Adam vs Onshape

Adam 82

The docs name 15 adam_ tools plus displayFile and loadSkill, so 11 to 30 (15), and task tools are discovered per task with adam_list_task_tools rather than listed up front, which earns 8 back (23 of 25). Cursor pagination with limit 1 to 50, status and project filters on tasks, and message parts that admins can trim, though results of tool calls may be truncated without a size control (18 of 20). One error envelope with type, message and requestId, 402 and 403 that name the plan or scope at fault, and a recovery table for each direct-tool failure (18 of 20). Idempotency-Key required on every write that starts work, a 24-hour replay, cancel documented as safe to repeat, and an unknown status that tells the agent to inspect before retrying; deletes need confirmation, but readOnlyHint and destructiveHint annotations were not confirmed since tools/list was not read (16 of 20). Few required parameters, but no official SDK in any language (7 of 15). 23 + 18 + 18 + 16 + 7 = 82.

Onshape 46

Document and element endpoints take ids and the list endpoints take limit and offset, with no field selection documented in what we read; the MCP server's tool count is unknown (12 of 25). Pagination and filters on document lists, and revisions page (a paging loop was fixed in rel-1.219) (14 of 20). HTTP codes with 401, 402 and 429 meanings; the error body shape was on the unread response codes page (10 of 20). No idempotency keys; POSTs create microversions on every edit; no readOnlyHint or destructiveHint published for the MCP tools (2 of 20). Every API key request needs a Date header, a nonce and an HMAC-SHA256 signature, and 307 redirects need a new signature; official Go and TypeScript clients handle it (8 of 15). 12 + 14 + 10 + 2 + 8 = 46.

Adam 35

Read with the hosted lines. status.adam.new exists and is linked from the docs, but it loads its components and history by script and nothing readable was served, so the page counts for half (10 of 20) and the incident record is unread (5). Rate limits are documented as two refilling buckets reported in RateLimit, RateLimit-Policy and X-RateLimit headers, with no numeric quota published (5 of 15). 429 carries Retry-After, and Idempotency-Key is required on task creation, messages and tool calls and replayed for 24 hours (15). No SLA found (0). The MCP server and the REST API are labelled beta, with breaking changes allowed (0 of 10). 10 + 5 + 5 + 15 + 0 + 0 = 35.

Onshape 60

Read with the hosted lines on cad.onshape.com. Atlassian Statuspage at status.onshape.com with regional CAD service components and history feeds (20). The feed holds 18 incidents from 15 August to 30 October 2026, all degraded performance, delayed imports and exports or partial signup blocks, the longest 2 hours 42 minutes of export degradation on 15 September and imports, exports and notifications not working for 1 hour 42 minutes on 11 September; no full outage of the CAD service (18 of 30). Annual API call quotas are published per plan with numbers, while per-endpoint rate limits are said to vary by endpoint with no figure (8 of 15). 429 is documented without a header or backoff timing, 402 marks a spent quota, and no idempotency guidance was found (6 of 15). The terms promise commercially reasonable efforts and no SLA (0). The REST API is generally available; the FeatureScript MCP Server is an early-access Labs feature (8 of 10). 20 + 18 + 8 + 6 + 0 + 8 = 60.

Adam 55

Read for a closed service. The changelog's newest entry is 10 September 2026, 54 days before this check (20). Entries dated 7, 10, 11 and 25 August and 4 to 10 September 2026, more than three in 90 days (20). A public changelog, hello@adam.new, a Discord and the CADAM repository with 26 open issues, which were not read for replies (10 of 15). The manifest follows the registry schema but new.adam/adam is not in the official MCP registry, and there is no official SDK (0 of 15). CADAM was pushed on 15 October 2026 and the service itself has no package to judge (5 of 10). 20 + 20 + 10 + 0 + 5 = 55.

Onshape 79

Read for a closed service. API release notes rel-1.223 dated 30 October 2026 (30). Six dated releases from 17 July to 30 October, three weeks apart (20). A public changelog, forum.onshape.com and api-support@onshape.com; response times were not tested (12 of 15). No Onshape-owned server in the official MCP registry, where the only match is io.github.gpambrozio/onshape; the official Go client was pushed on 31 October 2026 and the TypeScript clients in June and September 2025 (12 of 15). The Go client is generated and its CI was not read; the multi-language onshape-clients repository is archived (5 of 10). 30 + 20 + 12 + 12 + 5 = 79.

