{ "data": { "a": { "slug": "countly", "name": "Countly", "vendor": "Countly Ltd", "vendorUrl": "https://countly.com", "kind": "http-api", "category": "product-analytics", "summary": "Countly is a product analytics platform sold as a managed private-cloud server (Flex), a self-hosted Enterprise edition and the open-source Countly Lite. Agents reach a Countly server through its HTTP API or the official `countly-mcp-server`.", "url": "https://www.anchorterminal.com/tools/countly", "markdownUrl": "https://www.anchorterminal.com/tools/countly.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/countly.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/countly.json", "dns": "countly.grade.anchorterminal.com", "repo": "https://github.com/Countly/countly-server", "license": "Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT", "transports": [ "http", "stdio", "streamable-http" ], "remoteUrl": "https://mcp.count.ly/mcp", "packages": [ { "registry": "npm", "name": "countly-mcp-server" }, { "registry": "npm", "name": "countly-sdk-web" }, { "registry": "npm", "name": "countly-sdk-nodejs" } ], "auth": "api-key", "authNotes": "Self-serve once a server exists. A dashboard user copies an `api_key`, which has that user's full read and write access, or creates an auth token in the Token Manager or with `/i/token/create`, limited by app, endpoint pattern and lifetime. Tokens go in the `countly-token` header or the `auth_token` query parameter. The MCP server takes `COUNTLY_SERVER_URL` and `COUNTLY_AUTH_TOKEN`, or `X-Countly-Server-Url` and `X-Countly-Auth-Token` headers over HTTP. SDKs send the write-only `app_key`.", "pricing": "paid", "pricingNotes": "Flex starts at $175 a month, billed by tier on monthly active users and data points, with a 14-day trial that needs a credit card. Tier prices appear during signup. Funnels, retention and flows sit in the Intelligence add-on. Enterprise is on custom pricing. Countly Lite is free to self-host. API and MCP calls are not billed (https://countly.com/pricing, checked 2026-11-04).", "priceSummary": "$175 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference source, the MCP server README or the pricing page (checked 2026-11-04).", "endpoints": [] }, "toolCount": 209, "popularity": { "githubStars": null, "npmWeekly": 27579, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://api.count.ly/", "llmsTxt": "https://countly.com/llms.txt", "capabilities": [ "analytics.query", "analytics.events", "analytics.funnels", "analytics.experiments", "analytics.flags", "observability.errors" ], "tags": [ "official", "hosted", "self-hosted", "open-source", "mcp", "api-key", "llms-txt", "paid", "trial", "typescript" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 38.8, "grade": "E", "agentReady": false, "rank": 1352, "ranked": true, "rankOf": 1510, "categoryRank": 19, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 80, "payments": 17, "reliability": 23, "schema": 75, "security": 62, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -15, "negativeNotes": [ "2026-10-16. Countly published four GitHub advisories for its own countly-server code, CVE-2026-44977 (stored XSS, CVSS 3.1 9.0 Critical), CVE-2026-41582 (unauthenticated path traversal, 7.5 High), CVE-2026-42270 (unauthenticated denial of service, 7.5 High) and CVE-2026-42269 (path traversal in delete_import, 8.1 High), fixed in 24.05.50 and 25.03.44. Fixed, under two months old, 2 each (-8). https://osv.dev/list?q=countly", "2026-09-10. CVE-2026-87803, a DBViewer authorisation bypass that reaches password-reset tokens, CVSS 4.0 7.1 High, published by Snyk as CNA and fixed in 25.03.53-LTS. A fixed third-party High under two months old (-2, falling to -1 after 10 November). https://osv.dev/vulnerability/CVE-2026-87803", "2026-10-27. Server 25.03.58 lists 10 security fixes to Countly's own code (token permissions and revocation, single-use tokens, read rights on endpoints), after 25.03.54 (22 September, 20 fixes) and MCP server 1.5.0 (25 August) and 1.7.0 (7 October). No advisory was found for them. Released fixes with no advisory, folded (-3). https://github.com/Countly/countly-server/blob/master/CHANGELOG.md", "2026-10-07. `countly-mcp-server` 1.7.0, a minor release, removed the `databases_stats` tool (committed on 6 October as a breaking refactor), with no earlier notice found. A breaking change in a minor release without notice (-3). https://github.com/Countly/countly-mcp-server/blob/main/CHANGELOG.md", "2026-10-27. Server 25.03.58 limits existing app-restricted tokens without permissions to their owner's rights and makes endpoint restrictions match exact API paths, so requests that earlier tokens were allowed to make can now fail. The change was posted with the release, with no earlier notice found. A published behaviour changed for existing clients on the day it took effect (-3). https://github.com/Countly/countly-server/blob/master/CHANGELOG.md", "The five terms add to -19, held at the -15 limit." ], "verdict": "Countly suits an agent working against a server its owner already runs. The official MCP server filters its 209 tools by edition, plugin and permission and has per-category read-only settings. Five countly-server CVEs were published since September, all fixed, and no status page, OpenAPI document or published API rate limit was found.", "bestFor": "An agent whose owner runs Countly on its own infrastructure or a dedicated Flex server and wants analytics, crash and remote-config data through MCP with per-category permissions.", "strengths": [ "Official MIT MCP server, `countly-mcp-server` 1.7.0 of 7 October 2026, with read-only, destructive and idempotent annotations on its tools", "`COUNTLY_TOOLS_ALL=R` makes every MCP tool read-only, and per-category settings take None, R, CR, CRU or CRUD", "Auth tokens can be limited to named apps and endpoint patterns, carry a lifetime in seconds and are revocable", "API reference at api.count.ly is versioned (26.01, 25.03, 24.05) with parameters, examples and error responses per endpoint", "Flex terms, privacy policy, DPA, sub-processor list and a telemetry notice, all dated 20 October 2026, with 30 days' notice of sub-processor changes" ], "weaknesses": [ "No public status page or incident history was found for Flex servers or for mcp.count.ly", "Five CVEs in countly-server were published between 10 September and 16 October 2026, one Critical and four High, all fixed", "`countly-mcp-server` 1.7.0 removed the `databases_stats` tool in a minor release with no earlier notice", "The API accepts `api_key` and `auth_token` in the URL query string, and the `api_key` has its user's full read and write access", "Flex starts at $175 a month, its 14-day trial needs a credit card, and tier prices appear only during signup", "Servers and the MCP server report usage to stats.count.ly by default until it is switched off" ], "agentNotes": [ "Create a dedicated token in the Token Manager, limited to the apps and endpoints the task needs, and send it in