{ "data": { "a": { "slug": "countly", "name": "Countly", "vendor": "Countly Ltd", "vendorUrl": "https://countly.com", "kind": "http-api", "category": "product-analytics", "summary": "Countly is a product analytics platform sold as a managed private-cloud server (Flex), a self-hosted Enterprise edition and the open-source Countly Lite. Agents reach a Countly server through its HTTP API or the official `countly-mcp-server`.", "url": "https://www.anchorterminal.com/tools/countly", "markdownUrl": "https://www.anchorterminal.com/tools/countly.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/countly.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/countly.json", "dns": "countly.grade.anchorterminal.com", "repo": "https://github.com/Countly/countly-server", "license": "Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT", "transports": [ "http", "stdio", "streamable-http" ], "remoteUrl": "https://mcp.count.ly/mcp", "packages": [ { "registry": "npm", "name": "countly-mcp-server" }, { "registry": "npm", "name": "countly-sdk-web" }, { "registry": "npm", "name": "countly-sdk-nodejs" } ], "auth": "api-key", "authNotes": "Self-serve once a server exists. A dashboard user copies an `api_key`, which has that user's full read and write access, or creates an auth token in the Token Manager or with `/i/token/create`, limited by app, endpoint pattern and lifetime. Tokens go in the `countly-token` header or the `auth_token` query parameter. The MCP server takes `COUNTLY_SERVER_URL` and `COUNTLY_AUTH_TOKEN`, or `X-Countly-Server-Url` and `X-Countly-Auth-Token` headers over HTTP. SDKs send the write-only `app_key`.", "pricing": "paid", "pricingNotes": "Flex starts at $175 a month, billed by tier on monthly active users and data points, with a 14-day trial that needs a credit card. Tier prices appear during signup. Funnels, retention and flows sit in the Intelligence add-on. Enterprise is on custom pricing. Countly Lite is free to self-host. API and MCP calls are not billed (https://countly.com/pricing, checked 2026-11-04).", "priceSummary": "$175 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference source, the MCP server README or the pricing page (checked 2026-11-04).", "endpoints": [] }, "toolCount": 209, "popularity": { "githubStars": null, "npmWeekly": 27579, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://api.count.ly/", "llmsTxt": "https://countly.com/llms.txt", "capabilities": [ "analytics.query", "analytics.events", "analytics.funnels", "analytics.experiments", "analytics.flags", "observability.errors" ], "tags": [ "official", "hosted", "self-hosted", "open-source", "mcp", "api-key", "llms-txt", "paid", "trial", "typescript" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 38.8, "grade": "E", "agentReady": false, "rank": 1332, "ranked": true, "rankOf": 1486, "categoryRank": 18, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 80, "payments": 17, "reliability": 23, "schema": 75, "security": 62, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -15, "negativeNotes": [ "2026-10-16. Countly published four GitHub advisories for its own countly-server code, CVE-2026-44977 (stored XSS, CVSS 3.1 9.0 Critical), CVE-2026-41582 (unauthenticated path traversal, 7.5 High), CVE-2026-42270 (unauthenticated denial of service, 7.5 High) and CVE-2026-42269 (path traversal in delete_import, 8.1 High), fixed in 24.05.50 and 25.03.44. Fixed, under two months old, 2 each (-8). https://osv.dev/list?q=countly", "2026-09-10. CVE-2026-87803, a DBViewer authorisation bypass that reaches password-reset tokens, CVSS 4.0 7.1 High, published by Snyk as CNA and fixed in 25.03.53-LTS. A fixed third-party High under two months old (-2, falling to -1 after 10 November). https://osv.dev/vulnerability/CVE-2026-87803", "2026-10-27. Server 25.03.58 lists 10 security fixes to Countly's own code (token permissions and revocation, single-use tokens, read rights on endpoints), after 25.03.54 (22 September, 20 fixes) and MCP server 1.5.0 (25 August) and 1.7.0 (7 October). No advisory was found for them. Released fixes with no advisory, folded (-3). https://github.com/Countly/countly-server/blob/master/CHANGELOG.md", "2026-10-07. `countly-mcp-server` 1.7.0, a minor release, removed the `databases_stats` tool (committed on 6 October as a breaking refactor), with no earlier notice found. A breaking change in a minor release without notice (-3). https://github.com/Countly/countly-mcp-server/blob/main/CHANGELOG.md", "2026-10-27. Server 25.03.58 limits existing app-restricted tokens without permissions to their owner's rights and makes endpoint restrictions match exact API paths, so requests that earlier tokens were allowed to make can now fail. The change was posted with the release, with no earlier notice found. A published behaviour changed for existing clients on the day it took effect (-3). https://github.com/Countly/countly-server/blob/master/CHANGELOG.md", "The five terms add to -19, held at the -15 limit." ], "verdict": "Countly suits an agent working against a server its owner already runs. The official MCP server filters its 209 tools by edition, plugin and permission and has per-category read-only settings. Five countly-server CVEs were published since September, all fixed, and no status page, OpenAPI document or published API rate limit was found.", "bestFor": "An agent whose owner runs Countly on its own infrastructure or a dedicated Flex server and wants analytics, crash and remote-config data through MCP with per-category permissions.", "strengths": [ "Official MIT MCP server, `countly-mcp-server` 1.7.0 of 7 October 2026, with read-only, destructive and idempotent annotations on its tools", "`COUNTLY_TOOLS_ALL=R` makes every MCP tool read-only, and per-category settings take None, R, CR, CRU or CRUD", "Auth tokens can be limited to named apps and endpoint patterns, carry a lifetime in seconds and are revocable", "API reference at api.count.ly is versioned (26.01, 25.03, 24.05) with parameters, examples and error responses per endpoint", "Flex terms, privacy policy, DPA, sub-processor list and a telemetry notice, all dated 20 October 2026, with 30 days' notice of sub-processor changes" ], "weaknesses": [ "No public status page or incident history was found for Flex servers or for mcp.count.ly", "Five CVEs in countly-server were published between 10 September and 16 October 2026, one Critical and four High, all fixed", "`countly-mcp-server` 1.7.0 removed the `databases_stats` tool in a minor release with no earlier notice", "The API accepts `api_key` and `auth_token` in the URL query string, and the `api_key` has its user's full read and write access", "Flex starts at $175 a month, its 14-day trial needs a credit card, and tier prices appear only during signup", "Servers and the MCP server report usage to stats.count.ly by default until it is switched off" ], "agentNotes": [ "Create a dedicated token in the Token Manager, limited to the apps and endpoints the task needs, and send it in the `countly-token` header, not the URL", "Set `COUNTLY_TOOLS_ALL=R` unless the task needs writes. The token's own permissions still apply and the stricter of the two wins", "Call `apps_list` first. Most tools need `app_id` or an exact `app_name`", "Check `get_version` for the detected edition before planning funnel, retention or cohort queries, which need Enterprise plugins", "Set `ENABLE_ANALYTICS=false` to stop MCP usage reports to stats.count.ly, and ask the server owner to check the tracking settings for server reports" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 38.8 } ], "editorialScores": { "ergonomics": 66, "maintenance": 80, "payments": 17, "reliability": 23, "schema": 75, "security": 62, "transparency": 73 }, "provenanceScore": 70, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y countly-mcp-server", "http": "curl -H \"countly-token: YOUR_TOKEN\" \"https://your-countly-url.com/o?app_id=APP_ID\u0026method=funneldata\u0026funnels=[%22FUNNEL_ID%22]\"", "claudeCode": "claude mcp add countly -e COUNTLY_SERVER_URL=https://your-countly-url.com -e COUNTLY_AUTH_TOKEN=YOUR_TOKEN -- npx -y --prefer-online countly-mcp-server@latest", "config": { "mcpServers": { "countly": { "args": [ "-y", "--prefer-online", "countly-mcp-server@latest" ], "command": "npx", "env": { "COUNTLY_AUTH_TOKEN": "YOUR_TOKEN", "COUNTLY_SERVER_URL": "https://your-countly-url.com" } } } } }, "letme": { "capability": "https://letme.dev/analytics.query", "tool": "https://letme.dev/countly" }, "area": "business", "unitPrices": [ { "item": "Flex, lowest tier", "unit": "month", "usd": 175, "note": "starting price, by monthly active users and data points, add-ons extra" } ], "provenance": { "legalEntity": "Countly Ltd", "domain": "countly.com", "domainRegistered": "2011-09-05", "endpointOnVendorDomain": true, "terms": "https://countly.com/legal/flex-terms", "privacy": "https://countly.com/legal/flex-privacy", "statusPage": "", "changelog": "https://github.com/Countly/countly-server/blob/master/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "Countly's legal pages were split on 20 October 2026 into website, Flex and Enterprise documents. The Flex terms (last updated 20 October 2026) name Countly Ltd, incorporated in England and Wales with registered number 8568329, registered at 1 Bow Churchyard, London EC4M 9DQ. The former terms URL now holds the Enterprise terms.", "The Flex privacy policy (last updated 20 October 2026) covers Flex accounts and the Flex console and excludes data customers process in their Flex servers, which the Flex DPA at countly.com/legal/flex-dpa covers.", "The hosted MCP server answers at mcp.count.ly and the API reference at api.count.ly, a second domain of the vendor's. Each customer's API answers on that customer's own server address.", "countly.com/.well-known/security.txt returns 404. SECURITY.md in the repositories gives a disclosure address at count.ly.", "No status page was found. status.countly.com did not resolve on 4 November 2026.", "RDAP for countly.com gave a registration date of 2011-09-05, per the 8 October check, not re-read on 4 November." ], "score": 70 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/countly.json", "live": { "slug": "countly", "probe": { "target": "https://mcp.count.ly/mcp", "method": "get", "lastAt": "2026-11-07T18:20:18.976805602Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 239, "samples30d": 7289, "days": [ { "date": "2026-10-09", "probes": 169, "ok": 0 }, { "date": "2026-10-10", "probes": 247, "ok": 0 }, { "date": "2026-10-11", "probes": 247, "ok": 0 }, { "date": "2026-10-12", "probes": 247, "ok": 0 }, { "date": "2026-10-13", "probes": 248, "ok": 0 }, { "date": "2026-10-14", "probes": 249, "ok": 0 }, { "date": "2026-10-15", "probes": 253, "ok": 0 }, { "date": "2026-10-16", "probes": 252, "ok": 0 }, { "date": "2026-10-17", "probes": 253, "ok": 0 }, { "date": "2026-10-18", "probes": 256, "ok": 0 }, { "date": "2026-10-19", "probes": 255, "ok": 0 }, { "date": "2026-10-20", "probes": 252, "ok": 0 }, { "date": "2026-10-21", "probes": 253, "ok": 0 }, { "date": "2026-10-22", "probes": 253, "ok": 0 }, { "date": "2026-10-23", "probes": 248, "ok": 0 }, { "date": "2026-10-24", "probes": 251, "ok": 0 }, { "date": "2026-10-25", "probes": 250, "ok": 0 }, { "date": "2026-10-26", "probes": 252, "ok": 0 }, { "date": "2026-10-27", "probes": 249, "ok": 0 }, { "date": "2026-10-28", "probes": 251, "ok": 0 }, { "date": "2026-10-29", "probes": 248, "ok": 0 }, { "date": "2026-10-30", "probes": 249, "ok": 0 }, { "date": "2026-10-31", "probes": 251, "ok": 0 }, { "date": "2026-11-01", "probes": 249, "ok": 0 }, { "date": "2026-11-02", "probes": 250, "ok": 0 }, { "date": "2026-11-03", "probes": 248, "ok": 0 }, { "date": "2026-11-04", "probes": 246, "ok": 0 }, { "date": "2026-11-05", "probes": 185, "ok": 0 }, { "date": "2026-11-06", "probes": 241, "ok": 0 }, { "date": "2026-11-07", "probes": 187, "ok": 0 } ], "outages": [ { "start": "2026-10-09T07:40:23.474688008Z", "end": "0001-01-01T00:00:00Z", "note": "HTTP 500 server error" } ] }, "versions": [ { "registry": "github", "name": "Countly/countly-server", "version": "25.03.58", "released": "2026-10-27", "seenAt": "2026-11-06T23:18:01.436887578Z" }, { "registry": "npm", "name": "countly-mcp-server", "version": "1.7.0", "seenAt": "2026-11-06T23:17:57.231778538Z" }, { "registry": "npm", "name": "countly-sdk-nodejs", "version": "26.8.0", "seenAt": "2026-11-06T23:17:59.854974474Z" }, { "registry": "npm", "name": "countly-sdk-web", "version": "26.8.1", "seenAt": "2026-11-06T23:17:57.446036177Z" } ], "githubStars": 5926, "npmWeekly": 98, "securityTxt": { "url": "https://countly.com/.well-known/security.txt", "state": "valid", "expires": "2027-11-01T00:00:00.000Z", "checkedAt": "2026-11-07T16:01:40.278221054Z" }, "llmsTxt": { "url": "https://countly.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:12.439042164Z" }, "domain": { "domain": "countly.com", "registered": "2011-09-05", "source": "https://rdap.verisign.com/com/v1/domain/countly.com", "checkedAt": "2026-11-01T14:23:11.366008393Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/Countly/countly-server/master/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:18:15.260633274Z", "changedAt": "2026-10-28T04:41:57.810807375Z", "fingerprint": "464bd4917794" }, { "url": "https://countly.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:02:07.279637492Z", "changedAt": "2026-11-07T14:02:07.279637492Z", "fingerprint": "25a1aa31c1a8" }, { "url": "https://countly.com/legal/flex-privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:02:03.050349438Z", "changedAt": "2026-11-07T14:02:03.050349438Z", "fingerprint": "67c45cb07861" }, { "url": "https://countly.com/legal/privacy-policy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-04T08:17:18.582896946Z", "changedAt": "2026-10-30T05:33:48.300790761Z", "fingerprint": "524fd19db10d" }, { "url": "https://countly.com/legal/flex-terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:02:05.263811859Z", "changedAt": "2026-11-07T14:02:05.263811859Z", "fingerprint": "e6833f089a23" }, { "url": "https://countly.com/legal/terms-of-service", "kind": "terms", "status": 304, "checkedAt": "2026-11-04T08:17:20.792676441Z", "changedAt": "2026-10-30T05:33:50.469505336Z", "fingerprint": "917431844060" } ], "github": { "repo": "countly/countly-server", "checkedAt": "2026-11-02T08:41:46.317370507Z", "stars": 5926, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T20:04:22Z", "openIssues": 