ONES vs Todoist

ONES 40

Scored on the MCP server and the Open API together. 67 MCP tools load by default (5), and a client granted fewer scope groups is limited to fewer tools (5 back). Lists take limit and cursor with project and issue type filters, and query_issues_by_onesql runs a filtered query (15 of 20). Error status codes are documented per endpoint with response schemas, but no error code catalogue was found (8 of 20). No idempotency keys or MCP annotations found (0). One official SDK, @ones-open/node-sdk, aimed at ONES Apps, and the MCP setup is one mcp-remote line (7 of 15). 10 + 15 + 8 + 0 + 7 = 40.

Todoist 77

47 MCP tools at v13.8.2 scores 5. No toolsets or read-only subset, but a test in the repository caps tool definitions plus instructions at 35,700 tokens and several tools take batches, so 3 added back (8). Cursor pagination with limit (default 50, maximum 200), a filter query language at /tasks/filter, and MCP task searches that default to 10 results (20). JSON errors with error_tag, error_code and error_extra holding retry_after and an explanation, and since v13.7.2 batch tools report per-item failures (17). Every MCP tool has readOnlyHint, destructiveHint and idempotentHint (22 read-only and 12 destructive at v13.8.2, after v13.6.4 corrected several), and Sync commands are idempotent by uuid. REST idempotency isn't documented (17). A task needs only content, due dates accept natural language, and there are official Python and TypeScript SDKs (15). 8 + 20 + 17 + 17 + 15 = 77.

ONES 25

Graded as a hosted service on ONES.com Cloud's Open API and MCP server. No status page is linked from ones.com, the trust centre or the docs, and status.ones.com did not resolve (0). With no readable history the incident line scores 5. No rate limit with numbers was found in the developer docs index or the terms, which only reserve the right to restrict excessive traffic (0). No 429, backoff or idempotency guidance found (0). The pricing page states 99.9% uptime on Business and 99.95% on Enterprise (10). The MCP server has been in the release notes since 6.42.0 on 26 August 2025 and carries no beta label (10). 0 + 5 + 0 + 0 + 10 + 10 = 25.

Todoist 61

Graded on the hosted API v1 and the hosted MCP server. Instatus page at status.todoist.net (status.todoist.com redirects there) with Web application & API, Content Sync API, Website and Infrastructure components (20). In the 90 days from 3 August 2026 the history, re-read on 1 November, shows a 25 August "Sync and login issue" with Web application & API and Content Sync API in major outage from 8:58 to 9:17 AM UTC (19 minutes, inside a 1 hour 36 minute incident), and "Degraded performance in the web and desktop apps" from 31 August to 3 September for "some users" (65 hours 38 minutes). The 25 August outage took the whole API and sync down, which this run reads as a major however short, as for asana's and sumsub's full outages under an hour. The 31 August incident is partial by its own text, and the 3 August billing incident (Stripe and the Billing Portal) doesn't touch the API. Planned 15-minute API shutdowns on 20 and 23 August, 6 September and 29 October were announced ahead and aren't counted. One major (10). Limits are published for /sync only, 1,000 partial and 100 full requests per user per 15 minutes, with no figure for the other REST endpoints (10). 429 is documented, errors carry retry_after and a Retry-After header, and Sync commands are idempotent by uuid, with no general backoff guidance (11). No SLA found in the terms of service (0). API v1 and the MCP page carry no beta label (10). 20 + 10 + 10 + 11 + 0 + 10 = 61.

ONES 55

No downloadable OpenAPI file was found. The reference is rendered pages, and the MCP docs list tool names and one-line descriptions without input schemas (0). llms.txt with sized indexes and a Markdown copy of every page (10). Endpoint and tool descriptions state what each does in one line, with version history per endpoint but little on when not to use one (10 of 20). Parameters are typed with defaults, limits (limit at most 100) and required marks (10 of 15). Each endpoint lists 200, 401, 403, 404 and 500 responses with schemas and examples (10 of 15). API version 2.0, a History table per endpoint and dated release notes (15). 0 + 10 + 10 + 10 + 10 + 15 = 55.