the `countly-token` header, not the URL", "Set `COUNTLY_TOOLS_ALL=R` unless the task needs writes. The token's own permissions still apply and the stricter of the two wins", "Call `apps_list` first. Most tools need `app_id` or an exact `app_name`", "Check `get_version` for the detected edition before planning funnel, retention or cohort queries, which need Enterprise plugins", "Set `ENABLE_ANALYTICS=false` to stop MCP usage reports to stats.count.ly, and ask the server owner to check the tracking settings for server reports" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 38.8 } ], "editorialScores": { "ergonomics": 66, "maintenance": 80, "payments": 17, "reliability": 23, "schema": 75, "security": 62, "transparency": 73 }, "provenanceScore": 70, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y countly-mcp-server", "http": "curl -H \"countly-token: YOUR_TOKEN\" \"https://your-countly-url.com/o?app_id=APP_ID\u0026method=funneldata\u0026funnels=[%22FUNNEL_ID%22]\"", "claudeCode": "claude mcp add countly -e COUNTLY_SERVER_URL=https://your-countly-url.com -e COUNTLY_AUTH_TOKEN=YOUR_TOKEN -- npx -y --prefer-online countly-mcp-server@latest", "config": { "mcpServers": { "countly": { "args": [ "-y", "--prefer-online", "countly-mcp-server@latest" ], "command": "npx", "env": { "COUNTLY_AUTH_TOKEN": "YOUR_TOKEN", "COUNTLY_SERVER_URL": "https://your-countly-url.com" } } } } }, "letme": { "capability": "https://letme.dev/analytics.query", "tool": "https://letme.dev/countly" }, "area": "business", "unitPrices": [ { "item": "Flex, lowest tier", "unit": "month", "usd": 175, "note": "starting price, by monthly active users and data points, add-ons extra" } ], "provenance": { "legalEntity": "Countly Ltd", "domain": "countly.com", "domainRegistered": "2011-09-05", "endpointOnVendorDomain": true, "terms": "https://countly.com/legal/flex-terms", "privacy": "https://countly.com/legal/flex-privacy", "statusPage": "", "changelog": "https://github.com/Countly/countly-server/blob/master/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "Countly's legal pages were split on 20 October 2026 into website, Flex and Enterprise documents. The Flex terms (last updated 20 October 2026) name Countly Ltd, incorporated in England and Wales with registered number 8568329, registered at 1 Bow Churchyard, London EC4M 9DQ. The former terms URL now holds the Enterprise terms.", "The Flex privacy policy (last updated 20 October 2026) covers Flex accounts and the Flex console and excludes data customers process in their Flex servers, which the Flex DPA at countly.com/legal/flex-dpa covers.", "The hosted MCP server answers at mcp.count.ly and the API reference at api.count.ly, a second domain of the vendor's. Each customer's API answers on that customer's own server address.", "countly.com/.well-known/security.txt returns 404. SECURITY.md in the repositories gives a disclosure address at count.ly.", "No status page was found. status.countly.com did not resolve on 4 November 2026.", "RDAP for countly.com gave a registration date of 2011-09-05, per the 8 October check, not re-read on 4 November." ], "score": 70 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/countly.json", "live": { "slug": "countly", "probe": { "target": "https://mcp.count.ly/mcp", "method": "get", "lastAt": "2026-11-07T19:22:01.574281313Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 238, "samples30d": 7299, "days": [ { "date": "2026-10-09", "probes": 169, "ok": 0 }, { "date": "2026-10-10", "probes": 247, "ok": 0 }, { "date": "2026-10-11", "probes": 247, "ok": 0 }, { "date": "2026-10-12", "probes": 247, "ok": 0 }, { "date": "2026-10-13", "probes": 248, "ok": 0 }, { "date": "2026-10-14", "probes": 249, "ok": 0 }, { "date": "2026-10-15", "probes": 253, "ok": 0 }, { "date": "2026-10-16", "probes": 252, "ok": 0 }, { "date": "2026-10-17", "probes": 253, "ok": 0 }, { "date": "2026-10-18", "probes": 256, "ok": 0 }, { "date": "2026-10-19", "probes": 255, "ok": 0 }, { "date": "2026-10-20", "probes": 252, "ok": 0 }, { "date": "2026-10-21", "probes": 253, "ok": 0 }, { "date": "2026-10-22", "probes": 253, "ok": 0 }, { "date": "2026-10-23", "probes": 248, "ok": 0 }, { "date": "2026-10-24", "probes": 251, "ok": 0 }, { "date": "2026-10-25", "probes": 250, "ok": 0 }, { "date": "2026-10-26", "probes": 252, "ok": 0 }, { "date": "2026-10-27", "probes": 249, "ok": 0 }, { "date": "2026-10-28", "probes": 251, "ok": 0 }, { "date": "2026-10-29", "probes": 248, "ok": 0 }, { "date": "2026-10-30", "probes": 249, "ok": 0 }, { "date": "2026-10-31", "probes": 251, "ok": 0 }, { "date": "2026-11-01", "probes": 249, "ok": 0 }, { "date": "2026-11-02", "probes": 250, "ok": 0 }, { "date": "2026-11-03", "probes": 248, "ok": 0 }, { "date": "2026-11-04", "probes": 246, "ok": 0 }, { "date": "2026-11-05", "probes": 185, "ok": 0 }, { "date": "2026-11-06", "probes": 241, "ok": 0 }, { "date": "2026-11-07", "probes": 197, "ok": 0 } ], "outages": [ { "start": "2026-10-09T07:40:23.474688008Z", "end": "0001-01-01T00:00:00Z", "note": "HTTP 500 server error" } ] }, "versions": [ { "registry": "github", "name": "Countly/countly-server", "version": "25.03.58", "released": "2026-10-27", "seenAt": "2026-11-06T23:18:01.436887578Z" }, { "registry": "npm", "name": "countly-mcp-server", "version": "1.7.0", "seenAt": "2026-11-06T23:17:57.231778538Z" }, { "registry": "npm", "name": "countly-sdk-nodejs", "version": "26.8.0", "seenAt": "2026-11-06T23:17:59.854974474Z" }, { "registry": "npm", "name": "countly-sdk-web", "version": "26.8.1", "seenAt": "2026-11-06T23:17:57.446036177Z" } ], "githubStars": 5926, "npmWeekly": 98, "securityTxt": { "url": "https://countly.com/.well-known/security.txt", "state": "valid", "expires": "2027-11-01T00:00:00.000Z", "checkedAt": "2026-11-07T16:01:40.278221054Z" }, "llmsTxt": { "url": "https://countly.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:12.439042164Z" }, "domain": { "domain": "countly.com", "registered": "2011-09-05", "source": "https://rdap.verisign.com/com/v1/domain/countly.com", "checkedAt": "2026-11-01T14:23:11.366008393Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/Countly/countly-server/master/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:18:15.260633274Z", "changedAt": "2026-10-28T04:41:57.810807375Z", "fingerprint": "464bd4917794" }, { "url": "https://countly.