ClickUp vs ONES

ClickUp 62

Graded on the hosted MCP server and the public REST API, with the hosted lines. Status page at status.clickup.com on incident.io with 22 components, Public API among them, per the 8 October check (20). The incident window from 5 August couldn't be read on 3 November (a permission check refused the status feed and it wasn't retried). The 8 October incident reading came from the page's data endpoint, which this method doesn't use, so it is struck and the window is scored as unread (5). API limits published per plan, 100 requests a minute per token on Free Forever, Unlimited and Business, 1,000 on Business Plus and 10,000 on Enterprise, an MCP server limit of 1,000 requests a minute per connection and daily MCP caps of 100 to 25,000 calls (15). 429s carry X-RateLimit-* headers on the REST API. Since 27 October the MCP tools reference documents 429 with Retry-After: 60, RATE_LIMIT_EXCEEDED with retryAfter, reads as safe to retry, and says to check whether a write happened before retrying, since creates, comments and time entries duplicate. Safe-retry guidance without idempotency keys (12). No SLA found in the reviewed pages (0). Neither surface is marked beta, though the MCP docs say limits may change (10).

ONES 25

Graded as a hosted service on ONES.com Cloud's Open API and MCP server. No status page is linked from ones.com, the trust centre or the docs, and status.ones.com did not resolve (0). With no readable history the incident line scores 5. No rate limit with numbers was found in the developer docs index or the terms, which only reserve the right to restrict excessive traffic (0). No 429, backoff or idempotency guidance found (0). The pricing page states 99.9% uptime on Business and 99.95% on Enterprise (10). The MCP server has been in the release notes since 6.42.0 on 26 August 2025 and carries no beta label (10). 0 + 5 + 0 + 0 + 10 + 10 = 25.

ClickUp 79

OpenAPI 3.1 spec for API v2 with 138 operations and an OpenAPI 3.0 spec for v3 with 35, both public, per the 8 October check (25). The MCP tool JSON schemas need an OAuth session and were not read. llms.txt and a Markdown copy of every docs page (10). 137 of 138 v2 operations carry a description. Since 27 October the MCP tools reference gives each of 65 tools its exact name, Read or Write type, a Sensitive flag, inputs, returns and side effects. It lists clickup_delete_task while the MCP FAQ still says no deletion tools exist (15 of 20). Required fields are marked, but v2 has 6 enums, dates are Unix milliseconds and custom_fields filters travel as JSON in a query string. v3 has 62 enums (10 of 15). Every v2 operation has a response example. REST error responses are specified on few (400 on 6, 401 on 3), while the MCP reference now has an error table with meanings and whether to retry (12 of 15). Versions sit in the path (v2, v3). No API changelog was found, and the product changelog rarely covers the API (7 of 15).

ONES 55

No downloadable OpenAPI file was found. The reference is rendered pages, and the MCP docs list tool names and one-line descriptions without input schemas (0). llms.txt with sized indexes and a Markdown copy of every page (10). Endpoint and tool descriptions state what each does in one line, with version history per endpoint but little on when not to use one (10 of 20). Parameters are typed with defaults, limits (limit at most 100) and required marks (10 of 15). Each endpoint lists 200, 401, 403, 404 and 500 responses with schemas and examples (10 of 15). API version 2.0, a History table per endpoint and dated release notes (15). 0 + 10 + 10 + 10 + 10 + 15 = 55.

ClickUp 57

65 documented MCP tools (5). The OAuth metadata advertises separate read and write scopes and clickup_get_task takes an include list (3 more, 8 of 25). Get Tasks filters by status, assignee, tag, dates and Custom Fields at 100 tasks a page, v3 and the MCP read tools use cursors with has_more, and MCP has a Workspace search tool. No field selection on v2 (16 of 20). REST errors carry err and an ECODE, v3 adds status, message and trace_id, and the MCP reference documents each error with whether to retry (16 of 20). No idempotency keys in either spec. The MCP reference states for each write what repeating it does and marks reads and writes, while readOnlyHint and destructiveHint could not be checked without an OAuth session (10 of 20). Create Task needs only name (and list_id over MCP). No official SDK found on npm or in the ClickUp GitHub organisation. The official plugin adds three skills that preview a plan before writing (7 of 15).

ONES 40

Scored on the MCP server and the Open API together. 67 MCP tools load by default (5), and a client granted fewer scope groups is limited to fewer tools (5 back). Lists take limit and cursor with project and issue type filters, and query_issues_by_onesql runs a filtered query (15 of 20). Error status codes are documented per endpoint with response schemas, but no error code catalogue was found (8 of 20). No idempotency keys or MCP annotations found (0). One official SDK, @ones-open/node-sdk, aimed at ONES Apps, and the MCP setup is one mcp-remote line (7 of 15). 10 + 15 + 8 + 0 + 7 = 40.

ClickUp 54

The MCP tools reference was updated on 27 October 2026 and product Release Notes 4.09 are dated 17 October 2026 (30). The product changelog has four dated entries since 5 August (18 August, 25 August, 18 September, 17 October), none about the public API. Docs pages changed on 10 August, 14 August, 17 September, 7 October and 27 October, and the official plugin repository had commits on 11 August, 7 September, 19 October and 30 October, the last two adding marketplace manifests (12 of 20). Public product changelog and feedback board, and 24/7 support stated on the pricing page. No API changelog, and response times were not checked (8 of 15). No entry under a ClickUp namespace in the official MCP registry, and no official SDK (0). The official clickup-plugin repository is MIT, still at version 1.1.0, with eight commits between 1 April and 30 October 2026 (4 of 10).

ONES 68

Latest dated release notes are 7.33.0 on 30 September 2026, 37 days before this check. The registry entry moved to 1.0.3 on 8 October with no release note behind it, so it doesn't set recency (20). Nine dated releases since 8 August, several adding Open API endpoints or MCP capabilities (7.23.0, 7.26.0, 7.27.0, 7.29.0) (20). Closed service with a public changelog and support by email, with no public issue tracker (8 of 15). Verified com.ones/ones namespace in the official MCP registry (15). One official SDK for apps, with package health not checked (5 of 10). 20 + 20 + 8 + 15 + 5 = 68.

ClickUp 75

Closed service under Terms of Service effective 27 June 2025 and Developer Terms last updated 16 July 2024, naming Mango Technologies, Inc. DBA ClickUp. Clause 4.13(e) of the terms excludes API access with an unauthorised or third-party client, without defining it. The plugin repository is MIT (13 of 30). Privacy policy effective 2 June 2026 and a public DPA. Retention is stated as long as reasonably required, with no periods, and deletion at the end of term as soon as reasonably practicable. The security page says AI partners may not train on or retain customer data (18 of 30). No deprecation policy or dated notices found, and the Developer Terms state no obligation to maintain or support the API (3 of 20). Sub-processor list updated 28 September 2026 with purposes and locations, and Enterprise data residency in the US, Europe and Asia Pacific (18 of 20).

ONES 62

Closed service under terms naming The Beautiful ONES Technology PTE. LTD. and Singapore law (15 of 30). The privacy policy of 7 January 2026 deletes business data 30 days after a service ends with no login for 365 days, and honours deletion requests within 30 days, but no DPA or subprocessor list is public (12 of 30). Endpoint version histories record changes, with no deprecation policy (5 of 20). The privacy policy names AWS, Oracle cloud and OpenAI and says data is transferred mostly to the US, China and Singapore, with no subprocessor list or regions (6 of 20). 15 + 12 + 5 + 6 = 38.