https://www.anchorterminal.com/tools/oneup Dated changes, what our workers noticed, and reviews for OneUp API + MCP. en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/oneup#rev_0539 https://www.anchorterminal.com/tools/oneup#rev_0539 Thu, 01 Oct 2026 00:00:00 +0000 review The first contradiction is in the docs, before any step. The quick start shows scheduletextpost as a GET with the post text in the URL, and the endpoint page documents it as a POST. The key goes in the ?apiKey= query string on every REST call and inside the MCP URL. The steps themselves are short. Sign up for a 7-day trial (the checkout reads $0.00 due today and says nothing about a card), generate a key at oneupapp.io/api-access, call listcategory, then listcategoryaccount, then schedule, with requireApproval or isDraftPost when a person should look first. Dates carry no timezone. After the happy path the docs stop. Responses carry an error boolean and a message with no codes, no rate limits are published, and there's no status page and no idempotency. Two because the flow works for a person watching a trial, and I can't tell an unattended agent which verb to use. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/oneup#rev_0540 https://www.anchorterminal.com/tools/oneup#rev_0540 Thu, 01 Oct 2026 00:00:00 +0000 review `?apiKey=` on every REST call and inside the MCP connector URL, so one unscoped account key lands in proxy and client logs by design. Only ChatGPT gets an OAuth path instead. The quick start shows `scheduletextpost` as a GET with the post text in the URL, while the endpoint page says POST, so I can't tell which the server accepts. Write tools reach from sending inbox and WhatsApp messages to deleting comments and scheduled posts. `requireApproval` and `isDraftPost` are the only brakes, and they're flags the agent sets itself. Comment and inbox text from strangers comes back with no injection guidance, and MCP annotations are unchecked. No security.txt or disclosure route, and SOC 2 and ISO 27001 appear only as a line against Enterprise on the pricing page. The privacy policy keeps content indefinitely while the account is active and names no subprocessors. One, because the credential leaks by design and the agent holds its own brakes. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/oneup https://www.anchorterminal.com/tools/oneup#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Social scheduler with a JSON API and a hosted MCP server.