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:02:07.279637492Z", "changedAt": "2026-11-07T14:02:07.279637492Z", "fingerprint": "25a1aa31c1a8" }, { "url": "https://countly.com/legal/flex-privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:02:03.050349438Z", "changedAt": "2026-11-07T14:02:03.050349438Z", "fingerprint": "67c45cb07861" }, { "url": "https://countly.com/legal/privacy-policy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-04T08:17:18.582896946Z", "changedAt": "2026-10-30T05:33:48.300790761Z", "fingerprint": "524fd19db10d" }, { "url": "https://countly.com/legal/flex-terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:02:05.263811859Z", "changedAt": "2026-11-07T14:02:05.263811859Z", "fingerprint": "e6833f089a23" }, { "url": "https://countly.com/legal/terms-of-service", "kind": "terms", "status": 304, "checkedAt": "2026-11-04T08:17:20.792676441Z", "changedAt": "2026-10-30T05:33:50.469505336Z", "fingerprint": "917431844060" } ], "github": { "repo": "countly/countly-server", "checkedAt": "2026-11-02T08:41:46.317370507Z", "stars": 5926, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T20:04:22Z", "openIssues": 1, "openPRs": 9, "issuesOpened90d": 1, "issuesClosed90d": 8, "prsMerged90d": 281, "ci": { "branch": "master", "runs": 50, "success": 25, "failure": 25, "other": 0, "latest": "success", "latestAt": "2026-11-01T19:21:22Z" }, "advisories": [ { "ghsa": "GHSA-gx33-qqr5-376j", "severity": "medium", "published": "2026-10-26T18:20:22Z" }, { "ghsa": "GHSA-p78q-3v9r-c8qg", "severity": "high", "published": "2026-10-26T18:19:48Z" }, { "ghsa": "GHSA-fqgp-6rm9-8696", "cve": "CVE-2026-41582", "severity": "high", "published": "2026-07-15T12:52:34Z" }, { "ghsa": "GHSA-86cv-qwp9-jwp3", "cve": "CVE-2026-42270", "severity": "high", "published": "2026-07-15T12:49:59Z" }, { "ghsa": "GHSA-5pmc-54j6-jcgq", "cve": "CVE-2026-42269", "severity": "high", "published": "2026-07-15T12:49:06Z" }, { "ghsa": "GHSA-jqp4-p86c-phxc", "cve": "CVE-2026-44977", "severity": "high", "published": "2026-07-15T12:48:11Z" }, { "ghsa": "GHSA-98vh-wqw5-p23v", "cve": "CVE-2022-29174", "severity": "high", "published": "2022-05-17T17:17:14Z" } ], "replies": { "sampled": 25, "unanswered": 0, "medianDays": 67 } }, "updatedAt": "2026-11-07T19:22:01.574281313Z" } }, "answer": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Countly's 38.8 (E), and leads in 4 of 7 scored categories. Countly leads on transparency \u0026 trust.", "b": { "slug": "harness-fme", "name": "Harness Feature Management \u0026 Experimentation", "vendor": "Harness Inc.", "vendorUrl": "https://www.harness.io", "kind": "http-api", "category": "product-analytics", "summary": "Harness Feature Management \u0026 Experimentation (FME), formerly Split, manages feature flags, targeting, metrics and experiments. Agents reach it through the Admin API at api.split.io and the FME toolset of the Harness MCP server.", "url": "https://www.anchorterminal.com/tools/harness-fme", "markdownUrl": "https://www.anchorterminal.com/tools/harness-fme.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/harness-fme.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/harness-fme.json", "dns": "harness-fme.grade.anchorterminal.com", "repo": "https://github.com/harness/mcp-server", "transports": [ "http", "stdio", "streamable-http" ], "remoteUrl": "https://mcp.harness.io/mcp", "packages": [ { "registry": "npm", "name": "harness-mcp-v2" } ], "auth": "mixed", "authNotes": "The Admin API takes an Admin API key as a Bearer token, or a Harness personal access token (PAT) or service account token (SAT) in `x-api-key`. Admin keys carry fixed roles that can be combined and cannot be edited after creation, and a key cannot create another with more roles. The local MCP server reads HARNESS_API_KEY. The hosted MCP endpoint uses Harness Platform OAuth and must be enabled per account by Harness Support.", "pricing": "freemium", "pricingNotes": "An FME Free Plan is enabled from inside a Harness account; its limits are not published. The Enterprise plan and FME pricing are by quotation through sales. No FME prices appear on harness.io/pricing.", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the FME docs, the Split API reference or harness.io/pricing (checked 2026-11-06).", "endpoints": [] }, "toolCount": 11, "popularity": { "githubStars": null, "npmWeekly": 8800, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://developer.harness.io/feature-management-experimentation/feature-management-and-experimentation-documentation", "llmsTxt": "https://developer.harness.io/llms.txt", "capabilities": [ "analytics.flags", "analytics.experiments", "analytics.events" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "llms-txt", "free-tier", "sales-led", "status-page", "soc2", "iso27001", "typescript", "python", "cli", "closed-source" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 69.2, "grade": "B", "agentReady": false, "rank": 258, "ranked": true, "rankOf": 1510, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 81, "payments": 15, "reliability": 80, "schema": 71, "security": 79, "transparency": 61 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Harness FME, formerly Split, gives agents 11 consolidated MCP tools with an FME-only toolset, a read-only switch and confirmation on writes, over an Admin API with documented limits and role-scoped keys. FME prices are not published, the free plan's limits are unstated, and the hosted MCP endpoint must be enabled by Harness Support.", "bestFor": "Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails.", "strengths": [ "11 generic MCP tools with `--toolsets=fme`, readOnlyHint on reads and elicitation before writes", "HARNESS_READ_ONLY blocks every create, update, delete and execute call", "Admin API keys with fixed, combinable roles, plus Harness PATs and SATs", "Documented rate limit with remaining and reset headers, and automatic backoff in the MCP server", "SOC 2 Type II, ISO 27001 and FedRAMP 20x, with FME audit logs and MCP audit sinks" ], "weaknesses": [ "No FME prices are published; Enterprise is by quotation and free plan limits are unstated", "The hosted MCP endpoint must be enabled per account by Harness Support", "The FME MCP docs page still describes building a Go binary, unlike the current npm package", "About 20 Admin API requests per 10 seconds per organisation, which large lists can hit", "No public OpenAPI file for the Admin API was found" ], "agentNotes": [ "Start the MCP server with `--toolsets=fme` so only FME resource types load", "Call `harness_describe(resource_type='fme_feature_flag')` before a create or update to see the fields", "Filter fme_feature_flag lists by name, tags or rollout status rather than listing every flag", "Set HARNESS_READ_ONLY for analysis tasks; leave confirmation on for kill, restore and delete", "On 429, wait at least the larger X-RateLimit-Reset-Seconds value before retrying" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.2 } ], "editorialScores": { "ergonomics": 83, "maintenance": 81, "payments": 15, "reliability": 80, "schema": 71, "security": 79, "transparency": 60 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx harness-mcp-v2@latest", "config": { "mcpServers": { "harness": { "args": [ "harness-mcp-v2@latest", "--toolsets=fme" ], "command": "npx", "env": { "HARNESS_API_KEY": "pat.xxx" } } } } }, "letme": { "capability": "https://letme.dev/analytics.flags", "tool": "https://letme.dev/harness-fme" }, "area": "business", "provenance": { "legalEntity": "Harness