{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "secoda", "name": "Secoda", "vendor": "Secoda, Inc.", "vendorUrl": "https://www.secoda.co", "kind": "http-api", "category": "company-knowledge", "summary": "Secoda is a hosted data catalogue with lineage, monitoring and governance, which Atlassian has acquired. Agents use a REST API with a workspace API key, and a local MCP server for search, lineage and SQL.", "url": "https://www.anchorterminal.com/tools/secoda", "markdownUrl": "https://www.anchorterminal.com/tools/secoda.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/secoda.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/secoda.json", "repo": "https://github.com/secoda/secoda-mcp", "license": "Proprietary service under the Secoda Master Subscription Agreement. The local MCP server in secoda/secoda-mcp is MIT", "transports": [ "http", "stdio" ], "packages": [], "auth": "api-key", "authNotes": "Access is granted inside a customer's Secoda workspace. A user generates an API key under workspace settings, API, and sends it as `Authorization: Bearer \u003ckey\u003e`. The key has the same access as the user who created it, so it follows that user's role (Viewer, Editor or Admin) and team membership. No scopes, expiry or OAuth flow were found in the reviewed documentation. The MCP server's README says an admin generates the token. The MCP server reads the same key from the `API_TOKEN` environment variable.", "pricing": "paid", "pricingNotes": "No prices are published. www.secoda.co/pricing names three plans, Core, Premium and Enterprise, with editor and admin seats listed as Custom, and every plan button links to a sales form. No trial or sign-up button was found on the site, so an agent cannot start without a contract. The plan table lists API access under Core, while the FAQ on the same page says the API is on Business and Enterprise plans. The API docs still say to sign up for free at app.secoda.co, which we did not confirm (checked 2026-10-09).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the pricing page or the MCP server source (checked 2026-10-09).", "endpoints": [] }, "toolCount": 6, "popularity": { "githubStars": 1, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://docs.secoda.co/api", "llmsTxt": "https://docs.secoda.co/llms.txt", "capabilities": [ "data.catalogue", "data.lineage", "knowledge.search", "work.docs" ], "tags": [ "hosted", "closed-source", "enterprise", "official", "api-key", "openapi", "llms-txt", "mcp", "sales-led", "sla", "soc2", "bug-bounty", "self-hosted-option" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 44.5, "grade": "E", "agentReady": false, "rank": 875, "ranked": true, "rankOf": 950, "categoryRank": 12, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 44, "maintenance": 60, "payments": 0, "reliability": 40, "schema": 59, "security": 54, "transparency": 58 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 40, "points": 8, "reason": "Hosted service, read on the hosted lines and graded on the REST API, with the local MCP server as a second surface. No status page is linked from the home page, the pricing page or the documentation index, and we did not try guessed addresses (0 of 20). With no page there is no readable incident history (5 of 30). Writes are limited to 30 PUT, PATCH or POST calls a minute on entity endpoints. No limit for GET requests was found (10 of 15). A 429 is documented with advice to retry after a delay or back off. No `Retry-After` header or idempotency key was found (6 of 15). The Service Level Agreement attached to the subscription agreement commits to 99.9 per cent monthly availability with service credits (10). The REST API carries no beta label. The MCP server is at version 0.1.0, and the Secoda AI Terms still describe a private beta (9 of 10). 0 + 5 + 10 + 6 + 10 + 9 = 40." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 59, "points": 9.59, "reason": "Each API reference page embeds OpenAPI 3.0 definitions at version 8.22.66, with request and response schemas. The full description behind the ReDoc page the reference links to, on api.secoda.co, answered 403 to our reader, so we read the fragments on six of 23 reference pages (20 of 25). `llms.txt` with 371 lines and a Markdown copy of every page (10). Operations carry one or two sentences of purpose, deprecated list endpoints name their replacement with a filter example, and List Resources states its 10,000 limit. Lineage parameters have no descriptions, and the six MCP tools have one-line descriptions with a server prompt on choosing between the two search tools (10 of 20). Response fields are typed and described, but `filter` and `sort` are URL-encoded JSON passed as strings, and few enums were seen (7 of 15). An examples page with five workflows and authentication samples in curl, JavaScript and Python. Errors are status codes with a one-line description and no body format (7 of 15). Paths carry `/api/v1` and the definitions carry a version, but the public changelog stops at 28 October 2025 and has no API entries (5 of 15). 