{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/basecamp.json", "name": "Basecamp", "score": 67.9, "shared": [ "tasks.create", "tasks.update", "projects.manage", "tasks.comments", "events.webhooks-send" ], "slug": "basecamp" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/plane.json", "name": "Plane", "score": 67.6, "shared": [ "tasks.create", "tasks.update", "projects.manage", "tasks.comments", "events.webhooks-send" ], "slug": "plane" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/openproject.json", "name": "OpenProject", "score": 57.4, "shared": [ "tasks.create", "tasks.update", "projects.manage", "tasks.comments", "events.webhooks-send" ], "slug": "openproject" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/taiga.json", "name": "Taiga", "score": 31.7, "shared": [ "tasks.create", "tasks.update", "projects.manage", "tasks.comments", "events.webhooks-send" ], "slug": "taiga" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/monday.json", "name": "monday.com", "score": 76.4, "shared": [ "tasks.create", "tasks.update", "projects.manage", "tasks.comments" ], "slug": "monday" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/asana.json", "name": "Asana", "score": 70.1, "shared": [ "tasks.create", "tasks.update", "projects.manage", "tasks.comments" ], "slug": "asana" } ], "tool": { "slug": "redmine", "name": "Redmine", "vendor": "Redmine project", "vendorUrl": "https://www.redmine.org", "kind": "http-api", "category": "project-management", "summary": "Redmine is open-source project management software for issues, projects, time tracking, wikis and Gantt charts, written in Ruby on Rails and run on the owner's own server. Agents reach it through a REST API in JSON or XML.", "url": "https://www.anchorterminal.com/tools/redmine", "markdownUrl": "https://www.anchorterminal.com/tools/redmine.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/redmine.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/redmine.json", "repo": "https://github.com/redmine/redmine", "license": "GPL-2.0-or-later", "transports": [ "http" ], "packages": [], "auth": "mixed", "authNotes": "Access is self-serve on the owner's own install. An administrator first enables the REST API in the settings, where it is off by default. Each user then has one API key on the account page, sent in the `X-Redmine-API-Key` header, as the Basic auth user name or as a `key` query parameter. The key carries that user's full permissions and can be reset. Basic auth with a login and password also works, unless two-factor is active. Versions 6.1 and later accept OAuth 2 bearer tokens from applications an administrator registers, by the authorisation code grant, with one scope per Redmine permission.", "pricing": "free", "pricingNotes": "Free. Redmine is distributed under the GPL with no paid edition, cloud plan or trial from the project, so an agent can start without a contract once someone installs it. The owner pays for the server. API calls are not priced. The home page links one demo site and calls it unofficial and third-party (https://www.redmine.org/projects/redmine/wiki/Download, checked 2026-10-09).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the REST API wiki or the source at tag 7.0.2 (checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://www.redmine.org/projects/redmine/wiki/Rest_api", "capabilities": [ "tasks.create", "tasks.update", "projects.manage", "tasks.comments", "events.webhooks-send" ], "tags": [ "official", "self-hosted", "open-source", "rest", "oauth", "api-key", "free", "webhooks", "ruby", "project-management" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 50.2, "grade": "D", "agentReady": false, "rank": 777, "ranked": true, "rankOf": 950, "categoryRank": 13, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 51, "maintenance": 73, "payments": 60, "reliability": 69, "schema": 32, "security": 51, "transparency": 47 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 69, "points": 13.8, "reason": "Graded on the REST API of a self-hosted install, with the local-software lines. Redmine has no vendor-run cloud. Official tarballs and zip files with SHA-256 sums, and an install guide that states the supported Ruby, Rails and database versions. No official gem or container image (18 of 20). The repository has 386 test files and a GitHub Actions workflow across four Ruby versions and three databases. The run results are shown as badge images we could not read, so a passing default branch is not confirmed (18 of 25). The issue tracker's lists are closed to us by robots.txt. The 7.0.2 changelog alone lists more than 20 fixed defects, which is the only evidence read (12 of 25). A release policy of quarterly minors and yearly majors, a changelog per series and an API change history with two entries (11 of 15). 7.0.x is the latest stable series, but the docs mark 17 of 23 API resources Alpha (10 of 15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 32, "points": 5.2, "reason": "No OpenAPI document or other machine-readable contract was found in the wiki or the repository (0). No llms.txt (the path returned 404) and no Markdown docs for agents (0). Each resource has a wiki page that lists its calls and parameters in a line each, with little on when to use one (9 of 20). Parameters are named with few types, and allowed values are given for only some, such as `status_id` and `include` (5 of 15). Calls have XML and JSON examples, and the 422 validation response is documented. Other error responses are not (9 of 15). The API has no version of its own. Pages note the release each call arrived in, the changelog has a REST API section, and the change history holds two entries, one of them for the unreleased 7.1.0 (9 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 51, "points": 8.29, "reason": "Graded on the REST API. Lists return 25 items by default and 100 at most, and related data arrives only when named in `include`. No field selection (15 of 25). `offset`, `limit` and `page` with a `total_count`, filters with operators on issues, `sort` and saved queries (17 of 20). Validation failures return 422 with a list of messages. In the source, other errors answer with a status code and an empty body (9 of 20). No idempotency keys and no retry guidance. A wiki page update with a stale version returns 409, and no equivalent is documented for issues (4 of 20). Creating an issue needs a project and a subject. No official SDK was found, and the wiki lists community clients for nine languages (6 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 51, "points": 8.93, "reason": "OAuth 2 since 6.1 with the authorisation code grant, refresh