Asana vs Taskade

Asana 77

Graded on the hosted lines for the REST API and the V2 MCP server. Statuspage at status.asana.com with API, App, Mobile, Automations, Webhooks and Notifications components in five regions (20). Between 3 August and 1 November 2026 the history lists nine incidents. One was a full outage, on 21 October, when an infrastructure change made DynamoDB unreachable and every service in the US, EU, Japan and Australia was unavailable for about 30 minutes and mostly unavailable for a further 20, with a published postmortem. The others were partial, read as minor the way other listings' partial incidents are read. They were a webhook and event stream fault from 4 to 6 August that dropped most task change events, about two hours on 31 August for roughly 25 per cent of users, about 40 minutes on 2 September for a subset of customers, slow performance on 17 September, EU automations on 21 September, an EU API outage on 29 September, a partial API outage of 50 minutes on 30 September and background jobs degraded from 23 to 24 October. One major outage (10). Limits are published as 150 requests a minute on free domains and 1,500 on paid, 60 a minute for search, 50 concurrent reads and 15 concurrent writes (15). Every 429 carries Retry-After and the docs give backoff guidance, and ask callers to make retried POSTs idempotent themselves, but no idempotency keys were found for writes (12). The trust page states a 99.9 per cent uptime commitment for Enterprise customers (10). The REST API is GA and the V2 MCP server has been GA since 4 February 2026 (10).

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Asana 65

REST OAuth 2.0 with PKCE, one-hour access tokens, refresh tokens, a revocation endpoint and scopes in <resource>:<action> form (43 on the scopes page). Personal access tokens carry their owner's whole access and don't expire by default. MCP tokens are separate from REST tokens but carry no scopes (25). REST apps can register only the scopes they need, and a guest bot account narrows a token further. The MCP server has no read-only mode, and delete_task runs without a confirmation step outside Claude and ChatGPT. Admins on Enterprise+ can allow or block each MCP client (10). Task text, comments and attachments are written by other people, and no prompt-injection guidance was found in the developer docs (0). An audit log API with 90 days of events, open only to Enterprise+ service accounts (10). security.txt valid to 31 December 2026, a public Bugcrowd programme, SOC 2 Type 2, ISO 27001, 27017, 27018 and 27701 (20).

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

Asana 84

Closed service with published user terms, subscriber terms and API terms. The SDKs are MIT. The OpenAPI repository has no licence file (15). Privacy statement effective 1 September 2026 and a DPA of the same date, with deletion on request or at termination but no retention period in days. The privacy statement says domain metadata trains Asana's machine learning models when Asana AI is enabled, and that third-party LLM providers may not train on customer data (22). A written deprecation process with start, activation and end dates, Asana-Change response headers and opt-in and opt-out request headers, with no minimum notice period stated (16). Subprocessor list updated 11 September 2026 with countries, and data residency in Europe, Australia and Japan (20).

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.

Asana 30

No x402, MPP or L402 in the docs, spec or pricing page (0). Seat prices are public (Starter $10.99 and Advanced $24.99 a user a month billed yearly, Enterprise through sales), with nothing charged per API call (10). The Personal plan is $0 for up to two users and includes API access at 150 requests a minute. We didn't run the signup form to confirm no card is asked for (20). A person signs up in a browser and creates a token or app in the developer console (0).

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

Asana 80

JavaScript SDK v3.4.0 and Python SDK v5.5.1 were tagged on 27 October 2026, and the OpenAPI repository was rebuilt on 29 October (30). The API changelog has entries on 10 August, 26 August, 28 September, 8, 9, 13, 26 and 27 October 2026 (two on 27 October), and each SDK has three or more tags since 3 August (20). The developer forum is active, with staff replies on changelog threads (12). JavaScript and Python SDKs are current, while Ruby, Java and PHP are end-of-support (13). The SDK repositories show only a publish workflow, no test run, and node-asana had 72 open issues per the 8 October check, not re-read on 1 November (5).

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.