Amplitude vs Mostly Good Metrics

Amplitude 75

Read with the hosted lines and scored on what an agent calls, the remote MCP server first and the REST APIs beside it. status.amplitude.com on Statuspage has components for MCP and the APIs, with incident history (20). Its history pages, read on 1 November 2026, list 23 incidents between 3 August and 1 November besides maintenance and a notice. Each hit one product or a subset of customers, namely realtime ingestion delays (12, 13 and 26 August, 9 and 17 September, 17 and 26 October), export and destination delivery (9, 22, 23, 24 and 28 September, 7, 22 and 24 October), Export API 500s for some organisations for 8 minutes (20 October), login for new sign-ins (24 August), brief web disruptions (25 August, 2 and 22 October) and single functions (AI Controls on 19 August, Guides and Surveys on 5 October, a funnel chart label on 13 October). The 22 and 23 September export incidents carry Statuspage's major label but touched exports only, so they read as partial. Minor only (20 of 30). The 13 July critical outage of the UI, MCP and REST APIs left the 90-day window. The 7 October count came from the status API path, which robots.txt disallows, and is replaced by the history pages. Rate limits with numbers for the Dashboard REST API (5 concurrent, 108,000 cost an hour), Experiment Management (100 a second, 100,000 a day) and HTTP V2 (30 events a second per user or device), and none found for MCP or the Developer API (12 of 15). HTTP V2 says to pause 30 seconds on 429 and deduplicates on insert_id, and the Developer API returns retryable and retry_after_seconds and accepts Idempotency-Key on some operations. No guidance for MCP (13 of 15). No SLA found, and the terms disclaim uninterrupted service (0). The MCP server carries no beta label and is 1.0.0 in the official registry. The Developer API's spec is version 0.1.0 (10). 20 + 20 + 12 + 13 + 0 + 10 = 75.

Mostly Good Metrics 29

Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.

Amplitude 74

The MCP server takes OAuth 2.0 with PKCE S256, dynamic client registration, a revocation endpoint and mcp:read and mcp:write scopes, and the Developer API takes scoped tokens. The older REST APIs still use a project API key and secret key, which aren't scoped (28 of 30). Two role actions, Use MCP (read) and Use MCP (write), are enforced per project on each call, an admin can switch MCP off for the organisation, deletes need a second confirmed call and cohort syncs preview first. MCP is on by default and three standard roles include write (17 of 20). Session replays, feedback comments and user properties are untrusted content, and we found only a disclaimer about model outputs, no injection guidance for hosts (2 of 15). An organisation audit log with 90 days of entries and an API, whose event list doesn't name MCP tool calls (9 of 15). security.txt valid to 31 December 2028, SOC 2 Type II, ISO 27001, 27017 and 27018 on the trust portal and a bug bounty that is private (18 of 20).

Mostly Good Metrics 33

OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.

Amplitude 79

Closed service with terms effective 21 July 2026. The SDKs, CLI and marketplace plugins are MIT (15). The DPA of 4 June 2024 promises destruction within 90 days of termination and use only to run the service, while the terms let Amplitude apply machine learning to customer data to improve the services and delete data at its discretion after termination. The AI docs say data isn't used for model training (20 of 30). A written SDK lifecycle with at least 12 months of maintenance for a superseded major version. No deprecation policy for the REST APIs or MCP tools found (10 of 20). Sub-processor list updated 13 May 2026 with US and EU data centre locations and 10 business days' notice of additions under the DPA (18 of 20).

Mostly Good Metrics 45

The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.

Amplitude 72

The Developer API has an OpenAPI 3.1.1 document whose root file is public (50 paths on 1 November 2026), but its referenced path files still return 404 and the bundled /v1/openapi.json needs a token. The older REST APIs have no spec, and we couldn't read the MCP tool schemas without an Amplitude sign-in (15 of 25). llms.txt, five product feeds, llms-full.txt and Markdown for every docs page (10). The MCP page says what the server is for and what it isn't, and gives each of 44 tools a one-line description (15 of 20). REST parameter tables are typed with required fields, and the Developer API documents scopes, limits and formats. MCP input schemas unread (9 of 15). Request and response examples throughout the REST docs and error tables per API (13 of 15). Dated release notes at amplitude.com/releases and versioned API paths, but the registry entry has stayed at 1.0.0 since October 2025 while tools were consolidated on 17 August 2026 (10 of 15).

Mostly Good Metrics 49

No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.

Amplitude 72

44 tools is over the 30 line (5), with 10 added back for progressive discovery, which starts with four tools and loads schemas on demand, and a subset of about 25 for ChatGPT (15 of 25). Cursor and limit pagination on the Developer API (default 50, maximum 200), the Experiment Management API and the data warehouse tools, and filters on search and replay tools. The MCP page warns that hosts may truncate large charts (17 of 20). RFC 9457 errors with error_code, retryable and field errors on the Developer API and detailed 400 and 429 bodies on HTTP V2. MCP error shapes unread (15 of 20). Idempotency-Key and dry_run on some Developer API operations, insert_id on events, two-step deletes and optimistic concurrency on dashboards and notebooks. We couldn't see whether tools carry readOnlyHint or destructiveHint (13 of 20). Official SDKs in many languages cover ingestion and experiment evaluation, not queries, and the amp CLI prints compact JSON when piped (12 of 15).

Mostly Good Metrics 49

53 tools, more than 30 (5). We added 3 because Goals and Alerts tools load only where enabled and query_metrics batches up to 10 queries (8 of 25). Date ranges, grouping and filters on queries; no documented page or limit parameters for lists (12 of 20). JSON errors with a message, and per-item status in batch results (13 of 20). Annotations weren't readable without a session, the tool list includes deletes and key revocation, and no idempotency keys were found (4 of 20). Five client SDKs and a CLI with --json output (12 of 15). 8+12+13+4+12 = 49.

Amplitude 83

Dated release notes on 16, 27 and 29 October 2026 cover MCP service accounts, enterprise-managed auth for MCP, and guides and surveys through the Developer API, CLI and MCP (30). Eight release notes since 2 October and 20 on the first page from 20 August, plus amplitude-analytics (Python) 1.3.0 on 15 October with a new logging option (20). @amplitude/analytics-node 1.5.77 to 1.5.82 in October are version bumps only and set nothing. Closed service with public release notes, a feedback form for MCP and 12 commits to the amplitude/mcp-marketplace repository between 15 and 30 October. We didn't test support (11 of 15). com.amplitude/mcp-server is in the official MCP registry under the vendor's domain (15). The marketplace plugin bumps versions automatically (1.7.0 on 30 October), while the CLI needs Node.js 26 and the registry entry is a year old (7 of 10). 30 + 20 + 11 + 15 + 7 = 83.

Mostly Good Metrics 74

CLI v0.1.4 was tagged on 16 October 2026 (30). The JavaScript SDK released 0.12.0, 0.13.0 and 0.13.1 between 5 September and 2 October, and the Swift SDK 1.0.0 and 1.0.1 on 2 October (20). A closed service with no public changelog, support by email and GitHub repositories for the SDKs; issue activity wasn't read because the GitHub API refused us for its rate limit (6 of 25). Not in the official MCP registry; official SDKs in five languages are current (10 of 15). CI workflows on the SDK and CLI repositories (8 of 10). 30+20+6+10+8 = 74.