Inc.", "domain": "harness.io", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://www.harness.io/legal/subscription-terms", "privacy": "https://www.harness.io/legal/privacy", "statusPage": "https://status.harness.io", "changelog": "https://github.com/harness/mcp-server/releases", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The Admin API is on api.split.io, the former Split domain, and the hosted MCP endpoint on mcp.harness.io.", "The privacy statement names Harness Inc. as controller and Harness France SAS as EU representative. Its header says last updated 23 October 2026 and its body says version of 14 October 2026.", "developer.harness.io/robots.txt allows all and carries Content-Signal ai-train=yes, search=yes, ai-input=yes. docs.split.io allows all but edit and login paths.", "www.harness.io/.well-known/security.txt answered with an invalid-request page. The security page gives security@harness.io and a private bug bounty on request.", "RDAP gave no registration date for harness.io." ], "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/harness-fme.json", "live": { "slug": "harness-fme", "probe": { "target": "https://mcp.harness.io/mcp", "method": "get", "lastAt": "2026-11-07T19:22:10.85947707Z", "lastOk": true, "lastStatus": 401, "lastMs": 308, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 195, "p95ms24h": 285, "samples24h": 210, "samples30d": 210, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "vendorStatus": { "page": "https://status.harness.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T19:22:14.403533029Z" }, "versions": [ { "registry": "github", "name": "harness/mcp-server", "version": "v3.2.40", "released": "2026-11-05", "seenAt": "2026-11-06T23:32:13.419387707Z" }, { "registry": "npm", "name": "harness-mcp-v2", "version": "3.2.40", "seenAt": "2026-11-06T23:32:12.430886041Z" } ], "githubStars": 112, "npmWeekly": 8800, "securityTxt": { "url": "https://harness.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:19.957252225Z" }, "llmsTxt": { "url": "https://developer.harness.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:41.749004752Z" }, "pages": [ { "url": "https://www.harness.io/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:29:30.551687912Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b15935b42065" }, { "url": "https://www.harness.io/legal/subscription-terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:29:35.70684084Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "871b29e12dd4" } ], "updatedAt": "2026-11-07T19:22:10.85947707Z" } }, "edges": [ { "by": 57, "category": "reliability", "leads": "harness-fme", "name": "Reliability", "reasons": { "a": "Graded on the hosted lines, for a Countly Flex server reached through its HTTP API and the official MCP server. No status page was found on countly.com, the Flex page, the docs or the legal pages, and status.countly.com did not resolve on 4 November (0). With no page there is no readable incident history (5). The MCP server's HTTP endpoint is limited to 120 requests a minute per IP, but the Countly server's own `api_rate_limit_requests` setting ships at 0 (off), and the Flex terms of 20 October 2026 reserve usage limits without numbers (8 of 15, the earlier partial kept). No 429 or retry guidance and no idempotency keys were found in the API reference source (0). The pricing page lists an SLA as optional on Flex and included in Enterprise, with no SLA document published, which this run scores 0 (0). The API and MCP server 1.7.0 are generally available (10).", "b": "Graded on the hosted FME Admin API with the hosted lines. Statuspage at status.harness.io with an FME component among 196 (20). In the 90 days from 8 August, two FME incidents: API write operations returned 499 errors for 30 minutes on 20 August (minor) and the FME user interface was unavailable for 15 minutes on 23 August (major, interface only; flag evaluation was unaffected per the post). No API outage of an hour or more (20 of 30). About 20 Admin API requests per 10 seconds per organisation and per IP, documented on the MCP page (15). 429 responses carry remaining and reset headers with guidance to wait for the larger reset, and the MCP server backs off and retries three times (15). No SLA was found on harness.io/pricing or the FME docs (0). FME is generally available and the MCP server is at 3.2.40 (10). 20+20+15+15+0+10 = 80." }, "scores": { "a": 23, "b": 80 } }, { "by": 17, "category": "ergonomics", "leads": "harness-fme", "name": "Agent ergonomics", "reasons": { "a": "The MCP README counts 209 tools in 43 categories, far past 30 (5). Add back 8 because the server hides tools the edition, enabled plugins or user's permissions cannot run, and `COUNTLY_TOOLS_*` settings switch categories off (13). List endpoints take `iDisplayStart` and `iDisplayLength`, and MCP list tools take `skip`, `limit` and `search` (15). API errors are `{\"result\": \"message\"}` strings with HTTP status codes and no error codes. The MCP server returns failures as `isError` results that name the missing plugin or permission (12). MCP tools carry readOnlyHint, destructiveHint and idempotentHint since 1.7.0. No idempotency keys on API writes (14). MCP tools accept `app_name` in place of `app_id` and set defaults. The SDKs cover data collection, not the read API (12).", "b": "11 consolidated tools, and `--toolsets=fme` narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83." }, "scores": { "a": 66, "b": 83 } }, { "by": 17, "category": "security", "leads": "harness-fme", "name": "Security \u0026 auth", "reasons": { "a": "Auth tokens are scoped to apps and endpoint patterns, expire after a set lifetime, are revocable and carry create, read, update and delete permissions since 25.03.54. The dashboard `api_key` has its user's full access (26 of 30). Less 10 because `api_key` and `auth_token` are documented as query-string parameters, with the `countly-token` header as the recommended alternative (16). MCP read-only mode and per-category CRUD levels, bounded by the token's permissions. No confirmation step for destructive tools (16). Tools return event names, user properties and crash data written by end users, and no prompt-injection guidance was found (3). A system logs API records dashboard actions (12, kept; the 8 October count of log types came from the help centre's JSON API and is struck). No security.txt. SECURITY.md gives security@count.ly as the reporting route with no acknowledgement time and a bounty whose rewards are at Countly's discretion, which this run doesn't count as a bounty. Countly publishes advisories for countly-server on GitHub, and the site claims ISO 27001, 27017, 27018 and SOC 2 Type II without public reports. 