{ "data": { "a": { "slug": "openproject", "name": "OpenProject", "vendor": "OpenProject GmbH", "vendorUrl": "https://www.openproject.org", "kind": "http-api", "category": "project-management", "summary": "OpenProject is open-source project management software for work packages, Gantt plans, boards and time tracking, sold as a cloud service and for self-hosting. Agents reach it through the APIv3 REST API, and paid plans add an MCP server.", "url": "https://www.anchorterminal.com/tools/openproject", "markdownUrl": "https://www.anchorterminal.com/tools/openproject.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/openproject.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/openproject.json", "repo": "https://github.com/opf/openproject", "license": "GPL-3.0 for the OpenProject source. Enterprise add-ons need a paid token, and OpenProject Enterprise cloud runs under OpenProject's Terms of Service", "transports": [ "http" ], "packages": [], "auth": "mixed", "authNotes": "Access is self-serve. A user creates a named personal API token in account settings and sends it as `Authorization: Bearer`, or as the Basic auth password with the user name `apikey`. The token carries that user's permissions, and no per-token scope or expiry was found. An administrator can register OAuth 2.0 applications for the authorisation code grant, PKCE or client credentials, with one scope per API (`api_v3`, `mcp`, `scim_v2`, `bcf_v2_1`). JWTs from a configured OIDC provider are also accepted. No app review or partner approval is described.", "pricing": "freemium", "pricingNotes": "The Community edition is free to self-host with the REST API included, and the cloud has a 14-day trial with no credit card, so an agent can start without a contract. Cloud plans are per user per month on a yearly term, Basic $7.25 (from 5 users, $8.50 on a monthly term), Professional $13.50 (from 25 users) and Premium $19.50 (from 100 users), with Corporate on request. Euro prices are 5.95, 10.95 and 15.95. API calls are not priced. The MCP server needs Professional or above. Community is not sold as a cloud plan (https://www.openproject.org/pricing/, checked 2026-10-08).", "priceSummary": "$7.25 / seat-mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI document or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 16352, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://www.openproject.org/docs/api/", "openapi": "https://www.openproject.org/docs/api/v3/spec.yml", "capabilities": [ "tasks.create", "tasks.update", "projects.manage", "tasks.comments", "projects.reporting", "events.webhooks-send" ], "tags": [ "official", "hosted", "self-hosted", "open-source", "rest", "openapi", "oauth", "mcp", "freemium", "free-trial", "webhooks", "status-page", "sla", "eu-hosting", "project-management" ], "lastRelease": "2026-10-01", "graded": true, "anchor": { "graded": true, "score": 57.4, "grade": "C", "agentReady": false, "rank": 550, "ranked": true, "rankOf": 842, "categoryRank": 11, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 75, "payments": 30, "reliability": 52, "schema": 76, "security": 59, "transparency": 87 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": -5, "negativeNotes": [ "2026-06-08. 13 advisories rated critical were published against opf/openproject between January and June 2026, among them cache store poisoning leading to remote code execution (GHSA-qj96-f42f-6336, fixed in 17.3.3 and 17.4.1), SQL injection in the timestamps function (GHSA-98vw-2r87-fx2r) and a pre-authentication remote code execution in the Docker image through a default secret key (GHSA-r85r-gjq2-f83r, 13 May 2026). OpenProject published them itself, and its policy is to publish each advisory with the fixing release, so the deduction is reduced, -3 (https://github.com/opf/openproject/security/advisories).", "2026-09-30. 83 advisories in all were published in the twelve months to 8 October 2026, several of them missing permission checks in APIv3 that exposed private work package data across projects. Several credit the YesWeHack bounty sponsored by the European Commission. The advisories give self-hosted version numbers and do not say when the cloud was patched. Fixed and published, -2 (https://github.com/opf/openproject/security/advisories)." ], "verdict": "OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.", "bestFor": "Teams that want a self-hostable or EU-hosted project tool with Gantt, time tracking and budgets, and an agent working through a documented REST API.", "strengths": [ "OpenAPI 3.1 document with 234 paths and 320 