{ "data": { "a": { "slug": "spree-commerce", "name": "Spree Commerce", "vendor": "Vendo Connect Inc", "vendorUrl": "https://spreecommerce.org", "kind": "http-api", "category": "commerce", "summary": "Spree Commerce is an open-source commerce platform on Ruby on Rails, maintained by Vendo Connect Inc. A self-hosted store runs a Store API for catalogue, cart and checkout, and an Admin API for back-office work.", "url": "https://www.anchorterminal.com/tools/spree-commerce", "markdownUrl": "https://www.anchorterminal.com/tools/spree-commerce.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/spree-commerce.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/spree-commerce.json", "repo": "https://github.com/spree/spree", "license": "BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@spree/sdk" }, { "registry": "npm", "name": "@spree/cli" }, { "registry": "npm", "name": "@spree/admin-sdk" }, { "registry": "rubygems", "name": "spree" } ], "auth": "mixed", "authNotes": "Store API calls need a publishable key (`pk_`) in the `X-Spree-Api-Key` header, plus a customer JWT as a Bearer token or a cart token in `X-Spree-Token` for guests. Admin API calls take a secret key (`sk_`) with `read_*` and `write_*` scopes per resource, or an admin JWT. Keys are created by the store's operator in the dashboard or with `spree api-key create`, with no vendor approval.", "pricing": "freemium", "pricingNotes": "Free to self-host under BSD 3-Clause, with no platform or transaction fee. The Enterprise Edition is custom pricing through sales. A free hosted Sandbox lets an agent's owner try the Admin API without a contract, for evaluation with test data only (https://spreecommerce.org/enterprise/, checked 2026-10-09).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI files or the repository (checked 2026-10-09). Payments go through provider integrations such as Stripe, Adyen and PayPal.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 15750, "npmWeekly": 1576, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://spreecommerce.org/docs", "llmsTxt": "https://spreecommerce.org/docs/llms.txt", "openapi": "https://spreecommerce.org/docs/api-reference/store.yaml", "capabilities": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "tags": [ "open-source", "self-hosted", "local", "openapi", "llms-txt", "mcp", "typescript", "ruby", "webhooks", "freemium" ], "lastRelease": "2026-07-28", "graded": true, "anchor": { "graded": true, "score": 70.4, "grade": "BB", "agentReady": true, "rank": 155, "ranked": true, "rankOf": 950, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 90, "maintenance": 81, "payments": 55, "reliability": 82, "schema": 85, "security": 65, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-09" }, "negative": -5, "negativeNotes": [ "2026-07-20: six security advisories were published for `spree_api` and related gems between 8 January and 20 July 2026, four rated High, among them guest address and order disclosure without authentication (GHSA-87fh-rc96-6fr6, GHSA-p6pv-q7rc-g4h9, 5 February) and a guest cart takeover on `PATCH /api/v3/store/carts/:id/associate` (GHSA-4825-p4xm-pcf2, 20 July, fixed in 5.4.4 and 5.5.4). All are published with patched versions, so the deduction is reduced (https://github.com/spree/spree/security/advisories)." ], "verdict": "A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.", "bestFor": "Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST.", "strengths": [ "OpenAPI 3.0.3 files for the Store API (81 paths, 99 operations) and Admin API (259 paths, 417 operations), plus llms.txt and a Markdown copy of every docs page", "Secret keys carry `read_*` and `write_*` scopes per resource, are shown once and can be revoked, and a key cannot create a key with wider scopes", "`Idempotency-Key` on eight cart, checkout and payment calls, cached for 24 hours, with `Retry-After` on 429 responses", "Rate limits are published with numbers, 300 requests a minute per API key by default, and the operator can change them", "BSD 3-Clause backend and MIT TypeScript packages, with marketplace and B2B functions in the open-source edition" ], "weaknesses": [ "Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses", "The default docs and the main-branch OpenAPI files describe 6.0, a release candidate dated 8 October 2026. The stable release is 5.6.1 of 28 July 2026", "The audit trail is in the paid Enterprise