OneUp API + MCP vs TwitterAPI.io MCP

OneUp API + MCP 31

The hosted MCP returned 50 tools on tools/list per the 30 September check, with no toolsets or read-only subset (5). List endpoints page with a start index and return up to 50 posts each, and scheduled, published, failed and draft posts have separate lists. No field selection (12). Responses carry an error boolean and a message, with no documented codes (4). No idempotency key. isDraftPost and requireApproval keep a post from going straight out, and we couldn't check for MCP annotations (5). No SDKs. A text post needs five parameters (5).

TwitterAPI.io MCP 78

12 compact tools, about 12 KB (15). Cursor-based paging on followers and search (18 of 20). 429 handling documented (10 of 20). All 12 annotated read-only (20). Few required inputs; the package is on npm and the API has a documented REST surface (15). 15 + 18 + 10 + 20 + 15 = 78.

OneUp API + MCP 27

No OpenAPI or other machine-readable contract, and we couldn't read the MCP input schemas without a key (0). No llms.txt, docs.oneupapp.io/llms.txt returned 404 (0). Each endpoint page says what the call does, with nothing on when not to use it (8). Parameters are listed with types and required flags and one enum (google_post_type), but social_network_id takes either a JSON array or the string ALL (8). Success examples on every page we read, and no documented error responses (5). No API versioning. A help-centre changelog dated by month includes API and MCP entries (6).

TwitterAPI.io MCP 62

12 tools read from tools/list with JSON Schema inputs (25). llms.txt (10). Short descriptions of what each returns (10 of 20). Typed inputs with two enums (10 of 15). Examples on the docs page, errors described only as 429 (7 of 15). No changelog found (404); registry version 1.0.1 (0). 25 + 10 + 10 + 10 + 7 + 0 = 62.

OneUp API + MCP 10

No x402 or other machine payment (0). Plan prices are public, with no per-call price (10). No free plan. The 7-day trial's checkout reads $0.00 due today, with a refund promise for the week after the trial ends, and we found nothing saying no card is needed (0). A person has to sign up in a browser and generate the key (0).

TwitterAPI.io MCP 40

No machine payment protocol (0). Per-result prices public (20). Up to $1 in free credits, no card (20). A Google sign-in in a browser gets the key (0). 0 + 20 + 20 + 0 = 40.

OneUp API + MCP 18

No status page. status.oneupapp.io doesn't resolve and neither the homepage nor the docs link one (0). No incident history to read (5). The REST docs give no rate limits. The 30 September check saw an x-ratelimit-limit of 60 on the MCP endpoint, which no page documents (3). No 429 or retry guidance, and no idempotency for writes (0). No SLA, and the terms disclaim uninterrupted service (0). The API and MCP aren't labelled beta (10).

TwitterAPI.io MCP 40

No status page found (0). No incident history (5). Per-account QPS limits documented by tier (15). 'Hitting the ceiling returns an HTTP 429 (no Retry-After header is sent). Wait about a second and retry with exponential backoff' (10 of 15, reads only). No SLA; the terms disclaim uninterrupted service (0). Not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

OneUp API + MCP 17

One account key per user with no scopes, sent as the apiKey query parameter on every REST call and in the MCP URL. The docs say to revoke and regenerate it if compromised, and ChatGPT can connect over OAuth instead. Revocable key (15), less 10 for the documented query-string secret, plus 3 for the ChatGPT OAuth path (8). No read-only mode. requireApproval and isDraftPost give a review step (6). Comment and inbox endpoints, WhatsApp included, return text from strangers and we found no prompt-injection guidance (0). No audit log or key usage view found (0). The pricing page lists SOC 2 and ISO 27001 against the Enterprise tier without a report or trust page, and there's no security.txt or disclosure route (3).

TwitterAPI.io MCP 37

OAuth or a single API key per account (20 of 30). All tools are reads (12 of 20). Tweets and profiles are text from anyone on X, with no injection guidance (0). No audit log (0). No security.txt or programme found (5 of 20). 20 + 12 + 0 + 0 + 5 = 37.