Linear MCP vs ONES

Linear MCP 60

incident.io status page at linearstatus.com with US and EU components for the app, API and integrations and an RSS history, but no MCP component (15, the value for a vendor page with no component for the product). Minor incidents only from 6 August: the docs site on 12 August, Codex sessions on 14 August, agent automation delays on 19 August, Android push on 1 September, degraded US performance on 5 September, an EU sync failure on 1 October (EU application only), Slack integrations on 28 October, a 15-minute partial outage loading the apps on 27 October and project pages on 30 October (20). The GraphQL API publishes limits, 2,500 requests an hour per user on an API key and 5,000 on OAuth, but the MCP docs don't say whether these apply (10, carried). The rate-limit page now says a limited GraphQL request returns HTTP 429 with RATELIMITED and a Retry-After header, where on 1 October it said HTTP 400; the MCP docs still say nothing on limits or retries, so the partial 5 is carried (the line's 10 for Retry-After alone if the API page is read as covering MCP). Uptime SLA listed on the Enterprise column of the pricing page with no SLA document found (0). The MCP server carries no preview label; only Claude auto-connect is marked beta (10). 15 + 20 + 10 + 5 + 0 + 10 = 60.

ONES 25

Graded as a hosted service on ONES.com Cloud's Open API and MCP server. No status page is linked from ones.com, the trust centre or the docs, and status.ones.com did not resolve (0). With no readable history the incident line scores 5. No rate limit with numbers was found in the developer docs index or the terms, which only reserve the right to restrict excessive traffic (0). No 429, backoff or idempotency guidance found (0). The pricing page states 99.9% uptime on Business and 99.95% on Enterprise (10). The MCP server has been in the release notes since 6.42.0 on 26 August 2025 and carries no beta label (10). 0 + 5 + 0 + 0 + 10 + 10 = 25.

Linear MCP 76

Closed service under Linear's terms, effective 9 June 2026 (15). The privacy policy (effective 17 March 2025) says the services are hosted in the United States, while the security page says a workspace can choose EU or US storage, and retention is "as long as you have an open account" (15). The SSE endpoint is called a deprecated fallback with no end date (8). Subprocessors 12 to 20: the DPA (signed 31 May 2025) lists 34 authorised sub-processors with their locations (United States, European Union or global) and promises notice at least 30 days before a new one, beside EU or US hosting (20). 15 + 15 + 8 + 20 = 58.

ONES 62

Closed service under terms naming The Beautiful ONES Technology PTE. LTD. and Singapore law (15 of 30). The privacy policy of 7 January 2026 deletes business data 30 days after a service ends with no login for 365 days, and honours deletion requests within 30 days, but no DPA or subprocessor list is public (12 of 30). Endpoint version histories record changes, with no deprecation policy (5 of 20). The privacy policy names AWS, Oracle cloud and OpenAI and says data is transferred mostly to the US, China and Singapore, with no subprocessor list or regions (6 of 20). 15 + 12 + 5 + 6 = 38.

Linear MCP 75

OAuth 2.1 with dynamic client registration and a read scope that, in Linear's words, means the token can't reach write APIs, or API keys that can be created with Read permission only, sent in the Authorization header (30). A read-only endpoint plus read-only keys and scopes, but no confirmation step for writes on the full endpoint (16). Tools return issue and comment text written by anyone in the workspace, and we found no prompt-injection guidance (3). Workspace audit logs cover the last 3 months, admins can see active MCP connections and explicit OAuth token revocations are logged since 14 September 2026, but we found no per-call MCP log (8). Programme 14 to 18: security.txt valid (Expires 31 December 2027, read on 4 November) pointing to a disclosure policy that pays rewards for valid vulnerabilities and names the MCP server (mcp.linear.app) in scope, with SOC 2 Type II and ISO/IEC 27001:2022 on the security page and no public advisories found (18, as atlassian-rovo-mcp with security.txt, a bounty and SOC 2 and ISO 27001). 30 + 16 + 3 + 8 + 18 = 75.

ONES 65

OAuth for MCP clients with per-scope consent, Personal API keys created with chosen scopes and shown once, organisation credentials, token introspection and revocation, all sent as Bearer headers (30). Scope groups allow a read-only grant, and the docs advise revoking unused clients, but writes run without a confirmation step and the consent page preselects every group (12 of 20). Tools return issue, comment and wiki text written by other users plus search_external_web results, and no prompt-injection guidance was found (0). The authorised client list shows each client's grant time and last active time, and on-premises installs document an audit log (8 of 15). security.txt valid until June 2027, and the trust centre lists SOC 2 Type II, ISO 27001 and ISO 27018 without report access or a bug bounty (15 of 20). 30 + 12 + 0 + 8 + 15 = 65.