20 + 10 + 10 + 7 + 7 + 5 = 59." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 44, "points": 7.15, "reason": "Graded on the REST API. The catalogue response carries more than 40 fields for each resource, and no field selection or page size parameter was found. The MCP server is small, six tools with short definitions (12 of 25). Lists take `page` and return `links`, `meta` and `total_pages`, with JSON `filter` and `sort` and a filter generator in the app's settings. Results stop at 10,000 resources (15 of 20). Errors are HTTP status codes with one-line descriptions, plus a troubleshooting note on trailing slashes (6 of 20). No idempotency keys. Updates use PATCH, bulk update takes 100 entities, and the MCP tools set no `readOnlyHint` or `destructiveHint` (4 of 20). Few required parameters. No official API client libraries were found, and the Secoda SDK is for building custom integrations that run inside Secoda (7 of 15). 12 + 15 + 6 + 4 + 7 = 44." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 54, "points": 9.45, "reason": "A workspace API key sent as a Bearer header, with the same access as the user who created it. No scopes or expiry were found, and we did not confirm how a key is revoked. No secret travels in a query string (18 of 30). A key follows its creator's role and team membership, and `run_sql` needs an admin toggle and query access to the integration. No read-only key and no confirmation step for deletes were found (8 of 20). The API and MCP tools return descriptions, documents and query results written by workspace users. No prompt-injection guidance was found (3 of 15). An audit log filterable by user, date, type and resource, an audit log endpoint in the API, and SIEM logging on Enterprise (12 of 15). A disclosure policy with a reply within 5 business days and safe harbour, a bug bounty by email with a reward for findings of CVSS 4 or higher, and SOC 2 stated with documentation on request. No `security.txt` and no public advisories (13 of 20). 18 + 8 + 3 + 12 + 13 = 54." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 0, "points": 0, "reason": "Hosted service sold by contract, so the hosted rubric applies. No x402, MPP or L402 (0). The pricing page names Core, Premium and Enterprise with no prices, and every plan button links to a sales form (0). No free tier or trial was found on the site. The API docs still say to sign up for free at app.secoda.co, which we did not confirm (0). An agent needs a user in a customer workspace to generate an API key (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 60, "points": 5.25, "reason": "The docker-compose and Terraform repositories for self-hosted Secoda were tagged v2026.3.1 on 6 October 2026 (30). Five self-hosted versions were tagged between 4 August and 6 October 2026 (20). Closed service, scored on the 15-point scale. The public changelog stops at 28 October 2025, and support is by email and a Slack community. The MCP repository has one open issue (5 of 15). No official API client libraries and no entry in the official MCP registry. The MCP repository's last commit is 26 January 2026 (3 of 15). The MCP repository has no CI, no tests and no tags, and its dependencies are unpinned (2 of 10). 30 + 20 + 5 + 3 + 2 = 60." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 58, "points": 5.08, "note": "editorial 56, provenance 59", "reason": "Closed service with a published Master Subscription Agreement. The MCP server is MIT (15 of 30). A privacy policy, a Data Processing Agreement with 10 days' notice of subprocessor changes and breach notice without undue delay, return of customer data within 30 days of termination, and AI terms that rule out training on customer data without permission. Some statements disagree. The AI security page says OpenAI and Anthropic process in the US while also naming Google, the Data Processing Agreement's security appendix refers to audio and video streams, and no legal document mentions Atlassian (17 of 30). Deprecated endpoints are flagged in the API definitions with a replacement and no date. The acquisition post promises technical plans and timelines in advance, and none were found on the pages read (6 of 20). 25 subprocessors with locations, and three AWS hosting regions (18 of 20). 15 + 17 + 6 + 18 = 56." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the REST API. The catalogue response carries more than 40 fields for each resource, and no field selection or page size parameter was found. The MCP server is small, six tools with short definitions (12 of 25). Lists take `page` and return `links`, `meta` and `total_pages`, with JSON `filter` and `sort` and a filter generator in the app's settings. Results stop at 10,000 resources (15 of 20). Errors are HTTP status codes with one-line descriptions, plus a troubleshooting note on trailing slashes (6 of 20). No idempotency keys. Updates use PATCH, bulk update takes 100 entities, and the MCP tools set no `readOnlyHint` or `destructiveHint` (4 of 20). Few required parameters. No official API client libraries were found, and the Secoda SDK is for building custom integrations that run inside Secoda (7 of 15). 12 + 15 + 6 + 4 + 7 = 44.", "maintenance": "The docker-compose and Terraform repositories for self-hosted Secoda were tagged v2026.3.1 on 6 October 2026 (30). Five self-hosted versions were tagged between 4 August and 6 October 2026 (20). Closed service, scored on the 15-point scale. The public changelog stops at 28 October 2025, and support is by email and a Slack community. The MCP repository has one open issue (5 of 15). No official API client libraries and no entry in the official MCP registry. The MCP repository's last commit is 26 January 2026 (3 of 15). The MCP repository has no CI, no tests and no tags, and its dependencies are unpinned (2 of 10). 30 + 20 + 5 + 3 + 2 = 60.", "payments": "Hosted service sold by contract, so the hosted rubric applies. No x402, MPP or L402 (0). The pricing page names Core, Premium and Enterprise with no prices, and every plan button links to a sales form (0). No free tier or trial was found on the site. The API docs still say to sign up for free at app.secoda.co, which we did not confirm (0). An agent needs a user in a customer workspace to generate an API key (0).", "reliability": "Hosted service, read on the hosted lines and graded on the REST API, with the local MCP server as a second surface. No status page is linked from the home page, the pricing page or the documentation index, and we did not try guessed addresses (0 of 20). With no page there is no readable incident history (5 of 30). Writes are limited to 30 PUT, PATCH or POST calls a minute on entity endpoints. No limit for GET requests was found (10 of 15). A 429 is documented with advice to retry after a delay or back off. No `Retry-After` header or idempotency key was found (6 of 15). The Service Level Agreement attached to the subscription agreement commits to 99.9 per cent monthly availability with service credits (10). The REST API carries no beta label. The MCP server is at version 0.1.0, and the Secoda AI Terms still describe a private beta (9 of 10). 0 + 5 + 10 + 6 + 10 + 9 = 40.", "schema": "Each API reference page embeds OpenAPI 3.0 definitions at version 8.22.66, with request and response schemas. The full description behind the ReDoc page the reference links to, on api.secoda.co, answered 403 to our reader, so we read the fragments on six of 23 reference pages (20 of 25). `llms.txt` with 371 lines and a Markdown copy of every page (10). Operations carry one or two sentences of purpose, deprecated list endpoints name their replacement with a filter example, and List Resources states its 10,000 limit. Lineage parameters have no descriptions, and the six MCP tools have one-line descriptions with a server prompt on choosing between the two search tools (10 of 20). Response fields are typed and described, but `filter` and `sort` are URL-encoded JSON passed as strings, and few enums were seen (7 of 15). An examples page with five workflows and authentication samples in curl, JavaScript and Python. Errors are status codes with a one-line description and no body format (7 of 15). Paths carry `/api/v1` and the definitions carry a version, but the public changelog stops at 28 October 2025 and has no API entries (5 of 15). 20 + 10 + 10 + 7 + 7 + 5 = 59.", "security": "A workspace API key sent as a Bearer header, with the same access as the user who created it. No scopes or expiry were found, and we did not confirm how a key is revoked. No secret travels in a query string (18 of 30). A key follows its creator's role and team membership, and `run_sql` needs an admin toggle and query access to the integration. No read-only key and no confirmation step for deletes were found (8 of 20). The API and MCP tools return descriptions, documents and query results written by workspace users. No prompt-injection guidance was found (3 of 15). An audit log filterable by user, date, type and resource, an audit log endpoint in the API, and SIEM logging on Enterprise (12 of 15). A disclosure policy with a reply within 5 business days and safe harbour, a bug bounty by email with a reward for findings of CVSS 4 or higher, and SOC 2 stated with documentation on request. No `security.txt` and no public advisories (13 of 20). 