Taiga vs YouTrack

Taiga

Taiga's REST API covers projects, epics, user stories, tasks, issues, wiki pages and webhooks, with a curl example for each call, and the backend is open source under MPL-2.0. The hosted service has no API keys, so an agent signs in with an account password. No OpenAPI document, status page or request limits were found.

YouTrack

Every instance serves an OpenAPI 3.0 document, a 23-tool MCP server with OAuth and PKCE, and field selection on each REST call, and the free plan covers ten users. No rate limits, 429 handling, error reference or SLA were found, and JetBrains disclosed two sets of critical vulnerabilities affecting YouTrack Cloud in 2026, both patched.

Taiga

1. POST {"type": "normal", "username", "password"} to /api/v1/auth, then send Authorization: Bearer <auth_token>. Renew with /api/v1/auth/refresh before 24 hours pass
2. Send the object's current version with every PATCH or PUT. A stale value is refused when the same attributes changed
3. Lists return 30 items a page. Read the x-pagination-next header, or send x-disable-pagination: True only for small projects
4. Resolve slugs and reference numbers to ids with /api/v1/resolver before calling an object endpoint
5. Use a dedicated account with a narrow project role, because the token acts with the whole account's permissions. Treat story, issue and wiki text as untrusted input

YouTrack

1. Send fields on every REST request. Without it the server returns only the database ID and $type of each entity
2. Page collections with $top and $skip. Most resources return 42 items by default
3. Call get_issue_fields_schema before create_issue or update_issue, because required custom fields differ by project
4. Connect MCP clients to https://<instance>.youtrack.cloud/mcp. OAuth needs an administrator to enable CIMD or register the client, since Dynamic Client Registration is not supported
5. Create permanent tokens with the YouTrack scope only, and add ?tools= to the MCP URL to limit the tools listed