Axiom MCP Server vs Rootly MCP Server

Axiom MCP Server 60

No x402, MPP or L402 (0). The pricing page states the platform fee, the free allowances, add-on prices and that usage carries volume discounts, with a calculator rather than a printed per-unit rate (20). The Personal plan is free with no card (20). POST /v2/orgs/provision needs no authentication and returns a working token, so an agent can start without a person, though a person must claim the organisation within 24 hours for it to persist (20). 0 + 20 + 20 + 20 = 60.

Rootly MCP Server 20

No x402, MPP or L402 (0). Plan prices are public. Essentials is $20 per product per user a month, with MCP and API access included, and Enterprise is by quote. No per-call price (10). No free tier. Self-serve sign-up starts a trial of about two weeks per the pricing page. The sign-up page answered with a bot check, so whether a card is needed wasn't established, and the line takes half marks (10). A person signs up in a browser and either logs in through OAuth or creates an API key (0). The package is free to run but needs a Rootly account, so the self-hosted rule doesn't apply.

Axiom MCP Server 72

Scored as a hosted MCP server. status.axiom.co is an incident.io page with six US and six EU components (API, ingest, querying, alerting, endpoints, app) and uptime per component for August to November 2026, with no MCP component (20). feed.rss holds nine incidents in the 90 days to 3 November 2026, among them elevated query errors in the US from 18:05 to 19:15 UTC on 14 October with missed monitor runs, a metrics ingestion and query disruption on 15 October, elevated query errors after a deployment on 21 October, metrics query error rates on 25 October, query errors and monitor delays on 27 October, metrics ingest on 30 October, EU monitor alerting degraded on 7 October, and console authentication through GitHub degraded on 12 August. US querying shows 99.90 per cent uptime. One incident over an hour on the query path and several shorter ones, so one major (10). Rate limits are published as headers (X-RateLimit-Scope, -Limit, -Remaining, -Reset) and plan limits on the limits page, but the per-minute numbers aren't printed (12). 429 with a message and reset headers, query cost caps that answer 429 with the reset time, and provisioning 429 with backoff guidance; no idempotency keys for the write tools (10). A published SLA of 99.9 per cent monthly uptime for Axiom Cloud with 10 and 25 per cent credits (10). Not marked beta; registry version 1.0.0 (10). 20 + 10 + 12 + 10 + 10 + 10 = 72.

Rootly MCP Server 48

Scored as a hosted MCP server, the path the docs recommend. status.rootly.com is linked from the site and llms.txt. On 9 October it answered our reader with a bot check, so its components (15) and incident history (5) were unread. Rootly's Terms of Use bar crawling or scraping the Services, and this run pauses such hosts pending a ruling, so the 9 October readings are kept. The REST API behind the tools allows 3,000 read calls and 3,000 write calls a minute per API key, and 50 alert creations a minute. No separate limit for mcp.rootly.com was found (12). A 429 returns a JSON error with X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used and X-RateLimit-Reset headers. No Retry-After, backoff guidance or idempotency keys were found (8). The pricing table lists "99.99 % Reliability" for on-call, and no SLA document was found (0). The hosted /mcp and /mcp-codemode endpoints carry no beta label. The README calls Code Mode experimental while the docs recommend it (8).

Axiom MCP Server 62

The server is closed source (axiomhq/mcp isn't public) and tools/list needs a session, so the input schemas couldn't be read; partial credit for a contract that exists (10). llms.txt on axiom.co and a Markdown twin of every docs page (10). The tools reference gives each tool a purpose, an example request and a Read or Write label, says to use queryMetrics for metrics datasets instead of queryDataset, and the 29 October 2026 changelog adds session instructions on finding dataset and field names first (15). No parameters, types or enums are published for the tools (4). An example per tool, the REST docs' error shapes and the 429 bodies; no MCP error list (8). A dated changelog with MCP entries and a protocol version stated (2026-07-28 alongside the session transport), and a registry version (15). 10 + 10 + 15 + 4 + 8 + 15 = 62.

Rootly MCP Server 78

Read from the source at v2.3.21. Curated tools declare typed pydantic inputs and the rest are generated from Rootly's OpenAPI 3.0.1 description, 565 operations in the bundled copy, which the API docs also link for download (25). rootly.com/llms.txt and Markdown twins of the docs pages (10). Curated tools such as list_incidents say when to use them and when to prefer search_incidents. Generated tools carry the API's short summaries, for example "List alerts" (11). Sort orders use enums and generated tools keep the API's include enums, but severity, status and ID lists are free strings, with IDs passed comma-separated (9). The README and docs give worked calls for five tools and a troubleshooting section. The error types the server returns aren't documented (8). Semantic versioning with a dated Keep a Changelog file. The docs page still names two tools in camelCase and links the old Rootly-AI-Labs repository (15).

