OneUp API + MCP vs Xpoz MCP

OneUp API + MCP 27

No OpenAPI or other machine-readable contract, and we couldn't read the MCP input schemas without a key (0). No llms.txt, docs.oneupapp.io/llms.txt returned 404 (0). Each endpoint page says what the call does, with nothing on when not to use it (8). Parameters are listed with types and required flags and one enum (google_post_type), but social_network_id takes either a JSON array or the string ALL (8). Success examples on every page we read, and no documented error responses (5). No API versioning. A help-centre changelog dated by month includes API and MCP entries (6).

Xpoz MCP 64

52 tools read from tools/list with JSON Schema inputs and 42 enums (25). No llms.txt read (0). Server instructions explain paging and field selection (16 of 20). Typed inputs with enums (15). Examples on the home page (5 of 15). Registry 1.4.1 from July, server 3.0.0; no changelog (3 of 15). 25 + 0 + 16 + 15 + 5 + 3 = 64.

OneUp API + MCP 31

The hosted MCP returned 50 tools on tools/list per the 30 September check, with no toolsets or read-only subset (5). List endpoints page with a start index and return up to 50 posts each, and scheduled, published, failed and draft posts have separate lists. No field selection (12). Responses carry an error boolean and a message, with no documented codes (4). No idempotency key. isDraftPost and requireApproval keep a post from going straight out, and we couldn't check for MCP annotations (5). No SDKs. A text post needs five parameters (5).

Xpoz MCP 63

52 tools totalling about 238 KB (5). A fields parameter to select only needed fields, and paged results via a tableName (20). No documented errors (3 of 20). All annotated, 49 read-only (20). SDKs and a CLI (15). 5 + 20 + 3 + 20 + 15 = 63.

OneUp API + MCP 17

One account key per user with no scopes, sent as the apiKey query parameter on every REST call and in the MCP URL. The docs say to revoke and regenerate it if compromised, and ChatGPT can connect over OAuth instead. Revocable key (15), less 10 for the documented query-string secret, plus 3 for the ChatGPT OAuth path (8). No read-only mode. requireApproval and isDraftPost give a review step (6). Comment and inbox endpoints, WhatsApp included, return text from strangers and we found no prompt-injection guidance (0). No audit log or key usage view found (0). The pricing page lists SOC 2 and ISO 27001 against the Enterprise tier without a report or trust page, and there's no security.txt or disclosure route (3).

Xpoz MCP 37

One API key (20 of 30). 49 of 52 tools read-only (15 of 20). Posts and profiles are third-party text; the server says all tools are 'safe and read-only' but gives no injection guidance (0). No audit log (0). No security programme found (2 of 20). 20 + 15 + 0 + 0 + 2 = 37.

OneUp API + MCP 10

No x402 or other machine payment (0). Plan prices are public, with no per-call price (10). No free plan. The 7-day trial's checkout reads $0.00 due today, with a refund promise for the week after the trial ends, and we found nothing saying no card is needed (0). A person has to sign up in a browser and generate the key (0).

Xpoz MCP 30

No machine payment protocol (0). Plan prices public (10). Free 500 credits (20). A person signs in for a key (0). 0 + 10 + 20 + 0 = 30.

OneUp API + MCP 43

The help-centre changelog was updated on 23 September 2026 with September product entries. The last entry naming the API or MCP is posting from ChatGPT in August 2026 (20). 11 entries dated July to September 2026, by month rather than day (15). Public changelog and email support at help@oneupapp.io (8). No SDKs or MCP registry entry (0). No packages to assess (0).

Xpoz MCP 25

Registry entry last updated 14 July 2026 and repository commit on 9 September; the live server reports 3.0.0 (10). No dated releases in 90 days (0). Issues not read (0). Official registry entry ai.xpoz/social-insights (15). Docker packaging only (0). 10 + 0 + 0 + 15 + 0 = 25. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

OneUp API + MCP 40

Closed service under terms from OneUp, Inc. of Cranberry Township, Pennsylvania, with California governing law and no last-updated date (12). The privacy policy says user content is stored indefinitely while the account is active and removed when the account is deleted, names no subprocessors, has no DPA and no date (8). No deprecation policy, and the terms reserve the right to change or discontinue the service without notice (0). No subprocessors or data locations found (0).

Xpoz MCP 29

Closed service; terms of use read without a legal entity (10 of 30). Data handling not read (5 of 30). No deprecation policy (0). Where the social data comes from isn't stated beyond 'no platform API keys' (0). 10 + 5 + 0 + 0 = 15.