1, "openPRs": 9, "issuesOpened90d": 1, "issuesClosed90d": 8, "prsMerged90d": 281, "ci": { "branch": "master", "runs": 50, "success": 25, "failure": 25, "other": 0, "latest": "success", "latestAt": "2026-11-01T19:21:22Z" }, "advisories": [ { "ghsa": "GHSA-gx33-qqr5-376j", "severity": "medium", "published": "2026-10-26T18:20:22Z" }, { "ghsa": "GHSA-p78q-3v9r-c8qg", "severity": "high", "published": "2026-10-26T18:19:48Z" }, { "ghsa": "GHSA-fqgp-6rm9-8696", "cve": "CVE-2026-41582", "severity": "high", "published": "2026-07-15T12:52:34Z" }, { "ghsa": "GHSA-86cv-qwp9-jwp3", "cve": "CVE-2026-42270", "severity": "high", "published": "2026-07-15T12:49:59Z" }, { "ghsa": "GHSA-5pmc-54j6-jcgq", "cve": "CVE-2026-42269", "severity": "high", "published": "2026-07-15T12:49:06Z" }, { "ghsa": "GHSA-jqp4-p86c-phxc", "cve": "CVE-2026-44977", "severity": "high", "published": "2026-07-15T12:48:11Z" }, { "ghsa": "GHSA-98vh-wqw5-p23v", "cve": "CVE-2022-29174", "severity": "high", "published": "2022-05-17T17:17:14Z" } ], "replies": { "sampled": 25, "unanswered": 0, "medianDays": 67 } }, "updatedAt": "2026-11-07T18:20:18.976805602Z" } }, "answer": "Mostly Good Metrics scores 41.7 (E) on agent readiness against Countly's 38.8 (E), and leads in 2 of 7 scored categories. Countly leads on schema \u0026 documentation, agent ergonomics, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "mostly-good-metrics", "name": "Mostly Good Metrics", "vendor": "Mostly Good Metrics", "vendorUrl": "https://mostlygoodmetrics.com", "kind": "http-api", "category": "product-analytics", "summary": "Mostly Good Metrics is a product analytics service in public beta for indie developers and small teams. Apps send events through five SDKs or an HTTP API, and agents query funnels, retention and experiments through a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/mostly-good-metrics", "markdownUrl": "https://www.anchorterminal.com/tools/mostly-good-metrics.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mostly-good-metrics.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mostly-good-metrics.json", "dns": "mostly-good-metrics.grade.anchorterminal.com", "repo": "https://github.com/Mostly-Good-Metrics", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.mostlygoodmetrics.com/mcp", "packages": [ { "registry": "npm", "name": "@mostly-good-metrics/javascript" }, { "registry": "npm", "name": "@mostly-good-metrics/react-native" } ], "auth": "mixed", "authNotes": "The MCP server and the `mgm` CLI use browser OAuth 2.0 with PKCE (S256) and dynamic client registration; the advertised scopes are mcp:tools plus support and newsletter scopes. Event ingestion uses a project API key as a Bearer token, which can be pinned to web origins, Apple bundle IDs or Android package names. Keys are created in the dashboard, the CLI or through MCP tools.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 50,000 to 100,000 events a month and no card. Starter $9 a month ($90 a year) for 500,000 events and Pro $29 a month ($290 a year) for 5,000,000, both quoted as lifetime beta prices against $12 and $49. Enterprise has unlimited ingestion.", "priceSummary": "$9 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or on the pricing section of the home page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 53, "popularity": { "githubStars": null, "npmWeekly": 81, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.mostlygoodmetrics.com", "capabilities": [ "analytics.query", "analytics.funnels", "analytics.events", "analytics.experiments" ], "tags": [ "hosted", "mcp", "remote-mcp", "oauth", "free-tier", "no-card", "beta", "closed-source", "typescript", "cli" ], "lastRelease": "2026-10-16", "graded": true, "anchor": { "graded": true, "score": 41.7, "grade": "E", "agentReady": false, "rank": 1277, "ranked": true, "rankOf": 1486, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 49, "maintenance": 74, "payments": 30, "reliability": 29, "schema": 49, "security": 33, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "Mostly Good Metrics lets an agent run ad-hoc funnels, retention and up to ten metric queries per call through a hosted MCP server with OAuth, at prices from $0. It is a public beta built by one developer, with no status page, no named legal entity and no security policy found.", "bestFor": "Indie and small-team apps that want simple funnels and retention an agent can query.", "strengths": [ "Hosted MCP server with OAuth, PKCE and dynamic client registration; no API key to copy", "execute_funnel, execute_retention and execute_query accept inline definitions without saving anything", "query_metrics runs 1 to 10 aggregate queries in one call with per-item results", "Free plan with no card, and paid plans from $9 a month", "Ingestion keys can be pinned to web origins and app bundle IDs" ], "weaknesses": [ "Public beta run by one developer, with no named legal entity in the terms", "No status page, SLA, security.txt or disclosure policy found", "53 MCP tools load at once and one scope grants all of them, including deletes and key revocation", "No OpenAPI file or llms.txt", "The CLI is installed from source because it isn't on npm yet" ], "agentNotes": [ "Use query_metrics for several aggregate questions instead of repeated execute_query calls", "Pass inline definitions to execute_funnel and execute_retention rather than creating saved objects", "Confirm with the user before delete, revoke_api_key or stop_experiment calls, since the server doesn't ask", "Start a fresh agent session after connecting, since a running client may not reload the tool list", "On 429 from ingestion, wait for Retry-After before resending events" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 41.7 } ], "editorialScores": { "ergonomics": 49, "maintenance": 74, "payments": 30, "reliability": 29, "schema": 49, "security": 33, "transparency": 51 }, "provenanceScore": 39, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add --transport http mgm https://app.mostlygoodmetrics.com/mcp", "config": { "mcpServers": { "mgm": { "url": "https://app.mostlygoodmetrics.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/analytics.query", "tool": "https://letme.dev/mostly-good-metrics" }, "area": "business", "unitPrices": [ { "item": "Starter plan", "unit": "month", "usd": 9, "note": "500,000 events a month, lifetime beta price" }, { "item": "Pro plan", "unit": "month", "usd": 29, "note": "5,000,000 events a month, lifetime beta price" } ], "provenance": { "legalEntity": "", "domain": "mostlygoodmetrics.com", "domainRegistered": "2025-12-05", "endpointOnVendorDomain": true, "terms": "https://mostlygoodmetrics.com/terms", "privacy": "https://mostlygoodmetrics.com/privacy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both last updated December 2025, name only Mostly Good Metrics and give no legal entity, address or governing law.", "mostlygoodmetrics.com/robots.txt has every rule commented out; docs.mostlygoodmetrics.com has no robots.txt.", "/.well-known/security.txt returned 404 and no status page was found.", "RDAP gives mostlygoodmetrics.com a registration date of 5 December 2025." ], "score": 39 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mostly-good-metrics.json", "live": { "slug": "mostly-good-metrics", "probe": { "target": "https://app.mostlygoodmetrics.com/mcp", "method": "get", "lastAt": "2026-11-07T18:20:40.455487214Z", "lastOk": true, "lastStatus": 401, "lastMs": 220, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 167, "p95ms24h": 298, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "versions": [ { "registry": "npm", "name": "@mostly-good-metrics/javascript", "version": "0.13.1", "seenAt": "2026-11-06T23:47:33.682933227Z" }, { "registry": "npm", "name": "@mostly-good-metrics/react-native", "version": "0.9.1", "seenAt": "2026-11-06T23:47:34.884784704Z" } ], "npmWeekly": 81, "securityTxt": { "url": "https://mostlygoodmetrics.