OpenProject vs Taskade

OpenProject 87

The source is public under GPL-3.0, Enterprise add-ons included, with those add-ons unlocked by a paid token. The cloud runs under the Terms of Service of 6 August 2026 (28 of 30). The privacy policy of 30 July 2026 covers the cloud and names OpenProject GmbH as processor. An instance is deleted six months after the contract ends, web logs within 90 days, and the terms give 21 days' notice to export data. The data processing agreement follows the EU standard clauses and was last updated on 28 March 2024 (25 of 30). No deprecation policy with dates was found. The docs say the vendor strives to keep APIv3 backward compatible in stable releases, and 14 operations are marked deprecated with no removal date (7 of 20). The sub-processor list of 18 May 2026 names four companies for the openproject.com shard (AWS among them) and three for the EU shard (Scaleway among them), with addresses and transfer safeguards (19 of 20). Self-hosted installs call OpenProject's Release API for the update badge by default, which the privacy policy (version 30 July 2026) describes with its fields and an opt-out.

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.

OpenProject 76

A public OpenAPI 3.1 document with 234 paths and 320 operations, downloadable from the docs site and served by every instance at /api/v3/spec.json and /api/v3/spec.yml (25). No llms.txt (the path returns 404). The docs are Markdown files in the public repository, not served to agents from the docs site (2 of 10). The reference explains HAL links, collections, filters, forms and each resource's permissions at length, with little on when not to use an endpoint (14 of 20). 204 component schemas and 95 enumerations, but write bodies are HAL objects with _links, filters travel as a JSON string in the query, and custom fields appear as customFieldN. Form endpoints return the allowed values for a given resource (10 of 15). The spec carries about 1,200 examples and lists 400, 403, 404, 406, 415 and 422 responses per operation, with stable error identifiers (14 of 15). The version sits in the path and release notes are dated and list API changes. No changelog for the API alone was found (11 of 15).

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

OpenProject 59

OAuth 2.0 with the authorisation code grant, PKCE and client credentials, with one scope per API (api_v3, mcp, scim_v2, bcf_v2_1) and none finer. Personal API tokens are named, can be several and can be deleted, and carry their user's full permissions. No expiry or per-token scope was found. Tokens travel in the Authorization header only (22 of 30). Reach is limited by project roles and permissions, so a dedicated user with a read-only role is the least-privilege route, and administrators can switch off single MCP tools. No confirmation step for deletes (12 of 20). Work package text and comments are untrusted content, and no prompt-injection guidance was found in the API or MCP docs (2 of 15). Every change to a work package is journalled with its author, and application logs record sign-ins and credential changes. No per-token API log for a cloud customer was found (8 of 15). A signed security.txt valid to 31 December 2026, a disclosure policy with a 21-day target for critical fixes, advisories and CVEs published on GitHub, signed container images with SBOMs, and a YesWeHack bounty paid for by the European Commission. No SOC 2 or ISO 27001 certificate for the vendor was found (15 of 20).

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

OpenProject 52

Graded on the APIv3 of OpenProject Enterprise cloud, with the hosted lines. The same API ships in the free Community edition. Status page at status.openproject.com, run on UptimeRobot, with a 90-day uptime view and an update history (20). On 4 November the page still drew its figures and history by script from /api/, which its robots.txt disallows, so the incident record from 6 August could not be read (5, unread and not a finding against the vendor). No request limit for the API is published for the cloud. The only documented rule is an optional one for self-hosted installs, six requests per three seconds on form endpoints, off by default (3 of 15, partly met). No 429 or Retry-After guidance and no idempotency keys were found. Updates must send lockVersion, and a stale value is refused with 409 UpdateConflict (4 of 15, partly met). The service description, last updated 28 August 2026 and re-read on 4 November, commits to 99.9 per cent availability a year with SLA credits (10). APIv3 is described as the stable API (10). 20 + 5 + 3 + 4 + 10 + 10 = 52.

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

OpenProject 30

No x402, MPP or L402 (0). Plan prices are public per user per month, Basic at $7.25, Professional at $13.50 and Premium at $19.50 on a yearly term, Corporate on request. API calls are not priced (10). The cloud trial runs 14 days and the signup page says no credit card is needed. The Community edition is free to self-host, API included (20). A person fills in a web form with a domain and an email address to get an instance, and creates the token in account settings (0).

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

OpenProject 75

Version 18.0.0 was released on 2 November 2026, after 17.9.2 (15 October), 17.9.3 (22 October), 17.9.4 (26 October), 17.9.5 and 17.9.6 (30 October) (30). Twelve releases in the 90 days from 6 August, 17.7.1 through 18.0.0 (20). OpenProject tracks bugs on community.openproject.org, which we did not sample, so responsiveness is scored on the release record and the advisory handling alone, with fixes published alongside each advisory (15 of 25). No official SDK and no MCP registry entry were found (0 of 15). The repository runs test, CodeQL, Brakeman, Semgrep, dependency review and npm audit workflows, the test workflow running unit and browser test suites and validating the API spec on push and pull request, and the default branch had commits on 4 November 2026 (10). 30 + 20 + 15 + 0 + 10 = 75.

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.