tokens, hashed token storage and one scope per Redmine permission. Each user also has one API key with that user's full permissions, which can be reset. The docs give a `key` query parameter as one way to send it, so 10 is taken off (20 of 30). The REST API is off until an administrator enables it, reach follows roles and permissions, and OAuth scopes can narrow a token to read permissions. A project DELETE through the API skips the confirmation the web page requires (13 of 20). Issue and wiki text is untrusted content, and no prompt-injection guidance was found (2 of 15). Issue changes are journalled with their author, and 7.0 shows when an API key was last used. No API access log beyond the server log was found (7 of 15). A security contact, an advisories page with severity ratings and a supported-versions policy. No security.txt, bug bounty or certificate was found, and most advisories carry no CVE (9 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule. No x402, MPP or L402 in the docs or the source (0). Redmine is free software with nothing to buy from the project (20). No trial or card is involved (20). No signup with a vendor is needed. The owner installs it and creates the key (20)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 73, "points": 6.39, "reason": "Versions 7.0.2 and 6.1.5 were tagged on 30 September 2026 (30). Five releases in the last 90 days, across three series (20). The master branch had 113 commits in the 30 days to 8 October 2026 and each release fixes dozens of tracked defects. The issue tracker and forums were not sampled, because robots.txt closes the issue lists, and pull requests on the GitHub mirror are not reviewed by design (14 of 25). No official SDK and no MCP server were found (0). 7.0.2 moved to Rails 8.1.4, earlier releases updated Nokogiri, and tests and linters run on Ruby 3.2 to 4.0 (9 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 47, "points": 4.11, "note": "editorial 69, provenance 25", "reason": "The source is public under the GPL, version 2 or later (30). Data stays on the owner's server. The project publishes no statement on what an install stores or sends, and its privacy policy covers only the redmine.org website. In the source, Gravatar, which sends a hash of each email address to a third party, is off by default (17 of 30). A support policy names the three series that get fixes, and the API change history dates each breaking change. No deprecation policy with notice periods was found (10 of 20). No telemetry was found in a search of the application source, and the docs make no statement either way (12 of 20)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the REST API. Lists return 25 items by default and 100 at most, and related data arrives only when named in `include`. No field selection (15 of 25). `offset`, `limit` and `page` with a `total_count`, filters with operators on issues, `sort` and saved queries (17 of 20). Validation failures return 422 with a list of messages. In the source, other errors answer with a status code and an empty body (9 of 20). No idempotency keys and no retry guidance. A wiki page update with a stale version returns 409, and no equivalent is documented for issues (4 of 20). Creating an issue needs a project and a subject. No official SDK was found, and the wiki lists community clients for nine languages (6 of 15).", "maintenance": "Versions 7.0.2 and 6.1.5 were tagged on 30 September 2026 (30). Five releases in the last 90 days, across three series (20). The master branch had 113 commits in the 30 days to 8 October 2026 and each release fixes dozens of tracked defects. The issue tracker and forums were not sampled, because robots.txt closes the issue lists, and pull requests on the GitHub mirror are not reviewed by design (14 of 25). No official SDK and no MCP server were found (0). 7.0.2 moved to Rails 8.1.4, earlier releases updated Nokogiri, and tests and linters run on Ruby 3.2 to 4.0 (9 of 10).", "payments": "Read with the self-hosted rule. No x402, MPP or L402 in the docs or the source (0). Redmine is free software with nothing to buy from the project (20). No trial or card is involved (20). No signup with a vendor is needed. The owner installs it and creates the key (20).", "reliability": "Graded on the REST API of a self-hosted install, with the local-software lines. Redmine has no vendor-run cloud. Official tarballs and zip files with SHA-256 sums, and an install guide that states the supported Ruby, Rails and database versions. No official gem or container image (18 of 20). The repository has 386 test files and a GitHub Actions workflow across four Ruby versions and three databases. The run results are shown as badge images we could not read, so a passing default branch is not confirmed (18 of 25). The issue tracker's lists are closed to us by robots.txt. The 7.0.2 changelog alone lists more than 20 fixed defects, which is the only evidence read (12 of 25). A release policy of quarterly minors and yearly majors, a changelog per series and an API change history with two entries (11 of 15). 7.0.x is the latest stable series, but the docs mark 17 of 23 API resources Alpha (10 of 15).", "schema": "No OpenAPI document or other machine-readable contract was found in the wiki or the repository (0). No llms.txt (the path returned 404) and no Markdown docs for agents (0). Each resource has a wiki page that lists its calls and parameters in a line each, with little on when to use one (9 of 20). Parameters are named with few types, and allowed values are given for only some, such as `status_id` and `include` (5 of 15). Calls have XML and JSON examples, and the 422 validation response is documented. Other error responses are not (9 of 15). The API has no version of its own. Pages note the release each call arrived in, the changelog has a REST API section, and the change history holds two entries, one of them for the unreleased 7.1.0 (9 of 15).", "security": "OAuth 2 since 6.1 with the authorisation code grant, refresh tokens, hashed token storage and one scope per Redmine permission. Each user also has one API key with that user's full permissions, which can be reset. The docs give a `key` query parameter as one way to send it, so 10 is taken off (20 of 30). The REST API is off until an administrator enables it, reach follows roles and permissions, and OAuth scopes can narrow a token to read permissions. A project DELETE through the API skips the confirmation the web page requires (13 of 20). Issue and wiki text is untrusted content, and no prompt-injection guidance was found (2 of 15). Issue changes are journalled with their author, and 