{ "data": { "a": { "slug": "flagsmith", "name": "Flagsmith", "vendor": "Bullet Train Ltd", "vendorUrl": "https://www.flagsmith.com", "kind": "http-api", "category": "product-analytics", "summary": "Flagsmith is an open-source feature flag, remote config and experimentation service from Bullet Train Ltd. Teams use it on Flagsmith Cloud or self-hosted, through SDKs, a Management API and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/flagsmith", "markdownUrl": "https://www.anchorterminal.com/tools/flagsmith.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/flagsmith.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/flagsmith.json", "dns": "flagsmith.grade.anchorterminal.com", "repo": "https://github.com/Flagsmith/flagsmith", "license": "BSD-3-Clause", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.flagsmith.com", "packages": [ { "registry": "pypi", "name": "flagsmith" }, { "registry": "npm", "name": "flagsmith" } ], "auth": "mixed", "authNotes": "The hosted MCP server takes OAuth (the client discovers Flagsmith as the authorisation server and a person signs in) or an Organisation API key sent as `Authorization: Api-Key \u003ckey\u003e`. Organisation keys act as full organisation admin or with chosen RBAC roles; granular roles need Scale-Up or Enterprise. OIDC trust relationships let CI workloads such as GitHub Actions exchange their token for a short-lived one. SDK environment keys are separate.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 50,000 requests a month and one team member. Start-Up is $45 a month ($40 billed yearly) for 1,000,000 requests and three members, Scale-Up $300 a month ($250 yearly) for 5,000,000. Enterprise by quote. Extra API calls from $50 per million; the page also quotes $7 per 100,000 for Start-Up. The self-hosted edition is free under BSD-3-Clause.", "priceSummary": "$45 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI spec or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 54, "popularity": { "githubStars": 6639, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.flagsmith.com/", "openapi": "https://github.com/Flagsmith/flagsmith/blob/main/openapi.yaml", "capabilities": [ "analytics.flags", "analytics.experiments", "analytics.events" ], "tags": [ "official", "hosted", "open-source", "self-hosted", "mcp", "remote-mcp", "oauth", "openapi", "free-tier", "status-page", "soc2", "sla", "python", "typescript" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 61.2, "grade": "C", "agentReady": false, "rank": 620, "ranked": true, "rankOf": 1486, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 55, "maintenance": 83, "payments": 40, "reliability": 65, "schema": 67, "security": 65, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -2, "negativeNotes": [ "6 November 2026. The self-hosted API sends a heartbeat to https://api.flagsmith.com/api/v1/analytics/telemetry/ with counts of organisations, projects, environments, feature flags, segments and users, on by default (`ENABLE_TELEMETRY = env.bool(\"ENABLE_TELEMETRY\", default=True)`). The flag isn't in the environment-variable reference or anywhere else in the docs we read. Counts only, self-hosted only, so the minimum deduction (https://github.com/Flagsmith/flagsmith/blob/main/api/app/settings/common.py ; https://github.com/Flagsmith/flagsmith/blob/main/api/telemetry/telemetry.py)." ], "verdict": "Flagsmith pairs a BSD-licensed core with a hosted MCP server whose 54 tools come from its OpenAPI spec and carry read and destructive hints. A public 99.95 per cent SLA and SOC 2 report back the Cloud service. The MCP server is still an early release, and fine-grained key roles need a paid Scale-Up or Enterprise plan.", "bestFor": "Feature flags and experiments for teams that want open source or self-hosting, managed by an agent through MCP.", "strengths": [ "Hosted MCP server at mcp.flagsmith.com with OAuth or an Organisation API key, and a stdio option for local use", "Each of the 54 MCP tools has readOnlyHint, destructiveHint and idempotentHint set from its HTTP method", "Public SLA of 99.95 per cent monthly uptime with service credits, and a status page with component history", "BSD-3-Clause source with a free self-hosted edition and 34 tagged releases in the last 90 days", "OIDC trust relationships let CI jobs get short-lived Management API tokens without stored secrets" ], "weaknesses": [ "The MCP docs call the server an early release, and experiment tools are marked beta", "54 tools load at once, with no toolsets or read-only mode on the server", "Granular API key roles, change requests and audit logs need Scale-Up