{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "flagsmith", "name": "Flagsmith", "vendor": "Bullet Train Ltd", "vendorUrl": "https://www.flagsmith.com", "kind": "http-api", "category": "product-analytics", "summary": "Flagsmith is an open-source feature flag, remote config and experimentation service from Bullet Train Ltd. Teams use it on Flagsmith Cloud or self-hosted, through SDKs, a Management API and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/flagsmith", "markdownUrl": "https://www.anchorterminal.com/tools/flagsmith.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/flagsmith.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/flagsmith.json", "dns": "flagsmith.grade.anchorterminal.com", "repo": "https://github.com/Flagsmith/flagsmith", "license": "BSD-3-Clause", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.flagsmith.com", "packages": [ { "registry": "pypi", "name": "flagsmith" }, { "registry": "npm", "name": "flagsmith" } ], "auth": "mixed", "authNotes": "The hosted MCP server takes OAuth (the client discovers Flagsmith as the authorisation server and a person signs in) or an Organisation API key sent as `Authorization: Api-Key \u003ckey\u003e`. Organisation keys act as full organisation admin or with chosen RBAC roles; granular roles need Scale-Up or Enterprise. OIDC trust relationships let CI workloads such as GitHub Actions exchange their token for a short-lived one. SDK environment keys are separate.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 50,000 requests a month and one team member. Start-Up is $45 a month ($40 billed yearly) for 1,000,000 requests and three members, Scale-Up $300 a month ($250 yearly) for 5,000,000. Enterprise by quote. Extra API calls from $50 per million; the page also quotes $7 per 100,000 for Start-Up. The self-hosted edition is free under BSD-3-Clause.", "priceSummary": "$45 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI spec or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 54, "popularity": { "githubStars": 6639, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.flagsmith.com/", "mcpTools": { "url": "https://mcp.flagsmith.com", "checkedAt": "2026-11-07T01:44:38.567136868Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:44:38.567136868Z" }, "openapi": "https://github.com/Flagsmith/flagsmith/blob/main/openapi.yaml", "capabilities": [ "analytics.flags", "analytics.experiments", "analytics.events" ], "tags": [ "official", "hosted", "open-source", "self-hosted", "mcp", "remote-mcp", "oauth", "openapi", "free-tier", "status-page", "soc2", "sla", "python", "typescript" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 61.2, "grade": "C", "agentReady": false, "rank": 620, "ranked": true, "rankOf": 1486, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 55, "maintenance": 83, "payments": 40, "reliability": 65, "schema": 67, "security": 65, "transparency": 77 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 65, "points": 13, "reason": "Graded on Flagsmith Cloud with the hosted lines. Statuspage at status.flagsmith.com with components for the Edge API, Admin API, dashboard and website (20). In the 90 days from 8 August, an Admin and SDK API outage on 28 October marked critical, posted at 21:56 UTC and resolved at 22:12 with no cause given, and a minor delay in processing flag changes on 10 September. The posted span of the outage is 16 minutes and its start isn't stated, so we read it as one serious incident under an hour (15 of 30). The Management API limit of 500 requests a minute is documented (15). No 429 handling, Retry-After or idempotency guidance was found in the docs (0). A public SLA commits to 99.95 per cent monthly uptime with service credits (10). The Management API is generally available, but the MCP docs call the server an early release, so half (5 of 10). 20+15+15+0+10+5 = 65.", "checked": "2026-11-06" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 67, "points": 10.89, "reason": "openapi.yaml in the repository is OpenAPI 3.1 with 624 operations, and the MCP server builds its 54 tools from the operations tagged `mcp`, so every tool has a JSON Schema input (25). No llms.txt (404) and no Markdown served for agents on docs.flagsmith.com; the docs are Markdown only in the repository (0). Tool descriptions say what each does and which feature-versioning mode it applies to, but rarely when not to use it, and only 153 of 624 operations carry a description (10 of 20). 