ONES vs Teamwork.com

ONES 25

Graded as a hosted service on ONES.com Cloud's Open API and MCP server. No status page is linked from ones.com, the trust centre or the docs, and status.ones.com did not resolve (0). With no readable history the incident line scores 5. No rate limit with numbers was found in the developer docs index or the terms, which only reserve the right to restrict excessive traffic (0). No 429, backoff or idempotency guidance found (0). The pricing page states 99.9% uptime on Business and 99.95% on Enterprise (10). The MCP server has been in the release notes since 6.42.0 on 26 August 2025 and carries no beta label (10). 0 + 5 + 0 + 0 + 10 + 10 = 25.

Teamwork.com 73

Graded on the hosted lines for REST API v3 and the hosted MCP server. status.teamwork.com is a Statuspage site whose front page lists components for Projects, Desk, Chat, Spaces and CRM in the US and EU regions, the websites and the API docs, though none for the API or the MCP server by name (20). Its history.atom feed, read on 1 November (robots.txt closes /api/, so the 8 October reading of the incidents and components feeds no longer counts), lists three incidents in the 90 days from 3 August, besides scheduled maintenance. Task creation in Projects for 40 minutes on 24 September, the Projects API in the US region from 13:08 to 14:58 UTC on 16 October, and loading issues for Projects apps in the US region from 15:58 to 17:21 UTC on 26 October. Each touched one function or one region, so all read as minor (20). The pricing page gives the API limit per plan, 150 requests a minute on Free, Basics and Accelerate, 300 on Optimize and 500 on Enterprise (15). A 429 comes with X-Rate-Limit-Limit, X-Rate-Limit-Remaining and X-Rate-Limit-Reset and the guide says access returns after 60 seconds. No Retry-After header and no idempotency keys were found (8 of 15). No SLA found. The terms promise reasonable endeavours and the security page states a goal of over 99.9 per cent (0). API v3 and MCP server 1.x carry no beta label (10).

ONES 40

Scored on the MCP server and the Open API together. 67 MCP tools load by default (5), and a client granted fewer scope groups is limited to fewer tools (5 back). Lists take limit and cursor with project and issue type filters, and query_issues_by_onesql runs a filtered query (15 of 20). Error status codes are documented per endpoint with response schemas, but no error code catalogue was found (8 of 20). No idempotency keys or MCP annotations found (0). One official SDK, @ones-open/node-sdk, aimed at ONES Apps, and the MCP setup is one mcp-remote line (7 of 15). 10 + 15 + 8 + 0 + 7 = 40.

Teamwork.com 68

The generated tool reference at v1.60.1 lists 233 tools on the main MCP endpoint (225 on 8 October), 155 of them for Projects, which earns 5. Profile endpoints, 14 named toolsets, a -read-only flag on the local server and verbose=false on list tools add 9 back, and API v3 has sparse fieldsets (14 of 25). page and pageSize (default 50, up to 500 on most v3 endpoints), date, status and custom field filters, sorting and sideloading through include (20). MCP tools return text errors that name the bad parameter. The API error guide lists six status codes with causes and no body format (12 of 20). Tools carry readOnlyHint, destructiveHint and openWorldHint annotations, and batch tools validate every item before writing. No idempotency keys were found (12 of 20). Creating a task needs a name and a tasklist id. The one official SDK found is for Go (9 of 15).

ONES 68

Latest dated release notes are 7.33.0 on 30 September 2026, 37 days before this check. The registry entry moved to 1.0.3 on 8 October with no release note behind it, so it doesn't set recency (20). Nine dated releases since 8 August, several adding Open API endpoints or MCP capabilities (7.23.0, 7.26.0, 7.27.0, 7.29.0) (20). Closed service with a public changelog and support by email, with no public issue tracker (8 of 15). Verified com.ones/ones namespace in the official MCP registry (15). One official SDK for apps, with package health not checked (5 of 10). 20 + 20 + 8 + 15 + 5 = 68.

Teamwork.com 93

MCP server v1.60.1 was tagged on 30 October 2026 (30). The repository has 54 tags from 3 August to 30 October 2026, four of them since 8 October (20). Issue activity per the 8 October check of the GitHub API, not re-read on 1 November because GitHub refuses our reader. Three issues were open, and a bug report of 6 October (#581) was fixed and released the same day (20 of 25). The official MCP registry lists com.teamwork/mcp under Teamwork's own namespace, with 1.60.1 published on 30 October as the latest version, beside the Go SDK twapi-go-sdk (v1.37.0 on 23 October) (15). A test workflow runs on every push, and dependency updates are merged within days (8 of 10).

