Alation vs Basedash MCP

Alation 0

Hosted service, so the hosted rubric applies. No x402, MPP or L402 (0). No published prices. www.alation.com/pricing redirects to a form for a 30-minute sales call (0). No free tier or trial for a new user. The 2,000 free Aggregated Context API calls are a one-time allowance inside a paying tenant (0). An agent needs a customer's Server Admin to register an OAuth client, or a user to create a token, after a sales contract (0).

Basedash MCP 32

No x402, MPP or L402 (0). Plan prices are public, $1,000 a month for Startup with $1,000 of AI credits included, but the cost of an MCP question in AI usage isn't published (10). A 14-day trial needs no card, includes up to $250 of AI usage and has the MCP server, since it's on every plan and the trial has full feature access (20). A person signs up in a browser and approves the OAuth connection; clients can register themselves with the authorisation server, which earns 2 (2 of 20). Total 32.

Alation 78

Every API has an OpenAPI 3.0 definition, printed in the Markdown copy of each reference page and served by each instance under /openapi/. We found no single public file to download. The local MCP server's tools take typed parameters through FastMCP (22 of 25). No llms.txt on developer.alation.com, www.alation.com or docs.alation.com, but the developer portal serves a Markdown copy of each page at the same address with .md (6 of 10). MCP tool descriptions name use cases, counter-examples and the tool to call instead, and the API reference states purpose and availability for each operation (16 of 20). The signature parameter is a free-form JSON object, search filters is a JSON string, and the agent tools take one natural-language message (9 of 15). A table of six-digit error codes, request and response examples and recipes. The portal warns that its code generator builds a wrong URL for filters (13 of 15). Reference pages are versioned from v2024.1 to v2026.9.0-1 and paths carry v1 or v2, but the API release notes page we read holds only the 2026.7.2.0 entry (12 of 15).

Basedash MCP 57

The served tool definitions can be read only in a signed-in MCP session, which this run doesn't open. The docs and feature page list all ten tools with their inputs, which are required or optional, their scopes, what each returns and which one is annotated destructive, and the REST API counterpart has a public OpenAPI 3.1.0 file (50 paths, 91 operations). Judgement call, 10 of 25 for documented inputs without published JSON Schemas. llms.txt and Markdown copies of every docs page are served (10). Each tool's purpose is stated, with when to use MCP over the REST API and get_data_sources described as the call to make before asking; when not to call a build tool isn't stated (12 of 20). Inputs are a free-text question or instructions plus ids, with no enums or constraints documented (5 of 15). Example questions on the feature page and the launch posts, and troubleshooting for Forbidden or not-a-member, usage blocked and not-found errors, but no error payload shapes (10 of 15). A public dated changelog with MCP entries on 5 June, 14 August, 4 and 25 September and 7 and 9 October 2026, and a server.json version (1.1.0), but the registry entry is still 1.0.0 and the llms.txt of 7 October 2026 still describes two tools (10 of 15). Total 57.

Alation 71

The local MCP server registers 16 tools and enables 8 by default, with --enabled-tools and --disabled-tools lists, and the README says the remote server lists only the tools the current user may call. Descriptions are long. On the Aggregated Context API a signature selects object types and fields, and field caps hold a table to its top 50 columns (22 of 25). REST paging uses limit and skip with an X-Next-Page header and a 1,000-object cap, and the AI API uses limit and offset up to 1,000. Parameter names differ between API families (17 of 20). Six-digit error codes with a published table, and the SDK returns reason, resolution_hint, is_retryable and help_links (17 of 20). No idempotency keys in the docs and no readOnlyHint or destructiveHint in the MCP source. Bulk writes run as jobs with a status endpoint (6 of 20). The catalogue search agent needs one parameter. The official SDKs (alation-ai-agent-sdk, allie-sdk, alation-data-quality-sdk) are all Python (9 of 15).

Basedash MCP 55

Ten tools, grouped by the vendor into ask, build and look up. Their definitions' size couldn't be measured without a session, so 20 of 25 rather than 25. No paging, filters or size controls are documented for list_dashboards or list_charts; ask_question returns tables as CSV files rather than inline rows, and the client can page through the tool list, per the changelog of 14 August 2026 (5 of 20). The troubleshooting section names Forbidden or not-a-member, usage blocked and not-found or archived artifacts with what to do, and ask_question and get_data_sources return typed structured payloads since 5 June 2026 (10 of 20). edit_dashboard is annotated destructive and a failed dashboard or chart build is cleaned up, but no readOnlyHint on the look-up tools or idempotency on the create tools is documented (10 of 20). One or two required inputs per tool and nothing to install; the only official SDK is the React embedding SDK, which isn't for MCP (10 of 15). Total 55.

