OpenProject vs YouTrack

OpenProject

OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.

YouTrack

Every instance serves an OpenAPI 3.0 document, a 23-tool MCP server with OAuth and PKCE, and field selection on each REST call, and the free plan covers ten users. No rate limits, 429 handling, error reference or SLA were found, and JetBrains disclosed two sets of critical vulnerabilities affecting YouTrack Cloud in 2026, both patched.

OpenProject

1. Send the API token as Authorization: Bearer <token>, or as the Basic auth password with the user name apikey
2. Read the resource first and send its current lockVersion with every PATCH. A stale value returns 409 UpdateConflict
3. POST to the /form endpoint of a work package to learn writable fields and allowed values before creating or updating
4. URL-encode filters as a JSON array, and add pageSize, offset and select to keep work package lists small
5. Run the agent as a dedicated user with a narrow project role, and treat work package text and comments as untrusted input

YouTrack

1. Send fields on every REST request. Without it the server returns only the database ID and $type of each entity
2. Page collections with $top and $skip. Most resources return 42 items by default
3. Call get_issue_fields_schema before create_issue or update_issue, because required custom fields differ by project
4. Connect MCP clients to https://<instance>.youtrack.cloud/mcp. OAuth needs an administrator to enable CIMD or register the client, since Dynamic Client Registration is not supported
5. Create permanent tokens with the YouTrack scope only, and add ?tools= to the MCP URL to limit the tools listed