAt": "2026-10-09T17:21:28.899108995Z" } ], "githubStars": 15751, "npmWeekly": 1576, "updatedAt": "2026-10-09T17:21:34.764539584Z" } }, "answer": "Spree Commerce scores 70.4 (BB) on agent readiness against Square's 69.2 (B), and leads in 3 of 7 scored categories. Square leads on transparency \u0026 trust.", "b": { "slug": "square", "name": "Square", "vendor": "Block, Inc.", "vendorUrl": "https://squareup.com", "kind": "http-api", "category": "commerce", "summary": "Square is Block's commerce and payments platform for sellers. Its REST API covers catalogue, orders, payment links, payments, inventory and customers, with seven SDKs and a beta MCP server hosted at mcp.squareup.com.", "url": "https://www.anchorterminal.com/tools/square", "markdownUrl": "https://www.anchorterminal.com/tools/square.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/square.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/square.json", "repo": "https://github.com/square/square-mcp-server", "license": "Proprietary service under the Square Developer Terms of Service. The MCP server and the OpenAPI specification on GitHub are Apache 2.0, and the Node.js SDK is MIT", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.squareup.com/mcp", "packages": [ { "registry": "npm", "name": "square" }, { "registry": "npm", "name": "square-mcp-server" }, { "registry": "pypi", "name": "squareup" } ], "auth": "mixed", "authNotes": "Access needs a Square account and an application created in the Developer Console, both self-serve. Two token types go in the `Authorization: Bearer` header. A personal access token gives unrestricted access to the owner's own account, with a separate sandbox token. OAuth access tokens are limited to the scopes a seller grants, expire after 30 days and can be refreshed and revoked. The remote MCP server signs in through OAuth, and Square keeps an allowlist of MCP clients that may register.", "pricing": "usage", "pricingNotes": "The API and sandbox carry no charge. Sellers pay processing fees, 2.9% + 30 cents for card payments through the payments APIs in the US. Square Free is $0 a month, Plus $49 and Premium $149 per location. The sandbox lets an agent start without a contract (https://squareup.com/us/en/payments/our-fees, checked 2026-10-08).", "priceSummary": "2.9% fee", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs index at developer.squareup.com/llms.txt or the OpenAPI spec (checked 2026-10-08).", "endpoints": [] }, "toolCount": 3, "popularity": { "githubStars": null, "npmWeekly": 453743, "pypiWeekly": 72138, "asOf": "2026-10-08" }, "docsUrl": "https://developer.squareup.com/docs", "llmsTxt": "https://developer.squareup.com/llms.txt", "openapi": "https://raw.githubusercontent.com/square/connect-api-specification/master/api.json", "capabilities": [ "commerce.products", "commerce.orders", "commerce.checkout", "commerce.cart", "commerce.headless", "payments.card", "payments.checkout" ], "tags": [ "hosted", "closed-source", "mcp", "oauth", "openapi", "llms-txt", "webhooks", "sandbox", "graphql", "typescript", "python", "status-page", "bug-bounty" ], "lastRelease": "2026-09-16", "graded": true, "anchor": { "graded": true, "score": 69.2, "grade": "B", "agentReady": false, "rank": 195, "ranked": true, "rankOf": 950, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 81, "payments": 40, "reliability": 58, "schema": 87, "security": 67, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": 0, "verdict": "The REST API has a public OpenAPI 3.0 spec, OAuth scopes split by read and write for each resource, idempotency keys on writes and a free sandbox. The MCP server is in beta and its remote instance reaches production only. No numeric REST rate limits or SLA were found, and the status page recorded widespread errors on 27 September 2026.", "bestFor": "Agents working for a seller already on Square, on catalogue, inventory, orders, payment links and customers, online and in person.", "strengths": [ "Public OpenAPI 3.0 spec with 332 operations and 1,476 schemas, regenerated for API version 2026-09-16", "OAuth scopes are split by read and write for each resource, and access tokens expire after 30 days", "78 request schemas carry an `idempotency_key`, and the docs describe backoff with jitter for 429 responses", "Free sandbox at connect.squareupsandbox.com with test cards, and API Logs kept for 28 days", "Deprecated APIs are typically retired at least 12 months after deprecation, with dated release notes each month" ], "weaknesses": [ "The MCP server is marked beta, and the remote server reaches production data only", "No numeric rate limits were found for the REST API. Only GraphQL states a figure, 10 queries a second", "No SLA was found in the developer terms or documentation", "The status page recorded widespread