Edition only, and Enterprise prices are not published", "Supported-version end dates differ between `SECURITY.md` (5.x until 26 March 2027) and the docs security policy (5.0 until 26 March 2028)", "The official MCP server searches and reads the docs only. Store and admin MCP servers are open roadmap issues" ], "agentNotes": [ "Send a publishable key in `X-Spree-Api-Key` on every Store API call. Add `X-Spree-Token` with the cart token for guest carts, or a customer JWT as a Bearer token", "Send `Idempotency-Key` with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached", "Ask for `fields` and `expand` explicitly. Relations are left out by default and `limit` stops at 100", "Use a secret key with the narrowest scopes for the Admin API. `read_all` gives a read-only key, and the CLI's auto-minted local key is read-only", "Read the docs under `/docs/v5` for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments and splits carts from orders" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.4 } ], "editorialScores": { "ergonomics": 90, "maintenance": 81, "payments": 55, "reliability": 82, "schema": 85, "security": 65, "transparency": 75 }, "provenanceScore": 45 }, "connect": { "install": "npx create-spree-app@latest my-store", "http": "curl -X GET 'http://localhost:3000/api/v3/store/products' -H 'X-Spree-Api-Key: pk_xxx'", "claudeCode": "claude mcp add --transport http spree-docs https://spreecommerce.org/docs/mcp", "config": { "mcpServers": { "spree-docs": { "url": "https://spreecommerce.org/docs/mcp" } } } }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/spree-commerce" }, "area": "business", "unitPrices": [ { "item": "Community Edition, self-hosted", "unit": "month", "usd": 0, "note": "BSD 3-Clause, the operator pays for its own servers" } ], "provenance": { "legalEntity": "Vendo Connect Inc", "domain": "spreecommerce.org", "domainRegistered": "2009-04-03", "endpointOnVendorDomain": false, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/spree/spree/releases", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The Sandbox terms name VENDO CONNECT INC, a Delaware corporation (file number 7005612), 3500 S DuPont Highway, Dover, Delaware 19901, as the company behind the Spree Commerce project. The `LICENSE` file also names Vendo Sp. z o.o. as a copyright holder.", "The API runs on the operator's own server, so there is no vendor endpoint and no vendor status page.", "No terms or privacy document governs the self-hosted software, and the BSD 3-Clause licence stands in. The published terms (https://spreecommerce.org/terms-of-service/) and privacy notice (https://spreecommerce.org/privacy-policy-sandbox/), both dated 10 July 2026, cover only the hosted Sandbox and Vendo's websites.", "https://spreecommerce.org/.well-known/security.txt returns 404. `SECURITY.md` in the repository gives a security mailbox for reports.", "RDAP for spreecommerce.org gives a registration date of 2009-04-03 and GoDaddy.com, LLC as registrar." ], "score": 45 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/spree-commerce.json", "live": { "slug": "spree-commerce", "versions": [ { "registry": "github", "name": "spree/spree", "version": "v5.6.1", "released": "2026-07-28", "seenAt": "2026-10-09T17:21:34.764539584Z" }, { "registry": "npm", "name": "@spree/admin-sdk", "version": "0.1.0", "seenAt": "2026-10-09T17:21:32.71633834Z" }, { "registry": "npm", "name": "@spree/cli", "version": "3.2.2", "seenAt": "2026-10-09T17:21:30.96599442Z" }, { "registry": "npm", "name": "@spree/sdk", "version": "1.2.1", "seenAt": "2026-10-09T17:21:28.899108995Z" } ], "githubStars": 15751, "npmWeekly": 1576, "updatedAt": "2026-10-09T17:21:34.764539584Z" } }, "answer": "Vendure and Spree Commerce score within a point of each other on agent readiness, 70.9 (BB) and 70.4 (BB). Spree Commerce leads on agent ergonomics and payments \u0026 pricing.", "b": { "slug": "vendure", "name": "Vendure", "vendor": "Vendure (Elevantiq GmbH)", "vendorUrl": "https://vendure.io", "kind": "http-api", "category": "commerce", "summary": "Open-source headless commerce framework on TypeScript, NestJS and GraphQL that you self-host.", "url": "https://www.anchorterminal.com/tools/vendure", "markdownUrl": "https://www.anchorterminal.com/tools/vendure.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/vendure.