or Enterprise", "No llms.txt, no documented 429 handling, and few documented error responses in the spec", "Self-hosted installs send a usage heartbeat by default through a flag the docs don't mention" ], "agentNotes": [ "Send the key as `Authorization: Api-Key \u003ckey\u003e`; the `Api-Key ` prefix is required and a bare key fails", "Check whether the environment uses v2 feature versioning before choosing between segment-override and version-state tools", "Use a key with a read-only RBAC role for analysis tasks, since a Free plan key has organisation admin rights", "Pace Management API calls under 500 a minute; no Retry-After guidance is documented", "Treat experiment results as possibly null until Flagsmith has computed them" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.2 } ], "editorialScores": { "ergonomics": 55, "maintenance": 83, "payments": 40, "reliability": 65, "schema": 67, "security": 65, "transparency": 67 }, "provenanceScore": 86, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -H \"Authorization: Api-Key $FLAGSMITH_ORG_KEY\" https://api.flagsmith.com/api/v1/projects/", "claudeCode": "claude mcp add --transport http flagsmith https://mcp.flagsmith.com", "config": { "mcpServers": { "flagsmith": { "headers": { "Authorization": "Api-Key \u003cyour-api-key\u003e" }, "url": "https://mcp.flagsmith.com" } } } }, "letme": { "capability": "https://letme.dev/analytics.flags", "tool": "https://letme.dev/flagsmith" }, "area": "business", "unitPrices": [ { "item": "Start-Up plan", "unit": "month", "usd": 45, "note": "1,000,000 requests and 3 team members; $40 a month billed yearly" }, { "item": "Scale-Up plan", "unit": "month", "usd": 300, "note": "5,000,000 requests and 5 team members; $250 a month billed yearly" }, { "item": "Extra API calls", "unit": "1k-requests", "usd": 0.05, "note": "From $50 per million, lower with volume" }, { "item": "Extra Scale-Up team member", "unit": "seat-month", "usd": 50, "note": "Up to 20 members" } ], "provenance": { "legalEntity": "Bullet Train Ltd", "domain": "flagsmith.com", "domainRegistered": "2018-03-01", "endpointOnVendorDomain": true, "terms": "https://www.flagsmith.com/terms-of-service", "privacy": "https://www.flagsmith.com/privacy-policy", "statusPage": "https://status.flagsmith.com", "changelog": "https://github.com/Flagsmith/flagsmith/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms of service name Bullet Train Limited trading as Flagsmith, company number 12353266, registered at 66 Paul St, London, under the laws of England and Wales. Companies House lists the company with five active officers.", "The privacy policy was last updated in October 2023; the GDPR sub-processor list is dated 13 October 2025.", "www.flagsmith.com/robots.txt disallows only sign-up, login and similar paths. docs.flagsmith.com has no robots.txt. The terms contain no clause on automated access that we found.", "www.flagsmith.com/.well-known/security.txt returned 404. SECURITY.md in the repository asks for reports to support@flagsmith.com.", "RDAP gives flagsmith.com a registration date of 1 March 2018." ], "score": 86 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/flagsmith.json", "live": { "slug": "flagsmith", "probe": { "target": "https://mcp.flagsmith.com", "method": "get", "lastAt": "2026-11-07T18:20:25.400493249Z", "lastOk": true, "lastStatus": 401, "lastMs": 94, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 27, "p95ms24h": 100, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.flagsmith.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:11.347876696Z" }, "versions": [ { "registry": "github", "name": "Flagsmith/flagsmith", "version": "v2.290.0", "released": "2026-11-05", "seenAt": "2026-11-06T23:26:24.068130998Z" }, { "registry": "npm", "name": "flagsmith", "version": "10.0.0", "seenAt": "2026-11-06T23:26:23.147625706Z" }, { "registry": "pypi", "name": "flagsmith", "version": "6.5.0", "released": "2026-11-06", "seenAt": "2026-11-06T23:26:23.005711379Z" } ], "githubStars": 6642, "npmWeekly": 156837, "pypiWeekly": 401488, "securityTxt": { "url": "https://flagsmith.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:18.95883898Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/Flagsmith/flagsmith/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:21.223652009Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "34b306151856" }, { "url": "https://www.flagsmith.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:28:36.671052285Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ba6cc5c7a64f" }, { "url": "https://www.flagsmith.