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:38.90553607Z" }, "pages": [ { "url": "https://mostlygoodmetrics.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:14:39.017388202Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f43e747ad9a3" }, { "url": "https://mostlygoodmetrics.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:14:41.227658165Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "99ed64144abf" } ], "mcpTools": { "url": "https://app.mostlygoodmetrics.com/mcp", "checkedAt": "2026-11-07T01:46:16.716952564Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:46:16.716952564Z" }, "updatedAt": "2026-11-07T18:20:40.455487214Z" } }, "edges": [ { "by": 29, "category": "security", "leads": "countly", "name": "Security \u0026 auth", "reasons": { "a": "Auth tokens are scoped to apps and endpoint patterns, expire after a set lifetime, are revocable and carry create, read, update and delete permissions since 25.03.54. The dashboard `api_key` has its user's full access (26 of 30). Less 10 because `api_key` and `auth_token` are documented as query-string parameters, with the `countly-token` header as the recommended alternative (16). MCP read-only mode and per-category CRUD levels, bounded by the token's permissions. No confirmation step for destructive tools (16). Tools return event names, user properties and crash data written by end users, and no prompt-injection guidance was found (3). A system logs API records dashboard actions (12, kept; the 8 October count of log types came from the help centre's JSON API and is struck). No security.txt. SECURITY.md gives security@count.ly as the reporting route with no acknowledgement time and a bounty whose rewards are at Countly's discretion, which this run doesn't count as a bounty. Countly publishes advisories for countly-server on GitHub, and the site claims ISO 27001, 27017, 27018 and SOC 2 Type II without public reports. 15, as daytona has for a disclosure route and certifications with a discretionary reward.", "b": "OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33." }, "scores": { "a": 62, "b": 33 } }, { "by": 27, "category": "transparency", "leads": "countly", "name": "Transparency \u0026 trust", "reasons": { "a": "Countly Lite is AGPL-3.0 with added branding terms under Section 7, the MCP server is MIT, and the Enterprise plugins that hold funnels, retention, cohorts and Drill are closed (20 of 30). Flex now has its own terms, privacy policy, DPA and sub-processor list, all dated 20 October 2026. The Flex privacy policy excludes data customers process and gives no retention periods, and the DPA covers that data (20). The MCP changelog deprecated auth tokens in URL parameters on 23 April 2026 (1.3.0), and the server warns on their use, with no notice period (15, the settled value for dated notices without a period). The Flex sub-processor list names locations, with 30 days' notice of changes in the DPA, and Flex customers choose a Google Cloud region. A Connected Services and Telemetry notice (20 October 2026) says server reports to stats.count.ly are on by default and which settings turn them off, and MCP usage reporting is disclosed with an opt-out (18).", "b": "The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51." }, "scores": { "a": 72, "b": 45 } }, { "by": 26, "category": "schema", "leads": "countly", "name": "Schema \u0026 documentation", "reasons": { "a": "No OpenAPI document was found in the API reference source (Countly/countly-docs-site) or in Countly/countly-server. Every MCP tool has a typed JSON Schema input (18 of 25). countly.com/llms.txt (77 KB) indexes the help centre for agents, while api.count.ly has no llms.txt and help article pages answered a bot check on 8 October (8). MCP tool descriptions name the endpoint, the plugin required and the tool to use instead, and API pages state permissions and behaviour (16). 82 enums across the tool sources, but the HTTP API takes JSON arrays and objects as query-string values (9). API pages carry request examples, response fields and error responses, as plain message strings (11). The API reference is versioned 26.01, 25.03 and 24.05 (611 pages for 26.01 in the source), and the server and MCP server keep public changelogs (13).", "b": "No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49." }, "scores": { "a": 75, "b": 49 } }, { "by": 17, "category": "ergonomics", "leads": "countly", "name": "Agent ergonomics", "reasons": { "a": "The MCP README counts 209 tools in 43 categories, far past 30 (5). Add back 8 because the server hides tools the edition, enabled plugins or user's permissions cannot run, and `COUNTLY_TOOLS_*` settings switch categories off (13). List endpoints take `iDisplayStart` and `iDisplayLength`, and MCP list tools take `skip`, `limit` and `search` (15). API errors are `{\"result\": \"message\"}` strings with HTTP status codes and no error codes. The MCP server returns failures as `isError` results that name the missing plugin or permission (12). MCP tools carry readOnlyHint, destructiveHint and idempotentHint since 1.7.0. No idempotency keys on API writes (14). MCP tools accept `app_name` in place of `app_id` and set defaults. The SDKs cover data collection, not the read API (12).", "b": "53 tools, more than 30 (5). We added 3 because Goals and Alerts tools load only where enabled and query_metrics batches up to 10 queries (8 of 25). Date ranges, grouping and filters on queries; no documented page or limit parameters for lists (12 of 20). JSON errors with a message, and per-item status in batch results (13 of 20). Annotations weren't readable without a session, the tool list includes deletes and key revocation, and no idempotency keys were found (4 of 20). Five client SDKs and a CLI with `--json` output (12 of 15). 