18 + 8 + 3 + 12 + 13 = 54.", "transparency": "Closed service with a published Master Subscription Agreement. The MCP server is MIT (15 of 30). A privacy policy, a Data Processing Agreement with 10 days' notice of subprocessor changes and breach notice without undue delay, return of customer data within 30 days of termination, and AI terms that rule out training on customer data without permission. Some statements disagree. The AI security page says OpenAI and Anthropic process in the US while also naming Google, the Data Processing Agreement's security appendix refers to audio and video streams, and no legal document mentions Atlassian (17 of 30). Deprecated endpoints are flagged in the API definitions with a replacement and no date. The acquisition post promises technical plans and timelines in advance, and none were found on the pages read (6 of 20). 25 subprocessors with locations, and three AWS hosting regions (18 of 20). 15 + 17 + 6 + 18 = 56." }, "sources": [ { "what": "docs index for agents", "url": "https://docs.secoda.co/llms.txt", "seen": "2026-10-09" }, { "what": "API overview", "url": "https://docs.secoda.co/api.md", "seen": "2026-10-09" }, { "what": "API authentication", "url": "https://docs.secoda.co/api/authentication.md", "seen": "2026-10-09" }, { "what": "base URLs and versions", "url": "https://docs.secoda.co/api/reference/getting-started.md", "seen": "2026-10-09" }, { "what": "rate limits and resource model", "url": "https://docs.secoda.co/api/reference/helpful-information.md", "seen": "2026-10-09" }, { "what": "API reference, Resources (OpenAPI fragments read from the Markdown page)", "url": "https://docs.secoda.co/api/reference/resources.md", "seen": "2026-10-09" }, { "what": "API reference, Lineage", "url": "https://docs.secoda.co/api/reference/lineage.md", "seen": "2026-10-09" }, { "what": "API reference, Tables", "url": "https://docs.secoda.co/api/reference/tables.md", "seen": "2026-10-09" }, { "what": "API reference, Audit Logs", "url": "https://docs.secoda.co/api/reference/audit-logs.md", "seen": "2026-10-09" }, { "what": "API reference, Documents", "url": "https://docs.secoda.co/api/reference/documents.md", "seen": "2026-10-09" }, { "what": "API reference, Users", "url": "https://docs.secoda.co/api/reference/users.md", "seen": "2026-10-09" }, { "what": "API examples", "url": "https://docs.secoda.co/api/examples.md", "seen": "2026-10-09" }, { "what": "MCP server docs", "url": "https://docs.secoda.co/features/ai-assistant/secoda-mcp-server.md", "seen": "2026-10-09" }, { "what": "MCP server source (shallow clone)", "url": "https://github.com/secoda/secoda-mcp", "seen": "2026-10-09" }, { "what": "Secoda AI security FAQs", "url": "https://docs.secoda.co/features/ai-assistant/security.md", "seen": "2026-10-09" }, { "what": "audit log", "url": "https://docs.secoda.co/features/audit-log.md", "seen": "2026-10-09" }, { "what": "user management and roles", "url": "https://docs.secoda.co/user-management.md", "seen": "2026-10-09" }, { "what": "changelog", "url": "https://docs.secoda.co/changelog.md", "seen": "2026-10-09" }, { "what": "self-hosted changelog", "url": "https://docs.secoda.co/enterprise/self-hosted-secoda/self-hosted-changelog.md", "seen": "2026-10-09" }, { "what": "self-hosted release tags (shallow clone)", "url": "https://github.com/secoda/docker-compose", "seen": "2026-10-09" }, { "what": "self-hosted release tags, Terraform (shallow clone)", "url": "https://github.com/secoda/terraform-aws-secoda", "seen": "2026-10-09" }, { "what": "docs sitemap with last-modified dates", "url": "https://docs.secoda.co/sitemap-pages.xml", "seen": "2026-10-09" }, { "what": "Master Subscription Agreement", "url": "https://docs.secoda.co/policies/master-subscription-agreement.md", "seen": "2026-10-09" }, { "what": "Service Level Agreement", "url": "https://docs.secoda.co/policies/service-level-agreement.md", "seen": "2026-10-09" }, { "what": "privacy policy", "url": "https://docs.secoda.co/policies/privacy-policy.md", "seen": "2026-10-09" }, { "what": "Data Processing Agreement", "url": "https://docs.secoda.co/policies/data-processing-agreement.md", "seen": "2026-10-09" }, { "what": "Terms of Use", "url": "https://docs.secoda.co/policies/terms-of-use.md", "seen": "2026-10-09" }, { "what": "Secoda AI Terms", "url": "https://docs.secoda.co/policies/secoda-ai-terms.md", "seen": "2026-10-09" }, { "what": "security policy", "url": "https://docs.secoda.co/policies/security-policy.md", "seen": "2026-10-09" }, { "what": "bug bounty", "url": "https://docs.secoda.co/policies/bug-bounty-program.md", "seen": "2026-10-09" }, { "what": "subprocessors", "url": "https://docs.secoda.co/policies/subprocessors.md", "seen": "2026-10-09" }, { "what": "home