ONES vs Wrike

ONES 68

Latest dated release notes are 7.33.0 on 30 September 2026, 37 days before this check. The registry entry moved to 1.0.3 on 8 October with no release note behind it, so it doesn't set recency (20). Nine dated releases since 8 August, several adding Open API endpoints or MCP capabilities (7.23.0, 7.26.0, 7.27.0, 7.29.0) (20). Closed service with a public changelog and support by email, with no public issue tracker (8 of 15). Verified com.ones/ones namespace in the official MCP registry (15). One official SDK for apps, with package health not checked (5 of 10). 20 + 20 + 8 + 15 + 5 = 68.

Wrike 33

The newest API changelog entries are dated 17 September 2026, 48 days before this check. The MCP tools page was re-stamped on 19 October 2026 and the MCP overview on 9 October, but neither records a change (the same 29 tools as on 8 October), so neither sets the date (20). Two dated changelog entries in the 90 days from 6 August, both on 17 September; the 28 July entry has left the window and the agent skills repository has no releases, so short of three (0). A public changelog, a developer community forum and a support form. We didn't check response times (10 of 15). No official SDK, and the official MCP registry lists only a third-party server, ai.waystation/wrike (0). No packages to assess. The MIT agent skills repository is published by CI and last changed on 7 October 2026 (3 of 10). 20+0+10+0+3 = 33.

ONES 25

Graded as a hosted service on ONES.com Cloud's Open API and MCP server. No status page is linked from ones.com, the trust centre or the docs, and status.ones.com did not resolve (0). With no readable history the incident line scores 5. No rate limit with numbers was found in the developer docs index or the terms, which only reserve the right to restrict excessive traffic (0). No 429, backoff or idempotency guidance found (0). The pricing page states 99.9% uptime on Business and 99.95% on Enterprise (10). The MCP server has been in the release notes since 6.42.0 on 26 August 2025 and carries no beta label (10). 0 + 5 + 0 + 0 + 10 + 10 = 25.

Wrike 55

Graded on the hosted lines for REST API v4 and the MCP server. status.wrike.com is Wrike's own page with a dated timeline but no per-component history and no API or MCP entry, per the 8 October check (15 of 20). The page draws its timeline by script from a data feed on the same host. The 8 October incident reading came from that feed, which this method doesn't read, so it is struck, and the window from 6 August to 4 November is unread (5). The error reference gives 400 requests a minute per IP or access token (15). The FAQ advises retries with exponential backoff on 429, with no Retry-After header and no idempotency keys or safe-retry guidance for writes found (10, backoff guidance alone). No SLA found in the terms, pricing or trust centre pages we read (0). API v4 is generally available and MCP v2 carries no beta label, though recommend_resources is a Wrike Labs tool (10). 15+5+15+10+0+10 = 55.

ONES 55

No downloadable OpenAPI file was found. The reference is rendered pages, and the MCP docs list tool names and one-line descriptions without input schemas (0). llms.txt with sized indexes and a Markdown copy of every page (10). Endpoint and tool descriptions state what each does in one line, with version history per endpoint but little on when not to use one (10 of 20). Parameters are typed with defaults, limits (limit at most 100) and required marks (10 of 15). Each endpoint lists 200, 401, 403, 404 and 500 responses with schemas and examples (10 of 15). API version 2.0, a History table per endpoint and dated release notes (15). 0 + 10 + 10 + 10 + 10 + 15 = 55.

Wrike 78

Each of the 244 API reference pages embeds an OpenAPI 3.0.1 definition with a bearer security scheme, and a Postman collection is published. We found no single downloadable spec (22 of 25). llms.txt and Markdown copies of every docs page (10). API parameter descriptions are short, such as 'Title of task, required', and the MCP tools page gives one line per tool with a few limits stated, for example that prefill_requestform doesn't submit. The MCP tool schemas sit behind authentication and were not read (12 of 20). Enums for status, importance and sort fields and required flags, but structured values such as dates travel as JSON strings in query parameters (11 of 15). Curl and JSON examples in the guides and an error table of 11 codes, while reference responses are grouped as 2XX, 4XX and 5XX (10 of 15). A single v4 version and a dated changelog with sparse entries (13 of 15).

