# Amplitude vs Flagsmith (slim)

> Amplitude scores 69.3 (B) to Flagsmith's 61.2 (C) for feature flags. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/amplitude-vs-flagsmith.md (~5,050 tokens) · this version ~3,080 tokens · JSON https://www.anchorterminal.com/compare/amplitude-vs-flagsmith.json · canonical https://www.anchorterminal.com/compare/amplitude-vs-flagsmith
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Amplitude scores 69.3 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 5 of 7 scored categories. Flagsmith leads on payments & pricing. Both do feature flags.

- Amplitude: B 69.3, rank #249 of 1486 · https://www.anchorterminal.com/tools/amplitude.min.md
- Flagsmith: C 61.2, rank #620 of 1486 · https://www.anchorterminal.com/tools/flagsmith.min.md
- Amplitude, good for A team already on Amplitude that wants an agent to query charts, funnels, retention and experiment results, edit dashboards and manage the tracking plan under its own permissions. Ahead on Reliability, 75 against 65; Schema & documentation, 72 against 67; Agent ergonomics, 72 against 55; Security & auth, 74 against 65. Also Free to start without a card.
- Flagsmith, good for Feature flags and experiments for teams that want open source or self-hosting, managed by an agent through MCP. Ahead on Payments & pricing, 40 against 30. Also Runs on your own machine; Open source.

| Category | Amplitude | Flagsmith |
| --- | --- | --- |
| Reliability (16%) | 75 | 65 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 72 | 67 |
| Agent ergonomics (13%) | 72 | 55 |
| Security & auth (14%) | 74 | 65 |
| Payments & pricing (10%) | 30 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 83 | 83 |
| Transparency & trust (7%) | 79 | 77 |

| Fact (where they differ) | Amplitude | Flagsmith |
| --- | --- | --- |
| Vendor | Amplitude, Inc. | Bullet Train Ltd |
| Hosted endpoint | `https://mcp.amplitude.com/mcp` | `https://mcp.flagsmith.com` |
| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP, stdio |
| Licence | Proprietary service under Amplitude's terms of service. The SDKs, the `amp` CLI and the MCP marketplace plugins on GitHub and npm are MIT | BSD-3-Clause |
| Tools exposed | 45 | 54 |
| Read-only variant documented | no | yes |
| llms.txt | yes | no |
| MCP registry | `com.amplitude/mcp-server` | not listed |
| Last release | 2026-10-29 | 2026-11-05 |
| Terms last updated | 2026-07-21 | 2026-09-01 |
| Privacy policy last updated | 2026-08-31 | 2023-10-01 |
| Customer content may train models | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 1.3M npm/wk, 1.8M PyPI/wk | 6.6k stars |
| Agent reviews | 3/5 (4) | none |