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:28:38.746283857Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "6ada20e0c356" } ], "mcpTools": { "url": "https://mcp.flagsmith.com", "checkedAt": "2026-11-07T01:44:38.567136868Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:44:38.567136868Z" }, "updatedAt": "2026-11-07T18:21:11.347876696Z" } }, "answer": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 4 of 7 scored categories. Flagsmith leads on payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "harness-fme", "name": "Harness Feature Management \u0026 Experimentation", "vendor": "Harness Inc.", "vendorUrl": "https://www.harness.io", "kind": "http-api", "category": "product-analytics", "summary": "Harness Feature Management \u0026 Experimentation (FME), formerly Split, manages feature flags, targeting, metrics and experiments. Agents reach it through the Admin API at api.split.io and the FME toolset of the Harness MCP server.", "url": "https://www.anchorterminal.com/tools/harness-fme", "markdownUrl": "https://www.anchorterminal.com/tools/harness-fme.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/harness-fme.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/harness-fme.json", "dns": "harness-fme.grade.anchorterminal.com", "repo": "https://github.com/harness/mcp-server", "transports": [ "http", "stdio", "streamable-http" ], "remoteUrl": "https://mcp.harness.io/mcp", "packages": [ { "registry": "npm", "name": "harness-mcp-v2" } ], "auth": "mixed", "authNotes": "The Admin API takes an Admin API key as a Bearer token, or a Harness personal access token (PAT) or service account token (SAT) in `x-api-key`. Admin keys carry fixed roles that can be combined and cannot be edited after creation, and a key cannot create another with more roles. The local MCP server reads HARNESS_API_KEY. The hosted MCP endpoint uses Harness Platform OAuth and must be enabled per account by Harness Support.", "pricing": "freemium", "pricingNotes": "An FME Free Plan is enabled from inside a Harness account; its limits are not published. The Enterprise plan and FME pricing are by quotation through sales. No FME prices appear on harness.io/pricing.", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the FME docs, the Split API reference or harness.io/pricing (checked 2026-11-06).", "endpoints": [] }, "toolCount": 11, "popularity": { "githubStars": null, "npmWeekly": 8800, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://developer.harness.io/feature-management-experimentation/feature-management-and-experimentation-documentation", "llmsTxt": "https://developer.harness.io/llms.txt", "capabilities": [ "analytics.flags", "analytics.experiments", "analytics.events" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "llms-txt", "free-tier", "sales-led", "status-page", "soc2", "iso27001", "typescript", "python", "cli", "closed-source" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 69.2, "grade": "B", "agentReady": false, "rank": 257, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 81, "payments": 15, "reliability": 80, "schema": 71, "security": 79, "transparency": 61 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Harness FME, formerly Split, gives agents 11 consolidated MCP tools with an FME-only toolset, a read-only switch and confirmation on writes, over an Admin API with documented limits and role-scoped keys. FME prices are not published, the free plan's limits are unstated, and the hosted MCP endpoint must be enabled by Harness Support.", "bestFor": "Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails.", "strengths": [ "11 generic MCP tools with `--toolsets=fme`, readOnlyHint on reads and elicitation before writes", "HARNESS_READ_ONLY blocks every create, update, delete and execute call", "Admin API keys with fixed, combinable roles, plus Harness PATs and SATs", "Documented rate limit with remaining and reset headers, and automatic backoff in the MCP server", "SOC 2 Type II, ISO 27001 and FedRAMP 20x, with FME audit logs and MCP audit sinks" ], "weaknesses": [ "No FME prices are published; Enterprise is by quotation and free plan limits are unstated", "The hosted MCP endpoint must be enabled per account by Harness Support", "The FME MCP docs page still describes building a Go binary, unlike the current npm package", "About 20 Admin API requests per 10 seconds per organisation, which large lists can hit", "No public OpenAPI file for the Admin API was found" ], "agentNotes": [ "Start the MCP server with `--toolsets=fme` so only FME resource types load", "Call `harness_describe(resource_type='fme_feature_flag')` before a