8+12+13+4+12 = 49." }, "scores": { "a": 66, "b": 49 } }, { "by": 13, "category": "payments", "leads": "mostly-good-metrics", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). The pricing page gives only a starting price for Flex, $175 a month, priced on monthly active users and data points, with tier prices shown during signup and Enterprise on custom pricing (7 of 20, the earlier partial kept). The 14-day Flex trial needs a credit card, per the Flex page. Countly Lite is free to self-host with no card, without funnels, retention, cohorts or Drill, so half credit (10). A person signs up in a browser, creates a server and makes a token in the dashboard (0).", "b": "No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30." }, "scores": { "a": 17, "b": 30 } }, { "by": 6, "category": "reliability", "leads": "mostly-good-metrics", "name": "Reliability", "reasons": { "a": "Graded on the hosted lines, for a Countly Flex server reached through its HTTP API and the official MCP server. No status page was found on countly.com, the Flex page, the docs or the legal pages, and status.countly.com did not resolve on 4 November (0). With no page there is no readable incident history (5). The MCP server's HTTP endpoint is limited to 120 requests a minute per IP, but the Countly server's own `api_rate_limit_requests` setting ships at 0 (off), and the Flex terms of 20 October 2026 reserve usage limits without numbers (8 of 15, the earlier partial kept). No 429 or retry guidance and no idempotency keys were found in the API reference source (0). The pricing page lists an SLA as optional on Flex and included in Enterprise, with no SLA document published, which this run scores 0 (0). The API and MCP server 1.7.0 are generally available (10).", "b": "Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29." }, "scores": { "a": 23, "b": 29 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Countly Ltd", "b": "Mostly Good Metrics", "name": "Vendor" }, { "a": "https://mcp.count.ly/mcp", "b": "https://app.mostlygoodmetrics.com/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, stdio, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT", "b": "none", "name": "Licence" }, { "a": "209", "b": "53", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-10-27", "b": "2026-10-16", "name": "Last release" }, { "a": "not read yet", "b": "2025-12-01", "name": "Terms last updated" }, { "a": "not read yet", "b": "2025-12-01", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "28k npm/wk", "b": "81 npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Mostly Good Metrics scores 41.7 (E) on agent readiness against Countly's 38.8 (E), and leads in 2 of 7 scored categories. Countly leads on schema \u0026 documentation, agent ergonomics, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, Countly or Mostly Good Metrics?" }, { "answer": "Countly needs an API key. Mostly Good Metrics takes an API key or an OAuth sign-in.", "question": "Do Countly and Mostly Good Metrics need an API key?" }, { "answer": "Yes. Countly has a hosted endpoint at https://mcp.count.ly/mcp and Mostly Good Metrics at https://app.mostlygoodmetrics.com/mcp.", "question": "Can an agent call Countly and Mostly Good Metrics without installing anything?" }, { "answer": "Countly is open source (Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT). No open-source release is listed for Mostly Good Metrics.", "question": "Are Countly and Mostly Good Metrics open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 75 against 49", "Agent ergonomics, 66 against 49", "Security \u0026 auth, 62 against 33", "Maintenance \u0026 community, 80 against 74", "Transparency \u0026 trust, 72 against 45" ], "also": [ "Runs on your own machine", "Open source" ], "goodFor": "An agent whose owner runs Countly on its own infrastructure or a dedicated Flex server and wants analytics, crash and remote-config data through MCP with per-category permissions.", "slug": "countly", "watchFor": "No public status page or incident history was found for Flex servers or for mcp.count.ly" }, { "aheadOn": [ "Reliability, 29 against 23", "Payments \u0026 pricing, 30 against 17" ], "also": [ "Free to start without a card", "No incidents deducted, where Countly loses 15 points for them" ], "goodFor": "Indie and small-team apps that want simple funnels and retention an agent can query.", "slug": "mostly-good-metrics", "watchFor": "Public beta run by one developer, with no named legal entity in the terms" } ], "history": { "countly": [ { "causes": [ "security", "correction" ], "date": "2026-11-04", "delta": -16.1, "from": 54.9, "fromGrade": "C", "to": 38.8, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 54.8, "fromGrade": "C", "to": 54.9, "toGrade": "C" } ], "mostly-good-metrics": null }, "job": { "capability": "analytics.query", "name": "Analytics queries" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amplitude-vs-countly.json", "title": "Amplitude vs Countly", "url": "https://www.anchorterminal.com/compare/amplitude-vs-countly" }, { "json": "https://www.anchorterminal.com/compare/amplitude-vs-mostly-good-metrics.json", "title": "Amplitude vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/amplitude-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/basedash-mcp-vs-countly.json", "title": "Basedash MCP vs Countly", "url": "https://www.anchorterminal.com/compare/basedash-mcp-vs-countly" }, { "json": "https://www.anchorterminal.com/compare/basedash-mcp-vs-mostly-good-metrics.json", "title": "Basedash MCP vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/basedash-mcp-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-fullstory.json", "title": "Countly vs Fullstory", "url": "https://www.anchorterminal.com/compare/countly-vs-fullstory" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-growthbook.json", "title": "Countly vs GrowthBook", "url": "https://www.anchorterminal.com/compare/countly-vs-growthbook" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-matomo.json", "title": "Countly vs Matomo", "url": "https://www.anchorterminal.com/compare/countly-vs-matomo" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-mixpanel.json", "title": "Countly vs Mixpanel", "url": "https://www.anchorterminal.com/compare/countly-vs-mixpanel" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-openpanel.json", "title": "Countly vs OpenPanel", "url": "https://www.anchorterminal.com/compare/countly-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-optimizely.json", "title": "Countly vs Optimizely Experimentation", "url": "https://www.anchorterminal.com/compare/countly-vs-optimizely" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-pendo.json", "title": "Countly vs Pendo", "url": "https://www.anchorterminal.com/compare/countly-vs-pendo" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-posthog.json", "title": "Countly vs PostHog", "url": "https://www.anchorterminal.com/compare/countly-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-statsig.json", "title": "Countly vs Statsig", "url": "https://www.anchorterminal.com/compare/countly-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-userpilot.json", "title": "Countly vs Userpilot", "url": "https://www.anchorterminal.com/compare/countly-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-woopra.json", "title": "Countly vs Woopra", "url": "https://www.anchorterminal.com/compare/countly-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-mostly-good-metrics.json", "title": "Fullstory vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/fullstory-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/matomo-vs-mostly-good-metrics.json", "title": "Matomo vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/matomo-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/mixpanel-vs-mostly-good-metrics.json", "title": "Mixpanel vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/mixpanel-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-openpanel.json", "title": "Mostly