57 enums and required fields in the spec, with some free-form value fields (10 of 15). Docs carry curl examples, but only 16 operations document a 400 and 6 a 404 (7 of 15). A /api/v1 path, release-please changelog and dated release notes (15). 25+0+10+10+7+15 = 67.", "checked": "2026-11-06" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 55, "points": 8.94, "reason": "54 tools, more than 30, with no toolsets or read-only subset; enterprise tools only appear where installed (5 of 25). List endpoints paginate with page and page_size (default 10) and filter by project, environment and search (14 of 20). Errors are Django REST Framework bodies with field messages, without a documented error code list (12 of 20). Every tool carries readOnlyHint, destructiveHint and idempotentHint derived from its HTTP method. No idempotency keys for POST (14 of 20). Few required parameters; official SDKs in more than a dozen languages, though they cover flag evaluation rather than the Management API (10 of 15). 5+14+12+14+10 = 55.", "checked": "2026-11-06" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 65, "points": 11.38, "reason": "OAuth for interactive MCP clients with Flagsmith as the authorisation server, Organisation API keys in the Authorization header that act as admin or with chosen RBAC roles, and OIDC trust relationships that swap a CI token for a short-lived one. Granular key roles need Scale-Up or Enterprise, so a Free key is all-powerful (25 of 30). RBAC roles can limit a key to reads, and change requests put a flag change through approval on Scale-Up and Enterprise. There is no read-only switch on the MCP server itself (14 of 20). No prompt-injection guidance; tools return names, descriptions and trait values written by people (3 of 15). Audit logs record every admin action and stream by webhook, on Scale-Up and Enterprise (11 of 15). The docs say Flagsmith has a SOC 2 Type 2 report available on request, the terms promise a yearly third-party penetration test, and SECURITY.md routes reports to support email. No security.txt, bug bounty or public advisory process was found (12 of 20). 25+14+3+11+12 = 65.", "checked": "2026-11-06" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 (0). Plan prices and the per-million overage are public without login, though the page gives two overage rates for Start-Up ($50 per million and $7 per 100,000) (20). A $0 Free plan with 50,000 requests a month and a free BSD-3-Clause self-hosted edition. The pricing page doesn't say whether a card is needed, but the Free plan has no charge and the self-hosted edition needs no account (20). A person signs up in a browser, then approves OAuth or creates a key (0). 0+20+20+0 = 40.", "checked": "2026-11-06" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "reason": "v2.290.0 was released on 5 November 2026 (30). 34 tagged releases between 8 August and 5 November (20). Commits land daily (60 since 8 August in the 60-commit clone), with a Discord server and support email. We couldn't read issue response times because GitHub's API refused us for its rate limit (15 of 25). Not in the official MCP registry, which returned no Flagsmith entry; official SDKs are current (8 of 15). Renovate updates, CI workflows for the API, frontend, docs and MCP, and a Trivy scan (10). 30+20+15+8+10 = 83.", "checked": "2026-11-06" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 77, "points": 6.74, "note": "editorial 67, provenance 86", "reason": "BSD-3-Clause for the core and the MCP server; the about page says most of the product is under that licence and some CI runs with private packages, so not every Cloud feature is in the open repository (25 of 30). The terms set Flagsmith as processor with 48-hour breach notice and EEA transfer rules, and the sub-processor list is dated 13 October 2025. The privacy policy dates from October 2023 and states no retention periods (16 of 30). The Gram-hosted MCP server was retired with a dated notice (30 June 2026), and three spec operations are marked deprecated, without a stated deprecation policy (10 of 20). The sub-processor list names providers and their countries (16 of 20). 25+16+10+16 = 67.", "checked": "2026-11-06" } ], "assessment": { "date": "2026-11-06", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "54 tools, more than 30, with no toolsets or read-only subset; enterprise tools only appear where installed (5 of 25). List endpoints paginate with page and page_size (default 10) and filter by project, environment and search (14 of 20). Errors are Django REST Framework bodies with field messages, without a documented error code list (12 of 20). Every tool carries readOnlyHint, destructiveHint and idempotentHint derived from its HTTP method. No idempotency keys for POST (14 of 20). Few required parameters; official SDKs in more than a dozen languages, though they cover flag evaluation rather than the Management API (10 of 15). 