Axiom MCP Server 63

31 tools in the reference, 28 without service map, so the 11-to-30 band with no toolset switch (15). APL queries take their own limits and time ranges, and the REST API documents timestamp pagination; nothing documents page sizes for the list tools (15). 429 bodies state the limit and reset, the REST docs describe error shapes, and a sendFeedback tool reports unclear descriptions to Axiom (12). Reads and writes are labelled in the docs, but delete tools have no confirmation step, no idempotency keys exist for writes, and annotations weren't confirmed (8). One-command setup for 16 clients with OAuth, a setup prompt for agents, and official SDKs in eight languages for the API behind it (13). 15 + 15 + 12 + 8 + 13 = 63.

Rootly MCP Server 77

The default endpoint lists about 218 tools per the README, which the checklist scores at 5. A slim profile (77 names in the source, about 70 per the README), a Code Mode endpoint with five meta-tools and an exact allowlist for servers the owner runs add back 10 (15). List tools page with bounded sizes, strip alert and incident lists to summary fields and clamp out-of-range counts, reporting each change under argument_adjustments (18). Tool errors return error_type and a message, with hints for plan-gated 404s, the pagination cap and replaced alert routing tools (16). Every tool sets readOnlyHint, destructiveHint and openWorldHint since 2.3.19, and writes set idempotentHint. create_incident has no idempotency key (15). Curated tools have no required parameters beyond record references and accept common aliases such as limit. Rootly lists REST SDKs for Go, Python and other languages (13).

Axiom MCP Server 70

Closed service with clear terms naming Axiom, Inc. (15). A privacy policy with retention by data category, a DPA that names the sub-processor page and US or EU processing, and per-plan retention on the pricing page; the sub-processor list itself renders through a script and the terms carry no date (20). The changelog has a deprecation category and the docs mark the legacy query endpoint, but no notice period is written down (10). US and EU edge deployments are documented and the DPA says data may be processed in either, with the sub-processor list unread (12). 15 + 20 + 10 + 12 = 57.

Rootly MCP Server 81

The server is Apache-2.0 and the hosted service runs under Rootly's Terms of Use of July 2026 (27). A privacy policy of October 2026, a subprocessor list and AI data pages are public, and retention is stated only in general terms. The README says hosted telemetry records tool arguments, responses, timing and errors through AgentCat with redaction hooks. AgentCat isn't on the subprocessor list and the MCP docs page doesn't mention telemetry (15). No deprecation policy was found. camelCase tool names stay callable as hidden aliases with no removal date, and the terms say notice of changes isn't always practical (8). The subprocessor list names about 30 processors with purpose, data and location, nearly all in the United States (15).

Axiom MCP Server 72

Browser OAuth creates a session the agent uses as the signed-in user, listed and revocable under Settings > Profile, and the docs say agents never see tokens; the header route uses a personal access token with full account rights, and the organisation id, not a secret, may go in the URL (26). Query cost limits on roles cap what an OAuth session can spend, scoped API tokens with expiry exist for the REST API, but the MCP server runs with the user's whole role and lists delete tools with no confirmation, and the AI agents page's read-only description contradicts the tools reference (12). Log, trace and event content is untrusted text and no injection guidance was found (2). An audit log on every organisation for 30 days, full history as an add-on, and session listing (12). ISO 27001, SOC 2 Type II, a security.txt on app.axiom.co, a bug bounty policy at axiom.co/security and annual penetration tests (20). 26 + 12 + 2 + 12 + 20 = 72.

Rootly MCP Server 65

OAuth 2 with dynamic client registration, PKCE with S256, one-hour access tokens, rotating refresh tokens, a revocation endpoint and :read and :write scopes per resource. The MCP server's resource metadata advertises a single all scope since 2.3.13, so MCP logins aren't narrowed by scope. API keys are global with a chosen role, team or personal, sent in the Authorization header (26). Delete operations are off by default and API key, user, role and webhook endpoints are excluded. Write tools are on by default for hosted connections, the documented read-only switch applies to servers the owner runs, and no confirmation step was found (11). Incident text, alert payloads and meeting transcripts are untrusted content, and no injection guidance was found (3). list_audits reads Rootly's audit log, which the pricing page lists under Enterprise (9). security.txt valid to 1 September 2027, a disclosure policy with safe harbour and response times, no paid bounty, SOC 2 Type II stated with the report on request, and dependency advisories recorded in the changelog. The server's own fixes in 2.3.22 and 2.4.0 carry no advisory, and OSV holds none for the package (16).