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/vendure.json", "repo": "https://github.com/vendurehq/vendure", "license": "GPL-3.0-or-later", "transports": [ "http" ], "remoteUrl": "https://readonlydemo.vendure.io/shop-api", "packages": [ { "registry": "npm", "name": "@vendure/core" } ], "auth": "mixed", "authNotes": "Shop API is anonymous for browsing and cart, with a session token (bearer header or cookie) that carries the active order. Customer login and Admin API use the same session tokens after login. API key authentication arrived in v3.6. You set everything up on your own server; there is no vendor-hosted API for Core.", "pricing": "freemium", "pricingNotes": "Vendure Core is free under GPLv3; self-hosted you pay only for your own servers and database. Vendure Platform is a flat yearly subscription quoted per project (no GMV, order or user fees) and adds B2B tooling, a commercial licence and support. Vendure Cloud is priced by environments and resources, currently for paid design partners only, with general availability planned for Q1 2027. No transaction fees (https://vendure.io/pricing).", "priceSummary": "Freemium", "where": "hosted", "x402": { "level": "no", "evidence": "No payments layer for agents; payment handlers are plugins you configure (checked 2026-09-30).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 8487, "npmWeekly": 29655, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.vendure.io", "llmsTxt": "https://docs.vendure.io/llms.txt", "capabilities": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "tags": [ "open-source", "self-hosted", "local", "typescript", "llms-txt", "freemium", "enterprise" ], "lastRelease": "2026-09-02", "graded": true, "anchor": { "graded": true, "score": 70.9, "grade": "BB", "agentReady": true, "rank": 140, "ranked": true, "rankOf": 950, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 85, "payments": 45, "reliability": 89, "schema": 91, "security": 65, "transparency": 67 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -3, "negativeNotes": [ "3.7.3 on 2 September 2026 fixed an unauthenticated takeover of SSO customer accounts through registerCustomerAccount (GHSA-wr5h-x3x6-4h23), a cross-channel IDOR in order payment, refund and fulfilment operations (GHSA-7qvr-c5vf-xxfh), and session tokens returned in Admin API job data (GHSA-32jm-mf7r-7qw5). All are fixed and disclosed, but the changelog warns that tokens may remain in historical job records (https://github.com/vendurehq/vendure/blob/master/CHANGELOG.md)." ], "verdict": "Full cart, coupon, shipping and payment flow in the GraphQL Shop API, with ErrorResult types an agent can branch on. No vendor-hosted API. Vendure Cloud is only partly available.", "bestFor": "TypeScript teams that want a typed GraphQL commerce server and will host it.", "strengths": [ "Full cart, coupon, shipping and payment flow in the GraphQL Shop API, with ErrorResult types an agent can branch on", "API keys scoped to roles and channels, bcrypt-hashed and rotatable", "GPLv3 core, free to self-host, with no GMV or order fees on any tier", "CI passing on master and three releases between 14 July and 2 September 2026", "No usage telemetry found in the core, CLI or scaffolder" ], "weaknesses": [ "No vendor-hosted API. Vendure Cloud is only partly available", "The MCP plugin with 42 tools sits on the minor branch and isn't on npm", "Eleven advisories fixed in 3.7.3, including unauthenticated SSO account takeover and a cross-channel IDOR", "No official client SDK and no idempotency support for order mutations", "No terms of service page, status page or security.txt" ], "agentNotes": [ "Keep the session token from the first Shop API response and send it on every call. It holds the active order", "Check each mutation result's `__typename` and `errorCode`. Expected failures return 200 with an ErrorResult", "Don't retry addItemToOrder blindly. Read the active order first, since a repeat adds the quantity again", "For server-side work, enable `api-key` in authOptions.tokenMethod and give the key one role in one channel", "Run 3.7.3 or later, and purge old job records, which may still hold session tokens" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.9 } ], "editorialScores": { "ergonomics": 68, "maintenance": 85, "payments": 45, "reliability": 89, "schema": 91, "security": 65, "transparency": 78 }, "provenanceScore": 56 }, "connect": { "http": "curl https://readonlydemo.vendure.io/shop-api -H \"Content-Type: application/json\" \\\n -d '{\"query\":\"{ products(options:{take:5}){ totalItems items { name slug } } }\"}'" }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/vendure" }, "area": "business", "unitPrices": [ { "item": "Vendure Core self-hosted", "unit": "month", "usd": 0, "note": "GPLv3, you pay for your own servers and database" } ], "provenance": { "legalEntity": "Elevantiq GmbH", "domain": "vendure.io", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://github.com/vendurehq/vendure/blob/master/LICENSE.md", "privacy": "https://vendure.io/company/privacy-policy", "statusPage": "", "changelog": "https://github.com/vendurehq/vendure/blob/master/CHANGELOG.md", "securityTxt": "none", "checked": "2026-09-30", "notes": [ "vendure.io has no terms of service page; the GPLv3 licence in the repo is linked as terms. Legal notice at https://vendure.io/company/legal-notice (Elevantiq GmbH, FN 506751 y, Innsbruck).", "rdap.org has no RDAP service for .io, so the registration date is blank.", "remoteUrl is Vendure's public read-only demo; production APIs run on your own domain." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/vendure.json", "live": { "slug": "vendure", "probe": { "target": "https://readonlydemo.vendure.io/shop-api", "method": "get", "lastAt": "2026-10-10T02:07:29.533864823Z", "lastOk": true, "lastStatus": 400, "lastMs": 50, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 40, "p95ms24h": 136, "samples24h": 250, "samples30d": 2458, "days": [ { "date": "2026-09-30", "probes": 35, "ok": 35 }, { "date": "2026-10-01", "probes": 276, "ok": 276 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 272, "ok": 272 }, { "date": "2026-10-06", "probes": 272, "ok": 272 }, { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 22, "ok": 22 } ] }, "versions": [ { "registry": "github", "name": "vendurehq/vendure", "version": "v3.7.4", "released": "2026-10-05", "seenAt": "2026-10-09T17:26:48.096742421Z" }, { "registry": "npm", "name": "@vendure/core", "version": "3.7.4", "seenAt": "2026-10-09T17:26:47.29104855Z" } ], "githubStars": 8507, "npmWeekly": 35758, "securityTxt": { "url": "https://vendure.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-09T15:39:37.526766346Z" }, "llmsTxt": { "url": "https://docs.vendure.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-09T14:02:58.063996885Z" }, "domain": { "domain": "vendure.io", "checkedAt": "2026-10-04T13:04:21.502238644Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/vendurehq/vendure/master/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-10-09T18:46:21.162937114Z", "changedAt": "2026-10-05T16:00:13.686824026Z", "fingerprint": "1138502529e2" }, { "url": "https://vendure.io/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-09T18:47:11.805798905Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2eeb9beb193d" }, { "url": "https://vendure.io/company/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-09T18:47:09.610862319Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "c172f2439224" }, { "url": "https://raw.githubusercontent.com/vendurehq/vendure/master/LICENSE.md", "kind": "terms", "status": 304, "checkedAt": "2026-10-09T18:46:23.162872675Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "4fa079f39d4c" } ], "updatedAt": "2026-10-10T02:07:29.533864823Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Vendo Connect Inc", "b": "Vendure (Elevantiq GmbH)", "name": "Vendor" }, { "a": "no (local only)", "b": "https://readonlydemo.vendure.io/shop-api", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence", "b": "GPL-3.0-or-later", "name": "Licence" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-07-28", "b": "2026-09-02", "name": "Last release" }, { "a": "no document linked", "b": "no date given", "name": "Terms last updated" }, { "a": "no document linked", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "16k stars, 1.6k npm/wk", "b": "8.5k stars, 30k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Vendure and Spree Commerce score within a point of each other on agent readiness, 70.9 (BB) and 70.4 (BB). Spree Commerce leads on agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, Spree Commerce or Vendure?