7.0 shows when an API key was last used. No API access log beyond the server log was found (7 of 15). A security contact, an advisories page with severity ratings and a supported-versions policy. No security.txt, bug bounty or certificate was found, and most advisories carry no CVE (9 of 20).", "transparency": "The source is public under the GPL, version 2 or later (30). Data stays on the owner's server. The project publishes no statement on what an install stores or sends, and its privacy policy covers only the redmine.org website. In the source, Gravatar, which sends a hash of each email address to a third party, is off by default (17 of 30). A support policy names the three series that get fixes, and the API change history dates each breaking change. No deprecation policy with notice periods was found (10 of 20). No telemetry was found in a search of the application source, and the docs make no statement either way (12 of 20)." }, "sources": [ { "what": "home page", "url": "https://www.redmine.org/", "seen": "2026-10-09" }, { "what": "REST API overview (resources, authentication, pagination, errors, change history)", "url": "https://www.redmine.org/projects/redmine/wiki/Rest_api", "seen": "2026-10-09" }, { "what": "issues API", "url": "https://www.redmine.org/projects/redmine/wiki/Rest_Issues", "seen": "2026-10-09" }, { "what": "security advisories", "url": "https://www.redmine.org/projects/redmine/wiki/Security_Advisories", "seen": "2026-10-09" }, { "what": "download page (releases, version status, release and support policy)", "url": "https://www.redmine.org/projects/redmine/wiki/Download", "seen": "2026-10-09" }, { "what": "changelog for 7.0.x", "url": "https://www.redmine.org/projects/redmine/wiki/Changelog_7_0", "seen": "2026-10-09" }, { "what": "changelog for 6.1.x", "url": "https://www.redmine.org/projects/redmine/wiki/Changelog_6_1", "seen": "2026-10-09" }, { "what": "install guide (Ruby, Rails and database versions)", "url": "https://www.redmine.org/projects/redmine/wiki/RedmineInstall", "seen": "2026-10-09" }, { "what": "continuous integration page", "url": "https://www.redmine.org/projects/redmine/wiki/Continuous_Integration", "seen": "2026-10-09" }, { "what": "privacy policy of the redmine.org website", "url": "https://www.redmine.org/projects/redmine/wiki/PrivacyPolicy", "seen": "2026-10-09" }, { "what": "robots.txt, and 404 answers for security.txt and llms.txt", "url": "https://www.redmine.org/robots.txt", "seen": "2026-10-09" }, { "what": "GitHub mirror, cloned and read at tag 7.0.2 (controllers, OAuth configuration, webhooks, settings, tests, workflows, tags)", "url": "https://github.com/redmine/redmine", "seen": "2026-10-09" }, { "what": "RDAP record for redmine.org", "url": "https://rdap.org/domain/redmine.org", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: GitHub stars. api.github.com answered 403 (rate limit) to our one request, so `githubStars` is null", "unchecked: whether the GitHub Actions tests pass on the default branch today. The status is shown as badge images", "unchecked: issue responsiveness. robots.txt disallows the issue lists on redmine.org, and the forums were not sampled", "unchecked: the wiki pages for the other API resources, and any OAuth or webhook guide. OAuth and webhook facts come from the source at tag 7.0.2", "unchecked: the official MCP registry. No MCP server was found in the repository or the wiki pages read", "No terms of service and no product privacy document exist. The licence stands in, and the website privacy policy is not used for `provenance.privacy`", "No legal entity was found for the project", "The redmine.org home page was fetched before any terms page, to find one. It links none", "How an issue update with a stale `lock_version` answers through the API. The source rescues the conflict and the docs do not describe it", "The REST API wiki already describes changes for 7.1.0, which is not released. The latest release is 7.0.2", "The lead described the product correctly. It did not say the software is self-hosted only, with no cloud from the project" ] }, "negative": -4, "negativeNotes": [ "2026-09-30. 24 advisories were fixed between 6 January and 30 September 2026, two rated critical, both PostScript execution through thumbnail generation (#44145, fixed in 6.1.3 of 15 June 2026, and one fixed in 6.1.1 of 6 January 2026), and nine rated high, among them an OAuth scope bypass (#44174) and two REST API leaks of private issue subjects and project names (#44467, #44468, fixed in 7.0.2 and 6.1.5). All are fixed and listed by the project itself, so the deduction is reduced, -4 (https://www.redmine.org/projects/redmine/wiki/Security_Advisories)." ], "verdict": "Redmine's REST API covers issues, projects, time entries and 20 other resources, and versions 6.1 and later add OAuth 2 with one scope per permission. The software is free under the GPL. No OpenAPI document exists, most errors return a bare status code, and 24 security advisories were published in twelve months, two rated critical.", "bestFor": "Teams that already run Redmine or want a free, self-hosted tracker with issues, time entries and wikis under their own control.", "strengths": [ "Free under GPL version 2 or later, with no paid edition, and the REST API is part of the standard release", "OAuth 2 since 6.1, authorisation code grant only, with one scope per Redmine permission and tokens stored hashed", "Five releases between 26 August and 30 September 2026, and a published policy that keeps three release series supported", "Issue lists take filters with operators, `sort`, `offset`, `limit` and `page`, and return `total_count`", "Webhooks since 7.0 for issues, time entries, versions, wiki pages and news, signed in an `X-Redmine-Signature-256` header" ], "weaknesses": [ "No OpenAPI document or other machine-readable contract was found in the wiki or the source repository", "24 advisories were published in the twelve months to 9 October 2026, two critical and nine high, several of them data leaks through the REST API", "17 of the 23 API resources are marked Alpha in the documentation, and only five are marked Stable", "Errors other than validation failures return a status code with no body, and no idempotency keys exist", "The API key acts with its user's full permissions and is accepted in a `key` query parameter", "No official SDK. The wiki lists community clients, and no request limit is built in" ], "agentNotes": [ "Ask an administrator to tick Enable REST API under Administration, Settings, API. It is off by default and every call fails until then", "Send the key in the `X-Redmine-API-Key` header, never as the `key` query parameter, and set `Content-Type: application/json` on every POST and PUT", "Add `status_id=*` to issue lists. The default returns open issues only, 25 a page with a maximum of 100", "Comment on an issue by sending `notes` in a PUT to `/issues/\u003cid\u003e.json`. There is no separate comment endpoint", "A DELETE on a project through the API skips the confirmation the web page asks for, so run the agent as a non-administrator user" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 50.2 } ], "editorialScores": { "ergonomics": 51, "maintenance": 73, "payments": 60, "reliability": 69, "schema": 32, "security": 51, "transparency": 69 }, "provenanceScore": 25 }, "connect": { "http": "curl -H \"X-Redmine-API-Key: $API_KEY\" https://$REDMINE_HOST/issues.json" }, "letme": { "capability": "https://letme.dev/tasks.create", "tool": "https://letme.dev/redmine" }, "notable": [ "The REST API wiki lists 23 resources, five marked Stable (issues, projects, users, time entries, news), one Beta (attachments) and 17 Alpha. The source at 7.0.2 opens 82 controller actions to API authentication (https://www.redmine.org/projects/redmine/wiki/Rest_api)", "OAuth 2 arrived in 6.1.0 of 21 September 2025 through the Doorkeeper library. Only the authorisation code grant is enabled, refresh tokens are issued, and each Redmine permission is a scope, plus `admin` (https://github.com/redmine/redmine/blob/7.0.2/config/initializers/30-redmine.rb)", "The Security Advisories page lists 24 advisories fixed between 6 January and 30 September 2026, two critical, nine high, ten moderate and three low (https://www.redmine.org/projects/redmine/wiki/Security_Advisories)", "Versions 7.0.2 and 6.1.5 of 30 September 2026 fixed two high-severity leaks through the REST API, private issue subjects through `include=children` and private project names through group memberships (https://www.redmine.org/projects/redmine/wiki/Changelog_7_0)", "The release policy is a minor version every three months and a major one a year, best effort, with 7.0.x, 6.1.x and 6.0.x supported on 9 October 2026 (https://www.redmine.org/projects/redmine/wiki/Download)", "Development runs on redmine.org and a Subversion repository. The GitHub repository is a mirror, and its CONTRIBUTING file says pull requests there may not be reviewed (https://github.com/redmine/redmine/blob/master/CONTRIBUTING.md)", "The REST API, JSONP and webhooks are each switched off by default in `config/settings.yml`, and so is Gravatar (https://github.com/redmine/redmine/blob/7.0.2/config/settings.yml)" ], "area": "business", "details": [ { "label": "Surface graded", "value": "The REST API of a self-hosted Redmine 7.0.2 install, at the owner's own host. There is no vendor-run cloud. Hosting companies sell Redmine separately and are not graded here" }, { "label": "API", "value": "JSON or XML, chosen by a `.json` or `.xml` suffix. Issues, projects, memberships, users, time entries, news, issue relations, versions, wiki pages, queries, attachments, statuses, trackers, enumerations, categories, roles, groups, custom fields, search, files, my account and journals" }, { "label": "Authentication", "value": "API key in the `X-Redmine-API-Key` header, as the Basic auth user name or as a `key` query parameter. Login and password by Basic auth, refused when two-factor is active. OAuth 2 bearer tokens since 6.1" }, { "label": "OAuth", "value": "Authorisation code grant only, with refresh tokens. An administrator registers each application. Scopes are Redmine's permissions plus `admin`. Tokens and application secrets are stored hashed" }, { "label": "Impersonation", "value": "An administrator's call can act as another user with the `X-Redmine-Switch-User` header. An unknown login returns 412" }, { "label": "Pagination and sizing", "value": "`offset`, `limit` (default 25, maximum 100) and `page`. Lists return `total_count`. Related data such as journals, attachments and children arrive only when named in `include`. No field selection" }, { "label": "Filters", "value": "Issue lists filter by project, tracker, status, assignee, parent and custom field, with operators for dates and substrings, and sort by column" }, { "label": "Errors", "value": "422 with an `errors` array of messages on validation failures. Other failures return a status code with an empty body. A wiki page update with a stale version returns 409" }, { "label": "Rate limits", "value": "None built in. No throttling library is in the Gemfile at 7.0.2, so limits are whatever the owner's web server applies" }, { "label": "Webhooks", "value": "Since 7.0, off by default. Events created, updated and deleted for issues, time entries, versions, wiki pages and news, limited to projects where the user holds the `use_webhooks` permission, with an optional secret that signs the payload" }, { "label": "Runtime", "value": "Redmine 7.0 runs on Ruby 3.2, 3.3, 3.4 or 4.0 with Rails 8.1, and PostgreSQL 14, MySQL 8.0 to 8.4, SQL Server or SQLite" }, { "label": "Releases", "value": "7.0.2 and 6.1.5 on 30 September 2026, 7.0.1, 6.1.4 and 6.0.11 on 26 August, 7.0.0 on 30 June. Tarballs and zip files with SHA-256 sums on the download page" }, { "label": "Tests", "value": "386 test files in the repository, 29 of them REST API integration tests. GitHub Actions runs them on four Ruby versions and three databases" } ], "unitPrices": [ { "item": "Redmine (self-hosted)", "unit": "seat-month", "usd": 0, "note": "free software, REST API included; no paid edition from the project" } ], "provenance": { "legalEntity": "", "domain": "redmine.org", "domainRegistered": "2006-07-08", "endpointOnVendorDomain": false, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://www.redmine.org/projects/redmine/wiki/Changelog", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "No legal entity was found. The home page says Redmine is built and maintained by community volunteers, and the source files carry a copyright notice in the name of Jean-Philippe Lang.", "No terms of service were found on redmine.org. The software is distributed under the GPL, version 2 or later, which stands in.", "The privacy policy at https://www.redmine.org/projects/redmine/wiki/PrivacyPolicy covers the redmine.org website only (server logs, account registration, ads and Gravatar). It does not govern an install of the software, so `provenance.privacy` is left out.", "There is no hosted service run by the project, so no endpoint sits on the vendor's domain. Each install answers on its owner's host.", "www.redmine.org/.well-known/security.txt returned 404. The Security Advisories page gives security(at)redmine.org for reports.", "RDAP for redmine.org