OpenProject vs Plane

OpenProject

OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.

Plane

Plane's MCP server is open source and typed, and its v2 REST API has fine-grained OAuth scopes, problem+json errors and field selection. Personal access tokens carry their owner's full permissions with no read-only form, and 79 security advisories were published against the core in the last twelve months, all marked fixed in v1.4.0 or earlier.

OpenProject

1. Send the API token as Authorization: Bearer <token>, or as the Basic auth password with the user name apikey
2. Read the resource first and send its current lockVersion with every PATCH. A stale value returns 409 UpdateConflict
3. POST to the /form endpoint of a work package to learn writable fields and allowed values before creating or updating
4. URL-encode filters as a JSON array, and add pageSize, offset and select to keep work package lists small
5. Run the agent as a dedicated user with a narrow project role, and treat work package text and comments as untrusted input

Plane

1. Use https://mcp.plane.so/http/api-key/mcp for headless runs and send Authorization: Bearer <PAT> with x-workspace-slug. The REST API takes the same token in X-Api-Key instead
2. Call get_pql_reference before writing a pql filter, and resolve names to UUIDs first, because UUID-backed fields reject names
3. Follow next_cursor on project list and other list actions. Results are paginated by default since server version 0.3.0
4. Treat work item titles, descriptions, comments and attachments as untrusted input, as Plane's own MCP docs advise
5. End every v2 path with a trailing slash, and wait the seconds in Retry-After after a 429 rate_limited