Adam 81

Public OpenAPI 3.1 for the REST API (adam.new/openapi.json and api.adam.new/openapi.json), a site spec for OAuth and MCP endpoints, and an MCP manifest. MCP tool schemas were not read, since tools/list needs a sign-in, though adam_list_task_tools is documented to return input schemas (20 of 25). llms.txt, a docs index at docs.adam.new/llms.txt, Markdown for every page on request through the Accept header, and a starter SKILL.md (10). The direct-tools page gives each MCP tool a purpose and its scopes, and OpenAPI descriptions state conditional requirements such as cron or runAt, but no tool definition says when not to use it (12 of 20). Enums for task status, limit 1 to 50, required fields and multipart file fields are typed; the component schemas past the first 100,000 characters were not read (11 of 15). Every operation documents 400 to 500 responses with one error envelope, and the API introduction carries curl and JSON examples (13 of 15). Versioned /v1 paths, Deprecation and Sunset headers with 90 days' notice, and a dated changelog, though its newest entry is 10 September 2026 (15). 20 + 10 + 12 + 11 + 13 + 15 = 81.

Onshape 63

An OpenAPI document backs the Glassworks API Explorer and the generated Go and TypeScript clients, but cad.onshape.com/robots.txt closes the explorer and the document to readers, so the contract was seen only through the clients (18 of 25). No llms.txt and no Markdown twin of the docs (0). Guides per area state what each API does and the API intro explains documents, workspaces, versions and elements; the MCP server's tools are not listed anywhere public (12 of 20). The Go client's breaking-change list shows typed models with BTType mandatory; enums and constraints were not read in the spec itself (10 of 15). Guides carry examples; the response codes page linked from the docs answered 404 and the API limits page gives 429 and 402 meanings (8 of 15). Numbered API versions (v17), dated release notes every three weeks, deprecations marked and an x-deprecated header (15). 18 + 0 + 12 + 10 + 8 + 15 = 63.

Adam 72

Closed service under terms of 5 June 2026 that name Adam AI Labs, Inc. but state no governing law, refund or notice terms beyond email; CADAM is GPL-3.0 (13 of 30). The privacy policy of 24 October 2026 keeps data as long as needed, while the compliance page of 7 October 2026 gives 30-day deletion after closure, 7-day backups, no training on model inputs under the providers' commercial terms, and a DPA on request; the two agree where they overlap (20 of 30). Removals announced at least 90 days ahead with Deprecation and Sunset headers and changelog notices, though no removal has been recorded yet (16 of 20). Every subprocessor named with purpose, data and region, and data residency by category (18 of 20). 13 + 20 + 16 + 18 = 67.

Onshape 60

Closed service with clear terms of 15 July 2020 naming PTC Inc. and Massachusetts law (15). The privacy policy has moved to ptc.com, which our reader could not fetch; the data disclosures page names subprocessors (AWS, Salesforce, SendGrid, Zendesk, Vanilla Forums, Crownpeak, Thought Industries, Stripe, Zuora) without retention periods, and neither the terms nor the disclosures say whether customer content trains AI (12 of 30). Deprecations are marked in dated release notes and flagged with an x-deprecated header, but no notice period is stated (12 of 20). Subprocessors are named and the status page lists hosting regions by continent; no formal data location statement was read (14 of 20). 15 + 12 + 12 + 14 = 53.

Adam 74

OAuth 2.1 authorisation code with PKCE S256, automatic client registration, RFC 8707 resource indicators, refresh tokens, a revocation endpoint and 11 scopes, or a personal key minted for one workspace with chosen scopes and shown once; bearer header only, no query-string option (30). Read and change approved separately per area, tools:execute kept apart and blockable by an admin under Allow full harness execution, deletes behind confirmation, and access revoked at once from Connected apps. tools:execute is broad, covering commands, connected accounts, paired devices, stored credentials and billable tools (18 of 20). Task messages return the agent's output and tool results, which can include web search and connected-account content, and no prompt-injection guidance was found; per-user sandboxes isolate execution but do not address it (4 of 15). Connected apps are listed with revocation, every error carries a requestId and the billing summary reports usage, but no audit log for the operator was found (6 of 15). SOC 2 Type I approved with Type II in progress, a bug bounty of $10 to $100 per finding with a 90-day window and safe harbour, patch SLAs by CVSS severity, 72-hour incident notification, and no security.txt (16 of 20). 30 + 18 + 4 + 6 + 16 = 74.

Onshape 63

API keys scoped to permissions, revocable, two per individual account, with a signed request scheme; OAuth 2.0 authorisation code with 60-minute access tokens and refresh tokens revoked with the user's grant; no key expiry documented (26 of 30). Permission scopes allow read-only keys; no confirmation step before destructive calls and no approval gate on the MCP server beyond the App Store subscription (12 of 20). The MCP server reads FeatureScript errors and geometry from the document and no prompt-injection guidance was found (5 of 15). API usage counts are visible under Developer settings per company or user; no per-call audit log was found (6 of 15). SOC 2 Type 2 audited annually, AES-256 and TLS 1.2 with HSTS, paid researcher testing and security@onshape.com, but no security.txt (404), no public bug bounty and no advisories page (14 of 20). 26 + 12 + 5 + 6 + 14 = 63.