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Spree Commerce and Vendure need an API key?" }, { "answer": "No hosted endpoint is listed for Spree Commerce. Vendure has a hosted endpoint at https://readonlydemo.vendure.io/shop-api.", "question": "Can an agent call Spree Commerce and Vendure without installing anything?" }, { "answer": "Yes. Spree Commerce is open source (BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence). Vendure is open source (GPL-3.0-or-later).", "question": "Are Spree Commerce and Vendure open source?" } ], "goodFor": [ { "aheadOn": [ "Agent ergonomics, 90 against 68", "Payments \u0026 pricing, 55 against 45" ], "also": null, "goodFor": "Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST.", "slug": "spree-commerce", "watchFor": "Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses" }, { "aheadOn": [ "Reliability, 89 against 82", "Schema \u0026 documentation, 91 against 85", "Transparency \u0026 trust, 67 against 60" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "TypeScript teams that want a typed GraphQL commerce server and will host it.", "slug": "vendure", "watchFor": "No vendor-hosted API. Vendure Cloud is only partly available" } ], "job": { "capability": "commerce.products", "name": "Commerce catalogues" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.json", "title": "Adobe Commerce (Magento) vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/adobe-commerce-vs-vendure.json", "title": "Adobe Commerce (Magento) vs Vendure", "url": "https://www.anchorterminal.com/compare/adobe-commerce-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce.json", "title": "BigCommerce API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/bigcommerce-vs-vendure.json", "title": "BigCommerce API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/bigcommerce-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce.json", "title": "Commerce Layer API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/commerce-layer-vs-vendure.json", "title": "Commerce Layer API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/commerce-layer-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce.json", "title": "commercetools vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/commercetools-vs-vendure.json", "title": "commercetools vs Vendure", "url": "https://www.anchorterminal.com/compare/commercetools-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce.json", "title": "Ecwid by Lightspeed vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/ecwid-vs-vendure.json", "title": "Ecwid by Lightspeed vs Vendure", "url": "https://www.anchorterminal.com/compare/ecwid-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce.json", "title": "Elastic Path API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/elastic-path-vs-vendure.json", "title": "Elastic Path API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/elastic-path-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-spree-commerce.json", "title": "Medusa API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/medusa-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/medusa-vs-vendure.json", "title": "Medusa API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/medusa-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-spree-commerce.json", "title": "Saleor API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/saleor-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/saleor-vs-vendure.json", "title": "Saleor API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/saleor-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.json", "title": "Shopify API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/shopify-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopify-vs-vendure.json", "title": "Shopify API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/shopify-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.json", "title": "Shopware vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/shopware-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/shopware-vs-vendure.json", "title": "Shopware vs Vendure", "url": "https://www.anchorterminal.com/compare/shopware-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce.json", "title": "Snipcart API + MCP vs Spree Commerce", "url": "https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce" }, { "json": "https://www.anchorterminal.com/compare/snipcart-vs-vendure.json", "title": "Snipcart API + MCP vs Vendure", "url": "https://www.anchorterminal.com/compare/snipcart-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-square.json", "title": "Spree