Atlassian Rovo MCP Server vs Taskade

Atlassian Rovo MCP Server 48

MCP tools carry JSON Schema inputs by protocol, but the server is closed and the supported-tools page lists names and one-line purposes, not schemas, so typing on every tool couldn't be confirmed; 0 at the line's fixed value (was 15, not a checklist value). The developer site serves each guide as Markdown (supported-tools.md), though developer.atlassian.com/llms.txt answers 404 (10, was 5). Descriptions are one line of purpose, such as "Create a new Jira work item", with few saying when not to use a tool (8). Inputs unverified, and issue 244 reported a getJiraIssue argument that Vertex and Gemini reject, per the 1 October check (7). The README lists troubleshooting messages and the skills give usage examples, but there's no error catalogue (8). Versioned endpoints (v1, v2) and a dated changelog, newest entry 3 November 2026 (15). 0 + 10 + 8 + 7 + 8 + 15 = 48.

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Atlassian Rovo MCP Server 85

OAuth 2.1 bounded by the user's existing product permissions, with scopes per permission group, or API tokens in the Authorization header (Basic email and token, or a service-account Bearer key), never in the URL. Personal API tokens carry the user's full reach (26). Admins grant permission groups per product, delete_jira and manage_jira are off by default, destructive calls go through their own meta-tool, and admins can block client domains and enforce IP allowlists (16). The README and SECURITY.md describe prompt injection and tool poisoning and ask for human confirmation on destructive actions, guidance only (10). Every tool call lands in the organisation audit log under Rovo MCP User Actions (15). security.txt valid (Expires 4 February 2027, read on 4 November), a private disclosure route with a bug bounty named in SECURITY.md, and SOC 2 and ISO 27001 on the trust page, though the page doesn't say Rovo or MCP is in scope (18).

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

Atlassian Rovo MCP Server 50

Statuspage at rovo.status.atlassian.com with an MCP component, read from the page and history.atom (20). In the 90 days from 6 August the feed has two MCP incidents, degraded performance with timeouts on 21 October (15:30 to 18:25 UTC) and intermittent errors for some users on 22 October (14:42 to 18:16 UTC), both degradation rather than an outage, plus the 18 August Rovo chat streaming incident, which doesn't name MCP. Minor only (20). No numeric rate limits for the MCP server in the docs, README or supported-tools page (0). No 429 or retry guidance found (0). No SLA that names the MCP server found (0). v2 has been GA since 8 September 2026 (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Atlassian Rovo MCP Server 10

No x402, MPP or L402 (0). Usage draws Rovo credits. The usage-limits page says single-product lookups are free and enriched Teamwork Graph calls cost 1 to 10 credits each, and the supported-tools page gives 15 to 30 credits for Confluence infographic and visualisation tools, but no per-credit price sits next to them, so plan-level public pricing (10). Atlassian Cloud has free plans with no card, but no page we read says the MCP server is enabled on them, so 0 (was 10, not a checklist value). A person signs in through a browser OAuth flow or creates an API token (0). 0 + 10 + 0 + 0 = 10.

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

Atlassian Rovo MCP Server 78

The hosted server is closed under Atlassian's customer agreement. The GitHub repository of docs, manifests and skills is Apache-2.0 (15). Atlassian publishes a privacy policy and DPA, but we didn't find MCP-specific retention statements and didn't fetch the DPA in this run (18). v1 retirement is dated (automatic move to v2 on 1 March 2027, /v1/sse unsupported after 30 June 2026) and tool renames are logged, with no stated notice period (18). Atlassian publishes subprocessors and data residency for Cloud, not checked for MCP in this run (10).

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.

Atlassian Rovo MCP Server 73

About 247 tools are named on the supported-tools page (updated 2 November 2026), but v2 returns about 20 primary tools in tools/list, marked (Primary), with discover and the execute meta-tools loading the rest on demand, and admins enable permission groups per product. 11 to 30 tools gives 15, plus 10 back for dynamic loading and toolsets (25, was 20). Search and list tools take maxResults or limit, list tools such as listJiraIssueComments and searchTeams are paginated, and JQL, CQL and field selection filter results (20, was 15). Error messages are documented for IP allowlisting and auth, including 403s from IP rules or scopes, not per tool, so partly met (10 of 20). Read, write and destructive execution of deferred tools are separate meta-tools, but primary write tools are called by name, no readOnlyHint or destructiveHint is named in the tool docs and there is no idempotency guidance, so partly met (10 of 20). One URL and an OAuth sign-in, no SDK, required parameters per tool not published, so partly met (8 of 15). The three partly met lines keep their earlier values pending a rule on in-between values. 25 + 20 + 10 + 10 + 8 = 73.

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.