Adam vs Zoo

Adam 82

The docs name 15 adam_ tools plus displayFile and loadSkill, so 11 to 30 (15), and task tools are discovered per task with adam_list_task_tools rather than listed up front, which earns 8 back (23 of 25). Cursor pagination with limit 1 to 50, status and project filters on tasks, and message parts that admins can trim, though results of tool calls may be truncated without a size control (18 of 20). One error envelope with type, message and requestId, 402 and 403 that name the plan or scope at fault, and a recovery table for each direct-tool failure (18 of 20). Idempotency-Key required on every write that starts work, a 24-hour replay, cancel documented as safe to repeat, and an unknown status that tells the agent to inspect before retrying; deletes need confirmation, but readOnlyHint and destructiveHint annotations were not confirmed since tools/list was not read (16 of 20). Few required parameters, but no official SDK in any language (7 of 15). 23 + 18 + 18 + 16 + 7 = 82.

Zoo 44

zoo-mcp lists 42 tools in one process with no toolset switch, read-only subset or dynamic loading, and their docstrings total about 30,000 characters (5 of 25). List endpoints take limit, page_token and sort_by (31 paginated operations), with no field selection or filtering (15 of 20). Errors are a generic object with a message and request_id, no error codes, and MCP tools return a string on failure (8 of 20). No idempotency keys, no readOnlyHint or destructiveHint in the tool source, and the websocket needs a ping every 5 seconds to stay open (4 of 20). Few required parameters, official SDKs in Python, TypeScript, Rust and Go, but one modeling session per MCP process and a websocket protocol an agent has to drive by hand (12 of 15). 5 + 15 + 8 + 4 + 12 = 44.

Adam 55

Read for a closed service. The changelog's newest entry is 10 September 2026, 54 days before this check (20). Entries dated 7, 10, 11 and 25 August and 4 to 10 September 2026, more than three in 90 days (20). A public changelog, hello@adam.new, a Discord and the CADAM repository with 26 open issues, which were not read for replies (10 of 15). The manifest follows the registry schema but new.adam/adam is not in the official MCP registry, and there is no official SDK (0 of 15). CADAM was pushed on 15 October 2026 and the service itself has no package to judge (5 of 10). 20 + 20 + 10 + 0 + 5 = 55.

Zoo 90

Read for a hosted service with open-source clients. zoo-mcp v0.33.0 on 30 October 2026, the CLI v0.2.209 on 28 October and kittycad 1.8.0 on 15 October (30). Nine zoo-mcp tags from 24 to 30 October alone, with CLI and SDK releases through October (20). Commits land daily across the KittyCAD organisation, with a Discord and a community forum; issue response times were not read because GitHub's issue pages refused us (15 of 25). io.github.KittyCAD/zoo-mcp is in the official MCP registry under a GitHub-verified namespace, though at version 0.10.0 of 27 January 2026 (15). pytest across Python 3.11 to 3.14, ruff, ty, a security workflow and Dependabot, with the scheduled run on main passing on 3 November (10). 30 + 20 + 15 + 15 + 10 = 90.

Adam 35

Read with the hosted lines. status.adam.new exists and is linked from the docs, but it loads its components and history by script and nothing readable was served, so the page counts for half (10 of 20) and the incident record is unread (5). Rate limits are documented as two refilling buckets reported in RateLimit, RateLimit-Policy and X-RateLimit headers, with no numeric quota published (5 of 15). 429 carries Retry-After, and Idempotency-Key is required on task creation, messages and tool calls and replayed for 24 hours (15). No SLA found (0). The MCP server and the REST API are labelled beta, with breaking changes allowed (0 of 10). 10 + 5 + 5 + 15 + 0 + 0 = 35.

Zoo 55

Read with the hosted lines on api.zoo.dev. A Better Stack status page at status.zoo.dev lists public and internal components with uptime figures (20). Its incident pages show no incidents for September, October and November 2026; the June to August archive didn't render for our reader, so about three weeks of the 90-day window are unread (25 of 30). No rate limit with a number was found in the OpenAPI document, the API docs, the FAQ or the MCP source (0). No Retry-After or backoff guidance and no idempotency keys; the document says only that cancellation is idempotent (3 of 15). No SLA on any plan, and the terms disclaim uninterrupted service (0). The REST API and Zookeeper are not labelled beta, while POST /ml/kcl/completions carries the beta tag and zoo-mcp declares the Beta classifier (7 of 10). 20 + 25 + 0 + 3 + 0 + 7 = 55.

Adam 15

Read with the hosted rule. No x402, MPP or L402 (0). The pricing page's prices are drawn by script and were not readable; the Markdown version and the billing docs name Free, Pro, Max, Team and Enterprise with no figure, so pricing is scored as unread (0 of 20, named in openQuestions). A Free plan with a daily usage pool and Lite models exists, and trials charge a saved card only when confirmed; whether Free needs a card is not stated (15 of 20). A person signs in with OAuth in a browser and picks a workspace (0). 0 + 0 + 15 + 0 = 15.