5+14+12+14+10 = 55.", "maintenance": "v2.290.0 was released on 5 November 2026 (30). 34 tagged releases between 8 August and 5 November (20). Commits land daily (60 since 8 August in the 60-commit clone), with a Discord server and support email. We couldn't read issue response times because GitHub's API refused us for its rate limit (15 of 25). Not in the official MCP registry, which returned no Flagsmith entry; official SDKs are current (8 of 15). Renovate updates, CI workflows for the API, frontend, docs and MCP, and a Trivy scan (10). 30+20+15+8+10 = 83.", "payments": "No x402, MPP or L402 (0). Plan prices and the per-million overage are public without login, though the page gives two overage rates for Start-Up ($50 per million and $7 per 100,000) (20). A $0 Free plan with 50,000 requests a month and a free BSD-3-Clause self-hosted edition. The pricing page doesn't say whether a card is needed, but the Free plan has no charge and the self-hosted edition needs no account (20). A person signs up in a browser, then approves OAuth or creates a key (0). 0+20+20+0 = 40.", "reliability": "Graded on Flagsmith Cloud with the hosted lines. Statuspage at status.flagsmith.com with components for the Edge API, Admin API, dashboard and website (20). In the 90 days from 8 August, an Admin and SDK API outage on 28 October marked critical, posted at 21:56 UTC and resolved at 22:12 with no cause given, and a minor delay in processing flag changes on 10 September. The posted span of the outage is 16 minutes and its start isn't stated, so we read it as one serious incident under an hour (15 of 30). The Management API limit of 500 requests a minute is documented (15). No 429 handling, Retry-After or idempotency guidance was found in the docs (0). A public SLA commits to 99.95 per cent monthly uptime with service credits (10). The Management API is generally available, but the MCP docs call the server an early release, so half (5 of 10). 20+15+15+0+10+5 = 65.", "schema": "openapi.yaml in the repository is OpenAPI 3.1 with 624 operations, and the MCP server builds its 54 tools from the operations tagged `mcp`, so every tool has a JSON Schema input (25). No llms.txt (404) and no Markdown served for agents on docs.flagsmith.com; the docs are Markdown only in the repository (0). Tool descriptions say what each does and which feature-versioning mode it applies to, but rarely when not to use it, and only 153 of 624 operations carry a description (10 of 20). 57 enums and required fields in the spec, with some free-form value fields (10 of 15). Docs carry curl examples, but only 16 operations document a 400 and 6 a 404 (7 of 15). A /api/v1 path, release-please changelog and dated release notes (15). 25+0+10+10+7+15 = 67.", "security": "OAuth for interactive MCP clients with Flagsmith as the authorisation server, Organisation API keys in the Authorization header that act as admin or with chosen RBAC roles, and OIDC trust relationships that swap a CI token for a short-lived one. Granular key roles need Scale-Up or Enterprise, so a Free key is all-powerful (25 of 30). RBAC roles can limit a key to reads, and change requests put a flag change through approval on Scale-Up and Enterprise. There is no read-only switch on the MCP server itself (14 of 20). No prompt-injection guidance; tools return names, descriptions and trait values written by people (3 of 15). Audit logs record every admin action and stream by webhook, on Scale-Up and Enterprise (11 of 15). The docs say Flagsmith has a SOC 2 Type 2 report available on request, the terms promise a yearly third-party penetration test, and SECURITY.md routes reports to support email. No security.txt, bug bounty or public advisory process was found (12 of 20). 25+14+3+11+12 = 65.", "transparency": "BSD-3-Clause for the core and the MCP server; the about page says most of the product is under that licence and some CI runs with private packages, so not every Cloud feature is in the open repository (25 of 30). The terms set Flagsmith as processor with 48-hour breach notice and EEA transfer rules, and the sub-processor list is dated 13 October 2025. The privacy policy dates from October 2023 and states no retention periods (16 of 30). The Gram-hosted MCP server was retired with a dated notice (30 June 2026), and three spec operations are marked deprecated, without a stated deprecation policy (10 of 20). The sub-processor list names providers and their countries (16 of 20). 