OneUp API + MCP vs Pamba

OneUp API + MCP 32

No OpenAPI or other machine-readable contract. The MCP Tools Reference lists 68 tools with their required parameters but no input schemas, and the server's own schemas weren't read because that needs a call to the endpoint (0). No llms.txt, docs.oneupapp.io/llms.txt returned 404 on 11 November (0). Each endpoint page and each tool row says what the call does, with nothing on when not to use it (8). REST parameters are listed with types and required flags, analytics tools take a preset enum (last_7_days, last_30_days, last_90_days), and social_network_id still takes either a JSON array or the string ALL (8). Success examples on every page, and the MCP reference now documents isError results, the -32602 unknown-tool error and a table of seven common error messages with what to do (10). No API versioning. A help-centre changelog dated by month includes API and MCP entries (6).

Pamba 84

No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.

OneUp API + MCP 31

The MCP Tools Reference lists 68 tools with no toolsets or read-only subset, and says tools/list may be split into pages (5). REST list endpoints page with a start index and return up to 50 posts each, with separate lists for scheduled, published, failed and draft posts. No field selection (12). REST responses carry an error boolean and a message with no documented codes, while MCP results set isError with text saying what to fix, and the reference tabulates the common messages and their remedies. That covers the MCP server but not the REST API, so the line keeps its earlier partial value (4). No idempotency key. isDraftPost and requireApproval keep a post from going straight out, and MCP annotations weren't read (5). No SDKs. A text post needs five parameters (5). Total 31.

Pamba 75

Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.

OneUp API + MCP 28

The help-centre changelog, dated by month, runs to November 2026, but its entries since August are app functions (cross-posting, DM automations, dark mode, sign-in with Google) that the API doesn't serve. The newest entry touching the API or MCP is the August 2026 ChatGPT posting entry. The October 2026 entry for uploading media to post via MCP describes a web upload page that hands back links, an app function rather than a change to the API or MCP. A month-only entry can't show a change within 30 days (20). Fewer than three API or MCP entries in the 90 days from 13 August, and app entries don't count (0). Public changelog and support at support@oneupapp.io and help@oneupapp.io (8). No SDKs or MCP registry entry (0). No packages to assess (0).

Pamba 70

Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.

OneUp API + MCP 15

No x402 or other machine payment (0). Plan prices are public, with no per-call price (10). No free plan. The 7-day trial's checkout reads $0.00 due today, and we found nothing saying no card is needed (0). A person has to sign up in a browser and generate the key, and the OAuth flow asks for that key in a browser page (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 10 is 15.

Pamba 53

No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

OneUp API + MCP 15

No status page. Neither the homepage, the pricing page nor the docs link one (0). No incident history to read (5). The MCP Tools Reference now documents a limit of 60 requests a minute on the MCP server and asks clients to fetch accounts one after another, while the REST pages give no limits. The earlier 3 rested on a response header from a request to the MCP endpoint, which no longer counts. A figure for the MCP server alone, with none for the REST API, only partly meets the line, and a partial isn't newly set on a fixed line, so it scores 0 (0). No 429 or retry guidance, and no idempotency for writes (0). No SLA, and the terms disclaim uninterrupted service (0). The API and MCP aren't labelled beta (10). Total 15.

Pamba 45

Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists "SLA guarantees" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

OneUp API + MCP 21

One account key per user with no scopes, sent as the apiKey query parameter on every REST call and documented as a direct MCP URL. The docs say to regenerate it on the API Access page. Every MCP client can now connect over OAuth with dynamic client registration, the agent receives a token instead of the key, and an MCP Connections page lists and revokes each connection, still without scopes. Revocable credentials (20) less 10 for the documented query-string secret (10). No read-only mode. requireApproval and isDraftPost give a review step (6). Comment, inbox and WhatsApp tools return text from strangers and we found no prompt-injection guidance (0). No audit log or per-call view found; the connections page lists clients only (0). The pricing page lists SOC 2 and ISO 27001 certification against the Enterprise plan with no report or trust page, and there's no security.txt (404 on 11 November) or disclosure route. A bare certification claim takes 5 on this line by this run's reading (5).

Pamba 35

OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.