latency and errors on 27 September 2026, including payment authorisation", "A personal access token grants unrestricted access to the whole Square account", "97 of the 332 operations in the spec are marked beta" ], "agentNotes": [ "Test against the sandbox first with the local MCP server and `SANDBOX=true`. The remote server at mcp.squareup.com reaches production only", "Set `DISALLOW_WRITES=true` on the local MCP server when the task only reads", "Call `get_service_info`, then `get_type_info`, before each `make_api_request`. The request body is otherwise untyped", "Send a fresh `idempotency_key` on every write, and reuse it when retrying the same write", "Pin `Square-Version` in each request. Use a page cursor within 5 minutes of receiving it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.2 } ], "editorialScores": { "ergonomics": 83, "maintenance": 81, "payments": 40, "reliability": 58, "schema": 87, "security": 67, "transparency": 56 }, "provenanceScore": 84 }, "connect": { "install": "npx square-mcp-server start", "http": "curl https://connect.squareupsandbox.com/v2/locations \\\n -H 'Square-Version: 2026-09-16' \\\n -H 'Authorization: Bearer {SANDBOX_ACCESS_TOKEN}' \\\n -H 'Content-Type: application/json'", "config": { "mcpServers": { "mcp_square_api": { "args": [ "mcp-remote", "https://mcp.squareup.com/mcp" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/square" }, "area": "business", "unitPrices": [ { "item": "Card payment through the payments APIs (US)", "unit": "pct", "usd": 2.9, "note": "plus 30 cents per transaction" }, { "item": "ACH bank transfer through the API (US)", "unit": "pct", "usd": 1, "note": "$1 minimum, $5 fee cap" }, { "item": "Square Free", "unit": "month", "usd": 0, "note": "per location" }, { "item": "Square Plus", "unit": "month", "usd": 49, "note": "per location" }, { "item": "Square Premium", "unit": "month", "usd": 149, "note": "per location" } ], "provenance": { "legalEntity": "Block, Inc.", "domain": "squareup.com", "domainRegistered": "2007-05-26", "endpointOnVendorDomain": true, "terms": "https://squareup.com/us/en/legal/general/developers", "privacy": "https://squareup.com/us/en/legal/general/privacy", "statusPage": "https://www.issquareup.com", "changelog": "https://developer.squareup.com/docs/changelog/connect", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Square Developer Terms of Service (last updated 10 September 2026) are an agreement with Block, Inc. and govern the APIs, SDKs and developer tools. Payment processing through an API is also subject to Square's General Terms.", "The Privacy Notice for Square Sellers and Website Visitors (last updated 15 September 2026) names Block, Inc., 1955 Broadway, Suite 600, Oakland, CA 94612 as the entity for US sellers, with other Square entities for Canada, Japan, Australia and the EU.", "The API answers at connect.squareup.com and the remote MCP server at mcp.squareup.com. The sandbox uses the separate domain squareupsandbox.com.", "squareup.com/.well-known/security.txt and developer.squareup.com/.well-known/security.txt return 404. The security page links a Bugcrowd programme.", "RDAP for squareup.com gives a registration date of 2007-05-26." ], "score": 84 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/square.json", "live": { "slug": "square", "probe": { "target": "https://mcp.squareup.com/mcp", "method": "get", "lastAt": "2026-10-10T01:38:08.746026085Z", "lastOk": true, "lastStatus": 401, "lastMs": 60, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 49, "p95ms24h": 112, "samples24h": 250, "samples30d": 337, "days": [ { "date": "2026-10-08", "probes": 70, "ok": 70 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://www.issquareup.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-10T01:34:10.249911001Z" }, "versions": [ { "registry": "github", "name": "square/square-mcp-server", "version": "0.1.2", "released": "2025-04-25", "seenAt": "2026-10-09T17:21:43.600338775Z" }, { "registry": "npm", "name": "square", "version": "46.0.0", "seenAt": "2026-10-09T17:21:41.167707952Z" }, { "registry": "npm", "name": "square-mcp-server", "version": "0.1.2", "seenAt": "2026-10-09T17:21:41.974371266Z" }, { "registry": "pypi", "name": "squareup", "version": "46.0.0.20260916", "released": "2026-09-15", "seenAt": "2026-10-09T17:21:43.415674748Z" } ], "githubStars": 108, "npmWeekly": 372633, "pypiWeekly": 71219, "securityTxt": { "url": "https://squareup.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-09T15:39:46.319454102Z" }, "llmsTxt": { "url": "https://developer.squareup.