gives a registration date of 2006-07-08 and Gandi SAS as registrar." ], "score": 25, "checks": [ { "check": "Legal entity named", "value": "not found", "points": 0, "max": 20, "state": "no" }, { "check": "Domain age", "value": "redmine.org, registered 2006-07-08 (20 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": " is not on redmine.org", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/redmine.json", "live": { "slug": "redmine", "githubStars": 6044, "pages": [ { "url": "https://www.redmine.org/projects/redmine/wiki/Changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-09T18:53:27.794517102Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "5c04a846eb92" } ], "updatedAt": "2026-10-09T18:53:27.794517102Z" } }, "verify": { "accepts": "a page on redmine.org or one of its subdomains, or the README of github.com/redmine/redmine", "badgeUrl": "https://www.anchorterminal.com/badges/redmine.svg", "body": { "slug": "redmine", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/redmine", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/redmine\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/redmine.svg\" alt=\"Redmine on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Redmine on Anchor Terminal](https://www.anchorterminal.com/badges/redmine.svg)](https://www.anchorterminal.com/tools/redmine)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/redmine\"\u003eRedmine on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/redmine", "json": "https://www.anchorterminal.com/tools/redmine.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/redmine.md", "slim": "https://www.anchorterminal.com/tools/redmine.min.md" }, "markdown": "## Overview\n\n**Grade D · 50.2/100 · rank #777 of 950 · #13 in Project \u0026 task management · not agent-ready · confidence medium**\n\n\n## Assessment\n\nRedmine's REST API covers issues, projects, time entries and 20 other resources, and versions 6.1 and later add OAuth 2 with one scope per permission. The software is free under the GPL. No OpenAPI document exists, most errors return a bare status code, and 24 security advisories were published in twelve months, two rated critical.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Redmine project (https://www.redmine.org) |\n| Kind | HTTP API |\n| Category | Project \u0026 task management (https://www.anchorterminal.com/categories/project-management) |\n| Transport | HTTP |\n| Auth | OAuth or key · Access is self-serve on the owner's own install. An administrator first enables the REST API in the settings, where it is off by default. Each user then has one API key on the account page, sent in the `X-Redmine-API-Key` header, as the Basic auth user name or as a `key` query parameter. The key carries that user's full permissions and can be reset. Basic auth with a login and password also works, unless two-factor is active. Versions 6.1 and later accept OAuth 2 bearer tokens from applications an administrator registers, by the authorisation code grant, with one scope per Redmine permission. |\n| Pricing | Free (Free · OSS) · Free. Redmine is distributed under the GPL with no paid edition, cloud plan or trial from the project, so an agent can start without a contract once someone installs it. The owner pays for the server. API calls are not priced. The home page links one demo site and calls it unofficial and third-party (https://www.redmine.org/projects/redmine/wiki/Download, checked 2026-10-09). |\n| x402 | No · No x402, MPP or L402 in the REST API wiki or the source at tag 7.0.2 (checked 2026-10-09). |\n| Licence | GPL-2.0-or-later |\n| Source | https://github.com/redmine/redmine |\n| Docs | https://www.redmine.org/projects/redmine/wiki/Rest_api |\n| llms.txt | not found |\n| Last release | 2026-09-30 |\n| Surface graded | The REST API of a self-hosted Redmine 7.0.2 install, at the owner's own host. There is no vendor-run cloud. Hosting companies sell Redmine separately and are not graded here |\n| API | JSON or XML, chosen by a `.json` or `.xml` suffix. Issues, projects, memberships, users, time entries, news, issue relations, versions, wiki pages, queries, attachments, statuses, trackers, enumerations, categories, roles, groups, custom fields, search, files, my account and journals |\n| Authentication | API key in the `X-Redmine-API-Key` header, as the Basic auth user name or as a `key` query parameter. Login and password by Basic auth, refused when two-factor is active. OAuth 2 bearer tokens since 6.1 |\n| OAuth | Authorisation code grant only, with refresh tokens. An administrator registers each application. Scopes are Redmine's permissions plus `admin`. Tokens and application secrets are stored hashed |\n| Impersonation | An administrator's call can act as another user with the `X-Redmine-Switch-User` header. An unknown login returns 412 |\n| Pagination and sizing | `offset`, `limit` (default 25, maximum 100) and `page`. Lists return `total_count`. Related data such as journals, attachments and children arrive only when named in `include`. No field selection |\n| Filters | Issue lists filter by project, tracker, status, assignee, parent and custom field, with operators for dates and substrings, and sort by column |\n| Errors | 422 with an `errors` array of messages on validation failures. Other failures return a status code with an empty body. A wiki page update with a stale version returns 409 |\n| Rate limits | None built in. No throttling library is in the Gemfile at 7.0.2, so limits are whatever the owner's web server applies |\n| Webhooks | Since 7.0, off by default. Events created, updated and deleted for issues, time entries, versions, wiki pages and news, limited to projects where the user holds the `use_webhooks` permission, with an optional secret that signs the payload |\n| Runtime | Redmine 7.0 runs on Ruby 3.2, 3.3, 3.4 or 4.0 with Rails 8.1, and PostgreSQL 14, MySQL 8.0 to 8.4, SQL Server or SQLite |\n| Releases | 7.0.2 and 6.1.5 on 30 September 2026, 7.0.1, 6.1.4 and 6.0.11 on 26 August, 7.0.0 on 30 June. Tarballs and zip files with SHA-256 sums on the download page |\n| Tests | 386 test files in the repository, 29 of them REST API integration tests. GitHub Actions runs them on four Ruby versions and three databases |\n| Capabilities | tasks.create, tasks.update, projects.manage, tasks.comments, events.webhooks-send |\n| Tags | official, self-hosted, open-source, rest, oauth, api-key, free, webhooks, ruby, project-management |\n| JSON | https://www.anchorterminal.com/api/v1/tools/redmine.