Task app MCP servers audited: auth, tools and approval

Fourteen task and project apps we track run an official, hosted MCP server, and they agree on less than you'd think. All 14 sign in with OAuth, and 13 of them let a client register itself on the fly. Only 7 accept a client ID metadata document, the newer way for a client to identify itself, and 7 also take an API token. Six publish how many tools an agent gets, from 32 to 68. And none of the 14 documents an approval step that holds an outside agent's work until a person signs off: three have a partial one, two say plainly there isn't one, and nine don't say.

Which servers did we look at?

The 14 are the official servers in our roundup of MCP task managers: Akiflow, Reclaim, Sunsama, TickTick and Todoist for personal planning; Asana, ClickUp, Jira through Atlassian's Rovo server, Linear, monday.com, Notion, Taskade and Trello for teams; and Weft, which is built for agents. Each server's sign-in was read from its live OAuth metadata, and every other fact from the vendor's own docs, on October 24, 2026, with tool counts re-checked on October 28. Done runs an MCP server too, but it's ours, so it's left out of every count.

How do task app MCP servers handle sign-in?

OAuth won outright: every one of the 14 uses it, so you sign in in a browser instead of pasting a key into a config file. The differences are in how a client gets an identity. Dynamic client registration, where a client registers itself the first time it connects, is nearly universal at 13 of 14; Asana is the exception, and some clients need a client ID from its developer console. Client ID metadata documents, which let a client point to a URL that describes it instead of registering at all, are newer and half adopted, at 7 of 14. Seven servers also accept a personal API token or key, which is handy for scripts and scheduled runs but brings back the pasted secret OAuth was meant to retire.

How many tools does each server give an agent?

Six of the 14 publish a tool count. Notion documents the most, 68, reaching well past tasks into pages, databases, calendars and its own Custom Agent sessions. ClickUp documents 65, Atlassian lists 52 for Jira alone, Taskade 50, Todoist's open-source server ships 47 tool files, and Weft 32. The other eight tell you to ask the server: run tools/list and see what comes back. A long list isn't better in itself. Every tool is something an agent can call with your authority, so the useful question is how many of them write, and which of those can't be undone.

Which servers limit what an agent can break?

Four take a clear position, each a different one. Linear runs a separate read-only endpoint that exposes read tools only. Atlassian keeps Jira's three delete tools, which are permanent, in a group that's off until an admin turns it on. Trello's server can archive cards and lists but never delete them. Notion's delete tools move up to 20 pages to the trash, where they can be restored. ClickUp's docs disagree with each other: its overview says the server has no deletion tools, while its tool reference lists two. The rest leave limits to your account's own permissions.

Does any of them hold an agent's work for approval?

Not by default. Three have something partial: Linear reviews agent work in the pull request rather than on the issue, Reclaim previews calendar changes made from Claude, and Weft lets an agent send finished work to a review queue if it chooses to. Todoist and TickTick don't have one, and the other nine don't document one. On every one of these servers, an agent that calls a tool to complete or change a task has done it.

How Done's server compares

Done's MCP server supports all four sign-in options in the chart, publishes all 86 of its tools with readOnlyHint and destructiveHint annotations, and makes approval the default: an agent proposes completion and the task waits at pending approval until you approve it, unless you marked that task agent-ok. Agents can also ask you a question with ask_decision, and tokens can be limited to read-only or a single project. It's our product, which is why it sits outside the counts above.

How we built this dataset

• Scope: every app in our MCP task manager roundup with an official, hosted MCP server, excluding Done.
• Sign-in options come from each server's live OAuth metadata (its registration endpoint and its client ID metadata document flag) and the vendor's docs, read on October 24, 2026.
• Tool counts are what the vendor publishes. Todoist's is a count of tool files in its open-source repo; Jira's covers Jira only, not Confluence or Bitbucket.
• Approval and ask-you marks follow the roundup's rule: yes, partial or no where the docs say so, Not documented where they're silent.