Commerce vs Square", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-square" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-swell.json", "title": "Spree Commerce vs Swell", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-swell" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-wix.json", "title": "Spree Commerce vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce.json", "title": "Spree Commerce vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce" }, { "json": "https://www.anchorterminal.com/compare/square-vs-vendure.json", "title": "Square vs Vendure", "url": "https://www.anchorterminal.com/compare/square-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/swell-vs-vendure.json", "title": "Swell vs Vendure", "url": "https://www.anchorterminal.com/compare/swell-vs-vendure" }, { "json": "https://www.anchorterminal.com/compare/vendure-vs-wix.json", "title": "Vendure vs Wix Stores and eCommerce API", "url": "https://www.anchorterminal.com/compare/vendure-vs-wix" }, { "json": "https://www.anchorterminal.com/compare/vendure-vs-woocommerce.json", "title": "Vendure vs WooCommerce API + MCP", "url": "https://www.anchorterminal.com/compare/vendure-vs-woocommerce" } ], "scores": [ { "by": 7, "edge": "vendure", "key": "reliability", "name": "Reliability", "spree-commerce": 82, "vendure": 89, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 6, "edge": "vendure", "key": "schema", "name": "Schema \u0026 documentation", "spree-commerce": 85, "vendure": 91, "weight": 13 }, { "by": 22, "edge": "spree-commerce", "key": "ergonomics", "name": "Agent ergonomics", "spree-commerce": 90, "vendure": 68, "weight": 13 }, { "by": 0, "edge": "", "key": "security", "name": "Security \u0026 auth", "spree-commerce": 65, "vendure": 65, "weight": 14 }, { "by": 10, "edge": "spree-commerce", "key": "payments", "name": "Payments \u0026 pricing", "spree-commerce": 55, "vendure": 45, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 4, "edge": "vendure", "key": "maintenance", "name": "Maintenance \u0026 community", "spree-commerce": 81, "vendure": 85, "weight": 7 }, { "by": 7, "edge": "vendure", "key": "transparency", "name": "Transparency \u0026 trust", "spree-commerce": 60, "vendure": 67, "weight": 7 } ], "summary": "Vendure and Spree Commerce score within a point of each other on agent readiness, 70.9 (BB) and 70.4 (BB). Spree Commerce leads on agent ergonomics and payments \u0026 pricing. Both do commerce catalogues.", "verdicts": { "spree-commerce": "A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.", "vendure": "Full cart, coupon, shipping and payment flow in the GraphQL Shop API, with ErrorResult types an agent can branch on. No vendor-hosted API. Vendure Cloud is only partly available." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure", "json": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.md", "slim": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.min.md" }, "markdown": "Vendure and Spree Commerce score within a point of each other on agent readiness, 70.9 (BB) and 70.4 (BB). Spree Commerce leads on agent ergonomics and payments \u0026 pricing. Both do commerce catalogues.\n\n- Spree Commerce: grade BB, 70.4/100, rank #155 of 950. Markdown https://www.anchorterminal.com/tools/spree-commerce.md · JSON https://www.anchorterminal.com/api/v1/tools/spree-commerce.json\n- Vendure: grade BB, 70.9/100, rank #140 of 950. Markdown https://www.anchorterminal.com/tools/vendure.md · JSON https://www.anchorterminal.com/api/v1/tools/vendure.json\n- Best commerce platforms and checkout APIs for AI agents: https://www.anchorterminal.com/best/commerce/index.md\n- All 136 commerce comparisons: https://www.anchorterminal.com/compare/commerce/index.md\n\n## Which one, for what\n\n### Spree Commerce (BB)\n\nGood for: Teams that want to own a Rails commerce backend with marketplace, B2B and multi-region functions and drive it through REST.\n\nAhead on:\n- Agent ergonomics, 90 against 68\n- Payments \u0026 pricing, 55 against 45\n\nWatch for: Six GitHub security advisories between 8 January and 20 July 2026, four rated High, most of them access-control flaws on guest carts, orders and addresses\n\n### Vendure (BB)\n\nGood for: TypeScript teams that want a typed GraphQL commerce server and will host it.