25+16+10+16 = 67." }, "sources": [ { "what": "MCP server docs", "url": "https://docs.flagsmith.com/integrating-with-flagsmith/mcp-server", "seen": "2026-11-06" }, { "what": "MCP server source", "url": "https://github.com/Flagsmith/flagsmith/tree/main/mcp", "seen": "2026-11-06" }, { "what": "OpenAPI spec", "url": "https://github.com/Flagsmith/flagsmith/blob/main/openapi.yaml", "seen": "2026-11-06" }, { "what": "Management API authentication", "url": "https://docs.flagsmith.com/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication", "seen": "2026-11-06" }, { "what": "system limits", "url": "https://docs.flagsmith.com/administration-and-security/governance-and-compliance/system-limits", "seen": "2026-11-06" }, { "what": "status history", "url": "https://status.flagsmith.com/history", "seen": "2026-11-06" }, { "what": "pricing", "url": "https://www.flagsmith.com/pricing", "seen": "2026-11-06" }, { "what": "SLA", "url": "https://www.flagsmith.com/service-level-agreement", "seen": "2026-11-06" }, { "what": "terms of service", "url": "https://www.flagsmith.com/terms-of-service", "seen": "2026-11-06" }, { "what": "privacy policy", "url": "https://www.flagsmith.com/privacy-policy", "seen": "2026-11-06" }, { "what": "sub-processor list", "url": "https://www.flagsmith.com/gdpr-sub-processor-list", "seen": "2026-11-06" }, { "what": "changelog", "url": "https://github.com/Flagsmith/flagsmith/blob/main/CHANGELOG.md", "seen": "2026-11-06" }, { "what": "security FAQ", "url": "https://docs.flagsmith.com/support/faq/security-compliance", "seen": "2026-11-06" } ], "openQuestions": [ "Disclosure. On 6 November 2026 we read https://status.flagsmith.com/api/v2/incidents.json and components.json before reading robots.txt, which disallows /api/ on that host. The two incidents were then confirmed on the allowed /history page.", "unchecked: GitHub issue and pull request response times, because the GitHub API refused us for its rate limit", "The pricing page gives two overage prices for Start-Up ($50 per million in the grid, $7 per 100,000 in the FAQ)", "Whether the Free plan needs a card at signup isn't stated on the pricing page", "The 28 October 2026 outage's start time and cause aren't posted", "Which Cloud capabilities rely on the private packages referenced in CI wasn't established" ] }, "negative": -2, "negativeNotes": [ "6 November 2026. The self-hosted API sends a heartbeat to https://api.flagsmith.com/api/v1/analytics/telemetry/ with counts of organisations, projects, environments, feature flags, segments and users, on by default (`ENABLE_TELEMETRY = env.bool(\"ENABLE_TELEMETRY\", default=True)`). The flag isn't in the environment-variable reference or anywhere else in the docs we read. Counts only, self-hosted only, so the minimum deduction (https://github.com/Flagsmith/flagsmith/blob/main/api/app/settings/common.py ; https://github.com/Flagsmith/flagsmith/blob/main/api/telemetry/telemetry.py)." ], "verdict": "Flagsmith pairs a BSD-licensed core with a hosted MCP server whose 54 tools come from its OpenAPI spec and carry read and destructive hints. A public 99.95 per cent SLA and SOC 2 report back the Cloud service. The MCP server is still an early release, and fine-grained key roles need a paid Scale-Up or Enterprise plan.", "bestFor": "Feature flags and experiments for teams that want open source or self-hosting, managed by an agent through MCP.", "strengths": [ "Hosted MCP server at mcp.flagsmith.com with OAuth or an Organisation API key, and a stdio option for local use", "Each of the 54 MCP tools has readOnlyHint, destructiveHint and idempotentHint set from its HTTP method", "Public SLA of 99.95 per cent monthly uptime with service credits, and a status page with component history", "BSD-3-Clause source with a free self-hosted edition and 34 tagged releases in the last 90 days", "OIDC trust relationships let CI jobs get short-lived Management API tokens without stored secrets" ], "weaknesses": [ "The MCP docs call the server an early release, and experiment tools are marked beta", "54 tools load at once, with no toolsets or read-only mode on the server", "Granular API key roles, change requests