15, as daytona has for a disclosure route and certifications with a discretionary reward.", "b": "Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79." }, "scores": { "a": 62, "b": 79 } }, { "by": 11, "category": "transparency", "leads": "countly", "name": "Transparency \u0026 trust", "reasons": { "a": "Countly Lite is AGPL-3.0 with added branding terms under Section 7, the MCP server is MIT, and the Enterprise plugins that hold funnels, retention, cohorts and Drill are closed (20 of 30). Flex now has its own terms, privacy policy, DPA and sub-processor list, all dated 20 October 2026. The Flex privacy policy excludes data customers process and gives no retention periods, and the DPA covers that data (20). The MCP changelog deprecated auth tokens in URL parameters on 23 April 2026 (1.3.0), and the server warns on their use, with no notice period (15, the settled value for dated notices without a period). The Flex sub-processor list names locations, with 30 days' notice of changes in the DPA, and Flex customers choose a Google Cloud region. A Connected Services and Telemetry notice (20 October 2026) says server reports to stats.count.ly are on by default and which settings turn them off, and MCP usage reporting is disclosed with an opt-out (18).", "b": "A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60." }, "scores": { "a": 72, "b": 61 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Countly Ltd", "b": "Harness Inc.", "name": "Vendor" }, { "a": "https://mcp.count.ly/mcp", "b": "https://mcp.harness.io/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, stdio, Streamable HTTP", "b": "HTTP, stdio, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT", "b": "none", "name": "Licence" }, { "a": "209", "b": "11", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-27", "b": "2026-11-04", "name": "Last release" }, { "a": "not read yet", "b": "no date given", "name": "Terms last updated" }, { "a": "not read yet", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "28k npm/wk", "b": "8.8k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Countly's 38.8 (E), and leads in 4 of 7 scored categories. Countly leads on transparency \u0026 trust.", "question": "Which is better for AI agents, Countly or Harness Feature Management \u0026 Experimentation?" }, { "answer": "Countly needs an API key. Harness Feature Management \u0026 Experimentation takes an API key or an OAuth sign-in.", "question": "Do Countly and Harness Feature Management \u0026 Experimentation need an API key?" }, { "answer": "Yes. Countly has a hosted endpoint at https://mcp.count.ly/mcp and Harness Feature Management \u0026 Experimentation at https://mcp.harness.io/mcp.", "question": "Can an agent call Countly and Harness Feature Management \u0026 Experimentation without installing anything?" }, { "answer": "Countly is open source (Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT). No open-source release is listed for Harness Feature Management \u0026 Experimentation.", "question": "Are Countly and Harness Feature Management \u0026 Experimentation open source?" } ], "goodFor": [ { "aheadOn": [ "Transparency \u0026 trust, 72 against 61" ], "also": [ "Open source" ], "goodFor": "An agent whose owner runs Countly on its own infrastructure or a dedicated Flex server and wants analytics, crash and remote-config data through MCP with per-category permissions.", "slug": "countly", "watchFor": "No public status page or incident history was found for Flex servers or for mcp.count.ly" }, { "aheadOn": [ "Reliability, 80 against 23", "Agent ergonomics, 83 against 66", "Security \u0026 auth, 79 against 62" ], "also": [ "No incidents deducted, where Countly loses 15 points for them" ], "goodFor": "Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails.", "slug": "harness-fme", "watchFor": "No FME prices are published; Enterprise is by quotation and free plan limits are unstated" } ], "history": { "countly": [ { "causes": [ "security", "correction" ], "date": "2026-11-04", "delta": -16.1, "from": 54.9, "fromGrade": "C", "to": 38.8, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 54.8, "fromGrade": "C", "to": 54.9, "toGrade": "C" } ], "harness-fme": null }, "job": { "capability": "analytics.flags", "name": "Feature flags" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amplitude-vs-countly.json", "title": "Amplitude vs Countly", "url": "https://www.anchorterminal.com/compare/amplitude-vs-countly" }, { "json": "https://www.anchorterminal.com/compare/basedash-mcp-vs-countly.json", "title": "Basedash MCP vs Countly", "url": "https://www.anchorterminal.com/compare/basedash-mcp-vs-countly" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-fullstory.json", "title": "Countly vs Fullstory", "url": "https://www.anchorterminal.com/compare/countly-vs-fullstory" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-growthbook.json", "title": "Countly vs GrowthBook", "url": "https://www.anchorterminal.com/compare/countly-vs-growthbook" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-matomo.json", "title": "Countly vs Matomo", "url": "https://www.anchorterminal.com/compare/countly-vs-matomo" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-mixpanel.json", "title": "Countly vs Mixpanel", "url": "https://www.anchorterminal.com/compare/countly-vs-mixpanel" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics.json", "title": "Countly vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-openpanel.json", "title": "Countly vs OpenPanel", "url": "https://www.anchorterminal.com/compare/countly-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-optimizely.json", "title": "Countly vs Optimizely Experimentation", "url": "https://www.anchorterminal.com/compare/countly-vs-optimizely" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-pendo.json", "title": "Countly vs Pendo", "url": "https://www.anchorterminal.com/compare/countly-vs-pendo" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-posthog.json", "title": "Countly vs PostHog", "url": "https://www.anchorterminal.com/compare/countly-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-rudderstack-mcp.json", "title": "Countly vs RudderStack MCP", "url": "https://www.anchorterminal.com/compare/countly-vs-rudderstack-mcp" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-statsig.json", "title": "Countly vs Statsig", "url": "https://www.anchorterminal.com/compare/countly-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-userpilot.json", "title": "Countly vs Userpilot", "url": "https://www.anchorterminal.com/compare/countly-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-woopra.json", "title": "Countly vs Woopra", "url": "https://www.anchorterminal.com/compare/countly-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-heap.json", "title": "Countly vs Heap", "url": "https://www.anchorterminal.com/compare/countly-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-harness-fme.json", "title": "Fullstory vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/fullstory-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-heap.json", "title": "Harness Feature Management \u0026 Experimentation vs Heap", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-openpanel.json", "title": "Harness Feature Management \u0026 Experimentation vs OpenPanel", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-rudderstack-mcp.json", "title": "Harness Feature Management \u0026 Experimentation vs RudderStack MCP", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-rudderstack-mcp" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-woopra.json", "title": "Harness Feature Management \u0026 Experimentation vs Woopra", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/amplitude-vs-harness-fme.json", "title": "Amplitude vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/amplitude-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-flagsmith.json", "title": "Countly vs Flagsmith", "url": "https://www.anchorterminal.com/compare/countly-vs-flagsmith" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-launchdarkly.json", "title": "Countly vs LaunchDarkly", "url": "https://www.anchorterminal.com/compare/countly-vs-launchdarkly" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.json", "title": "Flagsmith vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-launchdarkly.json", "title": "Harness Feature Management \u0026 Experimentation vs LaunchDarkly", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-launchdarkly" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-mixpanel.json", "title": "Harness Feature Management \u0026 Experimentation vs Mixpanel", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-mixpanel" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-optimizely.json", "title": "Harness Feature Management \u0026 Experimentation vs Optimizely Experimentation", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-optimizely" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-posthog.json", "title": "Harness Feature Management \u0026 Experimentation vs PostHog", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-statsig.json", "title": "Harness Feature Management \u0026 Experimentation vs Statsig", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-harness-fme.json", "title": "GrowthBook vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/growthbook-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-matomo.json", "title": "Harness Feature Management \u0026 Experimentation vs Matomo", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-matomo" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics.json", "title": "Harness Feature Management \u0026 Experimentation vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics" } ], "panel": null, "scores": [ { "by": 57, "countly": 23, "edge": "harness-fme", "harness-fme": 80, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 4, "countly": 75, "edge": "countly", "harness-fme": 71, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 17, "countly": 66, "edge": "harness-fme", "harness-fme": 83, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 17, "countly": 62, "edge": "harness-fme", "harness-fme": 79, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 2, "countly": 17, "edge": "countly", "harness-fme": 15, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 1, "countly": 80, "edge": "harness-fme", "harness-fme": 81, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 11, "countly": 72, "edge": "countly", "harness-fme": 61, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Countly's 38.8 (E), and leads in 4 of 7 scored categories. Countly leads on transparency \u0026 trust. Both do feature flags.", "tasks": null, "tutorials": [], "verdicts": { "countly": "Countly suits an agent working against a server its owner already runs. The official MCP server filters its 209 tools by edition, plugin and permission and has per-category read-only settings. Five countly-server CVEs were published since September, all fixed, and no status page, OpenAPI document or published API rate limit was found.", "harness-fme": "Harness FME, formerly Split, gives agents 11 consolidated MCP tools with an FME-only toolset, a read-only switch and confirmation on writes, over an Admin API with documented limits and role-scoped keys. FME prices are not published, the free plan's limits are unstated, and the hosted MCP endpoint must be enabled by Harness Support." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/countly-vs-harness-fme", "json": "https://www.anchorterminal.com/compare/countly-vs-harness-fme.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/countly-vs-harness-fme.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/countly-vs-harness-fme.min.md" }, "markdown": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Countly's 38.8 (E), and leads in 4 of 7 scored categories. Countly leads on transparency \u0026 trust. Both do feature flags.\n\n- Countly: grade E, 38.8/100, rank #1352 of 1510. Markdown https://www.anchorterminal.com/tools/countly.md · JSON https://www.anchorterminal.com/api/v1/tools/countly.json\n- Harness Feature Management \u0026 Experimentation: grade B, 69.2/100, rank #258 of 1510. Markdown https://www.anchorterminal.com/tools/harness-fme.md · JSON https://www.anchorterminal.com/api/v1/tools/harness-fme.json\n- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md\n- All 170 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md\n\n## Which one, for what\n\n### Countly (E)\n\nGood for: An agent whose owner runs Countly on its own infrastructure or a dedicated Flex server and wants analytics, crash and remote-config data through MCP with per-category permissions.\n\nAhead on:\n- Transparency \u0026 trust, 72 against 61\n\nAlso in its favour:\n- Open source\n\nWatch for: No public status page or incident history was found for Flex servers or for mcp.count.ly\n\n### Harness Feature Management \u0026 Experimentation (B)\n\nGood for: Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails.\n\nAhead on:\n- Reliability, 80 against 23\n- Agent ergonomics, 83 against 66\n- Security \u0026 auth, 79 against 62\n\nAlso in its favour:\n- No incidents deducted, where Countly loses 15 points for them\n\nWatch for: No FME prices are published; Enterprise is by quotation and free plan limits are unstated\n\n\n## Why the edge\n\n### Reliability: Harness Feature Management \u0026 Experimentation +57\n\n- Countly (23): Graded on the hosted lines, for a Countly Flex server reached through its HTTP API and the official MCP server. No status page was found on countly.com, the Flex page, the docs or the legal pages, and status.countly.com did not resolve on 4 November (0). With no page there is no readable incident history (5). The MCP server's HTTP endpoint is limited to 120 requests a minute per IP, but the Countly server's own `api_rate_limit_requests` setting ships at 0 (off), and the Flex terms of 20 October 2026 reserve usage limits without numbers (8 of 15, the earlier partial kept). No 429 or retry guidance and no idempotency keys were found in the API reference source (0). The pricing page lists an SLA as optional on Flex and included in Enterprise, with no SLA document published, which this run scores 0 (0). The API and MCP server 1.7.0 are generally available (10).