operations, public on the docs site and served by every instance at `/api/v3/spec.json`", "Errors carry a stable `errorIdentifier` URN, and validation failures list one entry per property", "The Community edition is GPL-3.0 and free to self-host with the REST API included, and the cloud trial needs no credit card", "Seven releases between 5 August and 1 October 2026, with security fixes published as GitHub advisories and CVEs", "The service description commits to 99.9 per cent yearly availability with service credits, and an EU shard keeps all sub-processors in the EU" ], "weaknesses": [ "83 advisories published against opf/openproject in the twelve months to 8 October 2026, 13 rated critical, among them remote code execution and SQL injection", "No request limit, 429 behaviour or Retry-After guidance is published for the cloud API", "Personal API tokens act with their user's full permissions, and OAuth has one scope per API with no read-only form", "No official SDK. The client libraries the docs list are community projects the vendor says it does not vet", "The MCP server is an Enterprise add-on for the Professional plan and above, which starts at 25 users" ], "agentNotes": [ "Send the API token as `Authorization: Bearer \u003ctoken\u003e`, or as the Basic auth password with the user name `apikey`", "Read the resource first and send its current `lockVersion` with every PATCH. A stale value returns 409 `UpdateConflict`", "POST to the `/form` endpoint of a work package to learn writable fields and allowed values before creating or updating", "URL-encode `filters` as a JSON array, and add `pageSize`, `offset` and `select` to keep work package lists small", "Run the agent as a dedicated user with a narrow project role, and treat work package text and comments as untrusted input" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.4 } ], "editorialScores": { "ergonomics": 70, "maintenance": 75, "payments": 30, "reliability": 52, "schema": 76, "security": 59, "transparency": 79 }, "provenanceScore": 95 }, "connect": { "http": "curl -H \"Authorization: Bearer $API_KEY\" https://community.openproject.org/api/v3/users/42" }, "letme": { "capability": "https://letme.dev/tasks.create", "tool": "https://letme.dev/openproject" }, "area": "business", "unitPrices": [ { "item": "Community (self-hosted)", "unit": "seat-month", "usd": 0, "note": "free, REST API included; not sold as a cloud plan" }, { "item": "Basic (cloud)", "unit": "seat-month", "usd": 7.25, "note": "yearly term, from 5 users; $8.50 on a monthly term" }, { "item": "Professional (cloud)", "unit": "seat-month", "usd": 13.5, "note": "yearly term, from 25 users; includes the MCP server" }, { "item": "Premium (cloud)", "unit": "seat-month", "usd": 19.5, "note": "yearly term, from 100 users" } ], "provenance": { "legalEntity": "OpenProject GmbH", "domain": "openproject.org", "domainRegistered": "2003-10-24", "endpointOnVendorDomain": true, "terms": "https://www.openproject.org/legal/terms-of-service/", "privacy": "https://www.openproject.org/legal/privacy/", "statusPage": "https://status.openproject.com", "changelog": "https://www.openproject.org/docs/release-notes/", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Terms of Service (last updated 6 August 2026) name OpenProject GmbH, Krausenstrasse 9, 10117 Berlin, Germany, and cover both the cloud and the on-premises Enterprise edition. The German version takes precedence.", "The privacy policy (version 30 July 2026) has a section on OpenProject Enterprise Cloud, where OpenProject GmbH is processor and the customer controller. The data processing agreement at https://www.openproject.org/legal/data-processing-agreement/ is part of the terms.", "Cloud instances answer at \u003cname\u003e.openproject.com or, on the EU shard, an openproject.eu host. Both are the vendor's domains, apart from the openproject.org site that carries the docs and legal pages. Self-hosted instances answer on the owner's domain.", "www.openproject.org/.well-known/security.txt is PGP-signed, names security@openproject.com and expires on 31 December 2026.", "RDAP for openproject.org gives a registration date of 2003-10-24 and InterNetX GmbH as registrar." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/openproject.json", "live": { "slug": "openproject", "vendorStatus": { "page": "https://status.openproject.