and audit logs need Scale-Up or Enterprise", "No llms.txt, no documented 429 handling, and few documented error responses in the spec", "Self-hosted installs send a usage heartbeat by default through a flag the docs don't mention" ], "agentNotes": [ "Send the key as `Authorization: Api-Key \u003ckey\u003e`; the `Api-Key ` prefix is required and a bare key fails", "Check whether the environment uses v2 feature versioning before choosing between segment-override and version-state tools", "Use a key with a read-only RBAC role for analysis tasks, since a Free plan key has organisation admin rights", "Pace Management API calls under 500 a minute; no Retry-After guidance is documented", "Treat experiment results as possibly null until Flagsmith has computed them" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.2 } ], "editorialScores": { "ergonomics": 55, "maintenance": 83, "payments": 40, "reliability": 65, "schema": 67, "security": 65, "transparency": 67 }, "provenanceScore": 86, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-06", "grade": "C", "kind": "listed", "method": "0.7", "score": 61.2 } ] }, "connect": { "http": "curl -H \"Authorization: Api-Key $FLAGSMITH_ORG_KEY\" https://api.flagsmith.com/api/v1/projects/", "claudeCode": "claude mcp add --transport http flagsmith https://mcp.flagsmith.com", "config": { "mcpServers": { "flagsmith": { "headers": { "Authorization": "Api-Key \u003cyour-api-key\u003e" }, "url": "https://mcp.flagsmith.com" } } } }, "letme": { "capability": "https://letme.dev/analytics.flags", "tool": "https://letme.dev/flagsmith" }, "notable": [ "The MCP server is generated from the Management API's OpenAPI spec, exposing the 54 operations tagged `mcp` (47 core, 7 enterprise), each with readOnlyHint, destructiveHint and idempotentHint set from its HTTP method (https://github.com/Flagsmith/flagsmith/blob/main/mcp/src/flagsmith_mcp/server.py)", "The MCP docs call the server an early release and say the previous Gram-hosted server at app.getgram.ai was shut down on 30 June 2026 (https://docs.flagsmith.com/integrating-with-flagsmith/mcp-server)", "Management API limited to 500 requests a minute by default; SDK flag requests are not rate limited (https://docs.flagsmith.com/administration-and-security/governance-and-compliance/system-limits)", "Public SLA with a 99.95 per cent monthly uptime commitment and service credits of 10 and 30 per cent (https://www.flagsmith.com/service-level-agreement)", "34 tagged releases between 8 August and 5 November 2026, the newest v2.290.0 on 5 November (https://github.com/Flagsmith/flagsmith/blob/main/CHANGELOG.md)", "Experiments, metrics and experiment results are in beta in the MCP tool list (https://docs.flagsmith.com/integrating-with-flagsmith/mcp-server)" ], "area": "business", "details": [ { "label": "Surface listed", "value": "Flagsmith Cloud's Management API at api.flagsmith.com and the hosted MCP server at mcp.flagsmith.com, read from docs.flagsmith.com, the Flagsmith/flagsmith repository (docs, MCP source and openapi.yaml), the pricing, SLA and legal pages and status.flagsmith.com on 6 November 2026. No account was made and no tool was called" }, { "label": "MCP tools", "value": "47 core tools for flags, segments, segment overrides, multivariate options, feature versions, change requests, releases, code references, evaluation data, invites and experiments, plus 7 enterprise tools that appear only when those modules are installed" }, { "label": "Experimentation", "value": "Native experiments with a managed warehouse and built-in statistics, exposed through MCP tools marked beta, with metric creation and results reads" }, { "label": "Rate limits", "value": "500 Management API requests a minute by default, configurable on self-hosted installs with USER_THROTTLE_RATE. SDK traffic is limited only by plan, with 7 days' warning before a Free plan is blocked" }, { "label": "Governance", "value": "Roles, permissions, change requests and audit logs on Scale-Up and Enterprise; SAML on Scale-Up and Enterprise; audit log webhooks" }, { "label": "Self-hosting", "value": "BSD-3-Clause source on GitHub with Docker images; the self-hosted API sends a count-only telemetry heartbeat to api.flagsmith.com unless ENABLE_TELEMETRY is set to false" }, { "label": "Legal entity", "value": "Bullet Train Limited trading as Flagsmith, company number 12353266, 66 Paul Street, London, under English law" } ], "unitPrices": [ { "item": "Start-Up plan", "unit": "month", "usd": 45, "note": "1,000,000 