Adam vs SimScale

Adam 74

OAuth 2.1 authorisation code with PKCE S256, automatic client registration, RFC 8707 resource indicators, refresh tokens, a revocation endpoint and 11 scopes, or a personal key minted for one workspace with chosen scopes and shown once; bearer header only, no query-string option (30). Read and change approved separately per area, tools:execute kept apart and blockable by an admin under Allow full harness execution, deletes behind confirmation, and access revoked at once from Connected apps. tools:execute is broad, covering commands, connected accounts, paired devices, stored credentials and billable tools (18 of 20). Task messages return the agent's output and tool results, which can include web search and connected-account content, and no prompt-injection guidance was found; per-user sandboxes isolate execution but do not address it (4 of 15). Connected apps are listed with revocation, every error carries a requestId and the billing summary reports usage, but no audit log for the operator was found (6 of 15). SOC 2 Type I approved with Type II in progress, a bug bounty of $10 to $100 per finding with a 90-day window and safe harbour, patch SLAs by CVSS severity, 72-hour incident notification, and no security.txt (16 of 20). 30 + 18 + 4 + 6 + 16 = 74.

SimScale 44

One API key per user in the X-API-KEY header, with no scopes, documented expiry, rotation or revocation; the SDK reads it from an environment variable (10 of 30). Project and space permission endpoints exist and the sandbox cannot change data, but no read-only key or confirmation step for deletes was found (8 of 20). The API returns the owner's own geometry and results and no third-party content, so there is little untrusted content to inject (10 of 15). No audit log or per-call visibility found on the pages read (0 of 15). SOC 2 Type II by Prescient Assurance, a public Intigriti bug bounty with the API in scope, security.txt and AES encryption (16 of 20). 10 + 8 + 10 + 0 + 16 = 44.

Adam 82

The docs name 15 adam_ tools plus displayFile and loadSkill, so 11 to 30 (15), and task tools are discovered per task with adam_list_task_tools rather than listed up front, which earns 8 back (23 of 25). Cursor pagination with limit 1 to 50, status and project filters on tasks, and message parts that admins can trim, though results of tool calls may be truncated without a size control (18 of 20). One error envelope with type, message and requestId, 402 and 403 that name the plan or scope at fault, and a recovery table for each direct-tool failure (18 of 20). Idempotency-Key required on every write that starts work, a 24-hour replay, cancel documented as safe to repeat, and an unknown status that tells the agent to inspect before retrying; deletes need confirmation, but readOnlyHint and destructiveHint annotations were not confirmed since tools/list was not read (16 of 20). Few required parameters, but no official SDK in any language (7 of 15). 23 + 18 + 18 + 16 + 7 = 82.

SimScale 55

List endpoints page with limit and page parameters and results are fetched per run and per export rather than whole (15 of 25). Pagination on lists and filters on some, such as valid geometries only (15 of 20). Typed error responses by status code; message shapes were not read in detail and the v1 error format page rendered empty (10 of 20). No idempotency keys; runs are asynchronous with event logs and cancel, so a retry can start a second run (5 of 20). Official Python and C# SDKs cover the surface, but a simulation setup needs a full Simulation Spec object with many required fields and a matching schema version (10 of 15). 15 + 15 + 10 + 5 + 10 = 55.

Adam 55

Read for a closed service. The changelog's newest entry is 10 September 2026, 54 days before this check (20). Entries dated 7, 10, 11 and 25 August and 4 to 10 September 2026, more than three in 90 days (20). A public changelog, hello@adam.new, a Discord and the CADAM repository with 26 open issues, which were not read for replies (10 of 15). The manifest follows the registry schema but new.adam/adam is not in the official MCP registry, and there is no official SDK (0 of 15). CADAM was pushed on 15 October 2026 and the service itself has no package to judge (5 of 10). 20 + 20 + 10 + 0 + 5 = 55.

SimScale 33

Read for a closed service with open SDK sources. The Python SDK's newest release is 19.1.0 of 3 March 2026, 245 days before the check, and the v1 document carries no date (5 of 30, for a change in the window being likely from the v1 beta but unproven). Ten SDK releases from February 2025 to March 2026 and none since (0 of 20). api@simscale.com, support@simscale.com and a community forum; response times were not tested and the SDK repository has no issue activity we could read (10 of 15). Official Python and C# SDKs, with v1 editions, generated from the document (15). The SDK repository has no CI workflow and pins the document version at 0.0.0 (3 of 10). 5 + 0 + 10 + 15 + 3 = 33.

