Plane vs Taskade

Plane 89

Graded on the hosted MCP server and the Plane Cloud REST API, with the hosted lines. Status page at status.plane.so on incident.io with six components, API among them. The MCP server is not a component (20). Re-read on 1 November 2026, the page's 90-day window lists no incident and every component at 100 per cent. The one event is a payment-system maintenance window on 11 October, posted on 9 October and complete the same morning (30). API v1 is limited to 60 requests a minute per key. API v2 has per-token buckets with no number published, and no MCP limit was found (12 of 15). v2 returns 429 rate_limited with Retry-After and tells clients to wait that long, and v1 sends X-RateLimit-Remaining and X-RateLimit-Reset. No idempotency keys found (10 of 15). The SLA of 9 April 2026 sets 99.5 per cent monthly uptime with credits on Business and Enterprise (10). Neither surface is marked beta, but the MCP server is at 0.3.x and replaced its whole tool list in 0.3.0 on 14 August 2026 (7 of 10).

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Plane 68

The hosted MCP server uses OAuth with PKCE, dynamic client registration and read and write scopes, and REST OAuth apps can ask for any of 83 fine-grained scopes. The access-token route takes a personal access token that carries its owner's full permissions, with optional expiry, and the v2 docs say no read-only key exists. Tokens travel in headers only (25 of 30). The docs say there is no read-only endpoint and point to the client's tool allow-list. Workspace roles limit reach, a workspace access token can hold a minimum role, and no server-side confirmation for deletes is documented (10 of 20). The MCP docs tell users to treat titles, descriptions, comments and attachments as untrusted input and to prefer clients that confirm writes (9 of 15). Workspace audit logs record the actor type and source, with a read-only v2 endpoint, and the MCP server logs tool, action, status and user ID. The pricing page lists API-enabled audit logs under Enterprise Grid (10 of 15). A disclosure policy with a three-day acknowledgement and a no-legal-action promise, advisories published on GitHub, and SOC 2, ISO 27001, GDPR and HIPAA stated. No security.txt and no bounty found (14 of 20).

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

Plane 80

Every MCP tool is typed in the open repository, with action as a closed list. For the REST API the v2 docs say an OpenAPI document is served at /api/v2/schema/, but api.plane.so's robots.txt disallows every path, so we didn't read it, and the 8 October reading of that host is struck. v1's spec is off by default on self-hosted installs (20 of 25). llms.txt and a Markdown copy of every docs page (10). Each tool description lists its actions with required and optional parameters, a get_pql_reference tool explains the query language, server instructions cover epics, and each v2 endpoint page names its scopes and error codes. Guidance on when not to use a tool is thin (16 of 20). Enumerated values other than action are plain strings checked at call time, and optional parameters default to empty strings, per the repository's own conventions file (9 of 15). v2 pages carry cURL, Python and JavaScript examples and a full error code table, and the MCP docs have a troubleshooting table (13 of 15). API versions sit in the path, the MCP server has tagged releases with an upgrade guide, and the product changelog is dated. No developer changelog for the API was found (12 of 15).

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Plane 78

30 MCP tools, about 67,000 characters by the repository's count, down from 177 before 0.3.0 (15). No toolsets or read-only subset, though list and retrieve actions take fields and per_page (2 more, 17 of 25). Cursor pagination, PQL filters, order_by, ?fields= and ?expand= on both API versions and on MCP list actions (20). v2 errors are problem+json with a stable code and per-field entries, and the MCP server names missing arguments and plan-gated functions. v1 errors are plain status codes (17 of 20). readOnlyHint and destructiveHint are set per tool from its actions, so a tool with one delete action is marked destructive as a whole and idempotentHint is false throughout. No idempotency keys (10 of 20). workitem create needs only project_id and name, and there are official Python and Node SDKs (14 of 15).

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.

Plane 30

No x402, MPP or L402 (0). Plan prices are public, Free, Pro at $6 a seat a month billed yearly or $8 monthly, Business at $13 or $15, Enterprise Grid on request. API and MCP calls are not priced per call (10). The Free cloud plan covers up to 12 users, the MCP server is free and the Community Edition can be self-hosted at no charge. We did not go through signup to confirm no card is asked for (20). Dynamic client registration lets an MCP client register itself, but a person signs up and approves the workspace in a browser, or creates a token in settings (0).

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

Plane 76

The MCP server and both SDKs are MIT and the Community Edition is AGPL-3.0. Plane Cloud and the Commercial Edition run under the Terms of Service of 9 April 2026 (26 of 30). The privacy policy, the DPA and the terms agree. Customer data is exportable for 30 days after termination and deleted within a further 60, raw logs are kept up to 12 months, breaches are notified within 72 hours, and customer data is not used to train general-purpose models (26 of 30). No deprecation policy with dates was found. The docs mark v1 webhooks, the SSE endpoint and the npm MCP package as deprecated without removal dates, and say API v1 remains available (8 of 20). The sub-processor list of 9 April 2026 names 21 companies with locations and promises 30 days' notice. Hosting is on AWS, with the region not stated on the pages read (17 of 20).

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.