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:22.822468534Z" }, "updatedAt": "2026-10-09T07:58:22.822468534Z" } }, "answer": "Shortcut scores 60.2 (C) on agent readiness against OpenProject's 57.4 (C), and leads in 1 of 7 scored categories. OpenProject leads on agent ergonomics, security \u0026 auth and transparency \u0026 trust.", "b": { "slug": "shortcut", "name": "Shortcut", "vendor": "Shortcut Software Company", "vendorUrl": "https://www.shortcut.com", "kind": "http-api", "category": "project-management", "summary": "Shortcut is a hosted project tracker for software teams, with stories, epics, iterations, objectives and docs. Agents reach it through REST API v3 with a personal token, or the hosted MCP server at mcp.shortcut.com/mcp with OAuth.", "url": "https://www.anchorterminal.com/tools/shortcut", "markdownUrl": "https://www.anchorterminal.com/tools/shortcut.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shortcut.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shortcut.json", "repo": "https://github.com/useshortcut/shortcut-client-js", "license": "Proprietary service under Shortcut's terms of service. The JavaScript client and the archived MCP server on GitHub are MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.app.shortcut.com", "packages": [ { "registry": "npm", "name": "@shortcut/client" } ], "auth": "mixed", "authNotes": "Self-serve. Any workspace member creates an API token under Settings, API Tokens, with no app review. REST API v3 takes it in the `Shortcut-Token` header, and tokens can be read-only or read-write since 20 January 2026. An Observer's token can read but not change data. The hosted MCP server at mcp.shortcut.com/mcp takes OAuth only (authorisation code with PKCE, dynamic client registration) with the scopes read, write, story-write, comment-write and admin, and access can be revoked in Shortcut settings. The v4 alpha uses `Authorization: Bearer` with `sct_ro_` or `sct_rw_` tokens.", "pricing": "freemium", "pricingNotes": "The API, webhooks and the MCP server are listed on every plan, and Shortcut charges nothing per call. Free is $0 for up to 10 users, Team $8.50 a user a month billed yearly ($10 monthly), Business $12 ($16 monthly), and Enterprise is quoted by sales. A 14-day trial needs no card, so an agent's owner can start on Free or the trial without a contract (checked 2026-10-08).", "priceSummary": "$8.50 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference, the OpenAPI files, llms.txt or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 142, "npmWeekly": 102825, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://developer.shortcut.com/api/rest/v3", "llmsTxt": "https://www.shortcut.com/llms.txt", "openapi": "https://developer.shortcut.com/api/rest/v3/shortcut.openapi.json", "capabilities": [ "tasks.create", "tasks.update", "projects.manage", "tasks.comments", "projects.reporting", "automation.webhooks" ], "tags": [ "official", "hosted", "mcp", "oauth", "openapi", "llms-txt", "webhooks", "freemium", "free-tier", "no-card", "closed-source", "typescript", "status-page", "soc2" ], "lastRelease": "2026-09-22", "graded": true, "anchor": { "graded": true, "score": 60.2, "grade": "C", "agentReady": false, "rank": 477, "ranked": true, "rankOf": 842, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 57, "maintenance": 73, "payments": 30, "reliability": 64, "schema": 75, "security": 54, "transparency": 73 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": 0, "verdict": "REST API v3 and the hosted MCP server are included on the Free plan, with downloadable OpenAPI files and OAuth scopes down to story or comment writes on the MCP side. The API still accepts the token in a query string, and no idempotency keys, Retry-After header, uptime SLA or API changelog were found in the reviewed documentation.", "bestFor": "Software teams already on Shortcut that want an agent to search, create and update stories, epics, iterations and docs, and coding agents that pick up assigned stories.", "strengths": [ "REST API v3, webhooks and the MCP server are listed on every plan, Free (up to 10 users) among them, and the 14-day trial needs no card", "Swagger 2.0 and OpenAPI 3.0 files for v3 (143 operations) are downloadable, with enums, string limits and required fields", "The hosted MCP server uses OAuth with PKCE, dynamic client registration and the scopes read, write, story-write, comment-write and admin", "API tokens can be read-only or read-write since 20 January 2026, and Observers' tokens can read but not change data", "status.shortcut.com has separate API and Shortcut MCP components with incident history back to 2023" ], "weaknesses": [ "The v3 docs still allow the API token as a `token` query parameter, marked deprecated with no removal