Onshape vs SimScale

Onshape 79

Read for a closed service. API release notes rel-1.223 dated 30 October 2026 (30). Six dated releases from 17 July to 30 October, three weeks apart (20). A public changelog, forum.onshape.com and api-support@onshape.com; response times were not tested (12 of 15). No Onshape-owned server in the official MCP registry, where the only match is io.github.gpambrozio/onshape; the official Go client was pushed on 31 October 2026 and the TypeScript clients in June and September 2025 (12 of 15). The Go client is generated and its CI was not read; the multi-language onshape-clients repository is archived (5 of 10). 30 + 20 + 12 + 12 + 5 = 79.

SimScale 33

Read for a closed service with open SDK sources. The Python SDK's newest release is 19.1.0 of 3 March 2026, 245 days before the check, and the v1 document carries no date (5 of 30, for a change in the window being likely from the v1 beta but unproven). Ten SDK releases from February 2025 to March 2026 and none since (0 of 20). api@simscale.com, support@simscale.com and a community forum; response times were not tested and the SDK repository has no issue activity we could read (10 of 15). Official Python and C# SDKs, with v1 editions, generated from the document (15). The SDK repository has no CI workflow and pins the document version at 0.0.0 (3 of 10). 5 + 0 + 10 + 15 + 3 = 33.

Onshape 60

Read with the hosted lines on cad.onshape.com. Atlassian Statuspage at status.onshape.com with regional CAD service components and history feeds (20). The feed holds 18 incidents from 15 August to 30 October 2026, all degraded performance, delayed imports and exports or partial signup blocks, the longest 2 hours 42 minutes of export degradation on 15 September and imports, exports and notifications not working for 1 hour 42 minutes on 11 September; no full outage of the CAD service (18 of 30). Annual API call quotas are published per plan with numbers, while per-endpoint rate limits are said to vary by endpoint with no figure (8 of 15). 429 is documented without a header or backoff timing, 402 marks a spent quota, and no idempotency guidance was found (6 of 15). The terms promise commercially reasonable efforts and no SLA (0). The REST API is generally available; the FeatureScript MCP Server is an early-access Labs feature (8 of 10). 20 + 18 + 8 + 6 + 0 + 8 = 60.

SimScale 15

Read with the hosted lines on api.simscale.com. No status page, since status.simscale.com has no DNS record and none is linked from the site, the docs hub or the API document (0). No readable incident history (5). No rate limit with a number; the terms reserve the right to impose rate or traffic limits and the v0 document mentions a 429 response once (0). No Retry-After, backoff guidance or idempotency keys; runs can be cancelled (0). No SLA, and the terms say SimScale cannot warrant uninterrupted availability with Free plans carrying no availability obligation (0). /v0 is the generally available version; /v1 is in beta (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Onshape 63

API keys scoped to permissions, revocable, two per individual account, with a signed request scheme; OAuth 2.0 authorisation code with 60-minute access tokens and refresh tokens revoked with the user's grant; no key expiry documented (26 of 30). Permission scopes allow read-only keys; no confirmation step before destructive calls and no approval gate on the MCP server beyond the App Store subscription (12 of 20). The MCP server reads FeatureScript errors and geometry from the document and no prompt-injection guidance was found (5 of 15). API usage counts are visible under Developer settings per company or user; no per-call audit log was found (6 of 15). SOC 2 Type 2 audited annually, AES-256 and TLS 1.2 with HSTS, paid researcher testing and security@onshape.com, but no security.txt (404), no public bug bounty and no advisories page (14 of 20). 26 + 12 + 5 + 6 + 14 = 63.

SimScale 44

One API key per user in the X-API-KEY header, with no scopes, documented expiry, rotation or revocation; the SDK reads it from an environment variable (10 of 30). Project and space permission endpoints exist and the sandbox cannot change data, but no read-only key or confirmation step for deletes was found (8 of 20). The API returns the owner's own geometry and results and no third-party content, so there is little untrusted content to inject (10 of 15). No audit log or per-call visibility found on the pages read (0 of 15). SOC 2 Type II by Prescient Assurance, a public Intigriti bug bounty with the API in scope, security.txt and AES encryption (16 of 20). 10 + 8 + 10 + 0 + 16 = 44.