page", "url": "https://www.secoda.co/", "seen": "2026-10-09" }, { "what": "pricing page", "url": "https://www.secoda.co/pricing", "seen": "2026-10-09" }, { "what": "acquisition post", "url": "https://www.secoda.co/blog/atlassian-acquires-secoda", "seen": "2026-10-09" }, { "what": "security.txt (404)", "url": "https://www.secoda.co/.well-known/security.txt", "seen": "2026-10-09" }, { "what": "official MCP registry search (no result)", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=secoda", "seen": "2026-10-09" }, { "what": "robots.txt, docs host", "url": "https://docs.secoda.co/robots.txt", "seen": "2026-10-09" }, { "what": "robots.txt, main site", "url": "https://www.secoda.co/robots.txt", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: the full OpenAPI description. The ReDoc page the reference links to at api.secoda.co/api/schema/redoc/ answered 403 and we did not retry.", "unchecked: 17 of the 23 API reference sections, so the total number of operations is not established. The six sections read hold 31 operations.", "unchecked: whether a status page exists. None is linked from the home page, the pricing page or the documentation index, and we did not try guessed addresses.", "unchecked: whether app.secoda.co still accepts a new workspace without a contract. The site shows no sign-up button, while the API docs say to sign up for free.", "unchecked: how an API key is revoked, whether it expires, and whether users who are not admins can create one.", "unchecked: a rate limit for GET requests.", "unchecked: Atlassian's plans and dates for Secoda's API and infrastructure. The acquisition post promises them and we read no Atlassian page.", "unchecked: www.secoda.co/llms.txt, which redirects to robots.secoda.co, a host we did not fetch.", "unchecked: the registration date of secoda.co. The RDAP lookup we used has no service for .co domains.", "The lead said no MCP server was seen in the docs. One is documented (https://docs.secoda.co/features/ai-assistant/secoda-mcp-server), and its page lists eight tools where the source registers six.", "The pricing page lists API access under the Core plan, and its FAQ says the API is on Business and Enterprise plans, names that no longer appear in the plan table.", "The Terms of Use forbid bots that crawl or scrape Secoda, and the subscription agreement forbids disclosing benchmark results. Both matter before any probe is run." ] }, "negative": 0, "verdict": "The REST API reference embeds OpenAPI 3.0 definitions on every page, with `llms.txt` and Markdown copies, and the subscription agreement carries a 99.9 per cent uptime commitment. No price, trial or sign-up is published, no status page was found, and the public changelog stops at 28 October 2025 although self-hosted releases continue.", "bestFor": "A data team already on Secoda that wants an agent to read and edit catalogue metadata, lineage, documents and glossary terms, or to search the catalogue and run SQL through the local MCP server.", "strengths": [ "Every API reference page embeds an OpenAPI 3.0 definition (version 8.22.66), and the docs publish `llms.txt` and a Markdown copy of each page", "The Service Level Agreement commits to 99.9 per cent monthly availability, with a 5 per cent service credit for a day with 30 minutes or more of downtime", "An audit log filterable by user, date, type and resource, readable through `/api/v1/activity_log/audit_logs/`, with SIEM logging on the Enterprise plan", "25 subprocessors are listed with locations, and hosting is on AWS in us-east-1, eu-central-1 or ap-southeast-1", "Self-hosted releases are tagged regularly, five between 4 August and 6 October 2026, the latest v2026.3.1" ], "weaknesses": [ "No price is published. The three plans (Core, Premium, Enterprise) link to a sales form, and no trial or sign-up button was found on the site", "No status page is linked from the home page, the pricing page or the documentation index", "The public changelog stops at 28 October 2025 and the self-hosted changelog at 29 October 2025, while self-hosted versions were tagged up to 6 October 2026", "An API key has the same access as the user who created it, with no scopes. No idempotency keys and no error body format are documented", "The MCP page lists eight tools, and the published server registers six, with one-line descriptions and no read-only or destructive annotations", "The Terms of Use (23 December 2021) forbid bots that crawl or scrape Secoda, and the subscription agreement forbids disclosing benchmark results. Both matter before any probe is run" ], "agentNotes": [ "Pick the base URL by workspace region. `app.secoda.co` uses `api.secoda.co`, `eu.secoda.co` uses `eapi.secoda.co` and `apac.secoda.co` uses `aapi.secoda.co`", "Keep writes under 30 PUT, PATCH or POST calls a minute on entity endpoints, and back off on a 429", "List with `/api/v1/resource/catalog` and a URL-encoded JSON `filter`. The per-type list endpoints for tables are marked deprecated, and results stop at 10,000 resources", "Send at most 100 entities to `/api/v1/resource/all/bulk_update/` in one request", "Add a trailing slash when an endpoint does not behave as expected, as the docs advise", "Treat an API key as the creating user. `run_sql` in the MCP server works only when an admin has enabled Run SQL and the user has query access to the integration" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 44.5 } ], "editorialScores": { "ergonomics": 44, "maintenance": 60, "payments": 0, "reliability": 40, "schema": 59, "security": 54, "transparency": 56 }, "provenanceScore": 59 }, "connect": { "http": "curl 'https://api.secoda.co/api/v1/resource/catalog' -H 'Authorization: Bearer \u003cAPI key\u003e'", "config": { "mcpServers": { "secoda-mcp": { "args": [ "/path/to/secoda-mcp/server.py" ], "command": "python", "env": { "API_TOKEN": "your-api-token", "API_URL": "https://app.secoda.co/api/v1/" } } } } }, "letme": { "capability": "https://letme.dev/data.catalogue", "tool": "https://letme.dev/secoda" }, "notable": [ "Atlassian has acquired Secoda. The post by Secoda's co-founder, updated 4 December 2025, says existing customers' experience will not change, that parts of the infrastructure will move to Atlassian's cloud platform, and that technical plans and timelines will be published in advance (https://www.secoda.co/blog/atlassian-acquires-secoda)", "The lead for this listing said no MCP server was seen in the docs. Secoda documents one, a local FastMCP server cloned from GitHub that forwards six tools to `ai/mcp/tools/call/` on the workspace API (https://docs.secoda.co/features/ai-assistant/secoda-mcp-server)", "The API reference has 23 sections, among them Resources, Lineage, Documents, Queries, Monitors, Users, Teams and Audit Logs, each page embedding OpenAPI 3.0 definitions at version 8.22.66 (https://docs.secoda.co/api/reference/resources)", "Writes are limited to 30 PUT, PATCH or POST calls a minute on entity endpoints, with a 429 beyond that (https://docs.secoda.co/api/reference/helpful-information)", "The Service Level Agreement commits to 99.9 per cent monthly availability with service credits, and allows four hours of scheduled maintenance a month (https://docs.secoda.co/policies/service-level-agreement)", "The docker-compose repository for self-hosted Secoda was bumped to v2026.3.1 on 6 October 2026, while the self-hosted changelog in the docs ends at v2025.4.4 of 29 October 2025 (https://github.com/secoda/docker-compose)", "The Master Subscription Agreement forbids disclosing the results of benchmark tests or other evaluations to third parties, and the Terms of Use forbid bots that crawl or scrape Secoda. The docs host's robots.txt carries `Content-Signal: ai-input=yes` (https://docs.secoda.co/policies/master-subscription-agreement)", "Each Markdown page of docs.secoda.co ends with a block headed Agent Instructions that tells AI agents how to query the documentation with an `ask` parameter. We did not act on it" ], "area": "business", "details": [ { "label": "API", "value": "REST under `/api/v1` (the docs also name `/api/v2`), with create, read, update and delete for catalogue resources, tables, columns, documents, glossary terms, lineage, monitors, users, groups and teams. Base URL `api.secoda.co` (US), `eapi.secoda.co` (EU) or `aapi.secoda.co` (APAC), or the customer's own domain when self-hosted" }, { "label": "MCP server", "value": "Local server in secoda/secoda-mcp (Python, FastMCP, MIT, version 0.1.0, last commit 26 January 2026) over stdio, or HTTP on port 5012 for Microsoft Copilot Studio. Six tools, `run_sql`, `search_data_assets`, `search_documentation`, `retrieve_entity`, `entity_lineage` and `glossary`" }, { "label": "Credentials", "value": "Workspace API key as a Bearer token, with the access of the user who created it. No scopes, expiry or OAuth found. Sign-in to the app is by SSO, with SAML and SCIM in the plan table" }, { "label": "Rate limits", "value": "30 PUT, PATCH or POST calls a minute on entity endpoints, then a 429. No limit for GET requests found in the reviewed documentation" }, { "label": "Pagination", "value": "A `page` parameter, with `links`, `meta`, `count` and `total_pages` in each list response. `filter` and `sort` are URL-encoded JSON objects. A list returns at most 10,000 resources across all pages, and bulk update takes 100 entities" }, { "label": "Errors", "value": "HTTP 400, 403, 404, 429 and 500 with a one-line description for each operation. No error body format or