\n- Harness Feature Management \u0026 Experimentation (80): Graded on the hosted FME Admin API with the hosted lines. Statuspage at status.harness.io with an FME component among 196 (20). In the 90 days from 8 August, two FME incidents: API write operations returned 499 errors for 30 minutes on 20 August (minor) and the FME user interface was unavailable for 15 minutes on 23 August (major, interface only; flag evaluation was unaffected per the post). No API outage of an hour or more (20 of 30). About 20 Admin API requests per 10 seconds per organisation and per IP, documented on the MCP page (15). 429 responses carry remaining and reset headers with guidance to wait for the larger reset, and the MCP server backs off and retries three times (15). No SLA was found on harness.io/pricing or the FME docs (0). FME is generally available and the MCP server is at 3.2.40 (10). 20+20+15+15+0+10 = 80.\n\n### Agent ergonomics: Harness Feature Management \u0026 Experimentation +17\n\n- Countly (66): The MCP README counts 209 tools in 43 categories, far past 30 (5). Add back 8 because the server hides tools the edition, enabled plugins or user's permissions cannot run, and `COUNTLY_TOOLS_*` settings switch categories off (13). List endpoints take `iDisplayStart` and `iDisplayLength`, and MCP list tools take `skip`, `limit` and `search` (15). API errors are `{\"result\": \"message\"}` strings with HTTP status codes and no error codes. The MCP server returns failures as `isError` results that name the missing plugin or permission (12). MCP tools carry readOnlyHint, destructiveHint and idempotentHint since 1.7.0. No idempotency keys on API writes (14). MCP tools accept `app_name` in place of `app_id` and set defaults. The SDKs cover data collection, not the read API (12).\n- Harness Feature Management \u0026 Experimentation (83): 11 consolidated tools, and `--toolsets=fme` narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.\n\n### Security \u0026 auth: Harness Feature Management \u0026 Experimentation +17\n\n- Countly (62): Auth tokens are scoped to apps and endpoint patterns, expire after a set lifetime, are revocable and carry create, read, update and delete permissions since 25.03.54. The dashboard `api_key` has its user's full access (26 of 30). Less 10 because `api_key` and `auth_token` are documented as query-string parameters, with the `countly-token` header as the recommended alternative (16). MCP read-only mode and per-category CRUD levels, bounded by the token's permissions. No confirmation step for destructive tools (16). Tools return event names, user properties and crash data written by end users, and no prompt-injection guidance was found (3). A system logs API records dashboard actions (12, kept; the 8 October count of log types came from the help centre's JSON API and is struck). No security.txt. SECURITY.md gives security@count.ly as the reporting route with no acknowledgement time and a bounty whose rewards are at Countly's discretion, which this run doesn't count as a bounty. Countly publishes advisories for countly-server on GitHub, and the site claims ISO 27001, 27017, 27018 and SOC 2 Type II without public reports. 15, as daytona has for a disclosure route and certifications with a discretionary reward.\n- Harness Feature Management \u0026 Experimentation (79): Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.\n\n### Transparency \u0026 trust: Countly +11\n\n- Countly (72): Countly Lite is AGPL-3.0 with added branding terms under Section 7, the MCP server is MIT, and the Enterprise plugins that hold funnels, retention, cohorts and Drill are closed (20 of 30). Flex now has its own terms, privacy policy, DPA and sub-processor list, all dated 20 October 2026. The Flex privacy policy excludes data customers process and gives no retention periods, and the DPA covers that data (20). The MCP changelog deprecated auth tokens in URL parameters on 23 April 2026 (1.3.0), and the server warns on their use, with no notice period (15, the settled value for dated notices without a period). The Flex sub-processor list names locations, with 30 days' notice of changes in the DPA, and Flex customers choose a Google Cloud region. A Connected Services and Telemetry notice (20 October 2026) says server reports to stats.count.ly are on by default and which settings turn them off, and MCP usage reporting is disclosed with an opt-out (18).\n- Harness Feature Management \u0026 Experimentation (61): A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60.\n\n## Score by category\n\n| Category | Weight | Countly | Harness Feature Management \u0026 Experimentation | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 23 | 80 | Harness Feature Management \u0026 Experimentation +57 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 75 | 71 | Countly +4 |\n| Agent ergonomics | 13% (16.2 this run) | 66 | 83 | Harness Feature Management \u0026 Experimentation +17 |\n| Security \u0026 auth | 14% (17.5 this run) | 62 | 79 | Harness Feature Management \u0026 Experimentation +17 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 17 | 15 | Countly +2 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 80 | 81 | Harness Feature Management \u0026 Experimentation +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 61 | Countly +11 |\n| Negative events | ≤15 | -15 | 0 | |\n| **Total** | | **38.8 · E** | **69.2 · B** | |\n\n## Facts side by side\n\n| Fact | Countly | Harness Feature Management \u0026 Experimentation |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Countly Ltd | Harness Inc. |\n| Hosted endpoint | `https://mcp.count.ly/mcp` | `https://mcp.harness.io/mcp` |\n| Transports | HTTP, stdio, Streamable HTTP | HTTP, stdio, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT | none |\n| Tools exposed | 209 | 11 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-27 | 2026-11-04 |\n| Terms last updated | not read yet | no date given |\n| Privacy policy last updated | not read yet | no date given |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | 28k npm/wk | 8.8k npm/wk |\n\n## How the scores have moved\n\n### Countly\n\n- -16.1 on 4 November 2026 (C to E): security, correction\n- +0.1 on 27 October 2026: checklist\n\n### Harness Feature Management \u0026 Experimentation\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Countly.** Countly suits an agent working against a server its owner already runs. The official MCP server filters its 209 tools by edition, plugin and permission and has per-category read-only settings. Five countly-server CVEs were published since September, all fixed, and no status page, OpenAPI document or published API rate limit was found.\n\n**Harness Feature Management \u0026 Experimentation.** Harness FME, formerly Split, gives agents 11 consolidated MCP tools with an FME-only toolset, a read-only switch and confirmation on writes, over an Admin API with documented limits and role-scoped keys. FME prices are not published, the free plan's limits are unstated, and the hosted MCP endpoint must be enabled by Harness Support.