date", "No idempotency keys, Retry-After header or backoff guidance found. The docs state only 200 requests a minute and a 429", "No API changelog or deprecation policy found. API changes appear as lines in the product release notes", "The open-source MCP server is archived at v0.25.0, and the hosted server's tool list can't be read without a Shortcut account", "One official SDK, `@shortcut/client` for JavaScript and TypeScript, and no vendor entry in the official MCP registry" ], "agentNotes": [ "Send the v3 token in the `Shortcut-Token` header. v4 (alpha) takes `Authorization: Bearer` with `sct_ro_` or `sct_rw_` tokens, and v3 tokens don't work there.", "Create a story with `name` and `workflow_state_id`. Sending both `workflow_state_id` and `project_id`, or neither, is rejected.", "Use `GET /api/v3/search/stories` with `detail=slim`, `page_size` (1 to 250) and the `next` token. Many other v3 list endpoints return every record at once.", "Stay under 200 requests a minute and add your own backoff on 429, because no Retry-After header is documented.", "For MCP, connect to https://mcp.shortcut.com/mcp and request only the scopes needed, such as `read` or `story-write`." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.2 } ], "editorialScores": { "ergonomics": 57, "maintenance": 73, "payments": 30, "reliability": 64, "schema": 75, "security": 54, "transparency": 57 }, "provenanceScore": 88 }, "connect": { "install": "npm install @shortcut/client", "http": "curl -X GET -H \"Content-Type: application/json\" -H \"Shortcut-Token: $SHORTCUT_API_TOKEN\" -L \"https://api.app.shortcut.com/api/v3/categories\"", "claudeCode": "claude mcp add --transport http shortcut https://mcp.shortcut.com/mcp", "config": { "mcpServers": { "shortcut": { "url": "https://mcp.shortcut.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/tasks.create", "tool": "https://letme.dev/shortcut" }, "area": "business", "unitPrices": [ { "item": "Free (API, webhooks and MCP server included)", "unit": "seat-month", "usd": 0, "note": "up to 10 users, 5 GB of storage" }, { "item": "Team, billed yearly", "unit": "seat-month", "usd": 8.5, "note": "$10 billed monthly, as shown on 2026-10-08" }, { "item": "Business, billed yearly", "unit": "seat-month", "usd": 12, "note": "$16 billed monthly, as shown on 2026-10-08" } ], "provenance": { "legalEntity": "Shortcut Software Company", "domain": "shortcut.com", "domainRegistered": "1997-08-01", "endpointOnVendorDomain": true, "terms": "https://www.shortcut.com/terms/", "privacy": "https://www.shortcut.com/privacy/", "statusPage": "https://status.shortcut.com", "changelog": "https://www.shortcut.com/release-notes/", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms of service (effective 18 September 2025) name Shortcut Software Company, govern the Service on shortcut.com and korey.ai, and are under New York law. The GDPR notice gives the address 201 Allen St, Unit #10004, New York, NY 10002.", "The privacy policy (effective 11 July 2025) covers the websites, the app and the platform.", "The API answers at api.app.shortcut.com and the MCP server at mcp.shortcut.com.", "www.shortcut.com/.well-known/security.txt returns 404. Reports go to security@shortcut.com under the disclosure policy at shortcut.com/disclosure.", "The changelog link is the product release notes. No separate API changelog was found.", "RDAP for shortcut.com gives a registration date of 1997-08-01. Shortcut was named Clubhouse until September 2021 per its llms.txt." ], "score": 88 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shortcut.json", "live": { "slug": "shortcut", "probe": { "target": "https://api.app.shortcut.com", "method": "get", "lastAt": "2026-10-09T09:27:04.618146943Z", "lastOk": true, "lastStatus": 200, "lastMs": 304, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 252, "p95ms24h": 304, "samples24h": 151, "samples30d": 151, "days": [ { "date": "2026-10-08", "probes": 50, "ok": 50 }, { "date": "2026-10-09", "probes": 101, "ok": 101 } ] }, "vendorStatus": { "page": "https://status.shortcut.