OpenProject vs Wrike

OpenProject

OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.

Wrike

The official MCP server has 29 documented tools for search, task and project creation, bulk updates, comments and approvals, and it works on every plan including Free. Permanent access tokens never expire and carry the user's full access, and no SLA, official SDK or deprecation policy was found in the reviewed documentation.

OpenProject

1. Send the API token as Authorization: Bearer <token>, or as the Basic auth password with the user name apikey
2. Read the resource first and send its current lockVersion with every PATCH. A stale value returns 409 UpdateConflict
3. POST to the /form endpoint of a work package to learn writable fields and allowed values before creating or updating
4. URL-encode filters as a JSON array, and add pageSize, offset and select to keep work package lists small
5. Run the agent as a dedicated user with a narrow project role, and treat work package text and comments as untrusted input

Wrike

1. Build API URLs from the host value returned by /oauth2/token. Accounts live on www.wrike.com, app-eu.wrike.com or app-us2.wrike.com, and the wrong host answers 401.
2. Use https://mcp.wrike.com/v2 only. The older /app/mcp/stream and /app/mcp/sse URLs serve the v1 tool set.
3. Call search_workflows before setting a status, because update_items and search_items take custom status ids.
4. Stay under about 400 requests a minute per token or IP and back off exponentially on 429. Use POST /batch for up to 100 operations.
5. Page task lists with pageSize (up to 1,000) and nextPageToken, and request optional data through fields.