Collibra vs Onyx

Collibra

Each REST API has an OpenAPI 3.0 definition, the developer portal publishes llms.txt and Markdown pages, and every MCP tool carries read-only and destructive annotations. Access needs a sales contract, since no price, trial or self-serve sign-up is published, and no general API rate limit was found in the reviewed documentation.

Onyx

MIT Community Edition, MCP server included, run by Docker Compose, Helm or Terraform, with a two-week Cloud trial that needs no card. GHSA-q62f-rv3h-f822 (critical, CVSS 9.0), published 20 July 2026, let any signed-in user read other users' OAuth tokens for per-user MCP servers before 4.0.0.

Collibra

1. Ask a Collibra administrator to register an OAuth application. Integration applications use client credentials, and MCP clients need a user application with a redirect URI
2. Reuse each access token for its 5 minutes. The token endpoint answers 429 once a client drains its pool of 100 tokens, refilled at 30 a minute
3. Page large reads with cursor= and sortField=ID. Cursor and offset parameters cannot be combined, and Search API limit plus offset cannot exceed 10,000
4. Keep Import API files to 10,000 assets or fewer and run at most 8 imports at once. Retry a job that fails on a concurrency error
5. Expect discover_data_assets and discover_business_glossary to consume Collibra Units and to need the dgc.ai-copilot permission. Use search_asset_keyword for free keyword search

Onyx

1. Get the instance URL from the operator. Cloud is https://cloud.onyx.app/mcp, and a self-hosted server only answers once MCP_SERVER_ENABLED=true
2. Use a token limited to read:search. It covers every MCP tool and nothing else
3. Pass time_cutoff as a full ISO 8601 timestamp. A value that doesn't parse is dropped and the search runs unfiltered
4. Check each result for an error field. Failures come back with an empty results list, not as tool errors
5. Set skip_query_expansion to true for exact phrases. It skips an LLM call on every search