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-09T09:25:33.006784732Z" }, "updatedAt": "2026-10-09T09:27:04.618146943Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "OpenProject GmbH", "b": "Shortcut Software Company", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.app.shortcut.com", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "GPL-3.0 for the OpenProject source. Enterprise add-ons need a paid token, and OpenProject Enterprise cloud runs under OpenProject's Terms of Service", "b": "Proprietary service under Shortcut's terms of service. The JavaScript client and the archived MCP server on GitHub are MIT", "name": "Licence" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-01", "b": "2026-09-22", "name": "Last release" }, { "a": "2026-08-06", "b": "2025-09-18", "name": "Terms last updated" }, { "a": "no date given", "b": "2025-07-11", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "16k stars", "b": "142 stars, 103k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Shortcut scores 60.2 (C) on agent readiness against OpenProject's 57.4 (C), and leads in 1 of 7 scored categories. OpenProject leads on agent ergonomics, security \u0026 auth and transparency \u0026 trust.", "question": "Which is better for AI agents, OpenProject or Shortcut?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do OpenProject and Shortcut need an API key?" }, { "answer": "No hosted endpoint is listed for OpenProject. Shortcut has a hosted endpoint at https://api.app.shortcut.com.", "question": "Can an agent call OpenProject and Shortcut without installing anything?" }, { "answer": "OpenProject is open source (GPL-3.0 for the OpenProject source. Enterprise add-ons need a paid token, and OpenProject Enterprise cloud runs under OpenProject's Terms of Service). No open-source release is listed for Shortcut.", "question": "Are OpenProject and Shortcut open source?" } ], "goodFor": [ { "aheadOn": [ "Agent ergonomics, 70 against 57", "Security \u0026 auth, 59 against 54", "Transparency \u0026 trust, 87 against 73" ], "also": [ "Open source" ], "goodFor": "Teams that want a self-hostable or EU-hosted project tool with Gantt, time tracking and budgets, and an agent working through a documented REST API.", "slug": "openproject", "watchFor": "83 advisories published against opf/openproject in the twelve months to 8 October 2026, 13 rated critical, among them remote code execution and SQL injection" }, { "aheadOn": [ "Reliability, 64 against 52" ], "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card", "No incidents deducted, where OpenProject loses 5 points for them" ], "goodFor": "Software teams already on Shortcut that want an agent to search, create and update stories, epics, iterations and docs, and coding agents that pick up assigned stories.", "slug": "shortcut", "watchFor": "The v3 docs still allow the API token as a `token` query parameter, marked deprecated with no removal date" } ], "job": { "capability": "tasks.create", "name": "Tasks create" }, "others": [ { "json": "https://www.anchorterminal.com/compare/asana-vs-openproject.json", "title": "Asana vs OpenProject", "url": "https://www.anchorterminal.com/compare/asana-vs-openproject" }, { "json": "https://www.anchorterminal.com/compare/asana-vs-shortcut.json", "title": "Asana vs Shortcut", "url": "https://www.anchorterminal.com/compare/asana-vs-shortcut" }, { "json": "https://www.anchorterminal.com/compare/basecamp-vs-openproject.json", "title": "Basecamp vs OpenProject", "url": "https://www.anchorterminal.com/compare/basecamp-vs-openproject" }, { "json": "https://www.anchorterminal.com/compare/basecamp-vs-shortcut.json", "title": "Basecamp vs Shortcut", "url": "https://www.anchorterminal.com/compare/basecamp-vs-shortcut" }, { "json": "https://www.anchorterminal.com/compare/clickup-vs-openproject.json", "title": "ClickUp vs OpenProject", "url": "https://www.anchorterminal.com/compare/clickup-vs-openproject" }, { "json": "https://www.anchorterminal.com/compare/clickup-vs-shortcut.json", "title": "ClickUp vs Shortcut", "url": "https://www.anchorterminal.com/compare/clickup-vs-shortcut" }, { "json": "https://www.anchorterminal.com/compare/monday-vs-openproject.json", "title": "monday.com vs OpenProject", "url": "https://www.anchorterminal.com/compare/monday-vs-openproject" }, { "json": "https://www.anchorterminal.com/compare/monday-vs-shortcut.json", "title": "monday.com vs Shortcut", "url": "https://www.anchorterminal.com/compare/monday-vs-shortcut" }, { "json": "https://www.anchorterminal.com/compare/openproject-vs-plane.json", "title": "OpenProject vs Plane", "url": "https://www.anchorterminal.com/compare/openproject-vs-plane" }, { "json": "https://www.anchorterminal.com/compare/openproject-vs-roma.json", "title": "OpenProject vs Roma", "url": "https://www.anchorterminal.com/compare/openproject-vs-roma" }, { "json": "https://www.anchorterminal.com/compare/openproject-vs-taiga.json", "title": "OpenProject vs Taiga", "url": "https://www.anchorterminal.com/compare/openproject-vs-taiga" }, { "json": "https://www.anchorterminal.com/compare/openproject-vs-teamwork.json", "title": "OpenProject