Shortcut vs Taskade

Shortcut 69

Graded on the hosted lines for REST API v3 and the hosted MCP server. status.shortcut.com is a Statuspage site with API and Shortcut MCP components and history back to March 2023 (20). Read from its history feed and incident pages on 4 November 2026, the 90 days from 6 August hold four incidents. Outgoing webhooks were delayed twice on 19 October (about 35 minutes and 53 minutes, Integrations component), and GitHub processing was delayed on 27 October and from 3 November (still investigating). All are partial, none names the API or MCP component, and the July MCP incidents and the 4 August search delay have left the window, so minor only (20). The docs give 200 requests a minute (15). A 429 is documented, with no Retry-After header, backoff guidance or idempotency keys found for v3 (4 of 15). The Enterprise plan lists 'Premier support SLAs', and no uptime SLA was found (0). v3 is the current version with backwards-compatible changes only, and the hosted MCP server carries no beta label. v4 is now labelled beta and isn't graded (10).

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Shortcut 75

Swagger 2.0 and OpenAPI 3.0 files for v3 are downloadable from the docs (143 operations on 85 paths), and an OpenAPI 3.0.3 file for v4 (247 operations on 8 October, labelled beta since then, 257 operations in its reference on 4 November) is at www.shortcut.com/openapi.json. The v3 reference page lists the same 143 operations on 4 November, and the spec files themselves weren't re-read. The hosted MCP server's tool schemas need an account and were not read (25). www.shortcut.com/llms.txt links the spec, and help centre pages have Markdown copies. developer.shortcut.com has no llms.txt and is a single HTML page per version (7 of 10). 127 of 143 operations carry a description, mostly one line, with a few usage rules such as the workflow_state_id or project_id choice on story creation (12 of 20). Enums, maxLength, formats and required flags throughout (13 of 15). Every endpoint has a curl example and an example response, but errors are the same three lines everywhere (400 schema mismatch, 404, 422) with no documented error body (9 of 15). Versions are in the path (v2 deprecated, v3 current, v4 beta). No API changelog was found, although the v4 page refers to one, and API changes appear in the product release notes (9 of 15).

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Shortcut 73

The newest release notes are dated 21 October 2026, and @shortcut/client 3.5.0 was tagged on 26 October 2026 (30). Release notes on 14 August, 18 September, 16 October and 21 October, and client tags 3.3.0 (11 September), 3.3.1 and 3.4.0 (16 September), 3.4.1 (22 September) and 3.5.0 (20). Closed service with public release notes, a community Slack and a support address. Response times were not checked (9 of 15). The official client is current, but the official MCP registry has only third-party Shortcut servers (com.mcparmory/shortcut, io.github.stayce/shortcut-mcp) (8 of 15). The client repository's newest commit is of 3 November 2026 under MIT, with CI workflows. The MCP server repository is archived at v0.25.0 (23 June 2026) with a notice that development moved to the hosted server (6 of 10).

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.

Shortcut 57

Graded on the API. Search takes detail=slim to drop descriptions and comments, and list responses use slim types. Field selection (fields) exists only in v4, which is labelled beta (17 of 25). Search has operators, page_size up to 250 and a next token, and epics have a paginated list, but the v4 migration note says v3 list endpoints return all results at once (14 of 20). Errors are HTTP codes with one-line meanings, 404, 422 and 400 on almost every one of the 143 operations, and no error body is documented (9 of 20). No idempotency keys in v3 (v4 beta takes one on agent sessions). external_id fields exist on some entities. The archived MCP source (v0.25.0) sets readOnlyHint, destructiveHint and idempotentHint on its 78 tools, and the hosted server's annotations were not read (8 of 20). A story needs only a name and a workflow state. One official SDK, @shortcut/client for JavaScript and TypeScript (9 of 15).

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.

Shortcut 30

No x402, MPP or L402 (0). Plan prices are public, Free $0 for up to 10 users, Team $8.50 a user a month billed yearly or $10 monthly, Business $12 or $16, Enterprise by quote. API calls aren't priced (10). The Free plan lists API and webhook access and the MCP server, and the 14-day trial needs no card (20). A person signs up in a browser and creates a token or approves the OAuth grant (0).

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

Shortcut 54

The hosted MCP server uses the OAuth authorisation code flow with PKCE (S256), dynamic client registration and the scopes read, write, story-write, comment-write and admin. REST tokens are created per user, can be read-only or read-write since 20 January 2026, and the v4 beta lets an admin list and disable workspace tokens. The v3 docs still accept the token as a token query parameter, marked deprecated, which costs 10 (20 of 30). Read-only tokens, a read scope, narrow story and comment scopes and the view-only Observer role. No confirmation step for deletes was found (14 of 20). Stories, comments and docs written by other people reach the model, and no injection guidance was found (3 of 15). Story history is readable by API. No workspace audit log of API or MCP calls was found in the pages read (5 of 15). No security.txt (404). A disclosure policy promises acknowledgement within a week, and the security page states SOC 2 Type 2 with the report on request. No bug bounty or public advisories found (12 of 20).

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.