Adam 35

Read with the hosted lines. status.adam.new exists and is linked from the docs, but it loads its components and history by script and nothing readable was served, so the page counts for half (10 of 20) and the incident record is unread (5). Rate limits are documented as two refilling buckets reported in RateLimit, RateLimit-Policy and X-RateLimit headers, with no numeric quota published (5 of 15). 429 carries Retry-After, and Idempotency-Key is required on task creation, messages and tool calls and replayed for 24 hours (15). No SLA found (0). The MCP server and the REST API are labelled beta, with breaking changes allowed (0 of 10). 10 + 5 + 5 + 15 + 0 + 0 = 35.

SimScale 15

Read with the hosted lines on api.simscale.com. No status page, since status.simscale.com has no DNS record and none is linked from the site, the docs hub or the API document (0). No readable incident history (5). No rate limit with a number; the terms reserve the right to impose rate or traffic limits and the v0 document mentions a 429 response once (0). No Retry-After, backoff guidance or idempotency keys; runs can be cancelled (0). No SLA, and the terms say SimScale cannot warrant uninterrupted availability with Free plans carrying no availability obligation (0). /v0 is the generally available version; /v1 is in beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Adam 81

Public OpenAPI 3.1 for the REST API (adam.new/openapi.json and api.adam.new/openapi.json), a site spec for OAuth and MCP endpoints, and an MCP manifest. MCP tool schemas were not read, since tools/list needs a sign-in, though adam_list_task_tools is documented to return input schemas (20 of 25). llms.txt, a docs index at docs.adam.new/llms.txt, Markdown for every page on request through the Accept header, and a starter SKILL.md (10). The direct-tools page gives each MCP tool a purpose and its scopes, and OpenAPI descriptions state conditional requirements such as cron or runAt, but no tool definition says when not to use it (12 of 20). Enums for task status, limit 1 to 50, required fields and multipart file fields are typed; the component schemas past the first 100,000 characters were not read (11 of 15). Every operation documents 400 to 500 responses with one error envelope, and the API introduction carries curl and JSON examples (13 of 15). Versioned /v1 paths, Deprecation and Sunset headers with 90 days' notice, and a dated changelog, though its newest entry is 10 September 2026 (15). 20 + 10 + 12 + 11 + 13 + 15 = 81.

SimScale 71

Public OpenAPI 3.0.3 documents for /v0 (98 operations) and /v1 (163 operations), with the simulation and meshing schema versions selectable by query parameter (25). No llms.txt and no Markdown docs; the API docs are Swagger UI and script-rendered pages (0). The introduction explains the sandbox, versioning and Workbench compatibility, and operations carry one-line summaries, but 10 of the 98 v0 operations have no description and the guides for v1 rendered empty (12 of 20). 2,112 schemas with 355 enum lists, required fields and a typed security scheme (13 of 15). The sandbox answers every endpoint with example data, which stands in for examples, and responses are typed for 400, 403, 404, 409, 422 and 429 (11 of 15). Path versions v0 and v1 with a migration guide and changelog for v1, and dated SDK releases, though the changelog page itself rendered empty (10 of 15). 25 + 0 + 12 + 13 + 11 + 10 = 71.

Adam 72

Closed service under terms of 5 June 2026 that name Adam AI Labs, Inc. but state no governing law, refund or notice terms beyond email; CADAM is GPL-3.0 (13 of 30). The privacy policy of 24 October 2026 keeps data as long as needed, while the compliance page of 7 October 2026 gives 30-day deletion after closure, 7-day backups, no training on model inputs under the providers' commercial terms, and a DPA on request; the two agree where they overlap (20 of 30). Removals announced at least 90 days ahead with Deprecation and Sunset headers and changelog notices, though no removal has been recorded yet (16 of 20). Every subprocessor named with purpose, data and region, and data residency by category (18 of 20). 13 + 20 + 16 + 18 = 67.

SimScale 65

Closed service with clear terms (version July 2023) naming SimScale GmbH under German law (15). The data privacy statement (November 2025) gives retention periods for site data, names subprocessors with locations and the LLM providers used on platform content, and the terms give SimScale a licence over paid-plan content for improving the services; the statement's section 14 still says July 2023, and neither document says whether platform content trains models (20 of 30). v1 is announced as beta with a migration guide and v0 stays, but no deprecation policy or dated notices were found (8 of 20). Subprocessors and data locations are disclosed in detail, with production in AWS EU regions (18 of 20). 15 + 20 + 8 + 18 = 61.