$HEADLESS SYSTEMS
03 / Scorecard / Project & Task Management

Todoist

B
Headless Index
82/100
JAIRF
72.7/100
AI-Aware
Verified
AUG 20, 2026
Methodology v1 · JAIRF v1.0.0

Powered by JAIRF v1.0.0 by Jentic · open methodology at /the-headless-index/methodology

Todoist earns Band B in the Project & Task Management category of The Headless Index, with a thesis-fit score of 82/100 and a JAIRF rating of 72.7/100 (AI-Aware). Its strongest dimension is MCP and agent posture (18/20); its weakest scored dimension is webhooks and events (14/20). Todoist publishes a machine-readable OpenAPI specification, which is what lets an agent discover and operate it without human glue code.

Editorial verdict
Todoist is solidly built for programmatic consumption. The Headless Index thesis-fit score of 82/100 lands it in the upper-middle of the index, and JAIRF v1.0.0 puts it at 72.7/100 (Level 2, AI-Aware). In practice, vendors at this tier ship most of the primitives agents need, with one or two surfaces still leaning on documentation rather than discovery, and the rest of this verdict explains where Todoist lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Doist consolidated REST and Sync into one versioned surface at api.todoist.com/api/v1 and publishes it as OpenAPI 3.1 (76 documented paths). Two first party clients are current, @doist/todoist-sdk on npm and todoist_api_python, both pushed this week. For a consumer task app, this is more API discipline than most enterprise suites in the category manage. An agent can drive this product across most practical workflows, with a handful of edges where documentation reading still beats schema discovery. On headless operability: The Sync API is the unusual asset: an agent can pull full account state with a sync_token and push batched commands (item_add, item_complete, project_add) in one round trip, which is how the official apps themselves work. Filters, labels, sections, reminders and workspace membership all have endpoints. No CLI and no self-host, and OAuth app registration stays manual.[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: The server at github.com/Doist/todoist-mcp sits at 536 stars with commits this week, and Doist has repeated the pattern across its portfolio (Doist/twist-ai, Doist/comms-mcp), which reads as company policy rather than a side project. Tool coverage spans reads and writes over tasks, projects and comments. A registry listing and versioned release artifacts would finish it.[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Todoist signs every delivery with HMAC-SHA256 over the raw body in the X-Todoist-Hmac-SHA256 header, and the event vocabulary is explicit (item:added, item:completed, item:updated, note:added, project:added, reminder:fired). Retries run on a bounded schedule before the subscription is disabled. There is no replay endpoint and no delivery log an agent can query after the fact. Net assessment: Todoist can be operated by agents for the majority of practical workflows. The closest thing to a gap is webhooks and events[3], which integrators should sanity-check against their own use case before committing. Strong fit for agent-driven use cases.
Verdict by Headless Index pipeline (auto)
// AI-drafted from the evidence layer. Editorial review pending.
Scores

Scorecard detail

Headless Index · 5 sub-criteria
API-first design intent17/20
scored

Doist consolidated REST and Sync into one versioned surface at api.todoist.com/api/v1 and publishes it as OpenAPI 3.1 (76 documented paths). Two first party clients are current, @doist/todoist-sdk on npm and todoist_api_python, both pushed this week. For a consumer task app, this is more API discipline than most enterprise suites in the category manage.

signals (6)
  • +AI review appliedReviewer: Editorial review on 2026-08-19
  • +OpenAPI specPublished, 106 operations
  • GraphQL endpointNot discovered (5 probes; project-scoped endpoints require a real project ID)
  • +SDKs maintained5 (python, swift, typescript); top by stars: Doist/todoist-api-python (251 stars)
  • +SDK recency4 of 5 SDK repos pushed within 30 days (most recent SDK commit: 2026-08-19)
  • ·npm weekly downloads9.2k across published packages; top: @doist/todoist-sdk @ 8.9k/week
cite (1)
  • github.sdks@2026-08-19
Headless operation15/20
scored

The Sync API is the unusual asset: an agent can pull full account state with a sync_token and push batched commands (item_add, item_complete, project_add) in one round trip, which is how the official apps themselves work. Filters, labels, sections, reminders and workspace membership all have endpoints. No CLI and no self-host, and OAuth app registration stays manual.

