Basedash MCP vs Pendo

Basedash MCP 32

No x402, MPP or L402 (0). Plan prices are public, $1,000 a month for Startup with $1,000 of AI credits included, but the cost of an MCP question in AI usage isn't published (10). A 14-day trial needs no card, includes up to $250 of AI usage and has the MCP server, since it's on every plan and the trial has full feature access (20). A person signs up in a browser and approves the OAuth connection; clients can register themselves with the authorisation server, which earns 2 (2 of 20). Total 32.

Pendo 5

No x402, MPP or L402 (0). Paid plans are priced on request, and the only published plan is Free (0). Pendo Free needs no card but excludes the API and integrations, and the MCP server is for paid customers, so the free plan doesn't reach the graded surface. The 30-day trial goes through sales (5 of 20). An admin must sign in and enable access in a browser (0). Total 5.

Basedash MCP 70

Graded with the hosted lines, on the remote server at charts.basedash.com. Instatus status page at status.basedash.com with one component, App, and notices back to April 2021; the MCP server isn't a separate component (20). No notices since 14 March 2026 and 100.0 per cent shown for September, October and November 2026, so the last 90 days are clean (30). No rate limit is published for the MCP server. The public API allows 60 requests a minute by default, per the changelog of 7 August 2026, which we count in part since the MCP surface may differ (5 of 15). The OpenAPI file documents a 429 with RateLimitExceeded and retryAfterMs on all 91 operations and an Idempotency-Key on starting a chat, but nothing is documented for 429s or retries over MCP (5 of 15). No uptime SLA; the about page names priority support SLAs on Enterprise only (0). The server isn't labelled beta or preview and is on both paid plans (10). Total 70.

Pendo 45

Graded as a hosted service on the MCP server and the Engage API. Statuspage site with API and MCP components in each of five regions (20). Eight incidents between 10 July and 2 October 2026, among them a major US latency incident of 3 hours 51 minutes on 14 September that affected login and event processing, a critical guide targeting incident of 34 minutes on 21 September, and a minor incident on 1 October in which some customers couldn't connect to MCP for about 12 hours (10). No request rate limits found for the API or the MCP server (0). The API lists 429 and advises retrying 5xx after one second or more, with no Retry-After header or idempotency key documented (5). No SLA found on the public legal pages, and the contract centre wasn't read (0). The MCP server has been generally available since April 2026 (10). Total 45.

Basedash MCP 55

Ten tools, grouped by the vendor into ask, build and look up. Their definitions' size couldn't be measured without a session, so 20 of 25 rather than 25. No paging, filters or size controls are documented for list_dashboards or list_charts; ask_question returns tables as CSV files rather than inline rows, and the client can page through the tool list, per the changelog of 14 August 2026 (5 of 20). The troubleshooting section names Forbidden or not-a-member, usage blocked and not-found or archived artifacts with what to do, and ask_question and get_data_sources return typed structured payloads since 5 June 2026 (10 of 20). edit_dashboard is annotated destructive and a failed dashboard or chart build is cleaned up, but no readOnlyHint on the look-up tools or idempotency on the create tools is documented (10 of 20). One or two required inputs per tool and nothing to install; the only official SDK is the React embedding SDK, which isn't for MCP (10 of 15). Total 55.

Pendo 41

93 tools named in the reference earns 5, plus 5 back for the separate read-only and write switches and Command Centre tools being off by default (10 of 25). Documented date range and row limits, saved segments as filters and an afterKey cursor on survey responses, with no general pagination scheme described (14 of 20). A generic status code table, with per-endpoint codes on some requests (8 of 20). No idempotency keys, and tool annotations couldn't be read without a subscription. Orchestrate journeys are created as drafts (3 of 20). No official API client libraries found. The SDKs Pendo publishes are for data capture (6 of 15). Total 41.

Basedash MCP 68

OAuth on Basedash's own authorisation server, with the authorisation code grant and PKCE S256 only, refresh tokens, public clients, dynamic client registration, client ID metadata documents and a revocation endpoint. Three scopes separate asking, reading dashboards and writing them, and the token goes in the header only (30). Building needs mcp:dashboards:write on top of mcp:chat:ask, edit_dashboard is annotated destructive, no tool deletes, and Basedash's AI can change database rows only from the web app with an approval card, per the accuracy page. No server-side confirmation is documented for dashboard edits, and the consent screen on the feature page shows all three scopes together (15 of 20). Answers are drawn from connected company data, which can include text written by outsiders (tickets, CRM records synced by Fivetran), and no prompt-injection guidance was found. Hidden columns and row-level security narrow what reaches the model (5 of 15). The MCP server is a named audit log source, but AI tool calls and queries are recorded on Enterprise only; AI usage per person and feature is shown on every plan (10 of 15). No security.txt on www or charts, and no bug bounty or disclosure policy found. Basedash says it holds SOC 2 Type II, with the report under NDA, and runs third-party penetration tests (8 of 20). Total 68.

Pendo 58

OAuth with PKCE S256, dynamic client registration and client ID metadata documents, scopes limited to mcp:tools and mcp:resources, service accounts limited to chosen applications with rotation and 60-minute tokens, and integration keys that are read-only or read-write with no stated expiry (26 of 30). Read-only tools by default, write tools an admin opt-in, calls inherit the user's permissions, and Command Centre changes need confirmation, though guideSetState can publish a guide (16 of 20). Tools return end-user text such as feedback and agent conversations, and the only guidance found warns against using a service account where end users submit queries (3 of 15). No audit log of MCP or API calls found in the reviewed documentation (0 of 15). Yearly SOC 2 Type II, penetration tests twice a year and a security@pendo.io address, with no security.txt or bug bounty found (13 of 20). Total 58.

Basedash MCP 75

Read as a closed hosted service. The changelog's latest entry is 30 October 2026, and the latest MCP-specific entries are 7 and 9 October 2026 (chart placement on a dashboard tab, restyled MCP sign-in pages), all within 30 days (30). Weekly dated changelog entries, with MCP changes on 14 August, 4 and 25 September and 7 and 9 October 2026 (20). Support by email and by Slack on paid plans, with response times not tested (10 of 15). Active in the official MCP registry as com.basedash/mcp under the reverse-DNS namespace for basedash.com, though its description still names two tools (15). No package to judge; the registry entry lags the repository's server.json (0 of 10). Total 75.

Pendo 70

The MCP tools reference was updated on 30 September 2026 and the release notes carry October 2026 entries (30). MCP entries in the last 90 days include expanded tools in July, object analytics in September and the OAuth session length setting in September (20). Dated release notes, a community site and technical support, with no public issue tracker (10 of 25). Not checked in the official MCP registry, and no API client libraries, though the Claude Code plugin repository had its last commit on 30 September 2026 (6 of 15). The plugin repository is active with 43 commits and no CI seen (4 of 10). Total 70.