create or update to see the fields", "Filter fme_feature_flag lists by name, tags or rollout status rather than listing every flag", "Set HARNESS_READ_ONLY for analysis tasks; leave confirmation on for kill, restore and delete", "On 429, wait at least the larger X-RateLimit-Reset-Seconds value before retrying" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.2 } ], "editorialScores": { "ergonomics": 83, "maintenance": 81, "payments": 15, "reliability": 80, "schema": 71, "security": 79, "transparency": 60 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx harness-mcp-v2@latest", "config": { "mcpServers": { "harness": { "args": [ "harness-mcp-v2@latest", "--toolsets=fme" ], "command": "npx", "env": { "HARNESS_API_KEY": "pat.xxx" } } } } }, "letme": { "capability": "https://letme.dev/analytics.flags", "tool": "https://letme.dev/harness-fme" }, "area": "business", "provenance": { "legalEntity": "Harness Inc.", "domain": "harness.io", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://www.harness.io/legal/subscription-terms", "privacy": "https://www.harness.io/legal/privacy", "statusPage": "https://status.harness.io", "changelog": "https://github.com/harness/mcp-server/releases", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The Admin API is on api.split.io, the former Split domain, and the hosted MCP endpoint on mcp.harness.io.", "The privacy statement names Harness Inc. as controller and Harness France SAS as EU representative. Its header says last updated 23 October 2026 and its body says version of 14 October 2026.", "developer.harness.io/robots.txt allows all and carries Content-Signal ai-train=yes, search=yes, ai-input=yes. docs.split.io allows all but edit and login paths.", "www.harness.io/.well-known/security.txt answered with an invalid-request page. The security page gives security@harness.io and a private bug bounty on request.", "RDAP gave no registration date for harness.io." ], "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/harness-fme.json", "live": { "slug": "harness-fme", "probe": { "target": "https://mcp.harness.io/mcp", "method": "get", "lastAt": "2026-11-07T18:20:29.454967067Z", "lastOk": true, "lastStatus": 401, "lastMs": 211, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 195, "p95ms24h": 280, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.harness.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:14.597545686Z" }, "versions": [ { "registry": "github", "name": "harness/mcp-server", "version": "v3.2.40", "released": "2026-11-05", "seenAt": "2026-11-06T23:32:13.419387707Z" }, { "registry": "npm", "name": "harness-mcp-v2", "version": "3.2.40", "seenAt": "2026-11-06T23:32:12.430886041Z" } ], "githubStars": 112, "npmWeekly": 8800, "securityTxt": { "url": "https://harness.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:19.957252225Z" }, "llmsTxt": { "url": "https://developer.harness.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:41.749004752Z" }, "pages": [ { "url": "https://www.harness.io/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:29:30.551687912Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b15935b42065" }, { "url": "https://www.harness.io/legal/subscription-terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:29:35.70684084Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "871b29e12dd4" } ], "updatedAt": "2026-11-07T18:21:14.597545686Z" } }, "edges": [ { "by": 28, "category": "ergonomics", "leads": "harness-fme", "name": "Agent ergonomics", "reasons": { "a": "54 tools, more than 30, with no toolsets or read-only subset; enterprise tools only appear where installed (5 of 25). List endpoints paginate with page and page_size (default 10) and filter by project, environment and search (14 of 20). Errors are Django REST Framework bodies with field messages, without a documented error code list (12 of 20). Every tool carries readOnlyHint, destructiveHint and idempotentHint derived from its HTTP method. No idempotency keys for POST (14 of 20). Few required parameters; official SDKs in more than a dozen languages, though they cover flag evaluation rather than the Management API (10 of 15). 5+14+12+14+10 = 55.", "b": "11 consolidated tools, and `--toolsets=fme` narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83." }, "scores": { "a": 55, "b": 83 } }, { "by": 25, "category": "payments", "leads": "flagsmith", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices and the per-million overage are public without login, though the page gives two overage rates for Start-Up ($50 per million and $7 per 100,000) (20). A $0 Free plan with 50,000 requests a month and a free BSD-3-Clause self-hosted edition. The pricing page doesn't say whether a card is needed, but the Free plan has no charge and the self-hosted edition needs no account (20). A person signs up in a browser, then approves OAuth or creates a key (0). 