Good Metrics vs OpenPanel", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-optimizely.json", "title": "Mostly Good Metrics vs Optimizely Experimentation", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-optimizely" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-pendo.json", "title": "Mostly Good Metrics vs Pendo", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-pendo" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog.json", "title": "Mostly Good Metrics vs PostHog", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-statsig.json", "title": "Mostly Good Metrics vs Statsig", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.json", "title": "Mostly Good Metrics vs Userpilot", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-woopra.json", "title": "Mostly Good Metrics vs Woopra", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-flagsmith.json", "title": "Countly vs Flagsmith", "url": "https://www.anchorterminal.com/compare/countly-vs-flagsmith" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-harness-fme.json", "title": "Countly vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/countly-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-launchdarkly.json", "title": "Countly vs LaunchDarkly", "url": "https://www.anchorterminal.com/compare/countly-vs-launchdarkly" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-heap.json", "title": "Countly vs Heap", "url": "https://www.anchorterminal.com/compare/countly-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.json", "title": "Heap vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics.json", "title": "Flagsmith vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-mostly-good-metrics.json", "title": "GrowthBook vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/growthbook-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics.json", "title": "Harness Feature Management \u0026 Experimentation vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/launchdarkly-vs-mostly-good-metrics.json", "title": "LaunchDarkly vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/launchdarkly-vs-mostly-good-metrics" } ], "panel": null, "scores": [ { "by": 6, "countly": 23, "edge": "mostly-good-metrics", "key": "reliability", "mostly-good-metrics": 29, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 26, "countly": 75, "edge": "countly", "key": "schema", "mostly-good-metrics": 49, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 17, "countly": 66, "edge": "countly", "key": "ergonomics", "mostly-good-metrics": 49, "name": "Agent ergonomics", "weight": 13 }, { "by": 29, "countly": 62, "edge": "countly", "key": "security", "mostly-good-metrics": 33, "name": "Security \u0026 auth", "weight": 14 }, { "by": 13, "countly": 17, "edge": "mostly-good-metrics", "key": "payments", "mostly-good-metrics": 30, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 6, "countly": 80, "edge": "countly", "key": "maintenance", "mostly-good-metrics": 74, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 27, "countly": 72, "edge": "countly", "key": "transparency", "mostly-good-metrics": 45, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Mostly Good Metrics scores 41.7 (E) on agent readiness against Countly's 38.8 (E), and leads in 2 of 7 scored categories. Countly leads on schema \u0026 documentation, agent ergonomics, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do analytics queries.", "tasks": null, "tutorials": [], "verdicts": { "countly": "Countly suits an agent working against a server its owner already runs. The official MCP server filters its 209 tools by edition, plugin and permission and has per-category read-only settings. Five countly-server CVEs were published since September, all fixed, and no status page, OpenAPI document or published API rate limit was found.", "mostly-good-metrics": "Mostly Good Metrics lets an agent run ad-hoc funnels, retention and up to ten metric queries per call through a hosted MCP server with OAuth, at prices from $0. It is a public beta built by one developer, with no status page, no named legal entity and no security policy found." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics", "json": "https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics.min.md" }, "markdown": "Mostly Good Metrics scores 41.7 (E) on agent readiness against Countly's 38.8 (E), and leads in 2 of 7 scored categories. Countly leads on schema \u0026 documentation, agent ergonomics, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do analytics queries.\n\n- Countly: grade E, 38.8/100, rank #1332 of 1486. Markdown https://www.anchorterminal.com/tools/countly.md · JSON https://www.anchorterminal.com/api/v1/tools/countly.json\n- Mostly Good Metrics: grade E, 41.7/100, rank #1277 of 1486. Markdown https://www.anchorterminal.com/tools/mostly-good-metrics.md · JSON https://www.anchorterminal.com/api/v1/tools/mostly-good-metrics.json\n- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md\n- All 153 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md\n\n## Which one, for what\n\n### Countly (E)\n\nGood for: An agent whose owner runs Countly on its own infrastructure or a dedicated Flex server and wants analytics, crash and remote-config data through MCP with per-category permissions.\n\nAhead on:\n- Schema \u0026 documentation, 75 against 49\n- Agent ergonomics, 66 against 49\n- Security \u0026 auth, 62 against 33\n- Maintenance \u0026 community, 80 against 74\n- Transparency \u0026 trust, 72 against 45\n\nAlso in its favour:\n- Runs on your own machine\n- Open source\n\nWatch for: No public status page or incident history was found for Flex servers or for mcp.count.ly\n\n### Mostly Good Metrics (E)\n\nGood for: Indie and small-team apps that want simple funnels and retention an agent can query.\n\nAhead on:\n- Reliability, 29 against 23\n- Payments \u0026 pricing, 30 against 17\n\nAlso in its favour:\n- Free to start without a card\n- No incidents deducted, where Countly loses 15 points for them\n\nWatch for: Public beta run by one developer, with no named legal entity in the terms\n\n\n## Why the edge\n\n### Security \u0026 auth: Countly +29\n\n- Countly (62): Auth tokens are scoped to apps and endpoint patterns, expire after a set lifetime, are revocable and carry create, read, update and delete permissions since 25.03.54. The dashboard `api_key` has its user's full access (26 of 30). Less 10 because `api_key` and `auth_token` are documented as query-string parameters, with the `countly-token` header as the recommended alternative (16). MCP read-only mode and per-category CRUD levels, bounded by the token's permissions. No confirmation step for destructive tools (16). Tools return event names, user properties and crash data written by end users, and no prompt-injection guidance was found (3). A system logs API records dashboard actions (12, kept; the 8 October count of log types came from the help centre's JSON API and is struck). No security.txt. SECURITY.md gives security@count.ly as the reporting route with no acknowledgement time and a bounty whose rewards are at Countly's discretion, which this run doesn't count as a bounty. Countly publishes advisories for countly-server on GitHub, and the site claims ISO 27001, 27017, 27018 and SOC 2 Type II without public reports. 