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-09T14:02:50.718207337Z" }, "pages": [ { "url": "https://developer.squareup.com/docs/changelog/connect", "kind": "changelog", "status": 200, "checkedAt": "2026-10-09T18:35:22.456423662Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "62494a1dd472" }, { "url": "https://squareup.com/us/en/legal/general/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-09T18:45:50.08649639Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "18b57fb2f3f3" }, { "url": "https://squareup.com/us/en/legal/general/developers", "kind": "terms", "status": 200, "checkedAt": "2026-10-09T18:45:47.212927781Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "eecff0955171" } ], "updatedAt": "2026-10-10T01:38:08.746026085Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Vendo Connect Inc", "b": "Block, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://mcp.squareup.com/mcp", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP, Streamable HTTP, stdio", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Pay per use", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence", "b": "Proprietary service under the Square Developer Terms of Service. The MCP server and the OpenAPI specification on GitHub are Apache 2.0, and the Node.js SDK is MIT", "name": "Licence" }, { "a": "none", "b": "3", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-07-28", "b": "2026-09-16", "name": "Last release" }, { "a": "no document linked", "b": "2026-09-10", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-09-15", "name": "Privacy policy last updated" }, { "a": "", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "", "b": "yes", "name": "Terms restrict automated access" }, { "a": "", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "16k stars, 1.6k npm/wk", "b": "454k npm/wk, 72k PyPI/wk", "name": "Popularity" } ], "faq": [ { "answer": "Spree Commerce scores 70.4 (BB) on agent readiness against Square's 69.2 (B), and leads in 3 of 7 scored categories. Square leads on transparency \u0026 trust.", "question": "Which is better for AI agents, Spree Commerce or Square?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Spree Commerce and Square need an API key?" }, { "answer": "No hosted endpoint is listed for Spree Commerce. Square has a hosted endpoint at https://mcp.squareup.com/mcp.", "question": "Can an agent call Spree Commerce and Square without installing anything?" }, { "answer": "Spree Commerce is open source (BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence). No open-source release is listed for Square.", "question": "Are Spree Commerce and Square open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 82 against 58", "Agent ergonomics, 90 against 83", "Payments \u0026 pricing, 55 against 40" ], "also": [ "Agent-ready, a grade of BB or better", "Open source" ], "goodFor": "Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST.", "slug": "spree-commerce", "watchFor": "Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses" }, { "aheadOn": [ "Transparency \u0026 trust, 70 against 60" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine", "No incidents deducted, where Spree Commerce loses 5 points for them" ], "goodFor": "Agents working for a seller already on Square, on catalogue, inventory, orders, payment links and customers, online and in person.", "slug": "square", "watchFor": "The MCP server is marked beta, and the remote server reaches production data only" } ], "job": { "capability": "commerce.products", "name": "Commerce catalogues" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.json", "title": "Adobe Commerce (Magento) vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-square.json", "title": "Adobe Commerce (Magento) vs Square", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-square" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce.json", "title": "BigCommerce API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-square.json", "title": "BigCommerce API + MCP vs Square", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-square" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce.json", "title": "Commerce Layer API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-square.json", "title": "Commerce Layer API + MCP vs Square", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-square" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce.json", "title": "commercetools vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-square.json", "title": "commercetools vs Square", "url": "https://www.anchorterminal.com/compare/commercetools-vs-square" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce.json", "title": "Ecwid by Lightspeed vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-square.json", "title": "Ecwid by Lightspeed vs Square", "url": "https://www.anchorterminal.com/compare/ecwid-vs-square" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce.json", "title": "Elastic Path API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-square.json", "title": "Elastic