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-09 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 69 | 13.8 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 32 | 5.2 |\n| Agent ergonomics | 13% | 16.2 | 51 | 8.3 |\n| Security \u0026 auth | 14% | 17.5 | 51 | 8.9 |\n| Payments \u0026 pricing | 10% | 12.5 | 60 | 7.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 73 | 6.4 |\n| Transparency \u0026 trust (editorial 69, provenance 25) | 7% | 8.8 | 47 | 4.1 |\n| Negative events | up to −15 | up to −15 | 2026-09-30. 24 advisories were fixed between 6 January and 30 September 2026, two rated critical, both PostScript execution through thumbnail generation (#44145, fixed in 6.1.3 of 15 June 2026, and one fixed in 6.1.1 of 6 January 2026), and nine rated high, among them an OAuth scope bypass (#44174) and two REST API leaks of private issue subjects and project names (#44467, #44468, fixed in 7.0.2 and 6.1.5). All are fixed and listed by the project itself, so the deduction is reduced, -4 (https://www.redmine.org/projects/redmine/wiki/Security_Advisories). | -4 |\n| **Total** | | | | **50.2 → D** |\n\n### Why each score\n\n- Reliability 69: Graded on the REST API of a self-hosted install, with the local-software lines. Redmine has no vendor-run cloud. Official tarballs and zip files with SHA-256 sums, and an install guide that states the supported Ruby, Rails and database versions. No official gem or container image (18 of 20). The repository has 386 test files and a GitHub Actions workflow across four Ruby versions and three databases. The run results are shown as badge images we could not read, so a passing default branch is not confirmed (18 of 25). The issue tracker's lists are closed to us by robots.txt. The 7.0.2 changelog alone lists more than 20 fixed defects, which is the only evidence read (12 of 25). A release policy of quarterly minors and yearly majors, a changelog per series and an API change history with two entries (11 of 15). 7.0.x is the latest stable series, but the docs mark 17 of 23 API resources Alpha (10 of 15).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 32: No OpenAPI document or other machine-readable contract was found in the wiki or the repository (0). No llms.txt (the path returned 404) and no Markdown docs for agents (0). Each resource has a wiki page that lists its calls and parameters in a line each, with little on when to use one (9 of 20). Parameters are named with few types, and allowed values are given for only some, such as `status_id` and `include` (5 of 15). Calls have XML and JSON examples, and the 422 validation response is documented. Other error responses are not (9 of 15). The API has no version of its own. Pages note the release each call arrived in, the changelog has a REST API section, and the change history holds two entries, one of them for the unreleased 7.1.0 (9 of 15).\n- Agent ergonomics 51: Graded on the REST API. Lists return 25 items by default and 100 at most, and related data arrives only when named in `include`. No field selection (15 of 25). `offset`, `limit` and `page` with a `total_count`, filters with operators on issues, `sort` and saved queries (17 of 20). Validation failures return 422 with a list of messages. In the source, other errors answer with a status code and an empty body (9 of 20). No idempotency keys and no retry guidance. A wiki page update with a stale version returns 409, and no equivalent is documented for issues (4 of 20). Creating an issue needs a project and a subject. No official SDK was found, and the wiki lists community clients for nine languages (6 of 15).\n- Security \u0026 auth 51: OAuth 2 since 6.1 with the authorisation code grant, refresh tokens, hashed token storage and one scope per Redmine permission. Each user also has one API key with that user's full permissions, which can be reset. The docs give a `key` query parameter as one way to send it, so 10 is taken off (20 of 30). The REST API is off until an administrator enables it, reach follows roles and permissions, and OAuth scopes can narrow a token to read permissions. A project DELETE through the API skips the confirmation the web page requires (13 of 20). Issue and wiki text is untrusted content, and no prompt-injection guidance was found (2 of 15). Issue changes are journalled with their author, and 7.0 shows when an API key was last used. No API access log beyond the server log was found (7 of 15). A security contact, an advisories page with severity ratings and a supported-versions policy. No security.txt, bug bounty or certificate was found, and most advisories carry no CVE (9 of 20).\n- Payments \u0026 pricing 60: Read with the self-hosted rule. No x402, MPP or L402 in the docs or the source (0). Redmine is free software with nothing to buy from the project (20). No trial or card is involved (20). No signup with a vendor is needed. The owner installs it and creates the key (20).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 73: Versions 7.0.2 and 6.1.5 were tagged on 30 September 2026 (30). Five releases in the last 90 days, across three series (20). The master branch had 113 commits in the 30 days to 8 October 2026 and each release fixes dozens of tracked defects. The issue tracker and forums were not sampled, because robots.txt closes the issue lists, and pull requests on the GitHub mirror are not reviewed by design (14 of 25). No official SDK and no MCP server were found (0). 7.0.2 moved to Rails 8.1.4, earlier releases updated Nokogiri, and tests and linters run on Ruby 3.2 to 4.0 (9 of 10).\n- Transparency \u0026 trust 47: The source is public under the GPL, version 2 or later (30). Data stays on the owner's server. The project publishes no statement on what an install stores or sends, and its privacy policy covers only the redmine.org website. In the source, Gravatar, which sends a hash of each email address to a third party, is off by default (17 of 30). A support policy names the three series that get fixes, and the API change history dates each breaking change. No deprecation policy with notice periods was found (10 of 20). No telemetry was found in a search of the application source, and the docs make no statement either way (12 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (25 items): https://www.anchorterminal.com/fixes/redmine.md (JSON https://www.anchorterminal.com/fixes/redmine.json)\n\n### What we couldn't check\n\n- unchecked: GitHub stars. api.github.com answered 403 (rate limit) to our one request, so `githubStars` is null\n- unchecked: whether the GitHub Actions tests pass on the default branch today. The status is shown as badge images\n- unchecked: issue responsiveness. robots.txt disallows the issue lists on redmine.org, and the forums were not sampled\n- unchecked: the wiki pages for the other API resources, and any OAuth or webhook guide. OAuth and webhook facts come from the source at tag 7.0.2\n- unchecked: the official MCP registry. No MCP server was found in the repository or the wiki pages read\n- No terms of service and no product privacy document exist. The licence stands in, and the website privacy policy is not used for `provenance.privacy`\n- No legal entity was found for the project\n- The redmine.org home page was fetched before any terms page, to find one. It links none\n- How an issue update with a stale `lock_version` answers through the API. The source rescues the conflict and the docs do not describe it\n- The REST API wiki already describes changes for 7.1.0, which is not released. The latest release is 7.0.2\n- The lead described the product correctly. It did not say the software is self-hosted only, with no cloud from the project\n\n### Sources\n\n- home page: \u003chttps://www.redmine.org/\u003e (seen 2026-10-09)\n- REST API overview (resources, authentication, pagination, errors, change history): \u003chttps://www.redmine.org/projects/redmine/wiki/Rest_api\u003e (seen 2026-10-09)\n- issues API: \u003chttps://www.redmine.org/projects/redmine/wiki/Rest_Issues\u003e (seen 2026-10-09)\n- security advisories: \u003chttps://www.redmine.org/projects/redmine/wiki/Security_Advisories\u003e (seen 2026-10-09)\n- download page (releases, version status, release and support policy): \u003chttps://www.redmine.org/projects/redmine/wiki/Download\u003e (seen 2026-10-09)\n- changelog for 7.0.x: \u003chttps://www.redmine.org/projects/redmine/wiki/Changelog_7_0\u003e (seen 2026-10-09)\n- changelog for 6.1.x: \u003chttps://www.redmine.org/projects/redmine/wiki/Changelog_6_1\u003e (seen 2026-10-09)\n- install guide (Ruby, Rails and database versions): \u003chttps://www.redmine.org/projects/redmine/wiki/RedmineInstall\u003e (seen 2026-10-09)\n- continuous integration page: \u003chttps://www.redmine.org/projects/redmine/wiki/Continuous_Integration\u003e (seen 2026-10-09)\n- privacy policy of the redmine.org website: \u003chttps://www.redmine.org/projects/redmine/wiki/PrivacyPolicy\u003e (seen 2026-10-09)\n- robots.txt, and 404 answers for security.txt and llms.txt: \u003chttps://www.redmine.org/robots.txt\u003e (seen 2026-10-09)\n- GitHub mirror, cloned and read at tag 7.0.2 (controllers, OAuth configuration, webhooks, settings, tests, workflows, tags): \u003chttps://github.com/redmine/redmine\u003e (seen 2026-10-09)\n- RDAP record for redmine.org: \u003chttps://rdap.org/domain/redmine.org\u003e (seen 2026-10-09)\n\n## Who's behind it (provenance 25/100, checked 2026-10-09)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | not found | 0/20 |\n| Domain age | redmine.org, registered 2006-07-08 (20 years) | 15/15 |\n| Endpoint on the vendor's domain | is not on redmine.org | 0/15 |\n| Terms of service | not found | 0/10 |\n| Privacy policy | not found | 0/10 |\n| Status page | not found | 0/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nNo legal entity was found. The home page says Redmine is built and maintained by community volunteers, and the source files carry a copyright notice in the name of Jean-Philippe Lang.\n\nNo terms of service were found on redmine.org. The software is distributed under the GPL, version 2 or later, which stands in.\n\nThe privacy policy at https://www.redmine.org/projects/redmine/wiki/PrivacyPolicy covers the redmine.org website only (server logs, account registration, ads and Gravatar). It does not govern an install of the software, so `provenance.privacy` is left out.\n\nThere is no hosted service run by the project, so no endpoint sits on the vendor's domain. Each install answers on its owner's host.\n\nwww.redmine.org/.well-known/security.txt returned 404. The Security Advisories page gives security(at)redmine.org for reports.\n\nRDAP for redmine.org gives a registration date of 2006-07-08 and Gandi SAS as registrar.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service**. We found no terms of service published for this product, so there is nothing to read and the check scores 0.\n\n\n**Privacy policy**. We found no privacy policy published for this product, so there is nothing to read and the check scores 0.\n\n\n## Live (updated 2026-10-09 18:53 UTC)\n\n- Watching changelog \u003chttps://www.redmine.org/projects/redmine/wiki/Changelog\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/redmine.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Redmine (self-hosted) | free | per seat per month | free software, REST API included; no paid edition from the project |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Free under GPL version 2 or later, with no paid edition, and the REST API is part of the standard release\n- OAuth 2 since 6.1, authorisation code grant only, with one scope per Redmine permission and tokens stored hashed\n- Five releases between 26 August and 30 September 2026, and a published policy that keeps three release series supported\n- Issue lists take filters with operators, `sort`, `offset`, `limit` and `page`, and return `total_count`\n- Webhooks since 7.0 for issues, time entries, versions, wiki pages and news, signed in an `X-Redmine-Signature-256` header\n\n## Weaknesses\n\n- No OpenAPI document or other machine-readable contract was found in the wiki or the source repository\n- 24 advisories were published in the twelve months to 9 October 2026, two critical and nine high, several of them data leaks through the REST API\n- 17 of the 23 API resources are marked Alpha in the documentation, and only five are marked Stable\n- Errors other than validation failures return a status code with no body, and no idempotency keys exist\n- The API key acts with its user's full permissions and is accepted in a `key` query parameter\n- No official SDK. The wiki lists community clients, and no request limit is built in\n\n## Before you call it (notes for agents)\n\n1. Ask an administrator to tick Enable REST API under Administration, Settings, API. It is off by default and every call fails until then\n2. Send the key in the `X-Redmine-API-Key` header, never as the `key` query parameter, and set `Content-Type: application/json` on every POST and PUT\n3. Add `status_id=*` to issue lists. The default returns open issues only, 25 a page with a maximum of 100\n4. Comment on an issue by sending `notes` in a PUT to `/issues/\u003cid\u003e.json`. There is no separate comment endpoint\n5. A DELETE on a project through the API skips the confirmation the web page asks for, so run the agent as a non-administrator user\n\n## Connect\n\nFirst request:\n\n```bash\ncurl -H \"X-Redmine-API-Key: $API_KEY\" https://$REDMINE_HOST/issues.json\n```\n\nThrough letme (picks today, calling later): https://letme.dev/redmine. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Basecamp | B | 67.9 | 237 | tasks.create, tasks.update, projects.manage, tasks.comments, events.webhooks-send | no | https://www.anchorterminal.com/tools/basecamp.md |\n| Plane | B | 67.6 | 248 | tasks.create, tasks.update, projects.manage, tasks.comments, events.webhooks-send | no | https://www.anchorterminal.com/tools/plane.md |\n| OpenProject | C | 57.4 | 610 | tasks.create, tasks.update, projects.manage, tasks.comments, events.webhooks-send | no | https://www.anchorterminal.com/tools/openproject.md |\n| Taiga | F | 31.7 | 938 | tasks.create, tasks.update, projects.manage, tasks.comments, events.webhooks-send | no | https://www.anchorterminal.com/tools/taiga.md |\n| monday.com | BB | 76.4 | 34 | tasks.create, tasks.update, projects.manage, tasks.comments | no | https://www.anchorterminal.com/tools/monday.md |\n| Asana | BB | 70.1 | 161 | tasks.create, tasks.update, projects.manage, tasks.comments | no | https://www.anchorterminal.com/tools/asana.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The REST API wiki lists 23 resources, five marked Stable (issues, projects, users, time entries, news), one Beta (attachments) and 17 Alpha. The source at 7.0.2 opens 82 controller actions to API authentication (source: \u003chttps://www.redmine.org/projects/redmine/wiki/Rest_api\u003e)\n- OAuth 2 arrived in 6.1.0 of 21 September 2025 through the Doorkeeper library. Only the authorisation code grant is enabled, refresh tokens are issued, and each Redmine permission is a scope, plus `admin` (source: \u003chttps://github.com/redmine/redmine/blob/7.0.2/config/initializers/30-redmine.rb\u003e)\n- The Security Advisories page lists 24 advisories fixed between 6 January and 30 September 2026, two critical, nine high, ten moderate and three low (source: \u003chttps://www.redmine.org/projects/redmine/wiki/Security_Advisories\u003e)\n- Versions 7.0.2 and 6.1.5 of 30 September 2026 fixed two high-severity leaks through the REST API, private issue subjects through `include=children` and private project names through group memberships (source: \u003chttps://www.redmine.org/projects/redmine/wiki/Changelog_7_0\u003e)\n- The release policy is a minor version every three months and a major one a year, best effort, with 7.0.x, 6.1.x and 6.0.x supported on 9 October 2026 (source: \u003chttps://www.redmine.org/projects/redmine/wiki/Download\u003e)\n- Development runs on redmine.org and a Subversion repository. The GitHub repository is a mirror, and its CONTRIBUTING file says pull requests there may not be reviewed (source: \u003chttps://github.com/redmine/redmine/blob/master/CONTRIBUTING.md\u003e)\n- The REST API, JSONP and webhooks are each switched off by default in `config/settings.yml`, and so is Gravatar (source: \u003chttps://github.com/redmine/redmine/blob/7.0.2/config/settings.yml\u003e)\n\n- #13 of 15 in Best project and task management tools for AI agents: https://www.anchorterminal.com/best/project-management/index.md\n- All 135 projects comparisons: https://www.anchorterminal.com/compare/project-management/index.md\n\n## Compare\n\n- [Asana vs Redmine](https://www.anchorterminal.com/compare/asana-vs-redmine.md): BB 70.1 vs D 50.2\n- [Atlassian Rovo MCP Server vs Redmine](https://www.anchorterminal.com/compare/atlassian-rovo-mcp-vs-redmine.md): C 57.9 vs D 50.2\n- [Basecamp vs Redmine](https://www.anchorterminal.com/compare/basecamp-vs-redmine.md): B 67.9 vs D 50.2\n- [ClickUp vs Redmine](https://www.anchorterminal.com/compare/clickup-vs-redmine.md): C 60.9 vs D 50.2\n- [Linear MCP vs Redmine](https://www.anchorterminal.com/compare/linear-mcp-vs-redmine.md): D 53.8 vs D 50.2\n- [monday.com vs Redmine](https://www.anchorterminal.com/compare/monday-vs-redmine.md): BB 76.4 vs D 50.2\n- [OpenProject vs Redmine](https://www.anchorterminal.com/compare/openproject-vs-redmine.md): C 57.4 vs D 50.2\n- [Plane vs Redmine](https://www.anchorterminal.com/compare/plane-vs-redmine.md): B 67.6 vs D 50.2\n- [Redmine vs Roma](https://www.anchorterminal.com/compare/redmine-vs-roma.md): D 50.2 vs D 51.1\n- [Redmine vs Shortcut](https://www.anchorterminal.com/compare/redmine-vs-shortcut.md): D 50.2 vs C 60.2\n- [Redmine vs Taiga](https://www.anchorterminal.com/compare/redmine-vs-taiga.md): D 50.2 vs F 31.7\n- [Redmine vs Teamwork.com](https://www.anchorterminal.com/compare/redmine-vs-teamwork.md): D 50.2 vs B 65.9\n- [Redmine vs Todoist](https://www.anchorterminal.com/compare/redmine-vs-todoist.md): D 50.2 vs B 66.9\n- [Redmine vs Trello](https://www.anchorterminal.com/compare/redmine-vs-trello.md): D 50.2 vs C 61.1\n- [Redmine vs Wrike](https://www.anchorterminal.com/compare/redmine-vs-wrike.md): D 50.2 vs C 60.1\n- [Redmine vs YouTrack](https://www.anchorterminal.com/compare/redmine-vs-youtrack.md): D 50.2 vs D 49.9\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on redmine.org or one of its subdomains, or the README of github.com/redmine/redmine. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"redmine\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/redmine\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/redmine.svg\" alt=\"Redmine on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Redmine on Anchor Terminal](https://www.anchorterminal.com/badges/redmine.svg)](https://www.anchorterminal.com/tools/redmine)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/redmine\"\u003eRedmine on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Redmine is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/redmine-dark.png\n- Light: https://www.anchorterminal.com/assets/share/redmine-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Project \u0026 task management", "url": "https://www.anchorterminal.com/categories/project-management" }, { "name": "Redmine", "url": "" } ], "description": "Redmine is open-source project management software for issues, projects, time tracking, wikis and Gantt charts, written in Ruby on Rails and run on the owner's own server. Agents reach it through a REST API in JSON or XML.", "facts": [ "rank #777 of 950", "OAuth or key auth", "0 desk reviews" ], "h1": "Redmine", "image": "https://www.anchorterminal.com/assets/og/tools-redmine.png", "path": "/tools/redmine", "published": "2026-10-01", "section": "tools", "title": "Redmine review (2026): pricing, alternatives and grade D", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/tools/redmine" }, "tokens": { "markdown": 6850, "slim": 1780 }, "version": 1 }