Zoo 35

No x402, MPP or L402 (0). The per-second rate ($0.0083) and plan allowances are public in the pricing JSON the site loads and on the blog, with the FAQ stating rounding and free GETs (20). The Free plan carries $10 of usage a month with no plan fee; whether sign-up asks for a card was not established, and pay-as-you-go needs a payment method (15 of 20). A person signs in with SSO in a browser and mints the token; service accounts come only after an organisation exists (0). 0 + 20 + 15 + 0 = 35.

Adam 81

Public OpenAPI 3.1 for the REST API (adam.new/openapi.json and api.adam.new/openapi.json), a site spec for OAuth and MCP endpoints, and an MCP manifest. MCP tool schemas were not read, since tools/list needs a sign-in, though adam_list_task_tools is documented to return input schemas (20 of 25). llms.txt, a docs index at docs.adam.new/llms.txt, Markdown for every page on request through the Accept header, and a starter SKILL.md (10). The direct-tools page gives each MCP tool a purpose and its scopes, and OpenAPI descriptions state conditional requirements such as cron or runAt, but no tool definition says when not to use it (12 of 20). Enums for task status, limit 1 to 50, required fields and multipart file fields are typed; the component schemas past the first 100,000 characters were not read (11 of 15). Every operation documents 400 to 500 responses with one error envelope, and the API introduction carries curl and JSON examples (13 of 15). Versioned /v1 paths, Deprecation and Sunset headers with 90 days' notice, and a dated changelog, though its newest entry is 10 September 2026 (15). 20 + 10 + 12 + 11 + 13 + 15 = 81.

Zoo 65

OpenAPI 3.0.3 served at the root of api.zoo.dev, 174 paths and 226 operations each with a summary, and MCP tools whose inputs are typed Python signatures that the SDK turns into JSON Schema (25). No llms.txt (404) and no Markdown twin of the docs (0). The MCP docstrings average about 725 characters and say what each tool is for and when to use another, with snapshot at 3,500 characters; the OpenAPI summaries are one line and the websocket page lists one client message type (14 of 20). 583 schemas with 976 enum lists and required fields, and the file conversion path takes typed format parameters (12 of 15). Each docs endpoint page carries a request example, but errors are one generic object with request_id and message, and the websocket's server messages are not enumerated in the docs (9 of 15). The document reports version 0.1.0, there is no API changelog page, and changes are announced per repository release or on the blog, as the per-second billing change of 30 September 2025 was (5 of 15). 25 + 0 + 14 + 12 + 9 + 5 = 65.

Adam 74

OAuth 2.1 authorisation code with PKCE S256, automatic client registration, RFC 8707 resource indicators, refresh tokens, a revocation endpoint and 11 scopes, or a personal key minted for one workspace with chosen scopes and shown once; bearer header only, no query-string option (30). Read and change approved separately per area, tools:execute kept apart and blockable by an admin under Allow full harness execution, deletes behind confirmation, and access revoked at once from Connected apps. tools:execute is broad, covering commands, connected accounts, paired devices, stored credentials and billable tools (18 of 20). Task messages return the agent's output and tool results, which can include web search and connected-account content, and no prompt-injection guidance was found; per-user sandboxes isolate execution but do not address it (4 of 15). Connected apps are listed with revocation, every error carries a requestId and the billing summary reports usage, but no audit log for the operator was found (6 of 15). SOC 2 Type I approved with Type II in progress, a bug bounty of $10 to $100 per finding with a 90-day window and safe harbour, patch SLAs by CVSS severity, 72-hour incident notification, and no security.txt (16 of 20). 30 + 18 + 4 + 6 + 16 = 74.

Zoo 67

Bearer API tokens minted in the account, several per user, listed and deleted at /user/api-tokens, organisation service accounts on Team and Enterprise, and OAuth 2.0 apps with PKCE and a device grant; no scopes were found on tokens and no rotation guidance (22 of 30). No read-only token or MCP subset; the Team plan's admin console and auditing give oversight after the fact, and the MCP client's own file permissions govern writes to main.kcl (8 of 20). Zookeeper carries a web_search tool and the MCP server returns KCL samples and docs, with no prompt-injection guidance found (5 of 15). Organisation admins get an API activity log and /user/api-calls lists each call with its cost (12 of 15). security.txt with a GitHub advisory contact and a policy committing to a 72-hour reply and severity-based rewards, SOC 2 Type II on the trust centre, and two Trail of Bits reviews published in 2024 and 2026 (20 of 20). 22 + 8 + 5 + 12 + 20 = 67.