Path API + MCP vs Square", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-square" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-spree-commerce.json", "title": "Medusa API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/medusa-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-square.json", "title": "Medusa API + MCP vs Square", "url": "https://www.anchorterminal.com/compare/medusa-vs-square" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-spree-commerce.json", "title": "Saleor API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/saleor-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-square.json", "title": "Saleor API + MCP vs Square", "url": "https://www.anchorterminal.com/compare/saleor-vs-square" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.json", "title": "Shopify API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-square.json", "title": "Shopify API + MCP vs Square", "url": "https://www.anchorterminal.com/compare/shopify-vs-square" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.json", "title": "Shopware vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-square.json", "title": "Shopware vs Square", "url": "https://www.anchorterminal.com/compare/shopware-vs-square" }, { "json": "https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce.json", "title": "Snipcart API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/snipcart-vs-square.json", "title": "Snipcart API + MCP vs Square", "url": "https://www.anchorterminal.com/compare/snipcart-vs-square" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-swell.json", "title": "Spree Commerce vs Swell", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.json", "title": "Spree Commerce vs Vendure", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-wix.json", "title": "Spree Commerce vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce.json", "title": "Spree Commerce vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/square-vs-swell.json", "title": "Square vs Swell", "url": "https://www.anchorterminal.com/compare/square-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/square-vs-vendure.json", "title": "Square vs Vendure", "url": "https://www.anchorterminal.com/compare/square-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/square-vs-wix.json", "title": "Square vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/square-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/square-vs-woocommerce.json", "title": "Square vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/square-vs-woocommerce" } ], "scores": [ { "by": 24, "edge": "spree-commerce", "key": "reliability", "name": "Reliability", "spree-commerce": 82, "square": 58, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 2, "edge": "square", "key": "schema", "name": "Schema \u0026 documentation", "spree-commerce": 85, "square": 87, "weight": 13 }, { "by": 7, "edge": "spree-commerce", "key": "ergonomics", "name": "Agent ergonomics", "spree-commerce": 90, "square": 83, "weight": 13 }, { "by": 2, "edge": "square", "key": "security", "name": "Security \u0026 auth", "spree-commerce": 65, "square": 67, "weight": 14 }, { "by": 15, "edge": "spree-commerce", "key": "payments", "name": "Payments \u0026 pricing", "spree-commerce": 55, "square": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 0, "edge": "", "key": "maintenance", "name": "Maintenance \u0026 community", "spree-commerce": 81, "square": 81, "weight": 7 }, { "by": 10, "edge": "square", "key": "transparency", "name": "Transparency \u0026 trust", "spree-commerce": 60, "square": 70, "weight": 7 } ], "summary": "Spree Commerce scores 70.4 (BB) on agent readiness against Square's 69.2 (B), and leads in 3 of 7 scored categories. Square leads on transparency \u0026 trust. Both do commerce catalogues.", "verdicts": { "spree-commerce": "A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.", "square": "The REST API has a public OpenAPI 3.0 spec, OAuth scopes split by read and write for each resource, idempotency keys on writes and a free sandbox. The MCP server is in beta and its remote instance reaches production only. No numeric REST rate limits or SLA were found, and the status page recorded widespread errors on 27 September 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/spree-commerce-vs-square", "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-square.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/spree-commerce-vs-square.md", "slim": "https://www.anchorterminal.com/compare/spree-commerce-vs-square.min.md" }, "markdown": "Spree Commerce scores 70.4 (BB) on agent readiness against Square's 69.2 (B), and leads in 3 of 7 scored categories. Square leads on transparency \u0026 trust. Both do commerce catalogues.