monday.com vs Taskade

monday.com 79

Graded on the GraphQL API and the hosted MCP server. Statuspage at status.monday.com with components by region, an API component among them, and incident history (20). In the 90 days to 1 November 2026 the history lists a critical platform connectivity incident of 2 hours 8 minutes on 5 September, which the incident page says affected the US, EU and AUS platform components, and minor or partial ones, among them EU automations (32 minutes) and partial UI degradation on 17 September, degraded AI functionality in the US (47 minutes) on 14 October, and slow loading of the EU platform (28 minutes) and delayed EU automations (26 minutes) on 19 October. None names the API component, and we read the record as one major outage (10). Impact levels come from the incident pages, since status.monday.com's robots.txt disallows /api/. Daily, per-minute, concurrency, complexity and IP limits are published with numbers per plan, on a rate limits page updated 28 October 2026 (15). 429 carries Retry-After, rate limit errors carry retry_in_seconds, every response has RateLimit headers, and mutations accept an Idempotency-Key header (15). A 99.9 per cent uptime SLA is published for the Enterprise plan, and the pricing page still names it (10). The API is generally available and the hosted MCP docs carry no beta label, though the tools reference says some newer tools run against a preview API schema (9). 20+10+15+15+10+9 = 79.

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

monday.com 70

OAuth 2.1 with PKCE, expiring access tokens, refresh tokens and revocation, 21 scopes, and dynamic client registration on the MCP server. Personal tokens are unscoped and carry every permission their user has, and legacy OAuth tokens don't expire (26). A custom OAuth app can limit the MCP connection to scopes such as boards:read, admins can limit MCP to chosen workspaces, and the local server has --read-only. No server-side confirmation for deletes was found (14). The MCP security page places prompt-injection defence on the client, and the vendor's agent skill file tells agents to treat board content as data (8). Board activity logs are available through the API. The audit log API is limited to Enterprise admins, and the MCP security page says self-service export of detailed MCP or API audit logs isn't available (7). SOC 2 Type II and ISO 27001:2022 among ten listed attestations, and a vulnerability report form. No security.txt or bug bounty was found (15). The MCP security page (updated 8 October 2026) was re-read on 1 November. The OAuth, scope and trust centre pages are per the 8 October check, not re-read on 1 November. OSV lists no advisory for the three npm packages on 1 November, and monday.com/.well-known/security.txt still answers 404. 26+14+8+7+15 = 70.

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

monday.com 82

The MCP reference lists 64 tools on 1 November. agent-toolkit 5.76.0 (20 October) dropped the five agent management tools from the local server, which the hosted server still serves (5 of 25). The local server adds a read-only flag, tool modes and a three-tool dynamic mode, a custom OAuth app can cap the hosted connection by scope, and GraphQL field selection sizes every API response, so 16 overall. Cursor pagination up to 500 items a page, rule-based filters through query_params, and lookup by column value (20). Errors carry a code, a status code, a request_id and retry_in_seconds where it applies, though application errors arrive with HTTP 200 (18). Idempotency-Key on mutations with a 30-minute replay window, and readOnlyHint, destructiveHint and idempotentHint on the tools in the source (20). Few required arguments, but an agent must read a board's columns before writing values, and the only official API SDK is for JavaScript and TypeScript (8). 16+20+18+20+8 = 82.

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.

monday.com 30

No x402, MPP or L402 found (0). Plan prices are public per seat, $9 (Basic), $12 (Standard) and $19 (Pro) a seat a month billed annually for 10 seats, with daily API call allowances per plan and no per-call price. Extra calls can be bought as an API add-on, with no price shown (10). A Free plan with no card needed per the pricing page, with 200 API calls a day per the rate limits page, and a free developer sandbox account (20). A person creates the account in a browser. The signup skill (2.0.0), the agents signup page and now monday.com's llms.txt all say no API provisions one (0). 0+10+20+0 = 30.

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

monday.com 79

Closed service with published Terms of Service (5 May 2026) and Developer Terms. The MCP server, toolkit and API SDK are MIT (15). Privacy policy last updated 1 October 2026 and Terms of Service 5 May 2026, both re-read on 1 November. A DPA dated 20 December 2023 with deletion or return of data after termination, and an AI trust centre that rules out model training on customer input and output, per the 8 October check, not re-read on 1 November. Retention is stated as for as long as reasonably needed, with no period given (20). API versions are listed with dates, and the versioning page says a current version won't change for at least six months and that deprecations are announced at least six months ahead. On 13 October 2026 the changelog removed the install_app and uninstall_app mutations from every public version that had them, including 2026-07, which was still the current version until 26 October, with effect the same day. SSE on the hosted MCP server is called deprecated and unsupported with no date given (14, was 18). Sub-processor list last updated 24 June 2026 (re-read on 1 November) with hosting regions, and US, EU and APAC account regions (20). 15+20+14+20 = 69.

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.