15, as daytona has for a disclosure route and certifications with a discretionary reward.\n- Mostly Good Metrics (33): OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.\n\n### Transparency \u0026 trust: Countly +27\n\n- Countly (72): Countly Lite is AGPL-3.0 with added branding terms under Section 7, the MCP server is MIT, and the Enterprise plugins that hold funnels, retention, cohorts and Drill are closed (20 of 30). Flex now has its own terms, privacy policy, DPA and sub-processor list, all dated 20 October 2026. The Flex privacy policy excludes data customers process and gives no retention periods, and the DPA covers that data (20). The MCP changelog deprecated auth tokens in URL parameters on 23 April 2026 (1.3.0), and the server warns on their use, with no notice period (15, the settled value for dated notices without a period). The Flex sub-processor list names locations, with 30 days' notice of changes in the DPA, and Flex customers choose a Google Cloud region. A Connected Services and Telemetry notice (20 October 2026) says server reports to stats.count.ly are on by default and which settings turn them off, and MCP usage reporting is disclosed with an opt-out (18).\n- Mostly Good Metrics (45): The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.\n\n### Schema \u0026 documentation: Countly +26\n\n- Countly (75): No OpenAPI document was found in the API reference source (Countly/countly-docs-site) or in Countly/countly-server. Every MCP tool has a typed JSON Schema input (18 of 25). countly.com/llms.txt (77 KB) indexes the help centre for agents, while api.count.ly has no llms.txt and help article pages answered a bot check on 8 October (8). MCP tool descriptions name the endpoint, the plugin required and the tool to use instead, and API pages state permissions and behaviour (16). 82 enums across the tool sources, but the HTTP API takes JSON arrays and objects as query-string values (9). API pages carry request examples, response fields and error responses, as plain message strings (11). The API reference is versioned 26.01, 25.03 and 24.05 (611 pages for 26.01 in the source), and the server and MCP server keep public changelogs (13).\n- Mostly Good Metrics (49): No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.\n\n### Agent ergonomics: Countly +17\n\n- Countly (66): The MCP README counts 209 tools in 43 categories, far past 30 (5). Add back 8 because the server hides tools the edition, enabled plugins or user's permissions cannot run, and `COUNTLY_TOOLS_*` settings switch categories off (13). List endpoints take `iDisplayStart` and `iDisplayLength`, and MCP list tools take `skip`, `limit` and `search` (15). API errors are `{\"result\": \"message\"}` strings with HTTP status codes and no error codes. The MCP server returns failures as `isError` results that name the missing plugin or permission (12). MCP tools carry readOnlyHint, destructiveHint and idempotentHint since 1.7.0. No idempotency keys on API writes (14). MCP tools accept `app_name` in place of `app_id` and set defaults. The SDKs cover data collection, not the read API (12).\n- Mostly Good Metrics (49): 53 tools, more than 30 (5). We added 3 because Goals and Alerts tools load only where enabled and query_metrics batches up to 10 queries (8 of 25). Date ranges, grouping and filters on queries; no documented page or limit parameters for lists (12 of 20). JSON errors with a message, and per-item status in batch results (13 of 20). Annotations weren't readable without a session, the tool list includes deletes and key revocation, and no idempotency keys were found (4 of 20). Five client SDKs and a CLI with `--json` output (12 of 15). 8+12+13+4+12 = 49.\n\n### Payments \u0026 pricing: Mostly Good Metrics +13\n\n- Countly (17): No x402, MPP or L402 (0). The pricing page gives only a starting price for Flex, $175 a month, priced on monthly active users and data points, with tier prices shown during signup and Enterprise on custom pricing (7 of 20, the earlier partial kept). The 14-day Flex trial needs a credit card, per the Flex page. Countly Lite is free to self-host with no card, without funnels, retention, cohorts or Drill, so half credit (10). A person signs up in a browser, creates a server and makes a token in the dashboard (0).\n- Mostly Good Metrics (30): No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.\n\n### Reliability: Mostly Good Metrics +6\n\n- Countly (23): Graded on the hosted lines, for a Countly Flex server reached through its HTTP API and the official MCP server. No status page was found on countly.com, the Flex page, the docs or the legal pages, and status.countly.com did not resolve on 4 November (0). With no page there is no readable incident history (5). The MCP server's HTTP endpoint is limited to 120 requests a minute per IP, but the Countly server's own `api_rate_limit_requests` setting ships at 0 (off), and the Flex terms of 20 October 2026 reserve usage limits without numbers (8 of 15, the earlier partial kept). No 429 or retry guidance and no idempotency keys were found in the API reference source (0). The pricing page lists an SLA as optional on Flex and included in Enterprise, with no SLA document published, which this run scores 0 (0). The API and MCP server 1.7.0 are generally available (10).\n- Mostly Good Metrics (29): Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.\n\n## Score by category\n\n| Category | Weight | Countly | Mostly Good Metrics | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 23 | 29 | Mostly Good Metrics +6 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 75 | 49 | Countly +26 |\n| Agent ergonomics | 13% (16.2 this run) | 66 | 49 | Countly +17 |\n| Security \u0026 auth | 14% (17.5 this run) | 62 | 33 | Countly +29 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 17 | 30 | Mostly Good Metrics +13 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 80 | 74 | Countly +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 45 | Countly +27 |\n| Negative events | ≤15 | -15 | 0 | |\n| **Total** | | **38.8 · E** | **41.7 · E** | |\n\n## Facts side by side\n\n| Fact | Countly | Mostly Good Metrics |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Countly Ltd | Mostly Good Metrics |\n| Hosted endpoint | `https://mcp.count.ly/mcp` | `https://app.mostlygoodmetrics.com/mcp` |\n| Transports | HTTP, stdio, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT | none |\n| Tools exposed | 209 | 53 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | no |\n| Last release | 2026-10-27 | 2026-10-16 |\n| Terms last updated | not read yet | 2025-12-01 |\n| Privacy policy last updated | not read yet | 2025-12-01 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | 28k npm/wk | 81 npm/wk |\n\n## How the scores have moved\n\n### Countly\n\n- -16.1 on 4 November 2026 (C to E): security, correction\n- +0.1 on 27 October 2026: checklist\n\n### Mostly Good Metrics\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Countly.