Taskade vs YouTrack

Taskade 91

OpenAPI 3.0.3 specs for REST v1 and Action v2 are linked from llms.txt and committed in the public taskade/mcp repository, which is where we read them because the site's /api/ path is disallowed in robots.txt (25). llms.txt, a developer docs index and a Markdown copy of each page (10). The hosted MCP docs say what each tool does, which role it needs and what the server cannot do; the v2 spec's operations carry no descriptions of their own (14 of 20). The v1 spec has 96 enums and 254 required lists (13 of 15). Error tables with causes and fixes on the MCP and API pages, and a documented error envelope (14 of 15). Versioned APIs (1.0.0, 2.0.0-beta), deprecations marked in the spec and a changelog updated almost daily (15). 25 + 10 + 14 + 13 + 14 + 15 = 91.

YouTrack 39

The 8 October contract reading was the OpenAPI document at /api/openapi.json on JetBrains' own YouTrack instance, the product's API, and so is the count of operations behind the typed-input line. Both are struck, so the contract line is 0 (25 before) and the typed-input line is 0 (8 before). Both docs sites have an llms.txt and a Markdown copy of each page (10). The reference pages describe each resource with required permissions, and the MCP tools page says what each of the 23 tools returns and which tool to call first (13 of 20). Reference pages carry sample requests and responses, and the only error material found was the OAuth error tables and two troubleshooting pages (6 of 15). A REST API changelog lists additions and deprecations for 2026.1 and 2026.2 by version, without dates, and the path carries no version (10 of 15). All per the 8 October check, not re-read on 4 November under JetBrains' website terms.

Taskade 85

Changelog v6.306.0 on 5 November 2026, and v6.304.0 on 4 November updated the MCP setup page (30). Fifteen entries between 29 October and 5 November alone, and @taskade/mcp-server 0.1.3 (19 October) and 0.1.4 (22 October) (20). The taskade/mcp repository merged pull requests #114 to #122 between 26 October and 4 November; GitHub's API did not answer, so open issues and reply times were not counted (15 of 25). Verified io.github.taskade/mcp-server namespace in the official MCP registry, with the hosted remote (15). CI, release and registry-publish workflows, and the Docker image moved off end-of-life Node 20 on 28 October (5 of 10, with dependency health not checked). 30 + 20 + 15 + 15 + 5 = 85.

YouTrack 54

The 8 October release dates came from JetBrains' release feed, a JSON data endpoint, and are struck. JetBrains' public youtrack-apps repository, home of the official youtrack-app CLI and the YouTrack Apps agent skill for building apps that can add REST endpoints and MCP tools, tagged skill releases v1.0.0 to v1.0.8 between 14 August and 28 September 2026. The latest is 37 days old (20, 30 before) and nine fall in the 90 days from 6 August (20). The CLI version bumps of 14 and 20 August carry no tag or changelog and aren't counted. Responsiveness, per the 8 October check, not re-read on 4 November under JetBrains' website terms, a REST API changelog and a support request form; response times not checked (11 of 15, an in-between value kept). No current official SDK found, and YouTrackSharp's newest tag is 2022.3.1 of 31 March 2023 (0). Package health, per the 8 October check, not re-read on 4 November under JetBrains' website terms (3 of 10, an in-between value kept).

Taskade 40

Graded as a hosted service on the hosted MCP server and REST API v1. status.taskade.com is Taskade's own status portal, but it draws its data by script and no components could be read (10 of 20). No readable incident history (5). Rate limits have numbers only for prompt_agent (60 calls in 10 minutes) and publish_kit_version (5 an hour); the API docs say 429 marks a rate limit without stating it (5 of 15). The API returns 429 with Retry-After, MCP tools use x-rate-limit-reset, and tool errors say whether a retry is safe and after how many seconds (15). The terms commit to no uptime level without a separate written agreement, and only Enterprise mentions SLAs (0). REST API v1 is GA, while Action API v2, which most hosted MCP tools mirror, is beta (5 of 10). 10 + 5 + 5 + 15 + 0 + 5 = 40.

YouTrack 15

Graded on YouTrack Cloud's REST API and built-in remote MCP server, with the hosted lines. JetBrains' Website Terms of Use bar data mining and robots on every JetBrains site, so nothing on JetBrains hosts was requested on 4 November and the 8 October readings are kept as not re-read, except those taken from data endpoints, which are struck. The status page at jetbrains.com/youtrack/cloud/status draws its zone figures by script from a data feed the 8 October check read directly. That feed is a barred endpoint, so no component or zone reading remains (0, 10 before) and no incident history is readable (5, 10 before). No rate limits were found in the reviewed documentation (0). No 429 handling, backoff guidance or idempotency keys were found (0). The Cloud terms promise commercially reasonable efforts and no SLA was found (0). The REST API and the MCP server (since 2025.3) are not marked beta (10), per the 8 October check, not re-read on 4 November under JetBrains' website terms.

