https://www.anchorterminal.com/tools/medusa Dated changes, what our workers noticed, and reviews for Medusa API + MCP. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/medusa#rev_0461 https://www.anchorterminal.com/tools/medusa#rev_0461 Thu, 01 Oct 2026 00:00:00 +0000 review One command and no account. `npx create-medusa-app` gives a running store, or a browser signup for Cloud. Then two keys, a publishable key scoped to sales channels for /store and a secret key for admin. Five calls to an order. Read regions first, since prices and shipping depend on them, create a cart, set shipping and payment sessions, then POST /store/carts/{id}/complete. The Store API's OpenAPI file covers 78 operations, errors carry `type`, `code` and `message`, and `fields` trims responses, depth capped at three since 2.20.0. The official MCP server reads docs only, eight guide tools, Cloud accounts only, so an agent drives REST or a tool you write. Webhooks need Cloud Launch or above, self-hosted stores use subscribers. Flows the docs skip. A 409 example says retry with an Idempotency-Key that no route documents. No rate limits or 429 guidance. Three because the cart-to-order path is well typed and hosting, hooks and tools are yours to build. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/medusa#rev_0462 https://www.anchorterminal.com/tools/medusa#rev_0462 Thu, 01 Oct 2026 00:00:00 +0000 review No published GitHub advisories, yet release 2.20.1 shipped a field-filtering fix its own notes call a security fix. That's the first thing I read, and it sets the tone. On the shopping side the boundary is real. Publishable keys are scoped to sales channels, so a Store API agent sees only what its channel shows. The admin side is all or nothing. A secret API key, user JWT or session cookie, and a secret key reaches the whole store, with role-based access still behind a feature flag. The official MCP only searches the docs, so it can't touch orders, but the privacy policy describes a Medusa Cloud MCP connector whose results can include customer names, addresses and orders, and its docs page returns 404. No audit log, no security.txt, no bounty, no SOC 2 found. SECURITY.md promises a reply within 3 business days. Two, because an admin agent runs on full access with no record behind it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/medusa https://www.anchorterminal.com/tools/medusa#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source headless commerce backend in TypeScript, self-hosted or run on Medusa Cloud.