OneUp API + MCP vs Repostit

OneUp API + MCP 17

One account key per user with no scopes, sent as the apiKey query parameter on every REST call and in the MCP URL. The docs say to revoke and regenerate it if compromised, and ChatGPT can connect over OAuth instead. Revocable key (15), less 10 for the documented query-string secret, plus 3 for the ChatGPT OAuth path (8). No read-only mode. requireApproval and isDraftPost give a review step (6). Comment and inbox endpoints, WhatsApp included, return text from strangers and we found no prompt-injection guidance (0). No audit log or key usage view found (0). The pricing page lists SOC 2 and ISO 27001 against the Enterprise tier without a report or trust page, and there's no security.txt or disclosure route (3).

Repostit 44

OAuth with dynamic client registration and no client secret, per Repostit's Claude connector page, with offline access that renews for up to 90 days from the first authorisation; social-network sign-ins stay in Repostit and provider tokens are not passed to the assistant. PKCE S256 is stated only in third-party metadata. No scopes are named; the page lists the permissions shown at sign-in (read accounts, create workflows and Briefs, schedule or publish, read delivery status). Revocation is by disconnecting in the client or asking support (18 of 30). A Brief is saved as a draft, Manual workflows wait for approval, and the help article says the assistant shows each step for confirmation before publishing (on ChatGPT 'may ask', depending on the client); no read-only mode, and an activated future-content workflow publishes on its own (8 of 20). Tools return the user's own accounts, Briefs and delivery results and read no comments or messages (10). Assistant-created posts appear under Post with a Comments & Activity log of each step, and Post History shows each network's response; no per-call log for the connector (8 of 15). security.txt did not load through our reader, and no disclosure policy, bug bounty or certification appears on any page read (0 of 20). 18+8+10+8+0 = 44.

OneUp API + MCP 10

No x402 or other machine payment (0). Plan prices are public, with no per-call price (10). No free plan. The 7-day trial's checkout reads $0.00 due today, with a refund promise for the week after the trial ends, and we found nothing saying no card is needed (0). A person has to sign up in a browser and generate the key (0).

Repostit 30

No x402, MPP or L402 on any page read (0). Plan prices are public without a login, Basic $5 a month, Starter $14 or $10 yearly, Influencer $29 or $20, Agency $149 or $99, with no per-call or per-post price (10 of 20). A 14-day trial with no credit card on every plan, stated on the pricing page, the trial article and the refund page (20). A person signs up in a browser, connects each network in Repostit and approves the connector; no keyless or programmatic route (0). 0+10+20+0 = 30.

OneUp API + MCP 43

The help-centre changelog was updated on 23 September 2026 with September product entries. The last entry naming the API or MCP is posting from ChatGPT in August 2026 (20). 11 entries dated July to September 2026, by month rather than day (15). Public changelog and email support at help@oneupapp.io (8). No SDKs or MCP registry entry (0). No packages to assess (0).

Repostit 56

Closed service. The latest registry version is 2026.10.23, published 23 October 2026, and the connector article was updated 22 October 2026 (30). Dated changes in the last 90 days are the two registry versions of 17 and 23 October 2026; /whats-new/ is undated and the ChatGPT app's 1.1.0 (per the 3 November listing check) carries no date, so fewer than three dated releases (10 of 20). Support is email and weekday chat, 9am to 5pm Eastern, with replies within 24 hours; no public changelog with dates, forum or issue tracker (6 of 15). In the official MCP registry as io.github.hax98/repostit, a GitHub-verified namespace of a personal account; the entry links Repostit's own pages and its address matches the vendor's connector page, but no first-hand page ties the account to the company, so partial credit (10 of 15). No packages, public code or CI to judge (0 of 10). 30+10+6+10+0 = 56.