requests and 3 team members; $40 a month billed yearly" }, { "item": "Scale-Up plan", "unit": "month", "usd": 300, "note": "5,000,000 requests and 5 team members; $250 a month billed yearly" }, { "item": "Extra API calls", "unit": "1k-requests", "usd": 0.05, "note": "From $50 per million, lower with volume" }, { "item": "Extra Scale-Up team member", "unit": "seat-month", "usd": 50, "note": "Up to 20 members" } ], "provenance": { "legalEntity": "Bullet Train Ltd", "domain": "flagsmith.com", "domainRegistered": "2018-03-01", "endpointOnVendorDomain": true, "terms": "https://www.flagsmith.com/terms-of-service", "privacy": "https://www.flagsmith.com/privacy-policy", "statusPage": "https://status.flagsmith.com", "changelog": "https://github.com/Flagsmith/flagsmith/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms of service name Bullet Train Limited trading as Flagsmith, company number 12353266, registered at 66 Paul St, London, under the laws of England and Wales. Companies House lists the company with five active officers.", "The privacy policy was last updated in October 2023; the GDPR sub-processor list is dated 13 October 2025.", "www.flagsmith.com/robots.txt disallows only sign-up, login and similar paths. docs.flagsmith.com has no robots.txt. The terms contain no clause on automated access that we found.", "www.flagsmith.com/.well-known/security.txt returned 404. SECURITY.md in the repository asks for reports to support@flagsmith.com.", "RDAP gives flagsmith.com a registration date of 1 March 2018." ], "score": 86, "checks": [ { "check": "Legal entity named", "value": "Bullet Train Ltd", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "flagsmith.com, registered 2018-03-01 (8 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "mcp.flagsmith.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects", "points": 8.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.flagsmith.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "2 named with their role, 1 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "a support address, help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.flagsmith.com/terms-of-service", "state": "read", "readAt": "2026-11-06", "statedDate": "2026-09-01", "words": 4887, "points": 8.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Updated September 2026.", "says": "Last updated 2026-09-01" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "The parties agree to the exclusive jurisdiction of the courts of England and Wales.", "says": "Disputes go to the courts of England and Wales" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…the provision of the Service, whether in contract, tort or under any other theory of liability shall be limited to the Fees paid to Flagsmith during the twelve (12) months prior to the liability in question arising.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Customer’s credit or debit card will be charged at the time the Subscription order is placed and thereafter, at the frequency listed in the Documentation, which will continue until the Subscription ends or is terminated." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": false }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "…specifications of the Service (including as made available at www.flagsmith.com), including the Service Level Agreement and including as such specifications as may be updated or amended from time to time as necessary due to updates and enhancements, as determined and provided by Flagsmith." } ] }, { "kind": "privacy", "url": "https://www.flagsmith.com/privacy-policy", "state": "read", "readAt": "2026-11-06", "statedDate": "2023-10-01", "words": 3525, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "The contents of our Privacy Policy may change from time to time. Please check it now and again so you are aware of any updates. This Privacy Notice was last updated in October 2023.", "says": "Last updated 2023-10-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Sets out the types of personal data that we collect about you;" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We will get your express opt-in consent before we share your personal data with any third party for marketing purposes." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We may also share your personal data with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions about this privacy policy or our privacy practices, please contact: privacy@flagsmith.com.", "says": "privacy@flagsmith.