error codes found" }, { "label": "Pricing", "value": "Sales contract only. Core, Premium and Enterprise plans with no published price, and no trial or sign-up button found" }, { "label": "SLA", "value": "99.9 per cent monthly availability. After 60 consecutive minutes of downtime, a 5 per cent credit for each day with 30 minutes or more of unavailability, at most seven credits a month, claimed in writing within 24 hours" }, { "label": "Hosting", "value": "AWS us-east-1, eu-central-1 or ap-southeast-1 per the subprocessor list. Single-tenant deployment on Premium and self-hosted deployment on Enterprise" }, { "label": "Audit", "value": "Audit log under workspace settings, filterable by user, date, log type and resource, and `/api/v1/activity_log/audit_logs/` in the API. SIEM logging on Enterprise" }, { "label": "Security", "value": "SOC 2 stated in the security policy, with documentation on request. A bug bounty by email with a reward for valid findings of CVSS 4 or higher, and a disclosure policy with a reply within 5 business days. No `security.txt`" }, { "label": "AI data handling", "value": "Secoda AI sends workspace metadata to OpenAI, Google or Anthropic by region, and a sample of data when Run SQL is on. The Secoda AI Terms of 17 July 2025 say customer data is not used to train models without permission" }, { "label": "Releases", "value": "Self-hosted image tags v2026.2.6 (4 August 2026), v2026.2.7 (9 September), v2026.2.8 (18 September), v2026.3.0 (5 October) and v2026.3.1 (6 October). The public changelog's last entry is v8.21.0 of 28 October 2025" }, { "label": "Status", "value": "No status page found on the pages read" } ], "provenance": { "legalEntity": "Secoda, Inc.", "domain": "secoda.co", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://docs.secoda.co/policies/master-subscription-agreement", "privacy": "https://docs.secoda.co/policies/privacy-policy", "statusPage": "", "changelog": "https://docs.secoda.co/changelog", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The Master Subscription Agreement names Secoda, Inc., an Ontario corporation at 109 Atlantic Ave., Toronto, ON M6K 1G1, Canada, and is governed by the laws of Ontario and Canada. It incorporates the Service Level Agreement and the Data Processing Agreement published beside it.", "Atlassian has acquired Secoda, per the post on www.secoda.co updated 4 December 2025. None of the legal documents we read mentions Atlassian.", "The Terms of Use page (last updated 23 December 2021) covers the site and says not to use bots to crawl or scrape Secoda. The Secoda AI Terms (17 July 2025) supplement the services agreement.", "The API answers on api.secoda.co, eapi.secoda.co and aapi.secoda.co.", "www.secoda.co/.well-known/security.txt returns 404. The security policy and bug bounty pages take reports by email.", "No status page is linked from the home page, the pricing page or the documentation index.", "The registration date of secoda.co was not established. The RDAP lookup we used has no service for .co domains." ], "score": 59, "checks": [ { "check": "Legal entity named", "value": "Secoda, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "secoda.co, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "secoda.co", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 1 clause that costs points", "points": 6.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 5 of the 8 things a reader expects", "points": 7.8, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://docs.secoda.co/policies/master-subscription-agreement", "state": "read", "readAt": "2026-10-09", "words": 4523, "points": 6.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement shall be governed by, and construed under, the laws of the Province of Ontario and those of Canada, without regard to any of its conflict of laws principles.", "says": "The law of the Province of Ontario" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "AND (II) EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL NOT EXCEED THE GREATER OF ONE HUNDRED DOLLARS ($100.00) OR AN AMOUNT EQUAL TO THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER HEREUNDER DURING THE TWELVE (12) MONTHS PRECEDING THE DATE ON WHICH THE CLAIM AROSE.", "says": "Capped at the greater of $100.00 and the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "This Agreement may be terminated by either Party upon thirty (30) days’ prior written notice to the other Party, where such other Party has materially breached this Agreement and such material breach remains uncured at the expiration of such period." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Except as expressly authorized in this Agreement or by Secoda in writing, Customer will not, and will not permit any third party to: (i) copy, modify, adapt, or create derivative works of the Secoda Services;" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "“Service Level Agreement” or “SLA” means the service levels for the Platform and related support services to be provided by Secoda to Customer, as found in Attachment 1." } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "(v) disclose to any third party the results of any benchmark tests or other evaluation of the Secoda Services;", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "All fees rise automatically by four per cent on each anniversary of the effective date, with 30 days written notice.", "quote": "Commencing on the first anniversary of the Effective Date and on each subsequent anniversary, all fees set forth in the applicable Order Form(s) shall automatically increase by four percent (4%)." }, { "date": "2026-10-08", "text": "The customer grants a perpetual, irrevocable licence to use aggregated and anonymised customer data for any lawful purpose.", "quote": "Additionally, Customer grants Secoda a perpetual, irrevocable, worldwide, royalty-free license to use aggregated and anonymized Customer Data for any lawful purposes, provided that any such use externally does not identify Customer or any Authorized User." }, { "date": "2026-10-08", "text": "After the 30 days following expiry or termination, the vendor has no duty to make customer data available and may destroy it.", "quote": "Following such thirty (30) day period, Secoda shall have no further obligation to make Customer Data available to Customer, and Secoda reserves the right to destroy any such Customer Data to the extent not legally prohibited." } ] }, { "kind": "privacy", "url": "https://docs.secoda.co/policies/privacy-policy", "state": "read", "readAt": "2026-10-09", "words": 2148, "points": 7.8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "…in more detail below, and we use this Personal Information internally in connection with our Services, including to personalize, provide, and improve our services, to allow you to set up a user account and profile, to contact you and allow other users to contact you, to fulfill your requests for certain products and s…" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain Personal Data about you for as long as you have an open account with us or as otherwise necessary to provide you with our Services.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "In certain cases, we may also share some Personal Information with third parties, but only as described below." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We do not rent or sell your Personal Information in personally identifiable form to anyone.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Protection of Company and Others: We reserve the right to access, read, preserve, and disclose any information that we believe is necessary to comply with law or court order;" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": false }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "notes": [ { "date": "2026-10-08", "text": "The vendor may send promotional emails on behalf of other businesses to an email address it has been given.", "quote": "For example, if you’ve given us your email address, we may send you promotional email offers on behalf of other businesses, or email you about your use of the Services." }, { "date": "2026-10-08", "text": "Do Not Track requests are not supported, and the vendor collects information about online activity after the user leaves its services.", "quote": "Our Services do not support Do Not Track requests at this time, which means that we collect information about your online activity both while you are using the Services and after you leave our Services." }, { "date": "2026-10-08", "text": "When information is updated, the vendor may keep a copy of the earlier version in its records.", "quote": "When you update information, however, we may maintain a copy of the unrevised information in our records." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/secoda.json", "live": { "slug": "secoda", "githubStars": 1, "pages": [ { "url": "https://docs.secoda.co/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-09T18:38:15.806583184Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "bb1750df5552" }, { "url": "https://docs.secoda.co/policies/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-09T18:38:20.328935317Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "152634c5bb84" }, { "url": "https://docs.secoda.co/policies/master-subscription-agreement", "kind": "terms", "status": 200, "checkedAt": "2026-10-09T18:38:18.29936577Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9530fcb310d5" } ], "updatedAt": "2026-10-09T18:38:20.328935317Z" } } }