Why the edge:
- Agent ergonomics, Amplitude +17: Amplitude 72 (44 tools is over the 30 line (5), with 10 added back for progressive discovery, which starts with four tools and loads schemas on demand, and a subset of about 25 for ChatGPT (15 of 25). Cursor and `limit` pagination on the Developer API (default 50, maximum 200), the Experiment Management API and the data warehouse tools, and filters on search and replay tools. The MCP page warns that hosts may truncate large charts (17 of 20). RFC 9457 errors with `error_code`, `retryable` and field errors on the Developer API and detailed 400 and 429 bodies on HTTP V2. MCP error shapes unread (15 of 20). `Idempotency-Key` and `dry_run` on some Developer API operations, `insert_id` on events, two-step deletes and optimistic concurrency on dashboards and notebooks. We couldn't see whether tools carry readOnlyHint or destructiveHint (13 of 20). Official SDKs in many languages cover ingestion and experiment evaluation, not queries, and the `amp` CLI prints compact JSON when piped (12 of 15).); Flagsmith 55 (54 tools, more than 30, with no toolsets or read-only subset; enterprise tools only appear where installed (5 of 25). List endpoints paginate with page and page_size (default 10) and filter by project, environment and search (14 of 20). Errors are Django REST Framework bodies with field messages, without a documented error code list (12 of 20). Every tool carries readOnlyHint, destructiveHint and idempotentHint derived from its HTTP method. No idempotency keys for POST (14 of 20). Few required parameters; official SDKs in more than a dozen languages, though they cover flag evaluation rather than the Management API (10 of 15). 5+14+12+14+10 = 55.)
- Reliability, Amplitude +10: Amplitude 75 (Read with the hosted lines and scored on what an agent calls, the remote MCP server first and the REST APIs beside it. status.amplitude.com on Statuspage has components for MCP and the APIs, with incident history (20). Its history pages, read on 1 November 2026, list 23 incidents between 3 August and 1 November besides maintenance and a notice. Each hit one product or a subset of customers, namely realtime ingestion delays (12, 13 and 26 August, 9 and 17 September, 17 and 26 October), export and destination delivery (9, 22, 23, 24 and 28 September, 7, 22 and 24 October), Export API 500s for some organisations for 8 minutes (20 October), login for new sign-ins (24 August), brief web disruptions (25 August, 2 and 22 October) and single functions (AI Controls on 19 August, Guides and Surveys on 5 October, a funnel chart label on 13 October). The 22 and 23 September export incidents carry Statuspage's major label but touched exports only, so they read as partial. Minor only (20 of 30). The 13 July critical outage of the UI, MCP and REST APIs left the 90-day window. The 7 October count came from the status API path, which robots.txt disallows, and is replaced by the history pages. Rate limits with numbers for the Dashboard REST API (5 concurrent, 108,000 cost an hour), Experiment Management (100 a second, 100,000 a day) and HTTP V2 (30 events a second per user or device), and none found for MCP or the Developer API (12 of 15). HTTP V2 says to pause 30 seconds on 429 and deduplicates on `insert_id`, and the Developer API returns `retryable` and `retry_after_seconds` and accepts `Idempotency-Key` on some operations. No guidance for MCP (13 of 15). No SLA found, and the terms disclaim uninterrupted service (0). The MCP server carries no beta label and is 1.0.0 in the official registry. The Developer API's spec is version 0.1.0 (10). 20 + 20 + 12 + 13 + 0 + 10 = 75.); Flagsmith 65 (Graded on Flagsmith Cloud with the hosted lines. Statuspage at status.flagsmith.com with components for the Edge API, Admin API, dashboard and website (20). In the 90 days from 8 August, an Admin and SDK API outage on 28 October marked critical, posted at 21:56 UTC and resolved at 22:12 with no cause given, and a minor delay in processing flag changes on 10 September. The posted span of the outage is 16 minutes and its start isn't stated, so we read it as one serious incident under an hour (15 of 30). The Management API limit of 500 requests a minute is documented (15). No 429 handling, Retry-After or idempotency guidance was found in the docs (0). A public SLA commits to 99.95 per cent monthly uptime with service credits (10). The Management API is generally available, but the MCP docs call the server an early release, so half (5 of 10). 20+15+15+0+10+5 = 65.)
- Payments & pricing, Flagsmith +10: Amplitude 30 (Read with the hosted rubric. No x402, MPP or L402 (0). Plans are public but Plus shows a price only through an estimator that asks for a card, and Growth and Enterprise go through sales (10). The Free plan has 2 million events a month with no card, and MCP works on it (20). A person signs up and approves OAuth in a browser, or creates keys in settings (0).); Flagsmith 40 (No x402, MPP or L402 (0). Plan prices and the per-million overage are public without login, though the page gives two overage rates for Start-Up ($50 per million and $7 per 100,000) (20). A $0 Free plan with 50,000 requests a month and a free BSD-3-Clause self-hosted edition. The pricing page doesn't say whether a card is needed, but the Free plan has no charge and the self-hosted edition needs no account (20). A person signs up in a browser, then approves OAuth or creates a key (0). 0+20+20+0 = 40.)
- Security & auth, Amplitude +9: Amplitude 74 (The MCP server takes OAuth 2.0 with PKCE S256, dynamic client registration, a revocation endpoint and `mcp:read` and `mcp:write` scopes, and the Developer API takes scoped tokens. The older REST APIs still use a project API key and secret key, which aren't scoped (28 of 30). Two role actions, Use MCP (read) and Use MCP (write), are enforced per project on each call, an admin can switch MCP off for the organisation, deletes need a second confirmed call and cohort syncs preview first. MCP is on by default and three standard roles include write (17 of 20). Session replays, feedback comments and user properties are untrusted content, and we found only a disclaimer about model outputs, no injection guidance for hosts (2 of 15). An organisation audit log with 90 days of entries and an API, whose event list doesn't name MCP tool calls (9 of 15). security.txt valid to 31 December 2028, SOC 2 Type II, ISO 27001, 27017 and 27018 on the trust portal and a bug bounty that is private (18 of 20).); Flagsmith 65 (OAuth for interactive MCP clients with Flagsmith as the authorisation server, Organisation API keys in the Authorization header that act as admin or with chosen RBAC roles, and OIDC trust relationships that swap a CI token for a short-lived one. Granular key roles need Scale-Up or Enterprise, so a Free key is all-powerful (25 of 30). RBAC roles can limit a key to reads, and change requests put a flag change through approval on Scale-Up and Enterprise. There is no read-only switch on the MCP server itself (14 of 20). No prompt-injection guidance; tools return names, descriptions and trait values written by people (3 of 15). Audit logs record every admin action and stream by webhook, on Scale-Up and Enterprise (11 of 15). The docs say Flagsmith has a SOC 2 Type 2 report available on request, the terms promise a yearly third-party penetration test, and SECURITY.md routes reports to support email. No security.txt, bug bounty or public advisory process was found (12 of 20). 25+14+3+11+12 = 65.)
- Schema & documentation, Amplitude +5: Amplitude 72 (The Developer API has an OpenAPI 3.1.1 document whose root file is public (50 paths on 1 November 2026), but its referenced path files still return 404 and the bundled /v1/openapi.json needs a token. The older REST APIs have no spec, and we couldn't read the MCP tool schemas without an Amplitude sign-in (15 of 25). llms.txt, five product feeds, llms-full.txt and Markdown for every docs page (10). The MCP page says what the server is for and what it isn't, and gives each of 44 tools a one-line description (15 of 20). REST parameter tables are typed with required fields, and the Developer API documents scopes, limits and formats. MCP input schemas unread (9 of 15). Request and response examples throughout the REST docs and error tables per API (13 of 15). Dated release notes at amplitude.com/releases and versioned API paths, but the registry entry has stayed at 1.0.0 since October 2025 while tools were consolidated on 17 August 2026 (10 of 15).); Flagsmith 67 (openapi.yaml in the repository is OpenAPI 3.1 with 624 operations, and the MCP server builds its 54 tools from the operations tagged `mcp`, so every tool has a JSON Schema input (25). No llms.txt (404) and no Markdown served for agents on docs.flagsmith.com; the docs are Markdown only in the repository (0). Tool descriptions say what each does and which feature-versioning mode it applies to, but rarely when not to use it, and only 153 of 624 operations carry a description (10 of 20). 57 enums and required fields in the spec, with some free-form value fields (10 of 15). Docs carry curl examples, but only 16 operations document a 400 and 6 a 404 (7 of 15). A /api/v1 path, release-please changelog and dated release notes (15). 25+0+10+10+7+15 = 67.)