\n\n## Before you call either\n\n### Countly\n\n1. Create a dedicated token in the Token Manager, limited to the apps and endpoints the task needs, and send it in the `countly-token` header, not the URL\n2. Set `COUNTLY_TOOLS_ALL=R` unless the task needs writes. The token's own permissions still apply and the stricter of the two wins\n3. Call `apps_list` first. Most tools need `app_id` or an exact `app_name`\n4. Check `get_version` for the detected edition before planning funnel, retention or cohort queries, which need Enterprise plugins\n5. Set `ENABLE_ANALYTICS=false` to stop MCP usage reports to stats.count.ly, and ask the server owner to check the tracking settings for server reports\n\n### Harness Feature Management \u0026 Experimentation\n\n1. Start the MCP server with `--toolsets=fme` so only FME resource types load\n2. Call `harness_describe(resource_type='fme_feature_flag')` before a create or update to see the fields\n3. Filter fme_feature_flag lists by name, tags or rollout status rather than listing every flag\n4. Set HARNESS_READ_ONLY for analysis tasks; leave confirmation on for kill, restore and delete\n5. On 429, wait at least the larger X-RateLimit-Reset-Seconds value before retrying\n\n## Questions\n\n### Which is better for AI agents, Countly or Harness Feature Management \u0026 Experimentation?\n\nHarness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Countly's 38.8 (E), and leads in 4 of 7 scored categories. Countly leads on transparency \u0026 trust.\n\n### Do Countly and Harness Feature Management \u0026 Experimentation need an API key?\n\nCountly needs an API key. Harness Feature Management \u0026 Experimentation takes an API key or an OAuth sign-in.\n\n### Can an agent call Countly and Harness Feature Management \u0026 Experimentation without installing anything?\n\nYes. Countly has a hosted endpoint at https://mcp.count.ly/mcp and Harness Feature Management \u0026 Experimentation at https://mcp.harness.io/mcp.\n\n### Are Countly and Harness Feature Management \u0026 Experimentation open source?\n\nCountly is open source (Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT). No open-source release is listed for Harness Feature Management \u0026 Experimentation.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/countly-vs-harness-fme.json, and with the fewest tokens: https://www.anchorterminal.com/compare/countly-vs-harness-fme.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"countly\", \"b\": \"harness-fme\"}`. From a terminal: `anchor compare countly harness-fme`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/countly.json and https://www.anchorterminal.com/api/v1/tools/harness-fme.json\n\n## Other comparisons with Countly or Harness Feature Management \u0026 Experimentation\n\n- [Amplitude vs Countly](https://www.anchorterminal.com/compare/amplitude-vs-countly.md)\n- [Basedash MCP vs Countly](https://www.anchorterminal.com/compare/basedash-mcp-vs-countly.md)\n- [Countly vs Fullstory](https://www.anchorterminal.com/compare/countly-vs-fullstory.md)\n- [Countly vs GrowthBook](https://www.anchorterminal.com/compare/countly-vs-growthbook.md)\n- [Countly vs Matomo](https://www.anchorterminal.com/compare/countly-vs-matomo.md)\n- [Countly vs Mixpanel](https://www.anchorterminal.com/compare/countly-vs-mixpanel.md)\n- [Countly vs Mostly Good Metrics](https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics.md)\n- [Countly vs OpenPanel](https://www.anchorterminal.com/compare/countly-vs-openpanel.md)\n- [Countly vs Optimizely Experimentation](https://www.anchorterminal.com/compare/countly-vs-optimizely.md)\n- [Countly vs Pendo](https://www.anchorterminal.com/compare/countly-vs-pendo.md)\n- [Countly vs PostHog](https://www.anchorterminal.com/compare/countly-vs-posthog.md)\n- [Countly vs RudderStack MCP](https://www.anchorterminal.com/compare/countly-vs-rudderstack-mcp.md)\n- [Countly vs Statsig](https://www.anchorterminal.com/compare/countly-vs-statsig.md)\n- [Countly vs Userpilot](https://www.anchorterminal.com/compare/countly-vs-userpilot.md)\n- [Countly vs Woopra](https://www.anchorterminal.com/compare/countly-vs-woopra.md)\n- [Countly vs Heap](https://www.anchorterminal.com/compare/countly-vs-heap.md)\n- [Fullstory vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/fullstory-vs-harness-fme.md)\n- [Harness Feature Management \u0026 Experimentation vs Heap](https://www.anchorterminal.com/compare/harness-fme-vs-heap.md)\n- [Harness Feature Management \u0026 Experimentation vs OpenPanel](https://www.anchorterminal.com/compare/harness-fme-vs-openpanel.md)\n- [Harness Feature Management \u0026 Experimentation vs RudderStack MCP](https://www.anchorterminal.com/compare/harness-fme-vs-rudderstack-mcp.md)\n- [Harness Feature Management \u0026 Experimentation vs Woopra](https://www.anchorterminal.com/compare/harness-fme-vs-woopra.md)\n- [Amplitude vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/amplitude-vs-harness-fme.md)\n- [Countly vs Flagsmith](https://www.anchorterminal.com/compare/countly-vs-flagsmith.md)\n- [Countly vs LaunchDarkly](https://www.anchorterminal.com/compare/countly-vs-launchdarkly.md)\n- [Flagsmith vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.md)\n- [Harness Feature Management \u0026 Experimentation vs LaunchDarkly](https://www.anchorterminal.com/compare/harness-fme-vs-launchdarkly.md)\n- [Harness Feature Management \u0026 Experimentation vs Mixpanel](https://www.anchorterminal.com/compare/harness-fme-vs-mixpanel.md)\n- [Harness Feature Management \u0026 Experimentation vs Optimizely Experimentation](https://www.anchorterminal.com/compare/harness-fme-vs-optimizely.md)\n- [Harness Feature Management \u0026 Experimentation vs PostHog](https://www.anchorterminal.com/compare/harness-fme-vs-posthog.md)\n- [Harness Feature Management \u0026 Experimentation vs Statsig](https://www.anchorterminal.com/compare/harness-fme-vs-statsig.md)\n- [GrowthBook vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/growthbook-vs-harness-fme.md)\n- [Harness Feature Management \u0026 Experimentation vs Matomo](https://www.anchorterminal.com/compare/harness-fme-vs-matomo.md)\n- [Harness Feature Management \u0026 Experimentation vs Mostly Good Metrics](https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Countly vs Harness Feature Management \u0026 Experimentation", "url": "" } ], "description": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) to Countly's 38.8 (E) for feature flags. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Countly E 38.8", "Harness Feature Management \u0026 Experimentation B 69.2", "scores" ], "h1": "Countly vs Harness Feature Management \u0026 Experimentation", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/countly-vs-harness-fme", "published": "2026-10-01", "section": "tools", "title": "Countly vs Harness Feature Management \u0026 Experimentation (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/countly-vs-harness-fme" }, "tokens": { "markdown": 4900, "slim": 2580 }, "version": 1 }