Basecamp vs ONES

Basecamp 59

Graded on the hosted lines for the REST API. 37status.com has a Basecamp 5 component with 90 days of daily uptime, per the 8 October check (20). On 1 November its robots.txt disallows every path, so the history wasn't re-read. The 8 October incident reading came from its Statuspage /api/v2/incidents.json path, which is disallowed, so it no longer counts, and the window from 3 August is unread. The line takes the no-readable-history score, a limit of our reading and not a finding against Basecamp (5). The docs publish one number, 50 requests per 10 seconds per IP, and say other limits exist and change dynamically. An unauthenticated call returned an x-ratelimit header with the same figures, per the 8 October check (12). 429 carries Retry-After, 5xx may be retried with exponential backoff and 404 must not be. Creating more than 100 embeds an hour answers 429 with no Retry-After, as documented. The SDK model marks which mutations are safe to repeat, but there are no idempotency keys (12). The terms say 37signals has no service-level agreements (0). The API is generally available. The CLI and SDKs are 0.x releases (10). 20+5+12+12+0+10 = 59.

ONES 25

Graded as a hosted service on ONES.com Cloud's Open API and MCP server. No status page is linked from ones.com, the trust centre or the docs, and status.ones.com did not resolve (0). With no readable history the incident line scores 5. No rate limit with numbers was found in the developer docs index or the terms, which only reserve the right to restrict excessive traffic (0). No 429, backoff or idempotency guidance found (0). The pricing page states 99.9% uptime on Business and 99.95% on Enterprise (10). The MCP server has been in the release notes since 6.42.0 on 26 August 2025 and carries no beta label (10). 0 + 5 + 0 + 0 + 10 + 10 = 25.

Basecamp 67

No field selection and no page-size parameter were found. Pages are fixed at 15, 30, 50 and then 100 items, and ETag allows 304 responses. The CLI's --quiet and the MCP server's --domains trim what an agent loads (12). Link header paging with X-Total-Count, status, sort and date filters on lists, and account-wide search with type, project and creator filters (14). Status codes are documented with their causes, such as the Reason: Account Inactive header on 404, and bodies are {"error": "..."}. The CLI adds a stable code and a retryable flag (15). The spec flags mutations as idempotent and the SDKs never retry the others. There are no idempotency keys. The CLI's MCP server marks its read tools and sets readOnlyHint in --read-only mode, which its tests check (the 8 October note said no annotations were found), though no destructiveHint was found (12). Seven official SDKs and flat routes that need only a resource ID. Every call needs an account ID and a User-Agent header (14). 12+14+15+12+14 = 67.

ONES 40

Scored on the MCP server and the Open API together. 67 MCP tools load by default (5), and a client granted fewer scope groups is limited to fewer tools (5 back). Lists take limit and cursor with project and issue type filters, and query_issues_by_onesql runs a filtered query (15 of 20). Error status codes are documented per endpoint with response schemas, but no error code catalogue was found (8 of 20). No idempotency keys or MCP annotations found (0). One official SDK, @ones-open/node-sdk, aimed at ONES Apps, and the MCP setup is one mcp-remote line (7 of 15). 10 + 15 + 8 + 0 + 7 = 40.

Basecamp 80

OpenAPI 3.1 in the basecamp-sdk repository, version 2026-10-30, 295 operations on 198 paths (25). basecamp.com/llms.txt returned 404 on 8 October, but the whole API reference is Markdown in the bc-api repository and the CLI ships agent skills (10). All 295 operations have a description and none has a summary. The reference adds a key concepts section and the list of endpoints an agent's own token may call, with little guidance on when not to use a route (15). 512 schemas with required fields and formats, but one enum and three length limits in the whole spec, so allowed values live in prose (9). Each reference section has example JSON and a cURL line. The spec documents 401, 403 and 500 on every operation, 429 on 175, 404 on 169 and 422 on 106 (13). The spec is dated and the SDK has a MIGRATING.md, but the API has no version in its path and no changelog of its own was found (8). 25+10+15+9+13+8 = 80.

ONES 55

No downloadable OpenAPI file was found. The reference is rendered pages, and the MCP docs list tool names and one-line descriptions without input schemas (0). llms.txt with sized indexes and a Markdown copy of every page (10). Endpoint and tool descriptions state what each does in one line, with version history per endpoint but little on when not to use one (10 of 20). Parameters are typed with defaults, limits (limit at most 100) and required marks (10 of 15). Each endpoint lists 200, 401, 403, 404 and 500 responses with schemas and examples (10 of 15). API version 2.0, a History table per endpoint and dated release notes (15). 0 + 10 + 10 + 10 + 10 + 15 = 55.

Basecamp 80

Closed service under clear terms, last updated 16 September 2026, which include API terms. The CLI, SDKs and spec are MIT and the docs CC BY-SA 4.0 (17). The privacy policy and terms agree on retention, with content removed from active systems within 30 days of cancellation and from backups within 60, and trashed items purged within 90. A data processing addendum is part of the terms, and the policy says content is not used to train AI. Application databases are generally not encrypted at rest, which the vendor states itself (27). The docs say older project-scoped routes will keep working in perpetuity and a company policy promises to keep products running, but the terms allow changes with or without notice and no dated API deprecation policy was found (10). The Basecamp sub-processor list, updated 5 October 2026, names 12 companies with countries. Data is stored in the United States, and new sub-processors are announced on a feed (18). 17+27+10+18 = 72.

ONES 62

Closed service under terms naming The Beautiful ONES Technology PTE. LTD. and Singapore law (15 of 30). The privacy policy of 7 January 2026 deletes business data 30 days after a service ends with no login for 365 days, and honours deletion requests within 30 days, but no DPA or subprocessor list is public (12 of 30). Endpoint version histories record changes, with no deprecation policy (5 of 20). The privacy policy names AWS, Oracle cloud and OpenAI and says data is transferred mostly to the US, China and Singapore, with no subprocessor list or regions (6 of 20). 15 + 12 + 5 + 6 = 38.

Basecamp 82

CLI v0.22.1 tagged on 1 November 2026 and SDK v0.34.0 on 30 October (30). The SDK has dozens of tags and the CLI 18 releases since 3 August 2026, from v0.13.0 (7 October) to v0.22.1 alone (20). Closed service. The docs repository had 27 commits from 3 August to 30 October 2026. Questions go to a support ticket. Issue replies per the 8 October check, not re-read on 1 November because GitHub's pages refuse us (9). Current official SDKs in seven languages, tagged together through 30 October 2026 (15). Both repositories have test, CodeQL, Scorecard and Dependabot workflows, and the SDK added a Go vulnerability check of the whole module graph on 21 October. We didn't confirm the runs pass (8). 30+20+9+15+8 = 82.

ONES 68

Latest dated release notes are 7.33.0 on 30 September 2026, 37 days before this check. The registry entry moved to 1.0.3 on 8 October with no release note behind it, so it doesn't set recency (20). Nine dated releases since 8 August, several adding Open API endpoints or MCP capabilities (7.23.0, 7.26.0, 7.27.0, 7.29.0) (20). Closed service with a public changelog and support by email, with no public issue tracker (8 of 15). Verified com.ones/ones namespace in the official MCP registry (15). One official SDK for apps, with package health not checked (5 of 10). 20 + 20 + 8 + 15 + 5 = 68.