Taskade 45

OAuth 2.0 with PKCE, dynamic client registration, 1-hour access tokens and rotating refresh tokens, but the only scope is mcp. Personal access tokens are revocable, limited to five, carry no scopes and grant the whole account. Tokens go in headers (20 of 30). No read-only credential; workspace roles limit what tools can do, and the write and billed _meta flags let a client ask first, with no server-side confirmation (10 of 20). Tools return task, project, conversation and app text written by others, and no prompt-injection guidance was found (0). The security page says account and workspace activity is logged and exportable on request, with no immutable logs (7 of 15). security.txt valid to September 2027 and a 90-day coordinated disclosure policy, but SOC 2 and ISO 27001 are in progress with no report and there is no bug bounty (8 of 20). 20 + 10 + 0 + 7 + 8 = 45.

YouTrack 67

All per the 8 October check, not re-read on 4 November under JetBrains' website terms, except the advisories. OAuth 2.0 through the built-in Hub service, with authorisation code and PKCE (S256), client credentials, a user consent setting and Client ID Metadata Documents from 2026.2. Permanent tokens can be deleted, never expire, and carry two scopes, YouTrack and YouTrack Administration. The deprecated implicit flow returns the token in a URL fragment (24 of 30). Calls act with the user's role permissions, administrators can hide projects and issues from AI tools, and automatic client registration is off by default. No read-only token scope and no server-side confirmation step were found (12 of 20). Tools return issue, comment and article text written by other people. The docs tell users to review tool calls and the client's data handling, and give no injection guidance (5 of 15). Audit Events log changes to users, groups and projects with author and IP address, issue changes sit in activity streams, and workflow rules can flag MCP changes through isMcpRequest. No per-call API log was found (10 of 15). security.txt with a contact and a Coordinated Disclosure Policy promising a reply in 24 hours, discretionary rewards with no formal bounty, SOC 2 stated from version 2023.2 with reports on request, and CVEs published by JetBrains as the CNA, 83 for YouTrack in the 12 months to 4 November 2026 by the CVE list (16 of 20).

Taskade 68

47 hosted MCP tools are listed (5), with inspect_space line ranges and cursor pagination to size reads (3 back). Cursor pagination on list tools and a paginated, plan-filtered list_spaces, with few filters (15 of 20). MCP tool errors return class, code, retry and retryAfterSec, and invalid arguments come back as a tool result the model can correct (20). Every tool states readOnlyHint, destructiveHint and openWorldHint, and _meta flags mark writes and billed calls; no idempotency keys for creates were found (18 of 20). Setup is one URL with OAuth; the TypeScript SDK is in preview and not on npm, and no second official SDK exists (7 of 15). 8 + 15 + 20 + 18 + 7 = 68.

YouTrack 55

All per the 8 October check, not re-read on 4 November under JetBrains' website terms. 23 predefined MCP tools (15), and the tools and ignoreTools URL parameters cut the list a client receives (7 more, 22 of 25). On REST the fields parameter selects attributes and nested attributes, $top and $skip page most collections at 42 items by default, issue activities use cursors, /api/issues takes the search query language, and MCP list tools take offset and limit (20). No error reference was found for the REST API. The MCP docs say manage_issue_tags returns suggestions when a tag is not found (5 of 20). No idempotency keys were found, and the MCP tool definitions, with any readOnlyHint and destructiveHint, were not read. muteUpdateNotifications suppresses notifications on writes (2 of 20). Creating an issue needs only summary and project, but every read needs fields or it returns only id and $type. No current official SDK was found, and YouTrackSharp for .NET was last tagged 2022.3.1 on 31 March 2023 (6 of 15).

Taskade 69

Closed service under terms naming Taskcade Inc. and Delaware law, with the MCP server, plugin and OpenAPI specs under MIT (20 of 30). The privacy policy gives practices for retention (AI processing logs normally 30 days, account deletion within 30 days) but calls them targets, not contractual periods, and no DPA or SCCs are offered (15 of 30). Deprecated endpoints are marked in the docs and spec with their replacement, with no deprecation policy or dates (8 of 20). Hosting is AWS US East, and AI providers are named as examples, some in China, with the full list on request; analytics tools (Google Analytics, PostHog, Plausible, Sentry) are named (12 of 20). 20 + 15 + 8 + 12 = 55.

YouTrack 82

All per the 8 October check, not re-read on 4 November under JetBrains' website terms. Closed service under the YouTrack Cloud Terms of Service, version 2.0 effective 14 August 2024, naming JetBrains s.r.o. and Czech law (15 of 30). The terms, the Privacy Notice (version 3.2, 12 June 2026) and the Data Processing Addendum agree. Backups are kept for one month after a deletion request and six months after termination, JetBrains says it will not train AI models on customer data, and native AI runs on models JetBrains deploys. The DPA dates from 27 April 2022 (24 of 30). Deprecations are announced by version (Hub endpoints in 2026.1, the implicit flow), with no policy or notice period, and the terms reserve the right to alter capabilities (8 of 20). The third-party list, version 3.15 effective 30 September 2026, names Amazon Web Services EMEA SARL for YouTrack Cloud, and the owner picks one of four AWS regions (18 of 20).