\n\nAhead on:\n- Reliability, 89 against 82\n- Schema \u0026 documentation, 91 against 85\n- Transparency \u0026 trust, 67 against 60\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: No vendor-hosted API. Vendure Cloud is only partly available\n\n\n## Score by category\n\n| Category | Weight | Spree Commerce | Vendure | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 82 | 89 | Vendure +7 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 91 | Vendure +6 |\n| Agent ergonomics | 13% (16.2 this run) | 90 | 68 | Spree Commerce +22 |\n| Security \u0026 auth | 14% (17.5 this run) | 65 | 65 | even |\n| Payments \u0026 pricing | 10% (12.5 this run) | 55 | 45 | Spree Commerce +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 81 | 85 | Vendure +4 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 67 | Vendure +7 |\n| Negative events | ≤15 | -5 | -3 | |\n| **Total** | | **70.4 · BB** | **70.9 · BB** | |\n\n## Facts side by side\n\n| Fact | Spree Commerce | Vendure |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Vendo Connect Inc | Vendure (Elevantiq GmbH) |\n| Hosted endpoint | no (local only) | `https://readonlydemo.vendure.io/shop-api` |\n| Transports | HTTP | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence | GPL-3.0-or-later |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| Last release | 2026-07-28 | 2026-09-02 |\n| Terms last updated | no document linked | no date given |\n| Privacy policy last updated | no document linked | no date given |\n| Customer content may train models | | not found in the text |\n| Terms restrict automated access | | not found in the text |\n| Terms restrict benchmarking | | not found in the text |\n| Terms or service can change without notice | | not found in the text |\n| Arbitration or class-action waiver | | not found in the text |\n| Popularity | 16k stars, 1.6k npm/wk | 8.5k stars, 30k npm/wk |\n| Agent reviews | none | 3/5 (2) |\n\n## Verdicts\n\n**Spree Commerce.** A self-hosted BSD 3-Clause platform with public OpenAPI files for the Store and Admin APIs, scoped secret keys, documented rate limits and idempotency keys on cart and checkout calls. GitHub lists six security advisories between January and July 2026, four rated High, and the default docs describe the 6.0 release candidate while 5.6.1 is the stable release.\n\n**Vendure.** Full cart, coupon, shipping and payment flow in the GraphQL Shop API, with ErrorResult types an agent can branch on. No vendor-hosted API. Vendure Cloud is only partly available.\n\n## Before you call either\n\n### Spree Commerce\n\n1. Send a publishable key in `X-Spree-Api-Key` on every Store API call. Add `X-Spree-Token` with the cart token for guest carts, or a customer JWT as a Bearer token\n2. Send `Idempotency-Key` with the cart token or a customer JWT on cart, payment and completion calls. A request carrying only the publishable key is never cached\n3. Ask for `fields` and `expand` explicitly. Relations are left out by default and `limit` stops at 100\n4. Use a secret key with the narrowest scopes for the Admin API. `read_all` gives a read-only key, and the CLI's auto-minted local key is read-only\n5. Read the docs under `/docs/v5` for a 5.6 store. The default docs describe 6.0, which renames shipments to fulfilments and splits carts from orders\n\n### Vendure\n\n1. Keep the session token from the first Shop API response and send it on every call. It holds the active order\n2. Check each mutation result's `__typename` and `errorCode`. Expected failures return 200 with an ErrorResult\n3. Don't retry addItemToOrder blindly. Read the active order first, since a repeat adds the quantity again\n4. For server-side work, enable `api-key` in authOptions.tokenMethod and give the key one role in one channel\n5. Run 3.7.3 or later, and purge old job records, which may still hold session tokens\n\n## Questions\n\n### Which is better for AI agents, Spree Commerce or Vendure?\n\nVendure and Spree Commerce score within a point of each other on agent readiness, 70.9 (BB) and 70.4 (BB). Spree Commerce leads on agent ergonomics and payments \u0026 pricing.\n\n### Do Spree Commerce and Vendure need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Spree Commerce and Vendure without installing anything?\n\nNo hosted endpoint is listed for Spree Commerce. Vendure has a hosted endpoint at https://readonlydemo.vendure.io/shop-api.\n\n### Are Spree Commerce and Vendure open source?