ONES vs Redmine

ONES 25

Graded as a hosted service on ONES.com Cloud's Open API and MCP server. No status page is linked from ones.com, the trust centre or the docs, and status.ones.com did not resolve (0). With no readable history the incident line scores 5. No rate limit with numbers was found in the developer docs index or the terms, which only reserve the right to restrict excessive traffic (0). No 429, backoff or idempotency guidance found (0). The pricing page states 99.9% uptime on Business and 99.95% on Enterprise (10). The MCP server has been in the release notes since 6.42.0 on 26 August 2025 and carries no beta label (10). 0 + 5 + 0 + 0 + 10 + 10 = 25.

Redmine 66

Graded on the REST API of a self-hosted install, with the local-software lines. Redmine has no vendor-run cloud. Official tarballs and zip files with SHA-256 sums, and an install guide that states the supported Ruby, Rails and database versions. No official gem or container image (18 of 20, per the 9 October check for the install guide). GitHub Actions runs the 386 test files at tag 7.0.3 on four Ruby versions and three databases. The results are shown only as badge images on github.com, which we cannot read, so a public CI that runs the tests with an unreadable result takes 15 of 25. The issue tracker's lists are closed to us by robots.txt. The 7.0.3 changelog alone lists more than 20 fixed defects, which is the only evidence read (12 of 25). A release policy of quarterly minors and yearly majors, a changelog per series and an API change history (11 of 15). 7.0.x is the latest stable series, but the docs mark 17 of 23 API resources Alpha (10 of 15). 18 + 15 + 12 + 11 + 10 = 66.

ONES 30

No x402, MPP or L402 (0). Plan prices are public per seat a year, with nothing per call (10). The free plan covers up to 30 seats and the pricing page says no card is needed (20). A person signs up in a browser and grants OAuth consent (0). 0 + 10 + 20 + 0 = 30.

Redmine 60

Read with the self-hosted rule. No x402, MPP or L402 in the docs or the source (0). Redmine is free software with nothing to buy from the project (20). No trial or card is involved (20). No signup with a vendor is needed. The owner installs it and creates the key (20).

ONES 55

No downloadable OpenAPI file was found. The reference is rendered pages, and the MCP docs list tool names and one-line descriptions without input schemas (0). llms.txt with sized indexes and a Markdown copy of every page (10). Endpoint and tool descriptions state what each does in one line, with version history per endpoint but little on when not to use one (10 of 20). Parameters are typed with defaults, limits (limit at most 100) and required marks (10 of 15). Each endpoint lists 200, 401, 403, 404 and 500 responses with schemas and examples (10 of 15). API version 2.0, a History table per endpoint and dated release notes (15). 0 + 10 + 10 + 10 + 10 + 15 = 55.

Redmine 32

No OpenAPI document or other machine-readable contract was found in the wiki or the repository (0). No llms.txt (the path returned 404) and no Markdown docs for agents (0). Each resource has a wiki page that lists its calls and parameters in a line each, with little on when to use one (9 of 20). Parameters are named with few types, and allowed values are given for only some, such as status_id and include (5 of 15). Calls have XML and JSON examples, and the 422 validation response is documented. Other error responses are not (9 of 15). The API has no version of its own. Pages note the release each call arrived in, the changelog has a REST API section, and the change history holds two entries, one of them for the unreleased 7.1.0, which also adds a Documents resource (9 of 15).

ONES 65

OAuth for MCP clients with per-scope consent, Personal API keys created with chosen scopes and shown once, organisation credentials, token introspection and revocation, all sent as Bearer headers (30). Scope groups allow a read-only grant, and the docs advise revoking unused clients, but writes run without a confirmation step and the consent page preselects every group (12 of 20). Tools return issue, comment and wiki text written by other users plus search_external_web results, and no prompt-injection guidance was found (0). The authorised client list shows each client's grant time and last active time, and on-premises installs document an audit log (8 of 15). security.txt valid until June 2027, and the trust centre lists SOC 2 Type II, ISO 27001 and ISO 27018 without report access or a bug bounty (15 of 20). 30 + 12 + 0 + 8 + 15 = 65.

Redmine 51

OAuth 2 since 6.1 with the authorisation code grant, refresh tokens, hashed token storage and one scope per Redmine permission. Each user also has one API key with that user's full permissions, which can be reset. The docs give a key query parameter as one way to send it, so 10 is taken off (20 of 30). The REST API is off until an administrator enables it, reach follows roles and permissions, and OAuth scopes can narrow a token to read permissions. A project DELETE through the API skips the confirmation the web page requires (13 of 20). Issue and wiki text is untrusted content, and no prompt-injection guidance was found (2 of 15). Issue changes are journalled with their author, and 7.0 shows when an API key was last used. No API access log beyond the server log was found (7 of 15). A security contact (security(at)redmine.org) with no stated acknowledgement time, an advisories page with severity ratings and a supported-versions policy. No security.txt (404 on 4 November 2026), bug bounty or certificate was found, and most advisories carry no CVE (9 of 20).

ONES 40

Scored on the MCP server and the Open API together. 67 MCP tools load by default (5), and a client granted fewer scope groups is limited to fewer tools (5 back). Lists take limit and cursor with project and issue type filters, and query_issues_by_onesql runs a filtered query (15 of 20). Error status codes are documented per endpoint with response schemas, but no error code catalogue was found (8 of 20). No idempotency keys or MCP annotations found (0). One official SDK, @ones-open/node-sdk, aimed at ONES Apps, and the MCP setup is one mcp-remote line (7 of 15). 10 + 15 + 8 + 0 + 7 = 40.

Redmine 51

Graded on the REST API. Lists return 25 items by default and 100 at most, and related data arrives only when named in include. No field selection (15 of 25). offset, limit and page with a total_count, filters with operators on issues, sort and saved queries (17 of 20). Validation failures return 422 with a list of messages. In the source, other errors answer with a status code and an empty body (9 of 20). No idempotency keys and no retry guidance. A wiki page update with a stale version returns 409, and no equivalent is documented for issues (4 of 20). Creating an issue needs a project and a subject. No official SDK was found, and the wiki lists community clients for nine languages (6 of 15).

ONES 62

Closed service under terms naming The Beautiful ONES Technology PTE. LTD. and Singapore law (15 of 30). The privacy policy of 7 January 2026 deletes business data 30 days after a service ends with no login for 365 days, and honours deletion requests within 30 days, but no DPA or subprocessor list is public (12 of 30). Endpoint version histories record changes, with no deprecation policy (5 of 20). The privacy policy names AWS, Oracle cloud and OpenAI and says data is transferred mostly to the US, China and Singapore, with no subprocessor list or regions (6 of 20). 15 + 12 + 5 + 6 = 38.

Redmine 52

The source is public under the GPL, version 2 or later (30). Data stays on the owner's server. The project publishes no statement on what an install stores or sends, and its privacy policy covers only the redmine.org website. In the source, Gravatar, which sends a hash of each email address to a third party, is off by default (17 of 30). A support policy names the three series that get fixes, and the API change history dates each breaking change. No deprecation policy with notice periods was found (10 of 20). No telemetry was found in a search of the application source, and the docs make no statement either way (12 of 20).