ONES 62

Closed service under terms naming The Beautiful ONES Technology PTE. LTD. and Singapore law (15 of 30). The privacy policy of 7 January 2026 deletes business data 30 days after a service ends with no login for 365 days, and honours deletion requests within 30 days, but no DPA or subprocessor list is public (12 of 30). Endpoint version histories record changes, with no deprecation policy (5 of 20). The privacy policy names AWS, Oracle cloud and OpenAI and says data is transferred mostly to the US, China and Singapore, with no subprocessor list or regions (6 of 20). 15 + 12 + 5 + 6 = 38.

Teamwork.com 80

Closed service under terms naming Teamwork Crew Limited, with the MCP server, the Go SDK and the token helper open on GitHub and the MCP server under MIT (18 of 30). The privacy notice, last updated 19 August 2024, sends customer data to the DPA. The DPA and the terms agree that data is deleted after termination unless a copy is requested within 10 days, and the AI policy says customer data isn't used to train models. No retention periods are given (20 of 30). No written deprecation policy. The removal of localhost redirect URIs for dynamically registered OAuth apps was announced on 16 June 2026 for 1 August 2026 with Deprecation and Sunset headers, and the paging guide dates the end of total record counts to 6 January 2025 (12 of 20). The DPA lists ten sub-processors by function without locations, the AI list names AWS, OpenAI, Anthropic and Google with locations given as varying, and the security page says hosting is on AWS in the US and the EU (13 of 20).

ONES 55

No downloadable OpenAPI file was found. The reference is rendered pages, and the MCP docs list tool names and one-line descriptions without input schemas (0). llms.txt with sized indexes and a Markdown copy of every page (10). Endpoint and tool descriptions state what each does in one line, with version history per endpoint but little on when not to use one (10 of 20). Parameters are typed with defaults, limits (limit at most 100) and required marks (10 of 15). Each endpoint lists 200, 401, 403, 404 and 500 responses with schemas and examples (10 of 15). API version 2.0, a History table per endpoint and dated release notes (15). 0 + 10 + 10 + 10 + 10 + 15 = 55.

Teamwork.com 72

A Swagger 2.0 file for API v3 downloads from each reference page (319 paths, 430 operations) with no security scheme declared, and every MCP tool has a typed JSON Schema input in the public source (23 of 25). apidocs.teamwork.com/llms.txt returns 404. The main site has an llms.txt about the company and a Markdown pricing page, and the MCP tool reference is Markdown on GitHub (3 of 10). MCP descriptions say when to use a tool and name pitfalls, for example that a workflow from another project is ignored without a warning. API parameter descriptions are one line each (15 of 20). Enums, minimums and maximums and required fields in both, with nullable unions on many MCP inputs (12 of 15). Reference pages show response examples and 400, 403, 404 and 409 responses, while the error guide is brief and has no error body format (10 of 15). The API is versioned v1, v2 and v3 and the MCP server has tagged releases on GitHub, but no changelog for the REST API was found (9 of 15).

ONES 65

OAuth for MCP clients with per-scope consent, Personal API keys created with chosen scopes and shown once, organisation credentials, token introspection and revocation, all sent as Bearer headers (30). Scope groups allow a read-only grant, and the docs advise revoking unused clients, but writes run without a confirmation step and the consent page preselects every group (12 of 20). Tools return issue, comment and wiki text written by other users plus search_external_web results, and no prompt-injection guidance was found (0). The authorised client list shows each client's grant time and last active time, and on-premises installs document an audit log (8 of 15). security.txt valid until June 2027, and the trust centre lists SOC 2 Type II, ISO 27001 and ISO 27018 without report access or a bug bounty (15 of 20). 30 + 12 + 0 + 8 + 15 = 65.

Teamwork.com 58

OAuth 2.0 authorisation code flow with PKCE (S256) and dynamic client registration, with scopes at product level only (projects, desk, spaces, chat). The app login flow guide calls the access token permanent, and personal use is by a per-user API key or username and password over Basic auth. Credentials travel in the Authorization header (20 of 30). Every credential acts with its user's permissions. An administrator has to enable MCP for the site, the shipped servers register no delete tools, and the local server has a -read-only flag. The hosted server has no documented read-only mode or confirmation step (12 of 20). Task descriptions, comments, tickets and chat messages written by other people reach the model, and no injection guidance was found (3 of 15). An activity tool and a guide to project change history exist. No log of API or MCP calls for the operator was found (8 of 15). security.txt is valid until 17 July 2027 and names security@teamwork.com, the MCP repository has a security policy with a 48-hour acknowledgement, and the security page lists ISO/IEC 27001:2022 and SOC 2 Type 2. No bug bounty or public advisories found (15 of 20).