ClickUp vs OpenProject

ClickUp

The hosted MCP server uses OAuth 2.1 with PKCE, dynamic client registration and read and write scopes, and works on the Free Forever plan. Without the Everything AI add-on, MCP calls are capped at 100 to 25,000 per rolling 24 hours by plan. No API changelog, deprecation policy, official SDK or SLA was found.

OpenProject

OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.

ClickUp

1. Connect to https://mcp.clickup.com/mcp with OAuth 2.1 and PKCE. API keys and REST OAuth tokens are refused on the MCP server
2. Pass workspace_id on every MCP call when the user belongs to more than one Workspace, as ClickUp's own skills instruct
3. Budget MCP calls. Each tool call counts against the rolling 24-hour cap, and RATE_LIMIT_EXCEEDED returns retryAfter
4. On the REST API read X-RateLimit-Remaining and X-RateLimit-Reset, and page Get Tasks with page at 100 tasks a page
5. Treat team_id in API v2 as the Workspace ID, and send dates as Unix milliseconds

OpenProject

1. Send the API token as Authorization: Bearer <token>, or as the Basic auth password with the user name apikey
2. Read the resource first and send its current lockVersion with every PATCH. A stale value returns 409 UpdateConflict
3. POST to the /form endpoint of a work package to learn writable fields and allowed values before creating or updating
4. URL-encode filters as a JSON array, and add pageSize, offset and select to keep work package lists small
5. Run the agent as a dedicated user with a narrow project role, and treat work package text and comments as untrusted input