** Countly suits an agent working against a server its owner already runs. The official MCP server filters its 209 tools by edition, plugin and permission and has per-category read-only settings. Five countly-server CVEs were published since September, all fixed, and no status page, OpenAPI document or published API rate limit was found.\n\n**Mostly Good Metrics.** Mostly Good Metrics lets an agent run ad-hoc funnels, retention and up to ten metric queries per call through a hosted MCP server with OAuth, at prices from $0. It is a public beta built by one developer, with no status page, no named legal entity and no security policy found.\n\n## Before you call either\n\n### Countly\n\n1. Create a dedicated token in the Token Manager, limited to the apps and endpoints the task needs, and send it in the `countly-token` header, not the URL\n2. Set `COUNTLY_TOOLS_ALL=R` unless the task needs writes. The token's own permissions still apply and the stricter of the two wins\n3. Call `apps_list` first. Most tools need `app_id` or an exact `app_name`\n4. Check `get_version` for the detected edition before planning funnel, retention or cohort queries, which need Enterprise plugins\n5. Set `ENABLE_ANALYTICS=false` to stop MCP usage reports to stats.count.ly, and ask the server owner to check the tracking settings for server reports\n\n### Mostly Good Metrics\n\n1. Use query_metrics for several aggregate questions instead of repeated execute_query calls\n2. Pass inline definitions to execute_funnel and execute_retention rather than creating saved objects\n3. Confirm with the user before delete, revoke_api_key or stop_experiment calls, since the server doesn't ask\n4. Start a fresh agent session after connecting, since a running client may not reload the tool list\n5. On 429 from ingestion, wait for Retry-After before resending events\n\n## Questions\n\n### Which is better for AI agents, Countly or Mostly Good Metrics?\n\nMostly Good Metrics scores 41.7 (E) on agent readiness against Countly's 38.8 (E), and leads in 2 of 7 scored categories. Countly leads on schema \u0026 documentation, agent ergonomics, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.\n\n### Do Countly and Mostly Good Metrics need an API key?\n\nCountly needs an API key. Mostly Good Metrics takes an API key or an OAuth sign-in.\n\n### Can an agent call Countly and Mostly Good Metrics without installing anything?\n\nYes. Countly has a hosted endpoint at https://mcp.count.ly/mcp and Mostly Good Metrics at https://app.mostlygoodmetrics.com/mcp.\n\n### Are Countly and Mostly Good Metrics open source?\n\nCountly is open source (Countly Lite is AGPL-3.0 with added branding terms under Section 7. Enterprise plugins are proprietary. Flex is a hosted service under Countly's terms. The MCP server is MIT). No open-source release is listed for Mostly Good Metrics.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics.json, and with the fewest tokens: https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"countly\", \"b\": \"mostly-good-metrics\"}`. From a terminal: `anchor compare countly mostly-good-metrics`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/countly.json and https://www.anchorterminal.com/api/v1/tools/mostly-good-metrics.json\n\n## Other comparisons with Countly or Mostly Good Metrics\n\n- [Amplitude vs Countly](https://www.anchorterminal.com/compare/amplitude-vs-countly.md)\n- [Amplitude vs Mostly Good Metrics](https://www.anchorterminal.com/compare/amplitude-vs-mostly-good-metrics.md)\n- [Basedash MCP vs Countly](https://www.anchorterminal.com/compare/basedash-mcp-vs-countly.md)\n- [Basedash MCP vs Mostly Good Metrics](https://www.anchorterminal.com/compare/basedash-mcp-vs-mostly-good-metrics.md)\n- [Countly vs Fullstory](https://www.anchorterminal.com/compare/countly-vs-fullstory.md)\n- [Countly vs GrowthBook](https://www.anchorterminal.com/compare/countly-vs-growthbook.md)\n- [Countly vs Matomo](https://www.anchorterminal.com/compare/countly-vs-matomo.md)\n- [Countly vs Mixpanel](https://www.anchorterminal.com/compare/countly-vs-mixpanel.md)\n- [Countly vs OpenPanel](https://www.anchorterminal.com/compare/countly-vs-openpanel.md)\n- [Countly vs Optimizely Experimentation](https://www.anchorterminal.com/compare/countly-vs-optimizely.md)\n- [Countly vs Pendo](https://www.anchorterminal.com/compare/countly-vs-pendo.md)\n- [Countly vs PostHog](https://www.anchorterminal.com/compare/countly-vs-posthog.md)\n- [Countly vs Statsig](https://www.anchorterminal.com/compare/countly-vs-statsig.md)\n- [Countly vs Userpilot](https://www.anchorterminal.com/compare/countly-vs-userpilot.md)\n- [Countly vs Woopra](https://www.anchorterminal.com/compare/countly-vs-woopra.md)\n- [Fullstory vs Mostly Good Metrics](https://www.anchorterminal.com/compare/fullstory-vs-mostly-good-metrics.md)\n- [Matomo vs Mostly Good Metrics](https://www.anchorterminal.com/compare/matomo-vs-mostly-good-metrics.md)\n- [Mixpanel vs Mostly Good Metrics](https://www.anchorterminal.com/compare/mixpanel-vs-mostly-good-metrics.md)\n- [Mostly Good Metrics vs OpenPanel](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-openpanel.md)\n- [Mostly Good Metrics vs Optimizely Experimentation](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-optimizely.md)\n- [Mostly Good Metrics vs Pendo](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-pendo.md)\n- [Mostly Good Metrics vs PostHog](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog.md)\n- [Mostly Good Metrics vs Statsig](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-statsig.md)\n- [Mostly Good Metrics vs Userpilot](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.md)\n- [Mostly Good Metrics vs Woopra](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-woopra.md)\n- [Countly vs Flagsmith](https://www.anchorterminal.com/compare/countly-vs-flagsmith.md)\n- [Countly vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/countly-vs-harness-fme.md)\n- [Countly vs LaunchDarkly](https://www.anchorterminal.com/compare/countly-vs-launchdarkly.md)\n- [Countly vs Heap](https://www.anchorterminal.com/compare/countly-vs-heap.md)\n- [Heap vs Mostly Good Metrics](https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.md)\n- [Flagsmith vs Mostly Good Metrics](https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics.md)\n- [GrowthBook vs Mostly Good Metrics](https://www.anchorterminal.com/compare/growthbook-vs-mostly-good-metrics.md)\n- [Harness Feature Management \u0026 Experimentation vs Mostly Good Metrics](https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics.md)\n- [LaunchDarkly vs Mostly Good Metrics](https://www.anchorterminal.com/compare/launchdarkly-vs-mostly-good-metrics.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Countly vs Mostly Good Metrics", "url": "" } ], "description": "Mostly Good Metrics scores 41.7 (E) to Countly's 38.8 (E) for analytics queries. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Countly E 38.8", "Mostly Good Metrics E 41.7", "scores" ], "h1": "Countly vs Mostly Good Metrics", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/countly-vs-mostly-good-metrics", "published": "2026-10-01", "section": "tools", "title": "Countly vs Mostly Good Metrics for AI agents (2026) | Anchor Terminal", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics" }, "tokens": { "markdown": 5200, "slim": 3030 }, "version": 1 }