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Explains where we store your personal data and whether we transfer your data outside of the UK;" } ], "toKnow": [ { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "The contents of our Privacy Policy may change from time to time. Please check it now and again so you are aware of any updates. This Privacy Notice was last updated in October 2023." } ] } ] }, "humans": { "slug": "flagsmith", "checked": "2026-11-06", "company": "Bullet Train Ltd", "people": [ { "name": "Ben Rometsch", "role": "Co-founder, director and company secretary", "founder": true, "linkedin": "https://www.linkedin.com/in/benrometsch/", "page": "/people/ben-rometsch/" }, { "name": "Matthew Evans", "role": "Director", "page": "/people/matthew-evans/" } ], "peopleNote": "Companies House lists Bullet Train Ltd (12353266) with directors Benjamin Simon Rometsch and Matthew William Evans, appointed 9 December 2019, and two directors appointed on 25 September 2020. Flagsmith's author page for Ben Rometsch, read 6 November 2026, gives him as Co-Founder at Flagsmith and links his LinkedIn, and his blog byline calls him Flagsmith co-founder; the other co-founders aren't named on the pages read, so Matthew Evans is listed as director only. The about page says Flagsmith started as a side project while the founders ran an agency and that it has chosen to bootstrap without venture capital, so no investors, total raised or valuation are listed.", "companySocial": { "x": "https://x.com/getflagsmith", "github": "https://github.com/Flagsmith" }, "support": { "emails": [ "support@flagsmith.com" ], "urls": [ "https://docs.flagsmith.com/support", "https://status.flagsmith.com" ], "community": [ { "label": "Discord", "url": "https://discord.gg/hFhxNtXzgm", "kind": "discord" }, { "label": "GitHub issues", "url": "https://github.com/Flagsmith/flagsmith/issues", "kind": "github" } ], "contactEmails": [ "support@flagsmith.com" ] }, "sources": [ "https://find-and-update.company-information.service.gov.uk/company/12353266/officers", "https://www.flagsmith.com/about-us", "https://www.flagsmith.com/terms-of-service", "https://github.com/Flagsmith/flagsmith/blob/main/SECURITY.md", "https://www.flagsmith.com/interviewers/ben-rometsch", "https://www.flagsmith.com/blog/founding-a-remote-first-company-the-beautiful-game" ], "ownership": { "status": "private", "checked": "2026-11-06", "sources": [ "https://www.flagsmith.com/about-us", "https://find-and-update.company-information.service.gov.uk/company/12353266/officers" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/flagsmith.json", "live": { "slug": "flagsmith", "probe": { "target": "https://mcp.flagsmith.com", "method": "get", "lastAt": "2026-11-07T17:49:41.577625422Z", "lastOk": true, "lastStatus": 401, "lastMs": 23, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 27, "p95ms24h": 103, "samples24h": 195, "samples30d": 195, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 182, "ok": 182 } ] }, "vendorStatus": { "page": "https://status.flagsmith.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T17:45:32.928096888Z" }, "versions": [ { "registry": "github", "name": "Flagsmith/flagsmith", "version": "v2.290.0", "released": "2026-11-05", "seenAt": "2026-11-06T23:26:24.068130998Z" }, { "registry": "npm", "name": "flagsmith", "version": "10.0.0", "seenAt": "2026-11-06T23:26:23.147625706Z" }, { "registry": "pypi", "name": "flagsmith", "version": "6.5.0", "released": "2026-11-06", "seenAt": "2026-11-06T23:26:23.005711379Z" } ], "githubStars": 6642, "npmWeekly": 156837, "pypiWeekly": 401488, "securityTxt": { "url": "https://flagsmith.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:18.95883898Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/Flagsmith/flagsmith/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:21.223652009Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "34b306151856" }, { "url": "https://www.flagsmith.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:28:36.671052285Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ba6cc5c7a64f" }, { "url": "https://www.flagsmith.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:28:38.746283857Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "6ada20e0c356" } ], "mcpTools": { "url": "https://mcp.flagsmith.com", "checkedAt": "2026-11-07T01:44:38.567136868Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:44:38.567136868Z" }, "updatedAt": "2026-11-07T17:49:41.577625422Z" } } }