\n\n- Spree Commerce: grade BB, 70.4/100, rank #155 of 950. Markdown https://www.anchorterminal.com/tools/spree-commerce.md · JSON https://www.anchorterminal.com/api/v1/tools/spree-commerce.json\n- Square: grade B, 69.2/100, rank #195 of 950. Markdown https://www.anchorterminal.com/tools/square.md · JSON https://www.anchorterminal.com/api/v1/tools/square.json\n- Best commerce platforms and checkout APIs for AI agents: https://www.anchorterminal.com/best/commerce/index.md\n- All 136 commerce comparisons: https://www.anchorterminal.com/compare/commerce/index.md\n\n## Which one, for what\n\n### Spree Commerce (BB)\n\nGood for: Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST.\n\nAhead on:\n- Reliability, 82 against 58\n- Agent ergonomics, 90 against 83\n- Payments \u0026 pricing, 55 against 40\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n\nWatch for: Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses\n\n### Square (B)\n\nGood for: Agents working for a seller already on Square, on catalogue, inventory, orders, payment links and customers, online and in person.\n\nAhead on:\n- Transparency \u0026 trust, 70 against 60\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- No incidents deducted, where Spree Commerce loses 5 points for them\n\nWatch for: The MCP server is marked beta, and the remote server reaches production data only\n\n\n## Score by category\n\n| Category | Weight | Spree Commerce | Square | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 82 | 58 | Spree Commerce +24 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 87 | Square +2 |\n| Agent ergonomics | 13% (16.2 this run) | 90 | 83 | Spree Commerce +7 |\n| Security \u0026 auth | 14% (17.5 this run) | 65 | 67 | Square +2 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 55 | 40 | Spree Commerce +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 81 | 81 | even |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 70 | Square +10 |\n| Negative events | ≤15 | -5 | 0 | |\n| **Total** | | **70.4 · BB** | **69.2 · B** | |\n\n## Facts side by side\n\n| Fact | Spree Commerce | Square |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Vendo Connect Inc | Block, Inc. |\n| Hosted endpoint | no (local only) | `https://mcp.squareup.com/mcp` |\n| Transports | HTTP | HTTP, Streamable HTTP, stdio |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Pay per use |\n| x402 | no | no |\n| Licence | BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence | Proprietary service under the Square Developer Terms of Service. The MCP server and the OpenAPI specification on GitHub are Apache 2.0, and the Node.js SDK is MIT |\n| Tools exposed | none | 3 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| Last release | 2026-07-28 | 2026-09-16 |\n| Terms last updated | no document linked | 2026-09-10 |\n| Privacy policy last updated | no document linked | 2026-09-15 |\n| Customer content may train models | | not found in the text |\n| Terms restrict automated access | | yes |\n| Terms restrict benchmarking | | yes |\n| Terms or service can change without notice | | not found in the text |\n| Arbitration or class-action waiver | | yes |\n| Popularity | 16k stars, 1.6k npm/wk | 454k npm/wk, 72k PyPI/wk |\n\n## Verdicts\n\n**Spree Commerce.** A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.\n\n**Square.** The REST API has a public OpenAPI 3.0 spec, OAuth scopes split by read and write for each resource, idempotency keys on writes and a free sandbox. The MCP server is in beta and its remote instance reaches production only. No numeric REST rate limits or SLA were found, and the status page recorded widespread errors on 27 September 2026.\n\n## Before you call either\n\n### Spree Commerce\n\n1. Send a publishable key in `X-Spree-Api-Key` on every Store API call. Add `X-Spree-Token` with the cart token for guest carts, or a customer JWT as a Bearer token\n2. Send `Idempotency-Key` with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached\n3. Ask for `fields` and `expand` explicitly. Relations are left out by default and `limit` stops at 100\n4. Use a secret key with the narrowest scopes for the Admin API. `read_all` gives a read-only key, and the CLI's auto-minted local key is read-only\n5. Read the docs under `/docs/v5` for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments and splits carts from orders\n\n### Square\n\n1. Test against the sandbox first with the local MCP server and `SANDBOX=true`. The remote server at mcp.squareup.com reaches production only\n2. Set `DISALLOW_WRITES=true` on the local MCP server when the task only reads\n3. Call `get_service_info`, then `get_type_info`, before each `make_api_request`. The request body is otherwise untyped\n4. Send a fresh `idempotency_key` on every write, and reuse it when retrying the same write\n5. Pin `Square-Version` in each request. Use a page cursor within 5 minutes of receiving it\n\n## Questions\n\n### Which is better for AI agents, Spree Commerce or Square?