Alation 61

Hosted service, read on the hosted lines and graded on what an agent uses, the Alation Cloud Service REST APIs and the MCP server. A Statuspage at status.alationcloud.com with production and development components for nine regions (20). The history page lists four incidents between 10 August and 10 September 2026. US-East-1 lost connectivity for 2 hours 26 minutes on 10 September (marked critical), eu-west-1 was disrupted for 65 minutes on 10 August (major), a subset of customers had degraded availability for 56 minutes on 18 August (major), and Sydney was down for 19 minutes on 20 August (critical). Each was regional, and two ran over an hour. July was not on the page we read (5 of 30). The AI API has a two-tier token bucket with no numbers published. REST throttling is off by default and, when enabled, defaults to 20 requests a second for each API family. The Aggregated Context API has a one-time quota of 2,000 calls with enforcement at 2,400 (10 of 15). AI API 429s carry Retry-After and three Ai-RateLimit headers, REST 429s state the seconds to wait, and the SDK marks 429 and 500 as retryable. No idempotency keys were found (10 of 15). The MSA sets a 99.5 per cent monthly uptime target with service credits of 1 to 5 per cent (10). The Aggregated Context API has been generally available since 2025.1.5. The AI API page calls itself new and under highly active development, and the SDK and local MCP server are at 1.0.0rc3 (6 of 10).

Basedash MCP 70

Graded with the hosted lines, on the remote server at charts.basedash.com. Instatus status page at status.basedash.com with one component, App, and notices back to April 2021; the MCP server isn't a separate component (20). No notices since 14 March 2026 and 100.0 per cent shown for September, October and November 2026, so the last 90 days are clean (30). No rate limit is published for the MCP server. The public API allows 60 requests a minute by default, per the changelog of 7 August 2026, which we count in part since the MCP surface may differ (5 of 15). The OpenAPI file documents a 429 with RateLimitExceeded and retryAfterMs on all 91 operations and an Idempotency-Key on starting a chat, but nothing is documented for 429s or retries over MCP (5 of 15). No uptime SLA; the about page names priority support SLAs on Enterprise only (0). The server isn't labelled beta or preview and is on both paid plans (10). Total 70.

Alation 63

OAuth 2.0 client credentials on Alation Cloud Service. A Server Admin registers a client application, which creates a system user with one Alation role, and the admin can set token duration, revoke tokens, rotate the secret and rotate the signing key. An authorisation code flow with refresh tokens exists for user sign-in, without dynamic client registration. API keys are a refresh token (60 days) and an access token (24 hours) sent in a TOKEN header, revocable by an admin. Permissions follow roles, not scopes, and the refresh token endpoint takes a username and password (24 of 30). The APIs by Roles table maps each API to the roles that may call it, AI SQL execution allows reads only, and tools can be disabled. No confirmation step for writes was found (13 of 20). Tools return descriptions, documents and query text written by catalogue users, and we found no prompt-injection guidance (3 of 15). A Logging API, an API usage log, and SDK tool events sent to the customer's instance with tool name, parameters, duration and status. The source says parameters are not redacted (10 of 15). ISO 27001, 27701, 27017 and 27018, SOC 2 Type 2 with HIPAA, two penetration tests a year and a security@alation.com address. No security.txt, no bug bounty, and advisories need a Community login (13 of 20).

Basedash MCP 68

OAuth on Basedash's own authorisation server, with the authorisation code grant and PKCE S256 only, refresh tokens, public clients, dynamic client registration, client ID metadata documents and a revocation endpoint. Three scopes separate asking, reading dashboards and writing them, and the token goes in the header only (30). Building needs mcp:dashboards:write on top of mcp:chat:ask, edit_dashboard is annotated destructive, no tool deletes, and Basedash's AI can change database rows only from the web app with an approval card, per the accuracy page. No server-side confirmation is documented for dashboard edits, and the consent screen on the feature page shows all three scopes together (15 of 20). Answers are drawn from connected company data, which can include text written by outsiders (tickets, CRM records synced by Fivetran), and no prompt-injection guidance was found. Hidden columns and row-level security narrow what reaches the model (5 of 15). The MCP server is a named audit log source, but AI tool calls and queries are recorded on Enterprise only; AI usage per person and feature is shown on every plan (10 of 15). No security.txt on www or charts, and no bug bounty or disclosure policy found. Basedash says it holds SOC 2 Type II, with the report under NDA, and runs third-party penetration tests (8 of 20). Total 68.