Taskade vs Wrike

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.

Wrike 33

The newest API changelog entries are dated 17 September 2026, 48 days before this check. The MCP tools page was re-stamped on 19 October 2026 and the MCP overview on 9 October, but neither records a change (the same 29 tools as on 8 October), so neither sets the date (20). Two dated changelog entries in the 90 days from 6 August, both on 17 September; the 28 July entry has left the window and the agent skills repository has no releases, so short of three (0). A public changelog, a developer community forum and a support form. We didn't check response times (10 of 15). No official SDK, and the official MCP registry lists only a third-party server, ai.waystation/wrike (0). No packages to assess. The MIT agent skills repository is published by CI and last changed on 7 October 2026 (3 of 10). 20+0+10+0+3 = 33.

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

Wrike 55

Graded on the hosted lines for REST API v4 and the MCP server. status.wrike.com is Wrike's own page with a dated timeline but no per-component history and no API or MCP entry, per the 8 October check (15 of 20). The page draws its timeline by script from a data feed on the same host. The 8 October incident reading came from that feed, which this method doesn't read, so it is struck, and the window from 6 August to 4 November is unread (5). The error reference gives 400 requests a minute per IP or access token (15). The FAQ advises retries with exponential backoff on 429, with no Retry-After header and no idempotency keys or safe-retry guidance for writes found (10, backoff guidance alone). No SLA found in the terms, pricing or trust centre pages we read (0). API v4 is generally available and MCP v2 carries no beta label, though recommend_resources is a Wrike Labs tool (10). 15+5+15+10+0+10 = 55.

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

Wrike 60

OAuth 2.0 authorisation code flow with read-only and read-write scopes, one-hour access tokens and revocation. Permanent tokens never expire and reach everything their user can, and the docs point clients that need dynamic client registration to them. The docs also allow the token as an access_token query parameter, which costs 10 (20 of 30). The API has wsReadOnly, the MCP server inherits the user's permissions, has no delete tool and marks tools Read or Write, and client admins can restrict tools. No server-side read-only mode or confirmation step is documented (12 of 20). Comments, descriptions and inbox items written by other people reach the model, and no injection guidance was found (3 of 15). MCP actions appear in the activity stream under the user, and user audit reports are limited to Pinnacle and Apex (10 of 15). A vulnerability report form at /security/report/ and appsec@team.wrike.com, named in a security.txt that expired on 10 October 2026, and SOC 2 Type II and ISO 27001, 27017, 27018 and 27701 on the trust centre per the 8 October check. No bug bounty or public advisories found (15 of 20).

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

Wrike 78

Each of the 244 API reference pages embeds an OpenAPI 3.0.1 definition with a bearer security scheme, and a Postman collection is published. We found no single downloadable spec (22 of 25). llms.txt and Markdown copies of every docs page (10). API parameter descriptions are short, such as 'Title of task, required', and the MCP tools page gives one line per tool with a few limits stated, for example that prefill_requestform doesn't submit. The MCP tool schemas sit behind authentication and were not read (12 of 20). Enums for status, importance and sort fields and required flags, but structured values such as dates travel as JSON strings in query parameters (11 of 15). Curl and JSON examples in the guides and an error table of 11 codes, while reference responses are grouped as 2XX, 4XX and 5XX (10 of 15). A single v4 version and a dated changelog with sparse entries (13 of 15).

Taskade 20

No x402, MPP or L402 (0). Plan prices are public, billed yearly, with nothing per call (10). A Free plan needs no card, but the hosted MCP server is limited to paid plans and the pricing table lists the API from Business up, so the free tier reaches little of the agent surface (10 of 20). A person signs up in a browser and verifies an email before a token can be made (0). 0 + 10 + 10 + 0 = 20.

Wrike 30

No x402, MPP or L402 (0). Plan prices are public, Free $0, Team $10 and Business $25 a user a month, with Pinnacle and Apex quoted by sales. API calls aren't priced (10). The Free plan includes the API and the MCP server, and the 14-day trial needs no card (20). A person signs up in a browser and creates the API app or token (0).

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.

Wrike 76

Closed service with terms naming Wrike, Inc., and MIT agent skills (15). The privacy policy of 1 June 2026 gives retention periods but excludes customer data, which falls under the terms and a published DPA. The terms say customer data isn't used to train Wrike AI models, deletion follows 'then-current practices', and inactive Free accounts are deleted after 180 days. The MCP docs say the server stores and caches nothing (22 of 30). No deprecation policy found. The FAQ records the v3 sunset on 30 June 2019, and one parameter is marked deprecated without a date (5 of 20). The sub-processor list, updated 22 October 2026, gives purposes and US or EU locations by region (20).