0+20+20+0 = 40.", "b": "No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15." }, "scores": { "a": 40, "b": 15 } }, { "by": 16, "category": "transparency", "leads": "flagsmith", "name": "Transparency \u0026 trust", "reasons": { "a": "BSD-3-Clause for the core and the MCP server; the about page says most of the product is under that licence and some CI runs with private packages, so not every Cloud feature is in the open repository (25 of 30). The terms set Flagsmith as processor with 48-hour breach notice and EEA transfer rules, and the sub-processor list is dated 13 October 2025. The privacy policy dates from October 2023 and states no retention periods (16 of 30). The Gram-hosted MCP server was retired with a dated notice (30 June 2026), and three spec operations are marked deprecated, without a stated deprecation policy (10 of 20). The sub-processor list names providers and their countries (16 of 20). 25+16+10+16 = 67.", "b": "A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60." }, "scores": { "a": 77, "b": 61 } }, { "by": 15, "category": "reliability", "leads": "harness-fme", "name": "Reliability", "reasons": { "a": "Graded on Flagsmith Cloud with the hosted lines. Statuspage at status.flagsmith.com with components for the Edge API, Admin API, dashboard and website (20). In the 90 days from 8 August, an Admin and SDK API outage on 28 October marked critical, posted at 21:56 UTC and resolved at 22:12 with no cause given, and a minor delay in processing flag changes on 10 September. The posted span of the outage is 16 minutes and its start isn't stated, so we read it as one serious incident under an hour (15 of 30). The Management API limit of 500 requests a minute is documented (15). No 429 handling, Retry-After or idempotency guidance was found in the docs (0). A public SLA commits to 99.95 per cent monthly uptime with service credits (10). The Management API is generally available, but the MCP docs call the server an early release, so half (5 of 10). 20+15+15+0+10+5 = 65.", "b": "Graded on the hosted FME Admin API with the hosted lines. Statuspage at status.harness.io with an FME component among 196 (20). In the 90 days from 8 August, two FME incidents: API write operations returned 499 errors for 30 minutes on 20 August (minor) and the FME user interface was unavailable for 15 minutes on 23 August (major, interface only; flag evaluation was unaffected per the post). No API outage of an hour or more (20 of 30). About 20 Admin API requests per 10 seconds per organisation and per IP, documented on the MCP page (15). 429 responses carry remaining and reset headers with guidance to wait for the larger reset, and the MCP server backs off and retries three times (15). No SLA was found on harness.io/pricing or the FME docs (0). FME is generally available and the MCP server is at 3.2.40 (10). 20+20+15+15+0+10 = 80." }, "scores": { "a": 65, "b": 80 } }, { "by": 14, "category": "security", "leads": "harness-fme", "name": "Security \u0026 auth", "reasons": { "a": "OAuth for interactive MCP clients with Flagsmith as the authorisation server, Organisation API keys in the Authorization header that act as admin or with chosen RBAC roles, and OIDC trust relationships that swap a CI token for a short-lived one. Granular key roles need Scale-Up or Enterprise, so a Free key is all-powerful (25 of 30). RBAC roles can limit a key to reads, and change requests put a flag change through approval on Scale-Up and Enterprise. There is no read-only switch on the MCP server itself (14 of 20). No prompt-injection guidance; tools return names, descriptions and trait values written by people (3 of 15). Audit logs record every admin action and stream by webhook, on Scale-Up and Enterprise (11 of 15). The docs say Flagsmith has a SOC 2 Type 2 report available on request, the terms promise a yearly third-party penetration test, and SECURITY.md routes reports to support email. No security.txt, bug bounty or public advisory process was found (12 of 20). 