Basedash MCP vs OpenPanel

Basedash MCP 68

OAuth on Basedash's own authorisation server, with the authorisation code grant and PKCE S256 only, refresh tokens, public clients, dynamic client registration, client ID metadata documents and a revocation endpoint. Three scopes separate asking, reading dashboards and writing them, and the token goes in the header only (30). Building needs mcp:dashboards:write on top of mcp:chat:ask, edit_dashboard is annotated destructive, no tool deletes, and Basedash's AI can change database rows only from the web app with an approval card, per the accuracy page. No server-side confirmation is documented for dashboard edits, and the consent screen on the feature page shows all three scopes together (15 of 20). Answers are drawn from connected company data, which can include text written by outsiders (tickets, CRM records synced by Fivetran), and no prompt-injection guidance was found. Hidden columns and row-level security narrow what reaches the model (5 of 15). The MCP server is a named audit log source, but AI tool calls and queries are recorded on Enterprise only; AI usage per person and feature is shown on every plan (10 of 15). No security.txt on www or charts, and no bug bounty or disclosure policy found. Basedash says it holds SOC 2 Type II, with the report under NDA, and runs third-party penetration tests (8 of 20). Total 68.

OpenPanel 41

Client credentials with three types (write, read for one project, root for the organisation), created and deleted in the dashboard (25), less 10 because the docs give ?token= in the MCP URL as an option (15 of 30). Read clients are read-only and limited to one project, and onboarding creates a read-only MCP client. No approval step for root-client writes (14 of 20). Tools return event properties, page titles and profile data sent from tracked sites, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). SECURITY.md with a private advisory route and response times, a valid security.txt, and no bug bounty or certification found (9 of 20). 15+14+3+0+9 = 41.

Basedash MCP 57

The served tool definitions can be read only in a signed-in MCP session, which this run doesn't open. The docs and feature page list all ten tools with their inputs, which are required or optional, their scopes, what each returns and which one is annotated destructive, and the REST API counterpart has a public OpenAPI 3.1.0 file (50 paths, 91 operations). Judgement call, 10 of 25 for documented inputs without published JSON Schemas. llms.txt and Markdown copies of every docs page are served (10). Each tool's purpose is stated, with when to use MCP over the REST API and get_data_sources described as the call to make before asking; when not to call a build tool isn't stated (12 of 20). Inputs are a free-text question or instructions plus ids, with no enums or constraints documented (5 of 15). Example questions on the feature page and the launch posts, and troubleshooting for Forbidden or not-a-member, usage blocked and not-found errors, but no error payload shapes (10 of 15). A public dated changelog with MCP entries on 5 June, 14 August, 4 and 25 September and 7 and 9 October 2026, and a server.json version (1.1.0), but the registry entry is still 1.0.0 and the llms.txt of 7 October 2026 still describes two tools (10 of 15). Total 57.

OpenPanel 75

A live OpenAPI 3.0.3 document with 93 operations, 67 described, generated by the framework and titled 'Elysia Documentation' version 0.0.0; MCP tools are defined in TypeScript with typed inputs (22 of 25). llms.txt, llms-full.txt and Markdown pages (10). Tool descriptions say when to use them, for example list_event_names is to be called first when event names aren't known (14 of 20). 143 enums in the spec and typed MCP inputs (11 of 15). Curl examples in the API docs; error responses aren't documented per endpoint (9 of 15). Tagged releases on GitHub with notes, unversioned API paths and no changelog page (9 of 15). 22+10+14+11+9+9 = 75.

Basedash MCP 74

The editorial half. A closed service under dated terms (14 October 2026) naming Basedash Inc. and Delaware law, with 30 days' notice of material adverse changes to the agreement (15). The privacy policy (1 June 2026), the data processing addendum (6 October 2026) and the security docs agree that customer data isn't used for training by Basedash or its AI providers, and the security docs say table and column names and query results go to AI providers. Retention periods differ by document. The privacy policy says a reasonable period, the terms 60 days after a deletion request, the security docs complete removal on request, and audit events are kept 90 days. Locations differ in wording (San Francisco servers in the security docs, DigitalOcean in the United States in the privacy policy) (18 of 30). No deprecation policy for the MCP server; the REST API is unversioned and breaking changes are communicated in advance when possible, and the dashboard scopes were granted to existing connections without re-authorising (8 of 20). The DPA names ten subprocessors (OpenAI, Sentry, Stripe, DigitalOcean, Anthropic, Amazon Web Services, Microsoft Azure, Fivetran, MotherDuck, Betterstack) in the United States and the Czech Republic (16 of 20). Total 57.

OpenPanel 83

AGPL-3.0 for the whole product, and the about page says there is no enterprise edition (30). Terms and privacy policy of 21 May 2026 agree, with a DPA published, transient IP use, data ownership kept by the customer, and providers named with locations. Retention periods are general rather than stated in days (22 of 30). No deprecation policy or dated notices found; v3.0.0 was a major release on 16 October 2026 (4 of 20). Sub-processors and data locations disclosed in the privacy policy (Hetzner, Germany) (18 of 20). 30+22+4+18 = 74.

Basedash MCP 75

Read as a closed hosted service. The changelog's latest entry is 30 October 2026, and the latest MCP-specific entries are 7 and 9 October 2026 (chart placement on a dashboard tab, restyled MCP sign-in pages), all within 30 days (30). Weekly dated changelog entries, with MCP changes on 14 August, 4 and 25 September and 7 and 9 October 2026 (20). Support by email and by Slack on paid plans, with response times not tested (10 of 15). Active in the official MCP registry as com.basedash/mcp under the reverse-DNS namespace for basedash.com, though its description still names two tools (15). No package to judge; the registry entry lags the repository's server.json (0 of 10). Total 75.

OpenPanel 83

v3.30.0 was tagged on 6 November 2026 (30). 60 tagged releases between 8 August and 6 November (20). 572 commits since 8 August, a Discord server, a feedback board and email; issue response times weren't read because the GitHub API refused us for its rate limit (15 of 25). The official MCP registry has only a third-party OpenPanel server, not OpenPanel's own; official SDKs are current (10 of 15). Workflows build Docker images, SDKs and self-hosting releases; no test workflow was found in .github/workflows (8 of 10). 30+20+15+10+8 = 83.