Taskade vs Todoist

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Todoist 61

Graded on the hosted API v1 and the hosted MCP server. Instatus page at status.todoist.net (status.todoist.com redirects there) with Web application & API, Content Sync API, Website and Infrastructure components (20). In the 90 days from 3 August 2026 the history, re-read on 1 November, shows a 25 August "Sync and login issue" with Web application & API and Content Sync API in major outage from 8:58 to 9:17 AM UTC (19 minutes, inside a 1 hour 36 minute incident), and "Degraded performance in the web and desktop apps" from 31 August to 3 September for "some users" (65 hours 38 minutes). The 25 August outage took the whole API and sync down, which this run reads as a major however short, as for asana's and sumsub's full outages under an hour. The 31 August incident is partial by its own text, and the 3 August billing incident (Stripe and the Billing Portal) doesn't touch the API. Planned 15-minute API shutdowns on 20 and 23 August, 6 September and 29 October were announced ahead and aren't counted. One major (10). Limits are published for /sync only, 1,000 partial and 100 full requests per user per 15 minutes, with no figure for the other REST endpoints (10). 429 is documented, errors carry retry_after and a Retry-After header, and Sync commands are idempotent by uuid, with no general backoff guidance (11). No SLA found in the terms of service (0). API v1 and the MCP page carry no beta label (10). 20 + 10 + 10 + 11 + 0 + 10 = 61.

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

Todoist 61

OAuth authorisation code flow with six documented scopes, PKCE (S256), one-hour access tokens with refresh tokens, a revocation endpoint and dynamic client registration. The personal API token from settings has full access and no scopes, so 25 of 30. data:read and task:add scopes exist, deletes need data:delete or project:delete, and the CLI has a read-only login. The hosted MCP server lists data:read_write as its only scope and we found no confirmation step for deletes beyond the tool annotations (12). Tasks and comments can be written by collaborators and no prompt-injection guidance was found in the API reference or the MCP repository (0). An activity log API covers tasks, comments and projects, kept for 7 days on Beginner and in full on Pro and Business. It is not a per-call log (9). security.txt on todoist.com is valid to 31 December 2026 while the www copy expired on 1 September 2026, both re-read on 1 November. A bug bounty policy pays in Todoist Pro time, and the pricing page claims SOC 2 Type II. The trust centre needs JavaScript and we couldn't read it. No advisory for the MCP server, SDKs or CLI on OSV (15). 25 + 12 + 0 + 9 + 15 = 61.

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Todoist 76

The OpenAPI 3.1 description is embedded in the API reference at developer.todoist.com/api/v1/, read on 1 November with 124 operations on 94 paths, and MCP tools are defined with zod input and output schemas (25). developer.todoist.com's robots.txt now disallows every path but the home page and /api/v1/, so the separate openapi.json file and the 8 October reading of it are struck, and llms.txt there couldn't be checked. www.todoist.com/llms.txt answers with an HTML page, and no Markdown docs were found (0). All 124 operations have descriptions, and the MCP server instructions say which tool to pick, for example reschedule-tasks over update-tasks for dates (17). 97 enums in the embedded spec and bounded limits in the MCP schemas, but /sync takes a free-form list of commands (12). Examples throughout (1,142 example keys), and 400, 401, 403 and 404 on every operation with the error object documented. 429 appears on 11 of 124 operations (12). The API is versioned with a v9 migration guide, and the MCP server, SDKs and CLI have dated changelogs. No dated changelog for the API itself was found, only a mailing list (10). 25 + 0 + 17 + 12 + 12 + 10 = 76.

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

Todoist 30

No x402, MPP or L402 in the docs or the OpenAPI description (0). Plan prices are public (re-read on 1 November), Pro at $7 a month or $60 a year and Business at $10 a user a month or $8 billed yearly, with nothing charged per call (10). The Beginner plan is free, and the developer site says the API is free to use with any Todoist account (20). A person signs up in a browser and approves OAuth or copies a token. Dynamic client registration lets a client register itself, but the user still consents in a browser (0). 0 + 10 + 20 + 0 = 30.

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.

Todoist 77

47 MCP tools at v13.8.2 scores 5. No toolsets or read-only subset, but a test in the repository caps tool definitions plus instructions at 35,700 tokens and several tools take batches, so 3 added back (8). Cursor pagination with limit (default 50, maximum 200), a filter query language at /tasks/filter, and MCP task searches that default to 10 results (20). JSON errors with error_tag, error_code and error_extra holding retry_after and an explanation, and since v13.7.2 batch tools report per-item failures (17). Every MCP tool has readOnlyHint, destructiveHint and idempotentHint (22 read-only and 12 destructive at v13.8.2, after v13.6.4 corrected several), and Sync commands are idempotent by uuid. REST idempotency isn't documented (17). A task needs only content, due dates accept natural language, and there are official Python and TypeScript SDKs (15). 8 + 20 + 17 + 17 + 15 = 77.

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.

Todoist 77

The service is closed with published terms (effective 27 August 2026, re-read on 1 November), and the MCP server, both SDKs and the CLI are MIT (20). The privacy policy (effective 27 August 2026) keeps data as long as necessary and holds an encrypted backup for 90 days after account deletion. The terms let Todoist send user content to third-party LLM providers. No DPA and no statement on model training was found on the pages we read (17). Deprecation notices appear in the API docs without dates, alongside a v9 migration guide and an API mailing list (8). The privacy policy names AWS, Microsoft Azure, Google Cloud, Zendesk and Google and says data is processed in the US. The full sub-processor list is on the trust centre, which we couldn't read (12). 20 + 17 + 8 + 12 = 57.