\n\nSpree Commerce scores 70.4 (BB) on agent readiness against Square's 69.2 (B), and leads in 3 of 7 scored categories. Square leads on transparency \u0026 trust.\n\n### Do Spree Commerce and Square need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Spree Commerce and Square without installing anything?\n\nNo hosted endpoint is listed for Spree Commerce. Square has a hosted endpoint at https://mcp.squareup.com/mcp.\n\n### Are Spree Commerce and Square open source?\n\nSpree Commerce is open source (BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence). No open-source release is listed for Square.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/spree-commerce-vs-square.json, and with the fewest tokens: https://www.anchorterminal.com/compare/spree-commerce-vs-square.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"spree-commerce\", \"b\": \"square\"}`. From a terminal: `anchor compare spree-commerce square`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/spree-commerce.json and https://www.anchorterminal.com/api/v1/tools/square.json\n\n## Other comparisons with Spree Commerce or Square\n\n- [Adobe Commerce (Magento) vs Spree Commerce](https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.md)\n- [Adobe Commerce (Magento) vs Square](https://www.anchorterminal.com/compare/adobe-commerce-vs-square.md)\n- [BigCommerce API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce.md)\n- [BigCommerce API + MCP vs Square](https://www.anchorterminal.com/compare/bigcommerce-vs-square.md)\n- [Commerce Layer API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce.md)\n- [Commerce Layer API + MCP vs Square](https://www.anchorterminal.com/compare/commerce-layer-vs-square.md)\n- [commercetools vs Spree Commerce](https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce.md)\n- [commercetools vs Square](https://www.anchorterminal.com/compare/commercetools-vs-square.md)\n- [Ecwid by Lightspeed vs Spree Commerce](https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce.md)\n- [Ecwid by Lightspeed vs Square](https://www.anchorterminal.com/compare/ecwid-vs-square.md)\n- [Elastic Path API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce.md)\n- [Elastic Path API + MCP vs Square](https://www.anchorterminal.com/compare/elastic-path-vs-square.md)\n- [Medusa API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/medusa-vs-spree-commerce.md)\n- [Medusa API + MCP vs Square](https://www.anchorterminal.com/compare/medusa-vs-square.md)\n- [Saleor API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/saleor-vs-spree-commerce.md)\n- [Saleor API + MCP vs Square](https://www.anchorterminal.com/compare/saleor-vs-square.md)\n- [Shopify API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.md)\n- [Shopify API + MCP vs Square](https://www.anchorterminal.com/compare/shopify-vs-square.md)\n- [Shopware vs Spree Commerce](https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.md)\n- [Shopware vs Square](https://www.anchorterminal.com/compare/shopware-vs-square.md)\n- [Snipcart API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce.md)\n- [Snipcart API + MCP vs Square](https://www.anchorterminal.com/compare/snipcart-vs-square.md)\n- [Spree Commerce vs Swell](https://www.anchorterminal.com/compare/spree-commerce-vs-swell.md)\n- [Spree Commerce vs Vendure](https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.md)\n- [Spree Commerce vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/spree-commerce-vs-wix.md)\n- [Spree Commerce vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce.md)\n- [Square vs Swell](https://www.anchorterminal.com/compare/square-vs-swell.md)\n- [Square vs Vendure](https://www.anchorterminal.com/compare/square-vs-vendure.md)\n- [Square vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/square-vs-wix.md)\n- [Square vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/square-vs-woocommerce.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Spree Commerce vs Square", "url": "" } ], "description": "Spree Commerce scores 70.4 (BB) to Square's 69.2 (B) for commerce catalogues. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Spree Commerce BB 70.4", "Square B 69.2", "scores" ], "h1": "Spree Commerce vs Square", "image": "https://www.anchorterminal.com/assets/og/compare-spree-commerce-vs-square.png", "path": "/compare/spree-commerce-vs-square", "published": "2026-10-01", "section": "tools", "title": "Spree Commerce vs Square for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-square" }, "tokens": { "markdown": 2750, "slim": 780 }, "version": 1 }