25+14+3+11+12 = 65.", "b": "Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79." }, "scores": { "a": 65, "b": 79 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Bullet Train Ltd", "b": "Harness Inc.", "name": "Vendor" }, { "a": "https://mcp.flagsmith.com", "b": "https://mcp.harness.io/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP, stdio, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "BSD-3-Clause", "b": "none", "name": "Licence" }, { "a": "54", "b": "11", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-05", "b": "2026-11-04", "name": "Last release" }, { "a": "2026-09-01", "b": "no date given", "name": "Terms last updated" }, { "a": "2023-10-01", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "6.6k stars", "b": "8.8k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 4 of 7 scored categories. Flagsmith leads on payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, Flagsmith or Harness Feature Management \u0026 Experimentation?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Flagsmith and Harness Feature Management \u0026 Experimentation need an API key?" }, { "answer": "Yes. Flagsmith has a hosted endpoint at https://mcp.flagsmith.com and Harness Feature Management \u0026 Experimentation at https://mcp.harness.io/mcp.", "question": "Can an agent call Flagsmith and Harness Feature Management \u0026 Experimentation without installing anything?" }, { "answer": "Flagsmith is open source (BSD-3-Clause). No open-source release is listed for Harness Feature Management \u0026 Experimentation.", "question": "Are Flagsmith and Harness Feature Management \u0026 Experimentation open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 40 against 15", "Transparency \u0026 trust, 77 against 61" ], "also": [ "Open source" ], "goodFor": "Feature flags and experiments for teams that want open source or self-hosting, managed by an agent through MCP.", "slug": "flagsmith", "watchFor": "The MCP docs call the server an early release, and experiment tools are marked beta" }, { "aheadOn": [ "Reliability, 80 against 65", "Agent ergonomics, 83 against 55", "Security \u0026 auth, 79 against 65" ], "also": null, "goodFor": "Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails.", "slug": "harness-fme", "watchFor": "No FME prices are published; Enterprise is by quotation and free plan limits are unstated" } ], "history": null, "job": { "capability": "analytics.flags", "name": "Feature flags" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amplitude-vs-flagsmith.json", "title": "Amplitude vs Flagsmith", "url": "https://www.anchorterminal.com/compare/amplitude-vs-flagsmith" }, { "json": "https://www.anchorterminal.com/compare/amplitude-vs-harness-fme.json", "title": "Amplitude vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/amplitude-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-flagsmith.json", "title": "Countly vs Flagsmith", "url": "https://www.anchorterminal.com/compare/countly-vs-flagsmith" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-harness-fme.json", "title": "Countly vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/countly-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-growthbook.json", "title": "Flagsmith vs GrowthBook", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-growthbook" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-launchdarkly.json", "title": "Flagsmith vs LaunchDarkly", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-launchdarkly" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-mixpanel.json", "title": "Flagsmith vs Mixpanel", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-mixpanel" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-optimizely.json", "title": "Flagsmith vs Optimizely Experimentation", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-optimizely" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-posthog.json", "title": "Flagsmith vs PostHog", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-statsig.json", "title": "Flagsmith vs Statsig", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-launchdarkly.json", "title": "Harness Feature Management \u0026 Experimentation vs LaunchDarkly", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-launchdarkly" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-mixpanel.json", "title": "Harness Feature Management \u0026 Experimentation vs Mixpanel", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-mixpanel" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-optimizely.json", "title": "Harness Feature Management \u0026 Experimentation vs Optimizely Experimentation", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-optimizely" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-posthog.json", "title": "Harness Feature Management \u0026 Experimentation vs PostHog", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-statsig.json", "title": "Harness Feature