Todoist 76

The OpenAPI 3.1 description is embedded in the API reference at developer.todoist.com/api/v1/, read on 1 November with 124 operations on 94 paths, and MCP tools are defined with zod input and output schemas (25). developer.todoist.com's robots.txt now disallows every path but the home page and /api/v1/, so the separate openapi.json file and the 8 October reading of it are struck, and llms.txt there couldn't be checked. www.todoist.com/llms.txt answers with an HTML page, and no Markdown docs were found (0). All 124 operations have descriptions, and the MCP server instructions say which tool to pick, for example reschedule-tasks over update-tasks for dates (17). 97 enums in the embedded spec and bounded limits in the MCP schemas, but /sync takes a free-form list of commands (12). Examples throughout (1,142 example keys), and 400, 401, 403 and 404 on every operation with the error object documented. 429 appears on 11 of 124 operations (12). The API is versioned with a v9 migration guide, and the MCP server, SDKs and CLI have dated changelogs. No dated changelog for the API itself was found, only a mailing list (10). 25 + 0 + 17 + 12 + 12 + 10 = 76.

ONES 68

Latest dated release notes are 7.33.0 on 30 September 2026, 37 days before this check. The registry entry moved to 1.0.3 on 8 October with no release note behind it, so it doesn't set recency (20). Nine dated releases since 8 August, several adding Open API endpoints or MCP capabilities (7.23.0, 7.26.0, 7.27.0, 7.29.0) (20). Closed service with a public changelog and support by email, with no public issue tracker (8 of 15). Verified com.ones/ones namespace in the official MCP registry (15). One official SDK for apps, with package health not checked (5 of 10). 20 + 20 + 8 + 15 + 5 = 68.

Todoist 88

MCP server v13.8.2, CLI v5.9.0 and TypeScript SDK v15.13.0, all on 31 October 2026 (30). 46 tagged MCP server releases, 68 CLI tags and 27 TypeScript SDK tags in the 90 days from 3 August, read from clones (20). Ten open issues and pull requests on Doist/todoist-mcp against 554 stars, per the 8 October check (GitHub's API wasn't readable on 1 November), and changelog entries cite the issues they close. We didn't read reply times (15). net.todoist/mcp is in the official MCP registry under the vendor's domain namespace, though the entry is still version 1.0.0 from 24 September 2025. The TypeScript SDK is current (15). CI runs on Node 24 and 26 and npm packages are published with provenance, per the 8 October check. The Python SDK's last tag is still v4.0.0 from 25 March 2026, with breaking changes waiting under Unreleased (8). 30 + 20 + 15 + 15 + 8 = 88.

ONES 62

Closed service under terms naming The Beautiful ONES Technology PTE. LTD. and Singapore law (15 of 30). The privacy policy of 7 January 2026 deletes business data 30 days after a service ends with no login for 365 days, and honours deletion requests within 30 days, but no DPA or subprocessor list is public (12 of 30). Endpoint version histories record changes, with no deprecation policy (5 of 20). The privacy policy names AWS, Oracle cloud and OpenAI and says data is transferred mostly to the US, China and Singapore, with no subprocessor list or regions (6 of 20). 15 + 12 + 5 + 6 = 38.

Todoist 77

The service is closed with published terms (effective 27 August 2026, re-read on 1 November), and the MCP server, both SDKs and the CLI are MIT (20). The privacy policy (effective 27 August 2026) keeps data as long as necessary and holds an encrypted backup for 90 days after account deletion. The terms let Todoist send user content to third-party LLM providers. No DPA and no statement on model training was found on the pages we read (17). Deprecation notices appear in the API docs without dates, alongside a v9 migration guide and an API mailing list (8). The privacy policy names AWS, Microsoft Azure, Google Cloud, Zendesk and Google and says data is processed in the US. The full sub-processor list is on the trust centre, which we couldn't read (12). 20 + 17 + 8 + 12 = 57.