ClickUp vs Taskade

ClickUp 54

The MCP tools reference was updated on 27 October 2026 and product Release Notes 4.09 are dated 17 October 2026 (30). The product changelog has four dated entries since 5 August (18 August, 25 August, 18 September, 17 October), none about the public API. Docs pages changed on 10 August, 14 August, 17 September, 7 October and 27 October, and the official plugin repository had commits on 11 August, 7 September, 19 October and 30 October, the last two adding marketplace manifests (12 of 20). Public product changelog and feedback board, and 24/7 support stated on the pricing page. No API changelog, and response times were not checked (8 of 15). No entry under a ClickUp namespace in the official MCP registry, and no official SDK (0). The official clickup-plugin repository is MIT, still at version 1.1.0, with eight commits between 1 April and 30 October 2026 (4 of 10).

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.

ClickUp 62

Graded on the hosted MCP server and the public REST API, with the hosted lines. Status page at status.clickup.com on incident.io with 22 components, Public API among them, per the 8 October check (20). The incident window from 5 August couldn't be read on 3 November (a permission check refused the status feed and it wasn't retried). The 8 October incident reading came from the page's data endpoint, which this method doesn't use, so it is struck and the window is scored as unread (5). API limits published per plan, 100 requests a minute per token on Free Forever, Unlimited and Business, 1,000 on Business Plus and 10,000 on Enterprise, an MCP server limit of 1,000 requests a minute per connection and daily MCP caps of 100 to 25,000 calls (15). 429s carry X-RateLimit-* headers on the REST API. Since 27 October the MCP tools reference documents 429 with Retry-After: 60, RATE_LIMIT_EXCEEDED with retryAfter, reads as safe to retry, and says to check whether a write happened before retrying, since creates, comments and time entries duplicate. Safe-retry guidance without idempotency keys (12). No SLA found in the reviewed pages (0). Neither surface is marked beta, though the MCP docs say limits may change (10).

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

ClickUp 64

The MCP server takes only OAuth 2.1 with PKCE (S256), dynamic client registration and resource indicators, with two scopes, read and write. The REST API takes a personal token (pk_) or an OAuth 2.0 token, neither of which expires or carries scopes (24 of 30). The read scope, the user's choice of Workspaces at authorisation and ClickUp's permission model limit reach. The MCP FAQ says deletion tools are withheld as a safety measure, while the tools page lists Delete task. No server-side confirmation step is documented (12 of 20). Tools return task, comment, Doc and Chat text written by other people, and no injection guidance was found (3 of 15). Audit Log is an Enterprise capability with a v3 endpoint, and MCP responses carry X-Correlation-ID. Whether MCP calls are logged per tool was not established (8 of 15). security.txt valid until 1 September 2027, a disclosure policy with safe harbour, SOC 1 and SOC 2 Type 2, ISO 27001, 27017, 27018, 27701 and 42001 stated, third-party penetration tests. No paid bounty found (17 of 20).

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

ClickUp 79

OpenAPI 3.1 spec for API v2 with 138 operations and an OpenAPI 3.0 spec for v3 with 35, both public, per the 8 October check (25). The MCP tool JSON schemas need an OAuth session and were not read. llms.txt and a Markdown copy of every docs page (10). 137 of 138 v2 operations carry a description. Since 27 October the MCP tools reference gives each of 65 tools its exact name, Read or Write type, a Sensitive flag, inputs, returns and side effects. It lists clickup_delete_task while the MCP FAQ still says no deletion tools exist (15 of 20). Required fields are marked, but v2 has 6 enums, dates are Unix milliseconds and custom_fields filters travel as JSON in a query string. v3 has 62 enums (10 of 15). Every v2 operation has a response example. REST error responses are specified on few (400 on 6, 401 on 3), while the MCP reference now has an error table with meanings and whether to retry (12 of 15). Versions sit in the path (v2, v3). No API changelog was found, and the product changelog rarely covers the API (7 of 15).

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

ClickUp 57

65 documented MCP tools (5). The OAuth metadata advertises separate read and write scopes and clickup_get_task takes an include list (3 more, 8 of 25). Get Tasks filters by status, assignee, tag, dates and Custom Fields at 100 tasks a page, v3 and the MCP read tools use cursors with has_more, and MCP has a Workspace search tool. No field selection on v2 (16 of 20). REST errors carry err and an ECODE, v3 adds status, message and trace_id, and the MCP reference documents each error with whether to retry (16 of 20). No idempotency keys in either spec. The MCP reference states for each write what repeating it does and marks reads and writes, while readOnlyHint and destructiveHint could not be checked without an OAuth session (10 of 20). Create Task needs only name (and list_id over MCP). No official SDK found on npm or in the ClickUp GitHub organisation. The official plugin adds three skills that preview a plan before writing (7 of 15).

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.

ClickUp 30

No x402, MPP or L402 (0). Plan prices are public, Free Forever, Unlimited at $7 a seat a month billed yearly or $10 monthly, Business at $12 or $19, Enterprise through sales. API and MCP calls are not priced per call, and the MCP daily caps lift with the Everything AI add-on at $28 a seat a month (10). Free Forever includes the API and the MCP server at 100 MCP calls per rolling 24 hours. We did not go through signup to confirm no card is asked for (20). Dynamic client registration lets an MCP client register itself, but a person signs in and authorises the Workspace in a browser (0).

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.