Cronitor MCP server vs Rootly MCP Server

Cronitor MCP server 37

robots.txt disallows the terms and privacy pages, so neither was read (5 of 30, terms exist but weren't readable). Data handling only from the security page (encryption, backups) (10 of 30). No deprecation policy found; the docs version the error codes by protocol revision (5 of 20). Subprocessors not found (5 of 20). 5 + 10 + 5 + 5 = 25.

Rootly MCP Server 81

The server is Apache-2.0 and the hosted service runs under Rootly's Terms of Use of July 2026 (27). A privacy policy of October 2026, a subprocessor list and AI data pages are public, and retention is stated only in general terms. The README says hosted telemetry records tool arguments, responses, timing and errors through AgentCat with redaction hooks. AgentCat isn't on the subprocessor list and the MCP docs page doesn't mention telemetry (15). No deprecation policy was found. camelCase tool names stay callable as hidden aliases with no removal date, and the terms say notice of changes isn't always practical (8). The subprocessor list names about 30 processors with purpose, data and location, nearly all in the United States (15).

Cronitor MCP server 55

Registry entry io.cronitor/cronitor updated 3 November 2026 (30). No dated changelog found to count (0). Support page and docs; no public changelog (10 of 15). Official registry entry under its own namespace, and official SDKs (15). No package to read (0). 30 + 0 + 10 + 15 + 0 = 55. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Rootly MCP Server 81

v2.4.0 was tagged on 31 October 2026, four days before this check (30). Dated releases from 6 August to 4 November 2026 are 2.3.17 (10 August), 2.3.18 (29 August), 2.3.19 (9 September), 2.3.20 (14 September), 2.3.21 (5 October), 2.3.22 (21 October) and 2.4.0 (31 October) (20). The commit log shows pull requests merged through 3 November. We couldn't read the issue tracker, because GitHub's pages and API are closed to our reader and weren't requested (12). The official MCP registry lists com.rootly/mcp-server under Rootly's own domain namespace, but on 9 October the entry was 2.2.4 from 18 February 2026 and named only the SSE endpoint. The repository's server.json is now 2.4.0, with no workflow that publishes it (10). CI runs lint, two type checkers, unit and integration tests on Python 3.12 and 3.13 and a container protocol test, with a lockfile check, Dependabot and a dependency review workflow (9).

Cronitor MCP server 40

No machine payment protocol (0). Per-monitor and per-user prices public (20). Free plan for 5 monitors, no card mentioned (20). A person signs up or signs in through a browser (0). 0 + 20 + 20 + 0 = 40.

Rootly MCP Server 20

No x402, MPP or L402 (0). Plan prices are public. Essentials is $20 per product per user a month, with MCP and API access included, and Enterprise is by quote. No per-call price (10). No free tier. Self-serve sign-up starts a trial of about two weeks per the pricing page. The sign-up page answered with a bot check, so whether a card is needed wasn't established, and the line takes half marks (10). A person signs up in a browser and either logs in through OAuth or creates an API key (0). The package is free to run but needs a Rootly account, so the self-hosted rule doesn't apply.

Cronitor MCP server 55

Status page at status.cronitor.io with components for the APIs and telemetry regions (20). No history was readable (history.rss 404, uptime 'No data available') (5). Rate limits are returned with limit and window in the error data, but no numbers are published (5 of 15). Rate-limit errors carry retry_after_seconds, bulk deletes validate every key first, and the docs say which repeated calls are safe (15). No SLA found (0). Not labelled beta (10). 20 + 5 + 5 + 15 + 0 + 10 = 55.

Rootly MCP Server 48

Scored as a hosted MCP server, the path the docs recommend. status.rootly.com is linked from the site and llms.txt. On 9 October it answered our reader with a bot check, so its components (15) and incident history (5) were unread. Rootly's Terms of Use bar crawling or scraping the Services, and this run pauses such hosts pending a ruling, so the 9 October readings are kept. The REST API behind the tools allows 3,000 read calls and 3,000 write calls a minute per API key, and 50 alert creations a minute. No separate limit for mcp.rootly.com was found (12). A 429 returns a JSON error with X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used and X-RateLimit-Reset headers. No Retry-After, backoff guidance or idempotency keys were found (8). The pricing table lists "99.99 % Reliability" for on-call, and no SLA document was found (0). The hosted /mcp and /mcp-codemode endpoints carry no beta label. The README calls Code Mode experimental while the docs recommend it (8).

Cronitor MCP server 58

OAuth bounded by role with no scope choice, or scoped API keys (22 of 30). Read-only users get only read tools; write tools follow the role (14 of 20). The docs warn that event messages, command output and request bodies can hold customer data or secrets, and tell the agent to ask before expanding them; secrets are redacted (12 of 15). No audit log of MCP calls found (0). The security page covers encryption and relies on AWS's certifications; no security.txt (404) and no disclosure policy found (10 of 20). 22 + 14 + 12 + 0 + 10 = 58.

Rootly MCP Server 65

OAuth 2 with dynamic client registration, PKCE with S256, one-hour access tokens, rotating refresh tokens, a revocation endpoint and :read and :write scopes per resource. The MCP server's resource metadata advertises a single all scope since 2.3.13, so MCP logins aren't narrowed by scope. API keys are global with a chosen role, team or personal, sent in the Authorization header (26). Delete operations are off by default and API key, user, role and webhook endpoints are excluded. Write tools are on by default for hosted connections, the documented read-only switch applies to servers the owner runs, and no confirmation step was found (11). Incident text, alert payloads and meeting transcripts are untrusted content, and no injection guidance was found (3). list_audits reads Rootly's audit log, which the pricing page lists under Enterprise (9). security.txt valid to 1 September 2027, a disclosure policy with safe harbour and response times, no paid bounty, SOC 2 Type II stated with the report on request, and dependency advisories recorded in the changelog. The server's own fixes in 2.3.22 and 2.4.0 carry no advisory, and OSV holds none for the package (16).