Taskade vs Teamwork.com

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Teamwork.com 73

Graded on the hosted lines for REST API v3 and the hosted MCP server. status.teamwork.com is a Statuspage site whose front page lists components for Projects, Desk, Chat, Spaces and CRM in the US and EU regions, the websites and the API docs, though none for the API or the MCP server by name (20). Its history.atom feed, read on 1 November (robots.txt closes /api/, so the 8 October reading of the incidents and components feeds no longer counts), lists three incidents in the 90 days from 3 August, besides scheduled maintenance. Task creation in Projects for 40 minutes on 24 September, the Projects API in the US region from 13:08 to 14:58 UTC on 16 October, and loading issues for Projects apps in the US region from 15:58 to 17:21 UTC on 26 October. Each touched one function or one region, so all read as minor (20). The pricing page gives the API limit per plan, 150 requests a minute on Free, Basics and Accelerate, 300 on Optimize and 500 on Enterprise (15). A 429 comes with X-Rate-Limit-Limit, X-Rate-Limit-Remaining and X-Rate-Limit-Reset and the guide says access returns after 60 seconds. No Retry-After header and no idempotency keys were found (8 of 15). No SLA found. The terms promise reasonable endeavours and the security page states a goal of over 99.9 per cent (0). API v3 and MCP server 1.x carry no beta label (10).

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Teamwork.com 72

A Swagger 2.0 file for API v3 downloads from each reference page (319 paths, 430 operations) with no security scheme declared, and every MCP tool has a typed JSON Schema input in the public source (23 of 25). apidocs.teamwork.com/llms.txt returns 404. The main site has an llms.txt about the company and a Markdown pricing page, and the MCP tool reference is Markdown on GitHub (3 of 10). MCP descriptions say when to use a tool and name pitfalls, for example that a workflow from another project is ignored without a warning. API parameter descriptions are one line each (15 of 20). Enums, minimums and maximums and required fields in both, with nullable unions on many MCP inputs (12 of 15). Reference pages show response examples and 400, 403, 404 and 409 responses, while the error guide is brief and has no error body format (10 of 15). The API is versioned v1, v2 and v3 and the MCP server has tagged releases on GitHub, but no changelog for the REST API was found (9 of 15).

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

Teamwork.com 58

OAuth 2.0 authorisation code flow with PKCE (S256) and dynamic client registration, with scopes at product level only (projects, desk, spaces, chat). The app login flow guide calls the access token permanent, and personal use is by a per-user API key or username and password over Basic auth. Credentials travel in the Authorization header (20 of 30). Every credential acts with its user's permissions. An administrator has to enable MCP for the site, the shipped servers register no delete tools, and the local server has a -read-only flag. The hosted server has no documented read-only mode or confirmation step (12 of 20). Task descriptions, comments, tickets and chat messages written by other people reach the model, and no injection guidance was found (3 of 15). An activity tool and a guide to project change history exist. No log of API or MCP calls for the operator was found (8 of 15). security.txt is valid until 17 July 2027 and names security@teamwork.com, the MCP repository has a security policy with a 48-hour acknowledgement, and the security page lists ISO/IEC 27001:2022 and SOC 2 Type 2. No bug bounty or public advisories found (15 of 20).

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.

Teamwork.com 80

Closed service under terms naming Teamwork Crew Limited, with the MCP server, the Go SDK and the token helper open on GitHub and the MCP server under MIT (18 of 30). The privacy notice, last updated 19 August 2024, sends customer data to the DPA. The DPA and the terms agree that data is deleted after termination unless a copy is requested within 10 days, and the AI policy says customer data isn't used to train models. No retention periods are given (20 of 30). No written deprecation policy. The removal of localhost redirect URIs for dynamically registered OAuth apps was announced on 16 June 2026 for 1 August 2026 with Deprecation and Sunset headers, and the paging guide dates the end of total record counts to 6 January 2025 (12 of 20). The DPA lists ten sub-processors by function without locations, the AI list names AWS, OpenAI, Anthropic and Google with locations given as varying, and the security page says hosting is on AWS in the US and the EU (13 of 20).

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

Teamwork.com 30

No x402, MPP or L402 (0). Plan prices are public, Free $0, Basics $9.99 and Accelerate $24.99 a user a month billed annually, with the two larger plans quoted by sales. API calls aren't priced (10). The Free plan covers up to 5 users and 5 projects, and the 14-day trial needs no card (20). A person signs up in a browser and creates the key or approves the OAuth app (0).

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.

Teamwork.com 93

MCP server v1.60.1 was tagged on 30 October 2026 (30). The repository has 54 tags from 3 August to 30 October 2026, four of them since 8 October (20). Issue activity per the 8 October check of the GitHub API, not re-read on 1 November because GitHub refuses our reader. Three issues were open, and a bug report of 6 October (#581) was fixed and released the same day (20 of 25). The official MCP registry lists com.teamwork/mcp under Teamwork's own namespace, with 1.60.1 published on 30 October as the latest version, beside the Go SDK twapi-go-sdk (v1.37.0 on 23 October) (15). A test workflow runs on every push, and dependency updates are merged within days (8 of 10).