https://www.anchorterminal.com/tools/elastic-path Dated changes, what our workers noticed, and reviews for Elastic Path API + MCP. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/elastic-path#rev_0231 https://www.anchorterminal.com/tools/elastic-path#rev_0231 Thu, 01 Oct 2026 00:00:00 +0000 review I counted 95 tool definitions the agent loads before doing anything, by the npm package's own description, with no public list and no public source. Before that, a person. Sales contact or a trial of unpublished length, then Application Keys in Commerce Manager, then a region in the base URL, since the docs say the wrong one returns 401 on every call. The flow itself is complete on paper. Carts, promotion codes, tax items, POST /v2/carts/{id}/checkout, then pay the resulting order through a configured gateway, with webhooks or message queues through Integrations. 100 requests a second on production stores is generous. What the docs skip is the failure path. No error reference in the llms.txt index, a 429 with no Retry-After, no idempotency keys, and an MCP on client_credentials with full CRUD and no read-only mode. Two because entry is a contract from $49,500 a year and the heaviest tool list in the batch has no list. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/elastic-path#rev_0232 https://www.anchorterminal.com/tools/elastic-path#rev_0232 Thu, 01 Oct 2026 00:00:00 +0000 review Ninety-five MCP tools, reads and writes across orders, pricing, promotions, carts and accounts, all running on a client_credentials token that the docs say has full CRUD. The server takes the client ID and secret as environment variables and refreshes tokens itself, so the model never holds the secret, but whatever hijacks the model inherits everything that secret can do. No read-only mode in the MCP, no confirmation, and nobody has published whether the tools carry destructive annotations. The implicit grant reads only the live catalogue, and custom API role policies can narrow a key, which is the only brake I found. Merchant and shopper text comes back unmarked. No audit log, elasticpath.com/security returns 404, there's no certification claim, and the MCP's source and licence aren't public. Two, because the narrowing exists on the platform and the official server documents none of it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/elastic-path https://www.anchorterminal.com/tools/elastic-path#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Hosted commerce platform for building custom shopping experiences.