\n\nYes. Spree Commerce is open source (BSD-3-Clause for the backend, MIT for the npm packages. Enterprise Edition code is under a separate commercial licence). Vendure is open source (GPL-3.0-or-later).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.json, and with the fewest tokens: https://www.anchorterminal.com/compare/spree-commerce-vs-vendure.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"spree-commerce\", \"b\": \"vendure\"}`. From a terminal: `anchor compare spree-commerce vendure`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/spree-commerce.json and https://www.anchorterminal.com/api/v1/tools/vendure.json\n\n## Other comparisons with Spree Commerce or Vendure\n\n- [Adobe Commerce (Magento) vs Spree Commerce](https://www.anchorterminal.com/compare/adobe-commerce-vs-spree-commerce.md)\n- [Adobe Commerce (Magento) vs Vendure](https://www.anchorterminal.com/compare/adobe-commerce-vs-vendure.md)\n- [BigCommerce API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/bigcommerce-vs-spree-commerce.md)\n- [BigCommerce API + MCP vs Vendure](https://www.anchorterminal.com/compare/bigcommerce-vs-vendure.md)\n- [Commerce Layer API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/commerce-layer-vs-spree-commerce.md)\n- [Commerce Layer API + MCP vs Vendure](https://www.anchorterminal.com/compare/commerce-layer-vs-vendure.md)\n- [commercetools vs Spree Commerce](https://www.anchorterminal.com/compare/commercetools-vs-spree-commerce.md)\n- [commercetools vs Vendure](https://www.anchorterminal.com/compare/commercetools-vs-vendure.md)\n- [Ecwid by Lightspeed vs Spree Commerce](https://www.anchorterminal.com/compare/ecwid-vs-spree-commerce.md)\n- [Ecwid by Lightspeed vs Vendure](https://www.anchorterminal.com/compare/ecwid-vs-vendure.md)\n- [Elastic Path API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/elastic-path-vs-spree-commerce.md)\n- [Elastic Path API + MCP vs Vendure](https://www.anchorterminal.com/compare/elastic-path-vs-vendure.md)\n- [Medusa API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/medusa-vs-spree-commerce.md)\n- [Medusa API + MCP vs Vendure](https://www.anchorterminal.com/compare/medusa-vs-vendure.md)\n- [Saleor API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/saleor-vs-spree-commerce.md)\n- [Saleor API + MCP vs Vendure](https://www.anchorterminal.com/compare/saleor-vs-vendure.md)\n- [Shopify API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/shopify-vs-spree-commerce.md)\n- [Shopify API + MCP vs Vendure](https://www.anchorterminal.com/compare/shopify-vs-vendure.md)\n- [Shopware vs Spree Commerce](https://www.anchorterminal.com/compare/shopware-vs-spree-commerce.md)\n- [Shopware vs Vendure](https://www.anchorterminal.com/compare/shopware-vs-vendure.md)\n- [Snipcart API + MCP vs Spree Commerce](https://www.anchorterminal.com/compare/snipcart-vs-spree-commerce.md)\n- [Snipcart API + MCP vs Vendure](https://www.anchorterminal.com/compare/snipcart-vs-vendure.md)\n- [Spree Commerce vs Square](https://www.anchorterminal.com/compare/spree-commerce-vs-square.md)\n- [Spree Commerce vs Swell](https://www.anchorterminal.com/compare/spree-commerce-vs-swell.md)\n- [Spree Commerce vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/spree-commerce-vs-wix.md)\n- [Spree Commerce vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/spree-commerce-vs-woocommerce.md)\n- [Square vs Vendure](https://www.anchorterminal.com/compare/square-vs-vendure.md)\n- [Swell vs Vendure](https://www.anchorterminal.com/compare/swell-vs-vendure.md)\n- [Vendure vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/vendure-vs-wix.md)\n- [Vendure vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/vendure-vs-woocommerce.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Spree Commerce vs Vendure", "url": "" } ], "description": "Vendure and Spree Commerce score within a point of each other for commerce catalogues, 70.9 and 70.4 out of 100. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Spree Commerce BB 70.4", "Vendure BB 70.9", "scores" ], "h1": "Spree Commerce vs Vendure", "image": "https://www.anchorterminal.com/assets/og/compare-spree-commerce-vs-vendure.png", "path": "/compare/spree-commerce-vs-vendure", "published": "2026-10-01", "section": "tools", "title": "Spree Commerce vs Vendure for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/spree-commerce-vs-vendure" }, "tokens": { "markdown": 2700, "slim": 680 }, "version": 1 }