vs Teamwork.com", "url": "https://www.anchorterminal.com/compare/openproject-vs-teamwork" }, { "json": "https://www.anchorterminal.com/compare/openproject-vs-todoist.json", "title": "OpenProject vs Todoist", "url": "https://www.anchorterminal.com/compare/openproject-vs-todoist" }, { "json": "https://www.anchorterminal.com/compare/openproject-vs-trello.json", "title": "OpenProject vs Trello", "url": "https://www.anchorterminal.com/compare/openproject-vs-trello" }, { "json": "https://www.anchorterminal.com/compare/openproject-vs-wrike.json", "title": "OpenProject vs Wrike", "url": "https://www.anchorterminal.com/compare/openproject-vs-wrike" }, { "json": "https://www.anchorterminal.com/compare/openproject-vs-youtrack.json", "title": "OpenProject vs YouTrack", "url": "https://www.anchorterminal.com/compare/openproject-vs-youtrack" }, { "json": "https://www.anchorterminal.com/compare/plane-vs-shortcut.json", "title": "Plane vs Shortcut", "url": "https://www.anchorterminal.com/compare/plane-vs-shortcut" }, { "json": "https://www.anchorterminal.com/compare/roma-vs-shortcut.json", "title": "Roma vs Shortcut", "url": "https://www.anchorterminal.com/compare/roma-vs-shortcut" }, { "json": "https://www.anchorterminal.com/compare/shortcut-vs-taiga.json", "title": "Shortcut vs Taiga", "url": "https://www.anchorterminal.com/compare/shortcut-vs-taiga" }, { "json": "https://www.anchorterminal.com/compare/shortcut-vs-teamwork.json", "title": "Shortcut vs Teamwork.com", "url": "https://www.anchorterminal.com/compare/shortcut-vs-teamwork" }, { "json": "https://www.anchorterminal.com/compare/shortcut-vs-todoist.json", "title": "Shortcut vs Todoist", "url": "https://www.anchorterminal.com/compare/shortcut-vs-todoist" }, { "json": "https://www.anchorterminal.com/compare/shortcut-vs-trello.json", "title": "Shortcut vs Trello", "url": "https://www.anchorterminal.com/compare/shortcut-vs-trello" }, { "json": "https://www.anchorterminal.com/compare/shortcut-vs-wrike.json", "title": "Shortcut vs Wrike", "url": "https://www.anchorterminal.com/compare/shortcut-vs-wrike" }, { "json": "https://www.anchorterminal.com/compare/shortcut-vs-youtrack.json", "title": "Shortcut vs YouTrack", "url": "https://www.anchorterminal.com/compare/shortcut-vs-youtrack" } ], "scores": [ { "by": 12, "edge": "shortcut", "key": "reliability", "name": "Reliability", "openproject": 52, "shortcut": 64, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 1, "edge": "openproject", "key": "schema", "name": "Schema \u0026 documentation", "openproject": 76, "shortcut": 75, "weight": 13 }, { "by": 13, "edge": "openproject", "key": "ergonomics", "name": "Agent ergonomics", "openproject": 70, "shortcut": 57, "weight": 13 }, { "by": 5, "edge": "openproject", "key": "security", "name": "Security \u0026 auth", "openproject": 59, "shortcut": 54, "weight": 14 }, { "by": 0, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "openproject": 30, "shortcut": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 2, "edge": "openproject", "key": "maintenance", "name": "Maintenance \u0026 community", "openproject": 75, "shortcut": 73, "weight": 7 }, { "by": 14, "edge": "openproject", "key": "transparency", "name": "Transparency \u0026 trust", "openproject": 87, "shortcut": 73, "weight": 7 } ], "summary": "Shortcut scores 60.2 (C) on agent readiness against OpenProject's 57.4 (C), and leads in 1 of 7 scored categories. OpenProject leads on agent ergonomics, security \u0026 auth and transparency \u0026 trust. Both do tasks create.", "verdicts": { "openproject": "OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.", "shortcut": "REST API v3 and the hosted MCP server are included on the Free plan, with downloadable OpenAPI files and OAuth scopes down to story or comment writes on the MCP side. The API still accepts the token in a query string, and no idempotency keys, Retry-After header, uptime SLA or API changelog were found in the reviewed documentation." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/openproject-vs-shortcut", "json": "https://www.anchorterminal.com/compare/openproject-vs-shortcut.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/openproject-vs-shortcut.md", "slim": "https://www.anchorterminal.com/compare/openproject-vs-shortcut.min.md" }, "markdown": "Shortcut scores 60.2 (C) on agent readiness against OpenProject's 57.4 (C), and leads in 1 of 7 scored categories. OpenProject leads on agent ergonomics, security \u0026 auth and transparency \u0026 trust. Both do tasks create.