OneUp API + MCP 40

Closed service under terms from OneUp, Inc. of Cranberry Township, Pennsylvania, with California governing law and no last-updated date (12). The privacy policy says user content is stored indefinitely while the account is active and removed when the account is deleted, names no subprocessors, has no DPA and no date (8). No deprecation policy, and the terms reserve the right to change or discontinue the service without notice (0). No subprocessors or data locations found (0).

Repostit 29

Closed service. The terms of service (effective 7 March 2025, no revision since) name Repostit LLC of Newark, Delaware, with Delaware law and arbitration, take a non-exclusive licence to content only to run the service and say fees are non-refundable; every footer says Repostit, Inc., and the terms do not mention the connector (12 of 30). The privacy policy (29 July 2026) keeps data until the account is deleted or as needed, with no periods, deletes Pinterest credentials on disconnect but says nothing of other networks' tokens, names no DPA, and does not mention the connector or its 90-day offline access; the account deletion article gives no timeline and leaves network-side access to the user (10 of 30). No deprecation policy or dated notices; the terms promise notice of significant changes and the ChatGPT page names a pending version 1.1 without a date (3 of 20). Subprocessors are 'hosting providers, analytics services', unnamed, with transfers outside the user's country and no locations; the Tawk.to chat on the contact page and the Google Cloud Run host of the connector are not named in the policy (2 of 20). 12+10+3+2 = 27.

OneUp API + MCP 18

No status page. status.oneupapp.io doesn't resolve and neither the homepage nor the docs link one (0). No incident history to read (5). The REST docs give no rate limits. The 30 September check saw an x-ratelimit-limit of 60 on the MCP endpoint, which no page documents (3). No 429 or retry guidance, and no idempotency for writes (0). No SLA, and the terms disclaim uninterrupted service (0). The API and MCP aren't labelled beta (10).

Repostit 26

Hosted reading, for the connector and the service behind it. No status page was found. None is linked from the help centre, the contact page, the footer or the troubleshooting articles, and https://repostit.io/status/ did not load through our reader, which also fails on the home page (0). No readable incident history, so the floor (5). Repostit publishes posting quotas rather than request limits, 10 posts on the trial, 10 video posts a month on Basic, existing-content workflows up to 5 posts a day, plus per-network rules and 20 MB images through the connector; no request rate for the connector, and the terms only bar automated access faster than a human (6 of 15). No 429 or overload handling is documented. The Claude connector page says Queued means accepted, not delivered, and to check the existing result before retrying to avoid duplicate posts, and Brief locks queued posts against a second send; no idempotency key and no page says failed posts are retried (5 of 15). No SLA; the terms (7 March 2025) let Repostit modify or discontinue the service at any time and say nothing on uptime (0). The connector carries no beta label and its registry entry is active (10). 0+5+6+5+0+10 = 26.

OneUp API + MCP 31

The hosted MCP returned 50 tools on tools/list per the 30 September check, with no toolsets or read-only subset (5). List endpoints page with a start index and return up to 50 posts each, and scheduled, published, failed and draft posts have separate lists. No field selection (12). Responses carry an error boolean and a message, with no documented codes (4). No idempotency key. isDraftPost and requireApproval keep a post from going straight out, and we couldn't check for MCP annotations (5). No SDKs. A text post needs five parameters (5).

Repostit 25

MCP reading. The tool count is not published. The connector pages describe seven actions (list accounts, create, schedule and publish a Brief, check delivery, create a workflow, send a connection link), which suggests a small set, but the definitions were not read, so a middle reading rather than full marks (10 of 25). No pagination, filtering or output-size controls are documented (0 of 20). Delivery checks report a result per destination with public links when the network gives one, and the help centre lists failure reasons per network, but no error codes or connector error messages are documented (5 of 20). No idempotency key and no readOnlyHint or destructiveHint seen; Briefs start as drafts, queued Briefs are locked against a second send, Manual workflows hold posts for approval and the guidance says to check before retrying (6 of 20). Requests are made in plain language with few stated requirements (an HTTPS media URL, a timezone); no SDK in any language (4 of 15). 10+0+5+6+4 = 25.