{
 "categories": [
  "commerce",
  "developer-tools"
 ],
 "deployment": "hybrid",
 "evidence": [
  {
   "date": "2026-10-16",
   "fact": "homepage",
   "note": "The Medusa Cloud guide describes the Medusa MCP server for commerce data in applications deployed on Cloud.",
   "source": "https://docs.medusajs.com/cloud/medusa-mcp",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "name",
   "note": "The product name on the guide is Medusa.",
   "source": "https://docs.medusajs.com/cloud/medusa-mcp",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "vendor",
   "note": "The plugin README is in the medusajs organization and points at the Cloud MCP. GitHub reported the medusa repository pushed on 2026-10-15 and archived false.",
   "source": "https://github.com/medusajs/medusa-mcp-plugin",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "license",
   "note": "The medusajs/medusa LICENSE file is the MIT License, copyright 2021 Medusajs.",
   "source": "https://raw.githubusercontent.com/medusajs/medusa/master/LICENSE",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "deployment",
   "note": "The CLI page describes a Medusa application directory the developer runs, and says Medusa Cloud is the deployment path for production infrastructure. The product is hybrid.",
   "source": "https://docs.medusajs.com/resources/medusa-cli",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.exists",
   "note": "Medusa documents /admin routes for authenticated admin users and store routes such as /store/customers/me for authenticated customers.",
   "source": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.kinds[0]",
   "note": "The Cloud guide describes Admin and Store API routes and custom GET routes under /admin and /store. Those are HTTP resource routes.",
   "source": "https://docs.medusajs.com/cloud/medusa-mcp",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.auth[0]",
   "note": "The authenticate middleware accepts session for user and customer actors.",
   "source": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.auth[1]",
   "note": "The same middleware accepts bearer for user and customer actors.",
   "source": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.auth[2]",
   "note": "The page says the admin scope also supports the api-key authentication method. The example middleware list for a user route includes api-key.",
   "source": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.coverage",
   "note": "Protected routes are the path for actions such as creating a product or managing an order. This pass did not open the full Admin route index, so coverage is partial.",
   "source": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.docs",
   "note": "Opened as the current protected-routes guide. It links the Admin and Store authentication references.",
   "source": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.sdk.exists",
   "note": "The CLI reference lists a JS SDK for storefronts, admin dashboards, and Admin extensions.",
   "source": "https://docs.medusajs.com/resources/medusa-cli",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.sdk.languages[0]",
   "note": "The listed SDK is the JS SDK.",
   "source": "https://docs.medusajs.com/resources/medusa-cli",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.sdk.official",
   "note": "The JS SDK is listed in Medusa's own CLI reference as a Medusa SDK.",
   "source": "https://docs.medusajs.com/resources/medusa-cli",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.mcp.first_party",
   "note": "Medusa documents a remote MCP server at https://cloud.medusajs.com/mcp with OAuth. It is read-only, on all Cloud plans, and requires Medusa v2.12.4 or later.",
   "source": "https://docs.medusajs.com/cloud/medusa-mcp",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.mcp.verdict",
   "note": "Tools include list_connected_environments, find_commerce_api, describe_commerce_api, and read_admin_api. The guide also distinguishes the docs MCP at https://docs.medusajs.com/mcp.",
   "source": "https://docs.medusajs.com/cloud/medusa-mcp",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.cli.exists",
   "note": "Medusa documents npx medusa in an application directory for setup and database commands.",
   "source": "https://docs.medusajs.com/resources/medusa-cli",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "Opened the docs index. It links the Cloud MCP guide, the API reference index, and the CLI.",
   "source": "https://docs.medusajs.com/llms.txt",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "verdict.scores.api",
   "note": "Documented Admin and Store HTTP routes with session, bearer, and API-key auth are a practical write path. The unread full route index keeps the score at 7.",
   "source": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "verdict.scores.mcp",
   "note": "An official hosted server exists, but it is read-only, Cloud-only, and version-gated. That is a limited official server, score 5.",
   "source": "https://docs.medusajs.com/cloud/medusa-mcp",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "verdict.scores.cli",
   "note": "The official CLI is for development setup and database tasks. It is not the documented store read and write client. Score 4.",
   "source": "https://docs.medusajs.com/resources/medusa-cli",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as the current Medusa Cloud MCP guide.",
   "source": "https://docs.medusajs.com/cloud/medusa-mcp",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as the current protected API routes guide.",
   "source": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current Medusa CLI reference.",
   "source": "https://docs.medusajs.com/resources/medusa-cli",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current Medusa documentation index.",
   "source": "https://docs.medusajs.com/llms.txt",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-10-16",
  "volatility": "high",
  "watch": [
   {
    "type": "mcp",
    "url": "https://docs.medusajs.com/cloud/medusa-mcp"
   },
   {
    "type": "docs",
    "url": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes"
   },
   {
    "type": "cli",
    "url": "https://docs.medusajs.com/resources/medusa-cli"
   },
   {
    "type": "docs",
    "url": "https://docs.medusajs.com/llms.txt"
   }
  ]
 },
 "homepage": "https://docs.medusajs.com/cloud/medusa-mcp",
 "id": "medusa",
 "license": "open-source",
 "modalities": {
  "agent_docs": {
   "llms_txt": true
  },
  "api": {
   "auth": [
    "session",
    "bearer",
    "api-key"
   ],
   "coverage": "partial",
   "docs": "https://docs.medusajs.com/learn/fundamentals/api-routes/protected-routes",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [],
   "import": []
  },
  "extensibility": {
   "scripting": [],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. Medusa Admin is a web application. The documented machine paths are the Admin and Store APIs, the Medusa CLI, and the read-only Cloud MCP server. This record is not Shopify.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": true,
   "languages": [
    "javascript"
   ],
   "official": true
  }
 },
 "name": "Medusa",
 "platforms": [
  "web"
 ],
 "related": {
  "alternatives": [
   "shopify"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Medusa",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 7,
   "cli": 4,
   "computer_use": null,
   "integrations": null,
   "mcp": 5,
   "overall": 7,
   "rpa": null
  },
  "search": {
   "description": "Medusa documents Admin and Store APIs with session, bearer, and API-key auth. The Cloud MCP is read-only.",
   "title": "Medusa is automatable through its Admin API"
  },
  "summary": "Medusa is automatable today through its Admin and Store APIs. The framework documents protected /admin routes for authenticated admin users and protected customer routes such as /store/customers/me. The authenticate middleware accepts session, bearer, and, for admin users, api-key. Creating a product or managing an order is the example of work that requires that authentication. The JS SDK is the documented client SDK. The Medusa CLI is invoked with npx medusa and is documented for project setup and database tasks, not as a store-operations client. Medusa Cloud adds a remote MCP server at https://cloud.medusajs.com/mcp. It uses OAuth, is read-only, is available on all Cloud plans, and needs Medusa v2.12.4 or later. It can GET Admin routes as the admin user and Store routes as a guest, including custom GET routes under /admin and /store. Environments built before 8 October 2026 need a new build before routes are indexed. A separate docs MCP at https://docs.medusajs.com/mcp answers documentation questions. The application repository is MIT. Zapier, Make, Power Automate, and n8n were not opened. Computer-use viability is unassessed. The API scores 7, the Cloud MCP scores 5, and the CLI scores 4. The API is the best path because it can write and it is not limited to Medusa Cloud.\n"
 }
}