Onshape 22

No x402, MPP or L402 (0). Plan prices are public per user per year, with no per-call price; extra API calls are sold by sales at an unpublished rate (10). The Free plan costs nothing for non-commercial use with public documents and a Professional trial needs no card; whether the Free plan asks for a card was not stated (12 of 20). A person signs up in a browser and creates the key or OAuth app (0). 0 + 10 + 12 + 0 = 22.

SimScale 10

No x402, MPP or L402 (0). No price is published; Mechanical, Professional and Enterprise are on request and the Community plan carries no API (0). The sandbox with its fixed public key lets an agent exercise every endpoint without an account or card, though it runs nothing, and the free Community plan has no API; read as a partial free route (10 of 20). An API key comes with an Enterprise contract arranged by people (0). 0 + 0 + 10 + 0 = 10.

Onshape 46

Document and element endpoints take ids and the list endpoints take limit and offset, with no field selection documented in what we read; the MCP server's tool count is unknown (12 of 25). Pagination and filters on document lists, and revisions page (a paging loop was fixed in rel-1.219) (14 of 20). HTTP codes with 401, 402 and 429 meanings; the error body shape was on the unread response codes page (10 of 20). No idempotency keys; POSTs create microversions on every edit; no readOnlyHint or destructiveHint published for the MCP tools (2 of 20). Every API key request needs a Date header, a nonce and an HMAC-SHA256 signature, and 307 redirects need a new signature; official Go and TypeScript clients handle it (8 of 15). 12 + 14 + 10 + 2 + 8 = 46.

SimScale 55

List endpoints page with limit and page parameters and results are fetched per run and per export rather than whole (15 of 25). Pagination on lists and filters on some, such as valid geometries only (15 of 20). Typed error responses by status code; message shapes were not read in detail and the v1 error format page rendered empty (10 of 20). No idempotency keys; runs are asynchronous with event logs and cancel, so a retry can start a second run (5 of 20). Official Python and C# SDKs cover the surface, but a simulation setup needs a full Simulation Spec object with many required fields and a matching schema version (10 of 15). 15 + 15 + 10 + 5 + 10 = 55.

Onshape 63

An OpenAPI document backs the Glassworks API Explorer and the generated Go and TypeScript clients, but cad.onshape.com/robots.txt closes the explorer and the document to readers, so the contract was seen only through the clients (18 of 25). No llms.txt and no Markdown twin of the docs (0). Guides per area state what each API does and the API intro explains documents, workspaces, versions and elements; the MCP server's tools are not listed anywhere public (12 of 20). The Go client's breaking-change list shows typed models with BTType mandatory; enums and constraints were not read in the spec itself (10 of 15). Guides carry examples; the response codes page linked from the docs answered 404 and the API limits page gives 429 and 402 meanings (8 of 15). Numbered API versions (v17), dated release notes every three weeks, deprecations marked and an x-deprecated header (15). 18 + 0 + 12 + 10 + 8 + 15 = 63.

SimScale 71

Public OpenAPI 3.0.3 documents for /v0 (98 operations) and /v1 (163 operations), with the simulation and meshing schema versions selectable by query parameter (25). No llms.txt and no Markdown docs; the API docs are Swagger UI and script-rendered pages (0). The introduction explains the sandbox, versioning and Workbench compatibility, and operations carry one-line summaries, but 10 of the 98 v0 operations have no description and the guides for v1 rendered empty (12 of 20). 2,112 schemas with 355 enum lists, required fields and a typed security scheme (13 of 15). The sandbox answers every endpoint with example data, which stands in for examples, and responses are typed for 400, 403, 404, 409, 422 and 429 (11 of 15). Path versions v0 and v1 with a migration guide and changelog for v1, and dated SDK releases, though the changelog page itself rendered empty (10 of 15). 25 + 0 + 12 + 13 + 11 + 10 = 71.