nTop vs Onshape

nTop 26

Licence credentials rather than tokens, since ntopcl signs in with a username and password on the command line or a FlexNet server address, with no scoped, revocable or expiring key (8 of 30). The Run Command block has Prompt per File, Prompt per Block and Disallow All settings, which is the only approval control found; the docs MCP server is read-only (10 of 20). The docs server returns nTop's own documentation and ntopcl returns geometry, so little untrusted content reaches the model; no guidance was found (8 of 15). No audit log or per-call record found (0 of 15). No security.txt (404), disclosure policy, bug bounty, certification or advisories found on ntop.com or docs.ntop.com (0 of 20). 8 + 10 + 8 + 0 + 0 = 26.

Onshape 63

API keys scoped to permissions, revocable, two per individual account, with a signed request scheme; OAuth 2.0 authorisation code with 60-minute access tokens and refresh tokens revoked with the user's grant; no key expiry documented (26 of 30). Permission scopes allow read-only keys; no confirmation step before destructive calls and no approval gate on the MCP server beyond the App Store subscription (12 of 20). The MCP server reads FeatureScript errors and geometry from the document and no prompt-injection guidance was found (5 of 15). API usage counts are visible under Developer settings per company or user; no per-call audit log was found (6 of 15). SOC 2 Type 2 audited annually, AES-256 and TLS 1.2 with HSTS, paid researcher testing and security@onshape.com, but no security.txt (404), no public bug bounty and no advisories page (14 of 20). 26 + 12 + 5 + 6 + 14 = 63.

nTop 45

Read for closed software with a docs site. The newest release notes are for nTop 6.3, undated; the docs sitemap last modified the 6.1 page on 21 September 2026 and the Core package page on 19 October 2026, so a change within 90 days is likely but no release date was read (20 of 30). Four versions (6.0 to 6.3) are documented and the 6.0 and 6.1 pages changed in September, but without dates we can't count three releases in 90 days (12 of 20). support@ntop.com, a community site that renders only a loading screen, and a feedback tool on the docs server; no public issues or reply times (8 of 25). No entry in the official MCP registry for the docs server, and the only SDK is a beta Python package behind a login (5 of 15). No CI, package index or dependency data to read (0 of 10). 20 + 12 + 8 + 5 + 0 = 45.

Onshape 79

Read for a closed service. API release notes rel-1.223 dated 30 October 2026 (30). Six dated releases from 17 July to 30 October, three weeks apart (20). A public changelog, forum.onshape.com and api-support@onshape.com; response times were not tested (12 of 15). No Onshape-owned server in the official MCP registry, where the only match is io.github.gpambrozio/onshape; the official Go client was pushed on 31 October 2026 and the TypeScript clients in June and September 2025 (12 of 15). The Go client is generated and its CI was not read; the multi-language onshape-clients repository is archived (5 of 10). 30 + 20 + 12 + 12 + 5 = 79.

nTop 38

Read with the local-software lines, since ntopcl and the Core package run on the owner's machine. ntopcl ships inside the nTop Windows installer and the Core package states Python 3.10 or later on Windows and Linux, but both come from app.ntop.com behind a login, not a public package index (12 of 20). No public CI or test suite (0). No public issue tracker; the knowledge base has articles on debugging Automate errors and the 6.3 notes record ntopcl rejecting duplicate input names, which is all the crash record we could read (8 of 25). Release notes per version call out behaviour changes such as unique block names in 6.3, and the Core package warns that breaking changes may land between any two versions, with no semver statement (8 of 15). nTop 6.x is a released product; nTop Core is beta (10 of 15). 12 + 0 + 8 + 8 + 10 = 38.