ONES 40

Scored on the MCP server and the Open API together. 67 MCP tools load by default (5), and a client granted fewer scope groups is limited to fewer tools (5 back). Lists take limit and cursor with project and issue type filters, and query_issues_by_onesql runs a filtered query (15 of 20). Error status codes are documented per endpoint with response schemas, but no error code catalogue was found (8 of 20). No idempotency keys or MCP annotations found (0). One official SDK, @ones-open/node-sdk, aimed at ONES Apps, and the MCP setup is one mcp-remote line (7 of 15). 10 + 15 + 8 + 0 + 7 = 40.

Wrike 63

29 MCP tools in a fixed set with no toolsets or read-only subset on the server (15 of 25). Task queries take pageSize up to 1,000, nextPageToken, sort fields, a fields array and filters for dates, assignees and status, and search_items filters by assignee, status, dates and importance (20). Errors return error and errorDescription from 11 documented codes, which name the fault but rarely the fix (14 of 20). No idempotency keys. The tools page marks each tool Read or Write, and whether the server sends readOnlyHint or destructiveHint was not checked. The async Batch API reports per-operation results (6 of 20). Creating a task needs only a title, but the FAQ says there is no official SDK (8 of 15).

ONES 62

Closed service under terms naming The Beautiful ONES Technology PTE. LTD. and Singapore law (15 of 30). The privacy policy of 7 January 2026 deletes business data 30 days after a service ends with no login for 365 days, and honours deletion requests within 30 days, but no DPA or subprocessor list is public (12 of 30). Endpoint version histories record changes, with no deprecation policy (5 of 20). The privacy policy names AWS, Oracle cloud and OpenAI and says data is transferred mostly to the US, China and Singapore, with no subprocessor list or regions (6 of 20). 15 + 12 + 5 + 6 = 38.

Wrike 76

Closed service with terms naming Wrike, Inc., and MIT agent skills (15). The privacy policy of 1 June 2026 gives retention periods but excludes customer data, which falls under the terms and a published DPA. The terms say customer data isn't used to train Wrike AI models, deletion follows 'then-current practices', and inactive Free accounts are deleted after 180 days. The MCP docs say the server stores and caches nothing (22 of 30). No deprecation policy found. The FAQ records the v3 sunset on 30 June 2019, and one parameter is marked deprecated without a date (5 of 20). The sub-processor list, updated 22 October 2026, gives purposes and US or EU locations by region (20).

ONES 65

OAuth for MCP clients with per-scope consent, Personal API keys created with chosen scopes and shown once, organisation credentials, token introspection and revocation, all sent as Bearer headers (30). Scope groups allow a read-only grant, and the docs advise revoking unused clients, but writes run without a confirmation step and the consent page preselects every group (12 of 20). Tools return issue, comment and wiki text written by other users plus search_external_web results, and no prompt-injection guidance was found (0). The authorised client list shows each client's grant time and last active time, and on-premises installs document an audit log (8 of 15). security.txt valid until June 2027, and the trust centre lists SOC 2 Type II, ISO 27001 and ISO 27018 without report access or a bug bounty (15 of 20). 30 + 12 + 0 + 8 + 15 = 65.

Wrike 60

OAuth 2.0 authorisation code flow with read-only and read-write scopes, one-hour access tokens and revocation. Permanent tokens never expire and reach everything their user can, and the docs point clients that need dynamic client registration to them. The docs also allow the token as an access_token query parameter, which costs 10 (20 of 30). The API has wsReadOnly, the MCP server inherits the user's permissions, has no delete tool and marks tools Read or Write, and client admins can restrict tools. No server-side read-only mode or confirmation step is documented (12 of 20). Comments, descriptions and inbox items written by other people reach the model, and no injection guidance was found (3 of 15). MCP actions appear in the activity stream under the user, and user audit reports are limited to Pinnacle and Apex (10 of 15). A vulnerability report form at /security/report/ and appsec@team.wrike.com, named in a security.txt that expired on 10 October 2026, and SOC 2 Type II and ISO 27001, 27017, 27018 and 27701 on the trust centre per the 8 October check. No bug bounty or public advisories found (15 of 20).