Basecamp vs Taskade

Basecamp 67

OAuth at app.basecamp.com with PKCE, DPoP, device flow, client credentials, refresh tokens that rotate with reuse detection and a revocation endpoint. Scopes are only read and full, and tokens from the older Launchpad issuer carry none. Chatbot posting URLs carry a key in the path, which we did not count as a query-string secret (28). A read scope, agent principals limited to their projects and a documented endpoint list, basecamp mcp --read-only, and deletes that go to a trash kept about 25 days. No confirmation step in the API (15). The basecamp-connect skill says other people's text is input and not instructions. The API docs have no such guidance (8). Each recording has an events list, and the docs say the event feed is not an audit log. No operator log of API calls was found (5). Security response page, HackerOne bounty and CAIQ and HECVAT self-assessments. No security.txt, and the trust centre says there is no SOC 2 or ISO 27001 (11). 28+15+8+5+11 = 67.

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

Basecamp 59

Graded on the hosted lines for the REST API. 37status.com has a Basecamp 5 component with 90 days of daily uptime, per the 8 October check (20). On 1 November its robots.txt disallows every path, so the history wasn't re-read. The 8 October incident reading came from its Statuspage /api/v2/incidents.json path, which is disallowed, so it no longer counts, and the window from 3 August is unread. The line takes the no-readable-history score, a limit of our reading and not a finding against Basecamp (5). The docs publish one number, 50 requests per 10 seconds per IP, and say other limits exist and change dynamically. An unauthenticated call returned an x-ratelimit header with the same figures, per the 8 October check (12). 429 carries Retry-After, 5xx may be retried with exponential backoff and 404 must not be. Creating more than 100 embeds an hour answers 429 with no Retry-After, as documented. The SDK model marks which mutations are safe to repeat, but there are no idempotency keys (12). The terms say 37signals has no service-level agreements (0). The API is generally available. The CLI and SDKs are 0.x releases (10). 20+5+12+12+0+10 = 59.

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Basecamp 80

OpenAPI 3.1 in the basecamp-sdk repository, version 2026-10-30, 295 operations on 198 paths (25). basecamp.com/llms.txt returned 404 on 8 October, but the whole API reference is Markdown in the bc-api repository and the CLI ships agent skills (10). All 295 operations have a description and none has a summary. The reference adds a key concepts section and the list of endpoints an agent's own token may call, with little guidance on when not to use a route (15). 512 schemas with required fields and formats, but one enum and three length limits in the whole spec, so allowed values live in prose (9). Each reference section has example JSON and a cURL line. The spec documents 401, 403 and 500 on every operation, 429 on 175, 404 on 169 and 422 on 106 (13). The spec is dated and the SDK has a MIGRATING.md, but the API has no version in its path and no changelog of its own was found (8). 25+10+15+9+13+8 = 80.

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Basecamp 80

Closed service under clear terms, last updated 16 September 2026, which include API terms. The CLI, SDKs and spec are MIT and the docs CC BY-SA 4.0 (17). The privacy policy and terms agree on retention, with content removed from active systems within 30 days of cancellation and from backups within 60, and trashed items purged within 90. A data processing addendum is part of the terms, and the policy says content is not used to train AI. Application databases are generally not encrypted at rest, which the vendor states itself (27). The docs say older project-scoped routes will keep working in perpetuity and a company policy promises to keep products running, but the terms allow changes with or without notice and no dated API deprecation policy was found (10). The Basecamp sub-processor list, updated 5 October 2026, names 12 companies with countries. Data is stored in the United States, and new sub-processors are announced on a feed (18). 17+27+10+18 = 72.

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.

Basecamp 30

No x402, MPP or L402 in the docs, the spec or the pricing page (0). Plan prices are public and flat, re-read on 1 November (Freelancer $29, Pro $79, Pro Plus $99 a month, Pro Unlimited $199 a month billed annually), with nothing charged per call (10). The Free plan is $0 for one project and three users, and the terms say free plans ask for no card. We didn't run the signup form (20). A person signs up in a browser, and the device flow needs a person to approve a code. The OAuth server has a client registration endpoint, which registers a client and not an account (0). 0+10+20+0 = 30.

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.