Onshape 60

Read with the hosted lines on cad.onshape.com. Atlassian Statuspage at status.onshape.com with regional CAD service components and history feeds (20). The feed holds 18 incidents from 15 August to 30 October 2026, all degraded performance, delayed imports and exports or partial signup blocks, the longest 2 hours 42 minutes of export degradation on 15 September and imports, exports and notifications not working for 1 hour 42 minutes on 11 September; no full outage of the CAD service (18 of 30). Annual API call quotas are published per plan with numbers, while per-endpoint rate limits are said to vary by endpoint with no figure (8 of 15). 429 is documented without a header or backoff timing, 402 marks a spent quota, and no idempotency guidance was found (6 of 15). The terms promise commercially reasonable efforts and no SLA (0). The REST API is generally available; the FeatureScript MCP Server is an early-access Labs feature (8 of 10). 20 + 18 + 8 + 6 + 0 + 8 = 60.

nTop 0

Read with the paid-software rule, since nothing an agent would run is free. No x402, MPP or L402 (0). No price is published anywhere we read; licences are quoted by sales (0). No free tier or trial terms found; educational licences exist for students (0). A person buys a per-user licence, signs in at app.ntop.com and installs nTop; nothing is obtainable by an agent alone (0). 0 + 0 + 0 + 0 = 0.

Onshape 22

No x402, MPP or L402 (0). Plan prices are public per user per year, with no per-call price; extra API calls are sold by sales at an unpublished rate (10). The Free plan costs nothing for non-commercial use with public documents and a Professional trial needs no card; whether the Free plan asks for a card was not stated (12 of 20). A person signs up in a browser and creates the key or OAuth app (0). 0 + 10 + 12 + 0 = 22.

nTop 60

A command line with one notebook and two JSON files, a Python package with one class, and a docs MCP server with two tools, so almost nothing to load before work starts (20 of 25). Outputs are files whose size follows the notebook, mesh and voxel outputs are sized by feature_size and spacing, and the docs server caps each answer at 30 KB with rg and head for narrowing (12 of 20). Core raises builtin exceptions with messages; ntopcl's errors are described in knowledge-base articles rather than a reference (10 of 20). Running a notebook again with the same inputs produces the same outputs, and the SAVE flag controls whether inputs are written back; no annotations on the docs tools were published (10 of 20). The three-function ntopcl.py helper keeps defaults few, but every run needs a licence argument or signed-in session and only Python is covered (8 of 15). 20 + 12 + 10 + 10 + 8 = 60.

Onshape 46

Document and element endpoints take ids and the list endpoints take limit and offset, with no field selection documented in what we read; the MCP server's tool count is unknown (12 of 25). Pagination and filters on document lists, and revisions page (a paging loop was fixed in rel-1.219) (14 of 20). HTTP codes with 401, 402 and 429 meanings; the error body shape was on the unread response codes page (10 of 20). No idempotency keys; POSTs create microversions on every edit; no readOnlyHint or destructiveHint published for the MCP tools (2 of 20). Every API key request needs a Date header, a nonce and an HMAC-SHA256 signature, and 307 redirects need a new signature; official Go and TypeScript clients handle it (8 of 15). 12 + 14 + 10 + 2 + 8 = 46.

nTop 51

Closed software under an EULA last updated February 2026 that names nTopology Inc. and New York law (15). The privacy policy of February 2026 names the controller and US hosting, keeps data as long as needed with no periods, names no subprocessors, and the EULA says usage data is collected to run and improve the products; the statements agree but say little (12 of 30). No deprecation policy; the Core package says only that breaking changes may occur (4 of 20). The EULA discloses usage data collection and the licensing page says the desktop connects to the cloud for analytics, with no opt-out found (6 of 20). 15 + 12 + 4 + 6 = 37.

Onshape 60

Closed service with clear terms of 15 July 2020 naming PTC Inc. and Massachusetts law (15). The privacy policy has moved to ptc.com, which our reader could not fetch; the data disclosures page names subprocessors (AWS, Salesforce, SendGrid, Zendesk, Vanilla Forums, Crownpeak, Thought Industries, Stripe, Zuora) without retention periods, and neither the terms nor the disclosures say whether customer content trains AI (12 of 30). Deprecations are marked in dated release notes and flagged with an x-deprecated header, but no notice period is stated (12 of 20). Subprocessors are named and the status page lists hosting regions by continent; no formal data location statement was read (14 of 20). 15 + 12 + 12 + 14 = 53.