Linear MCP vs Taskade

Linear MCP 51

Tools carry JSON Schema by protocol, but Linear doesn't publish the tool list or schemas and we couldn't read them without signing in to a workspace (15, carried). llms.txt with links to .md pages, including the MCP page (10). Descriptions not readable from public sources (5). Input typing not verifiable (5). The docs have a troubleshooting FAQ for auth and transport and six example prompts, but no tool examples or error responses (4). Each changelog entry now has an MCP server section (14 September, 8 October, 22 October 2026), with no version on the tool surface; the registry version read on 1 October came from the registry's JSON API, which this run doesn't use, so it is struck and the partial 12 is carried on the changelog alone. 15 + 10 + 5 + 5 + 4 + 12 = 51.

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Linear MCP 38

Tool count not published and not countable without a workspace sign-in, so context cost is scored as unknown (5), plus a read-only endpoint that exposes only read tools (7). The changelog says list_customer_needs returns results one page at a time, other list tools weren't visible (8). No documented error responses for MCP calls (3). The read-only endpoint is safe by construction, and we couldn't check readOnlyHint or destructiveHint (8). One URL with OAuth or a Bearer key, and an official SDK in TypeScript only (7). 12 + 8 + 3 + 8 + 7 = 38.

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.

Linear MCP 75

OAuth 2.1 with dynamic client registration and a read scope that, in Linear's words, means the token can't reach write APIs, or API keys that can be created with Read permission only, sent in the Authorization header (30). A read-only endpoint plus read-only keys and scopes, but no confirmation step for writes on the full endpoint (16). Tools return issue and comment text written by anyone in the workspace, and we found no prompt-injection guidance (3). Workspace audit logs cover the last 3 months, admins can see active MCP connections and explicit OAuth token revocations are logged since 14 September 2026, but we found no per-call MCP log (8). Programme 14 to 18: security.txt valid (Expires 31 December 2027, read on 4 November) pointing to a disclosure policy that pays rewards for valid vulnerabilities and names the MCP server (mcp.linear.app) in scope, with SOC 2 Type II and ISO/IEC 27001:2022 on the security page and no public advisories found (18, as atlassian-rovo-mcp with security.txt, a bounty and SOC 2 and ISO 27001). 30 + 16 + 3 + 8 + 18 = 75.

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

Linear MCP 60

incident.io status page at linearstatus.com with US and EU components for the app, API and integrations and an RSS history, but no MCP component (15, the value for a vendor page with no component for the product). Minor incidents only from 6 August: the docs site on 12 August, Codex sessions on 14 August, agent automation delays on 19 August, Android push on 1 September, degraded US performance on 5 September, an EU sync failure on 1 October (EU application only), Slack integrations on 28 October, a 15-minute partial outage loading the apps on 27 October and project pages on 30 October (20). The GraphQL API publishes limits, 2,500 requests an hour per user on an API key and 5,000 on OAuth, but the MCP docs don't say whether these apply (10, carried). The rate-limit page now says a limited GraphQL request returns HTTP 429 with RATELIMITED and a Retry-After header, where on 1 October it said HTTP 400; the MCP docs still say nothing on limits or retries, so the partial 5 is carried (the line's 10 for Retry-After alone if the API page is read as covering MCP). Uptime SLA listed on the Enterprise column of the pricing page with no SLA document found (0). The MCP server carries no preview label; only Claude auto-connect is marked beta (10). 15 + 20 + 10 + 5 + 0 + 10 = 60.

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Linear MCP 65

Last MCP server change on 22 October 2026 (users assigned by part of their name, customer lookup by domain and external IDs), 13 days before 4 November (30). Four dated MCP entries since 6 August: 13 August (enterprise-managed authorisation through Okta), 14 September (list_teams and get_team report visibility and retiredAt), 8 October (new list_customer_needs tool) and 22 October (20). Closed service with a public changelog and in-app support, no public issue tracker for the MCP server (10). Registry line 15 to 0: the 1 October reading of app.linear/linear came from the registry's JSON API, which this run doesn't use, and no first-hand page names the entry (0). No package to install, and the TypeScript SDK's health wasn't checked (5, carried). 30 + 20 + 10 + 0 + 5 = 65.

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.

Linear MCP 30

No x402, MPP or L402 (0). No separate MCP charge, and Linear's plan prices are public, from $0 to $16 per user a month before Enterprise (10). The pricing table lists MCP access as included on the Free plan, which needs no card (20). A person signs in through OAuth or creates an API key in the app (0). 0 + 10 + 20 + 0 = 30.

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.