\n\n- OpenProject: grade C, 57.4/100, rank #550 of 842. Markdown https://www.anchorterminal.com/tools/openproject.md · JSON https://www.anchorterminal.com/api/v1/tools/openproject.json\n- Shortcut: grade C, 60.2/100, rank #477 of 842. Markdown https://www.anchorterminal.com/tools/shortcut.md · JSON https://www.anchorterminal.com/api/v1/tools/shortcut.json\n\n## Which one, for what\n\n### OpenProject (C)\n\nGood for: Teams that want a self-hostable or EU-hosted project tool with Gantt, time tracking and budgets, and an agent working through a documented REST API.\n\nAhead on:\n- Agent ergonomics, 70 against 57\n- Security \u0026 auth, 59 against 54\n- Transparency \u0026 trust, 87 against 73\n\nAlso in its favour:\n- Open source\n\nWatch for: 83 advisories published against opf/openproject in the twelve months to 8 October 2026, 13 rated critical, among them remote code execution and SQL injection\n\n### Shortcut (C)\n\nGood for: Software teams already on Shortcut that want an agent to search, create and update stories, epics, iterations and docs, and coding agents that pick up assigned stories.\n\nAhead on:\n- Reliability, 64 against 52\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n- No incidents deducted, where OpenProject loses 5 points for them\n\nWatch for: The v3 docs still allow the API token as a `token` query parameter, marked deprecated with no removal date\n\n\n## Score by category\n\n| Category | Weight | OpenProject | Shortcut | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 52 | 64 | Shortcut +12 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 76 | 75 | OpenProject +1 |\n| Agent ergonomics | 13% (16.2 this run) | 70 | 57 | OpenProject +13 |\n| Security \u0026 auth | 14% (17.5 this run) | 59 | 54 | OpenProject +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 30 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 75 | 73 | OpenProject +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 87 | 73 | OpenProject +14 |\n| Negative events | ≤15 | -5 | 0 | |\n| **Total** | | **57.4 · C** | **60.2 · C** | |\n\n## Facts side by side\n\n| Fact | OpenProject | Shortcut |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | OpenProject GmbH | Shortcut Software Company |\n| Hosted endpoint | no (local only) | `https://api.app.shortcut.com` |\n| Transports | HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | GPL-3.0 for the OpenProject source. Enterprise add-ons need a paid token, and OpenProject Enterprise cloud runs under OpenProject's Terms of Service | Proprietary service under Shortcut's terms of service. The JavaScript client and the archived MCP server on GitHub are MIT |\n| Read-only variant documented | no | yes |\n| llms.txt | no | yes |\n| Last release | 2026-10-01 | 2026-09-22 |\n| Terms last updated | 2026-08-06 | 2025-09-18 |\n| Privacy policy last updated | no date given | 2025-07-11 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 16k stars | 142 stars, 103k npm/wk |\n\n## Verdicts\n\n**OpenProject.** OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.\n\n**Shortcut.** REST API v3 and the hosted MCP server are included on the Free plan, with downloadable OpenAPI files and OAuth scopes down to story or comment writes on the MCP side. The API still accepts the token in a query string, and no idempotency keys, Retry-After header, uptime SLA or API changelog were found in the reviewed documentation.\n\n## Before you call either\n\n### OpenProject\n\n1. Send the API token as `Authorization: Bearer \u003ctoken\u003e`, or as the Basic auth password with the user name `apikey`\n2. Read the resource first and send its current `lockVersion` with every PATCH. A stale value returns 409 `UpdateConflict`\n3. POST to the `/form` endpoint of a work package to learn writable fields and allowed values before creating or updating\n4. URL-encode `filters` as a JSON array, and add `pageSize`, `offset` and `select` to keep work package lists small\n5. Run the agent as a dedicated user with a narrow project role, and treat work package text and comments as untrusted input\n\n### Shortcut\n\n1. Send the v3 token in the `Shortcut-Token` header. v4 (alpha) takes `Authorization: Bearer` with `sct_ro_` or `sct_rw_` tokens, and v3 tokens don't work there.\n2. Create a story with `name` and `workflow_state_id`. Sending both `workflow_state_id` and `project_id`, or neither, is rejected.\n3. Use `GET /api/v3/search/stories` with `detail=slim`, `page_size` (1 to 250) and the `next` token. Many other v3 list endpoints return every record at once.