Taskade vs Trello

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.

Trello 38

Closed service, so the changelog stands in for releases. The last API change is OAuth 2.0 for Trello, announced on 15 September 2026, 48 days before 2 November. The REST guides were last updated on 1 October 2026 and the OpenAPI file still has 191 paths and 261 operations (20). The changelog has two entries since 4 August, on 15 and 26 September 2026, and the one before is 20 February 2026 (0). A public dated changelog and a developer community that the changelog links to. We didn't read the community for reply times (8). No official server-side SDK. client.js and the Power-Up client library are the vendor's own clients, with example apps on Bitbucket (5). The spec is published and current with the OAuth 2.0 change. There is no package to assess (5).

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Trello 83

Graded on the hosted lines for the REST API. Statuspage at trello.status.atlassian.com with Trello.com and API components and incident history (20). Its history feed lists nothing between 26 May and 2 November 2026. The most recent entries are degraded performance from 17 to 26 May 2026 and an incident of about 85 minutes across several Atlassian products on 14 May 2026, both outside the 90 days from 4 August (30). Limits are published as 300 requests per 10 seconds per API key, 100 per token and 100 per 900 seconds on /1/members (15). 429 responses name the limit hit and every response carries x-rate-limit-* headers with the interval and the remaining count, but no Retry-After, backoff guidance or idempotency key was found (8). Atlassian's SLA page names the products covered by service credits and Trello is not among them (0). The REST API is generally available (10).

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Trello 63

OpenAPI 3.0.0 at developer.atlassian.com/cloud/trello/swagger.v3.json, 261 operations on 191 paths (25). developer.atlassian.com/llms.txt returned 404 and no Markdown copies of the docs were found (0). Every operation has a summary and 235 have a description, mostly one line that restates the name, with no guidance on when to use one route over another (10). 107 enums plus length and maximum constraints, but writes take their inputs as query parameters, some with no type, and many responses are a bare Success with no schema (9). 321 examples. Only 13 operations document 404 and 12 document 401, none documents 429, and the status codes page is general (7). One API version (/1), a spec version of 0.0.1 and a dated public changelog (12).

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

Trello 62

OAuth 2.0 with PKCE, ten scopes, one-hour access tokens and single-use refresh tokens valid 90 days has been available since 15 September 2026. The older key and user token remain, with read, write and account scopes, an expiry that can be never, and revocation by the user or the API. The documented default passes key and token in the URL query string, and the spec declares both as query credentials (30 less 10, so 20). Tokens can be read-only, OAuth 2.0 splits read from write for boards, workspaces, members and enterprises, and Power-Up clients are limited to one workspace. No confirmation step for deletes was found (12). Card text and comments are written by other people, and no prompt-injection guidance was found in the developer docs (0). An audit log route exists for Enterprise admin tokens, and board and card actions are readable on every plan (10). security.txt is signed and valid to 4 February 2027, Bugcrowd runs a Trello programme, and Atlassian's SOC 2 and ISO/IEC 27001:2022 pages list Trello (20).

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.

Trello 52

fields on 55 operations and nested resource parameters such as card_fields let a caller trim responses, and search takes per-type limits (20). limit up to 1,000 with before and since for longer lists, filter on 20 operations and a search route with paging, but no cursor tokens (15). Rate-limit and size errors carry machine-readable codes such as API_TOKEN_LIMIT_EXCEEDED and API_TOO_MANY_CARDS_REQUESTED. Other errors are a status code and a short message, such as invalid token (10). No idempotency keys or safe-retry guidance found (0). Creating a card needs only idList, and me stands in for the member ID. The only official client is client.js for browsers, with no server SDK in two languages (7).

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.

Trello 80

Closed service under the Atlassian Customer Agreement (effective 1 October 2026), with Trello product terms and the Atlassian Developer Terms for API use (15). Privacy policy effective 17 August 2026 and a data processing addendum. Deletion after termination follows the documentation, and no retention period in days was found. The privacy policy says information is used to improve the services, among other things for training machine learning models, and is de-identified where kept for that purpose (20). Deprecations are dated notices in the changelog. One cites six months under Atlassian's developer communications guidelines, two others in 2025 gave about one month, and we didn't find the guidelines page (13). The sub-processor list, effective 15 May 2026, names Trello against each provider with locations and 30 days' notice of additions. We didn't confirm that data residency covers Trello (18).