signals (9)
  • +AI review appliedReviewer: Editorial review on 2026-08-19
  • +API operations exposed106 operations in OpenAPI spec
  • ·Docs pages crawled0 pages (crawler: none)
  • ·Auth schemes documentedAuth documentation page not reached by crawler
  • ·Setup / quickstart docsNot reached by crawler
  • ·Billing docsNot reached by crawler
  • ·Teams / org docsNot reached by crawler
  • ·CLI docsNot reached by crawler
  • ·Schema / data model docsNot reached by crawler
cite (1)
  • github.sdks@2026-08-19
MCP & agent posture18/20
scored

The server at github.com/Doist/todoist-mcp sits at 536 stars with commits this week, and Doist has repeated the pattern across its portfolio (Doist/twist-ai, Doist/comms-mcp), which reads as company policy rather than a side project. Tool coverage spans reads and writes over tasks, projects and comments. A registry listing and versioned release artifacts would finish it.

signals (4)
  • +AI review appliedReviewer: Editorial review on 2026-08-19
  • +Official MCP serverhttps://github.com/Doist/todoist-mcp (536 stars, last commit 0 days ago)
  • ·Community MCP servers2 community MCP repos; top by stars: https://github.com/Doist/twist-ai (3 stars)
  • +Agent-friendly SDKs3 TS/JS SDKs available; top: @doist/todoist-sdk (8.9k/week downloads)
cite (1)
  • ai_review_browser.mcp@2026-08-19
Schema observability18/20
scored

A single fetch of https://developer.todoist.com/openapi.json returns OpenAPI 3.1 covering 76 paths (from /api/v1/tasks/completed/by_due_date to workspace invitation flows), with schemas inline. An agent can generate a working client without reading a sentence of prose. What holds it below the top is the absence of a versioned spec history; only the current document is served.

signals (3)
  • +AI review appliedReviewer: Editorial review on 2026-08-19
  • +OpenAPIPublished at https://developer.todoist.com/openapi.json (OpenAPI 3.1.0, 106 operations)
  • GraphQL introspectionNo GraphQL endpoint discovered (5 probes; some vendors use project-scoped endpoints that require a real project handle)
cite (1)
  • ai_review_browser.schema@2026-08-19
Webhooks & events14/20
scored

Todoist signs every delivery with HMAC-SHA256 over the raw body in the X-Todoist-Hmac-SHA256 header, and the event vocabulary is explicit (item:added, item:completed, item:updated, note:added, project:added, reminder:fired). Retries run on a bounded schedule before the subscription is disabled. There is no replay endpoint and no delivery log an agent can query after the fact.

signals (2)
  • +AI review appliedReviewer: Editorial review on 2026-08-19
  • ·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.
cite (1)
  • github.sdks@2026-08-19
JAIRF · 6 dimensions
FCFoundational Compliance
70/100

Structural validity, standards conformance, and parsability of the OpenAPI specification.

DXJDeveloper Experience & Tooling Compatibility
65/100

Documentation clarity, example coverage, response completeness, and ingestion health.

ARAXAI-Readiness & Agent Experience
92/100

Semantic clarity, intent expression, datatype specificity, and error standardization.

AUAgent Usability
90/100

Operational composability, complexity comfort, navigation affordances, and safety patterns.

SECSecurity
20/100

Authentication strength, transport security, secret hygiene, and OWASP risk posture.

AIDAI Discoverability
95.3/100

Descriptive richness, intent phrasing, workflow context, and registry signals.

Band rationale:B band: JAIRF=72.7 HeadlessIndex=82

04 / Embed

Show Todoist's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Calibration

How THI compares to external scorers

SourceScoreMeasuresLast checked
Fern Agent Scorenot foundDocumentation completeness and SDK shape (~22 checks)
CLIRank Agent Friendlinessnot foundCLI readiness, docs quality, and overall agent affordances
Cloudflare Is It Agent Ready?blockedCloudflare's manual agent-readiness heuristic per vendor URL
Jentic ScorecardJAIRF-based scorecard requiring a public OpenAPI specification
THI 82 vs external median 0

No external scores available to calibrate against.

FAQ

Todoist and agent readiness

Is Todoist agent-ready?
Todoist scores Band B on The Headless Index and rates AI-Aware on JAIRF (72.7/100). Its strongest area for agent use is MCP and agent posture; its weakest is webhooks and events.
Does Todoist publish an OpenAPI spec?
Yes. Todoist publishes an OpenAPI specification, scored under JAIRF v1.0.0. A published spec is what makes an API discoverable and callable by agents rather than only by developers reading docs.
What is Todoist's Headless Index score?
Todoist scores 82/100 on the Headless Index thesis-fit rubric and sits in Band B in the Project & Task Management category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.