Taiga vs Taskade

Taiga 21

The latest tagged backend release is 6.10.2 of 2 July 2026, 99 days before the check (10). No tagged release in the last 90 days. The main branch had merges on 28 September 2026 and the changelog lists 6.10.3 as unreleased (0). Of the 25 open issues on the first page of taigaio/taiga-back, 18 have no reply, some since 2023, and 59 are open in all. The community forum was not sampled (6 of 25). No official SDK and no MCP server were found (0). One CI workflow runs the tests on Python 3.10 only, and issues about outdated packages (August 2025) and Python 3.13 (January 2026) are open. Version 6.10.0 updated dependencies (5).

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.

Taiga 35

No OpenAPI or other machine-readable contract was found (0). No llms.txt (the path returned 404). The docs' AsciiDoc source is public in taigaio/taiga-doc but is not served to agents (2 of 10). Each of the 49 sections states what a call does and lists its parameters in a line or two, with nothing on when not to use it (10 of 20). Parameters are listed with a type and a required mark, with no schema, enumerations or constraints (6 of 15). Every call has a curl example and a sample response object. Error responses are not described (9 of 15). The version sits in the path and the backend has a dated changelog. There is no changelog for the API, and the reference's footer is dated 3 April 2024 (8 of 15).

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Taiga 17

Graded on the hosted REST API at api.taiga.io, with the hosted lines. The same API ships in the open-source backend. No status page is linked from the site, the docs or the terms (0), so there is no incident record to read (0). No request limit is published with numbers. The reference says only that an instance configured with throttling answers 429, and the backend's default settings leave the general rates unset (2 of 15). The backend's 429 message states the seconds to wait, which the reference does not mention, and every modifying request carries a version for optimistic concurrency. No idempotency keys and no retry guidance (5 of 15). The pricing page names priority support with an SLA for on-premise contracts by quote, and no SLA text is published (0). The API is version 1 and runs the vendor's own web client, though the terms say it may not always be available (10).

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Taiga 49

Graded on the REST API. Lists return 30 items a page and use lighter list objects than the detail calls. There is no field selection, and the page-size parameter in the backend settings is not in the reference (12 of 25). Pagination headers, per-resource filters, order_by, a filters_data call for each work item type and a project search endpoint (16 of 20). The backend returns _error_message and _error_type fields, which the reference does not document (6 of 20). No idempotency keys. The version parameter stops lost updates (10 of 20). No official SDK was found. Creating a task needs only a project and a subject, and a resolver call turns slugs into ids (5 of 15).

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.

Taiga 30

No x402, MPP or L402 (0). Plan prices are public, flat per month in euros with unlimited users, 5, 20 and 60 euros. API calls are not priced (10). A Free plan with one public and one private project and 10 MB of storage. We did not open the registration form, so no card is our reading of the pricing page (20). The reference documents POST /api/v1/auth/register, which takes an email address, a password and acceptance of the terms. We did not call it, the backend ships with public registration off, and a person accepting terms is still a signup, so no credit (0).

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

Taiga 37

The hosted service has no API key. A client posts the account's user name and password to /api/v1/auth and gets a bearer token, 24 hours by the backend default, with an 8-day refresh token. The token has no scopes and travels in the Authorization header. Application tokens need an application registered by an instance administrator (10 of 30). Reach is set by project roles with per-permission lists, so a dedicated account with a narrow role is the least-privilege route. No read-only token and no confirmation step for deletes (10 of 20). Story, issue and wiki text is untrusted content, and no prompt-injection guidance was found (2 of 15). Each object has a history endpoint, projects have timelines and webhooks have a delivery log. No API access log was found (7 of 15). A SECURITY.md and a security page give security@taiga.io, and two advisories with CVEs were published in October 2025. No security.txt, no bug bounty and no certificate held by Taiga were found. The security page cites the hosting provider's ISO/IEC 27001 (8 of 20).

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.