\n4. Stay under 200 requests a minute and add your own backoff on 429, because no Retry-After header is documented.\n5. For MCP, connect to https://mcp.shortcut.com/mcp and request only the scopes needed, such as `read` or `story-write`.\n\n## Questions\n\n### Which is better for AI agents, OpenProject or Shortcut?\n\nShortcut scores 60.2 (C) on agent readiness against OpenProject's 57.4 (C), and leads in 1 of 7 scored categories. OpenProject leads on agent ergonomics, security \u0026 auth and transparency \u0026 trust.\n\n### Do OpenProject and Shortcut need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call OpenProject and Shortcut without installing anything?\n\nNo hosted endpoint is listed for OpenProject. Shortcut has a hosted endpoint at https://api.app.shortcut.com.\n\n### Are OpenProject and Shortcut open source?\n\nOpenProject is open source (GPL-3.0 for the OpenProject source. Enterprise add-ons need a paid token, and OpenProject Enterprise cloud runs under OpenProject's Terms of Service). No open-source release is listed for Shortcut.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/openproject-vs-shortcut.json, and with the fewest tokens: https://www.anchorterminal.com/compare/openproject-vs-shortcut.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"openproject\", \"b\": \"shortcut\"}`. From a terminal: `anchor compare openproject shortcut`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/openproject.json and https://www.anchorterminal.com/api/v1/tools/shortcut.json\n\n## Other comparisons with OpenProject or Shortcut\n\n- [Asana vs OpenProject](https://www.anchorterminal.com/compare/asana-vs-openproject.md)\n- [Asana vs Shortcut](https://www.anchorterminal.com/compare/asana-vs-shortcut.md)\n- [Basecamp vs OpenProject](https://www.anchorterminal.com/compare/basecamp-vs-openproject.md)\n- [Basecamp vs Shortcut](https://www.anchorterminal.com/compare/basecamp-vs-shortcut.md)\n- [ClickUp vs OpenProject](https://www.anchorterminal.com/compare/clickup-vs-openproject.md)\n- [ClickUp vs Shortcut](https://www.anchorterminal.com/compare/clickup-vs-shortcut.md)\n- [monday.com vs OpenProject](https://www.anchorterminal.com/compare/monday-vs-openproject.md)\n- [monday.com vs Shortcut](https://www.anchorterminal.com/compare/monday-vs-shortcut.md)\n- [OpenProject vs Plane](https://www.anchorterminal.com/compare/openproject-vs-plane.md)\n- [OpenProject vs Roma](https://www.anchorterminal.com/compare/openproject-vs-roma.md)\n- [OpenProject vs Taiga](https://www.anchorterminal.com/compare/openproject-vs-taiga.md)\n- [OpenProject vs Teamwork.com](https://www.anchorterminal.com/compare/openproject-vs-teamwork.md)\n- [OpenProject vs Todoist](https://www.anchorterminal.com/compare/openproject-vs-todoist.md)\n- [OpenProject vs Trello](https://www.anchorterminal.com/compare/openproject-vs-trello.md)\n- [OpenProject vs Wrike](https://www.anchorterminal.com/compare/openproject-vs-wrike.md)\n- [OpenProject vs YouTrack](https://www.anchorterminal.com/compare/openproject-vs-youtrack.md)\n- [Plane vs Shortcut](https://www.anchorterminal.com/compare/plane-vs-shortcut.md)\n- [Roma vs Shortcut](https://www.anchorterminal.com/compare/roma-vs-shortcut.md)\n- [Shortcut vs Taiga](https://www.anchorterminal.com/compare/shortcut-vs-taiga.md)\n- [Shortcut vs Teamwork.com](https://www.anchorterminal.com/compare/shortcut-vs-teamwork.md)\n- [Shortcut vs Todoist](https://www.anchorterminal.com/compare/shortcut-vs-todoist.md)\n- [Shortcut vs Trello](https://www.anchorterminal.com/compare/shortcut-vs-trello.md)\n- [Shortcut vs Wrike](https://www.anchorterminal.com/compare/shortcut-vs-wrike.md)\n- [Shortcut vs YouTrack](https://www.anchorterminal.com/compare/shortcut-vs-youtrack.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "OpenProject vs Shortcut", "url": "" } ], "description": "Shortcut scores 60.2 (C) on agent readiness against OpenProject's 57.4 (C), and leads in 1 of 7 scored categories. OpenProject leads on agent ergonomics, security \u0026 auth and transparency \u0026 trust. Both do tasks create. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "OpenProject C 57.4", "Shortcut C 60.2", "scores" ], "h1": "OpenProject vs Shortcut", "image": "https://www.anchorterminal.com/assets/og/compare-openproject-vs-shortcut.png", "path": "/compare/openproject-vs-shortcut", "published": "2026-10-01", "section": "tools", "title": "OpenProject vs Shortcut for AI agents, C 57.4 vs C 60.2", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/openproject-vs-shortcut" }, "tokens": { "markdown": 2550, "slim": 680 }, "version": 1 }