Management \u0026 Experimentation vs Statsig", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-fullstory.json", "title": "Flagsmith vs Fullstory", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-fullstory" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-heap.json", "title": "Flagsmith vs Heap", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-openpanel.json", "title": "Flagsmith vs OpenPanel", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-woopra.json", "title": "Flagsmith vs Woopra", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-harness-fme.json", "title": "Fullstory vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/fullstory-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-heap.json", "title": "Harness Feature Management \u0026 Experimentation vs Heap", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-openpanel.json", "title": "Harness Feature Management \u0026 Experimentation vs OpenPanel", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-woopra.json", "title": "Harness Feature Management \u0026 Experimentation vs Woopra", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-matomo.json", "title": "Flagsmith vs Matomo", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-matomo" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics.json", "title": "Flagsmith vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-harness-fme.json", "title": "GrowthBook vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/growthbook-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-matomo.json", "title": "Harness Feature Management \u0026 Experimentation vs Matomo", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-matomo" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics.json", "title": "Harness Feature Management \u0026 Experimentation vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics" } ], "panel": null, "scores": [ { "by": 15, "edge": "harness-fme", "flagsmith": 65, "harness-fme": 80, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 4, "edge": "harness-fme", "flagsmith": 67, "harness-fme": 71, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 28, "edge": "harness-fme", "flagsmith": 55, "harness-fme": 83, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 14, "edge": "harness-fme", "flagsmith": 65, "harness-fme": 79, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 25, "edge": "flagsmith", "flagsmith": 40, "harness-fme": 15, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 2, "edge": "flagsmith", "flagsmith": 83, "harness-fme": 81, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 16, "edge": "flagsmith", "flagsmith": 77, "harness-fme": 61, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 4 of 7 scored categories. Flagsmith leads on payments \u0026 pricing and transparency \u0026 trust. Both do feature flags.", "tasks": null, "tutorials": [], "verdicts": { "flagsmith": "Flagsmith pairs a BSD-licensed core with a hosted MCP server whose 54 tools come from its OpenAPI spec and carry read and destructive hints. A public 99.95 per cent SLA and SOC 2 report back the Cloud service. The MCP server is still an early release, and fine-grained key roles need a paid Scale-Up or Enterprise plan.", "harness-fme": "Harness FME, formerly Split, gives agents 11 consolidated MCP tools with an FME-only toolset, a read-only switch and confirmation on writes, over an Admin API with documented limits and role-scoped keys. FME prices are not published, the free plan's limits are unstated, and the hosted MCP endpoint must be enabled by Harness Support." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme", "json": "https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.min.md" }, "markdown": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 4 of 7 scored categories. Flagsmith leads on payments \u0026 pricing and transparency \u0026 trust. Both do feature flags.\n\n- Flagsmith: grade C, 61.2/100, rank #620 of 1486. Markdown https://www.anchorterminal.com/tools/flagsmith.md · JSON https://www.anchorterminal.com/api/v1/tools/flagsmith.json\n- Harness Feature Management \u0026 Experimentation: grade B, 69.2/100, rank #257 of 1486. Markdown https://www.anchorterminal.com/tools/harness-fme.md · JSON https://www.anchorterminal.com/api/v1/tools/harness-fme.json\n- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md\n- All 153 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md\n\n## Which one, for what\n\n### Flagsmith (C)\n\nGood for: Feature flags and experiments for teams that want open source or self-hosting, managed by an agent through MCP.\n\nAhead on:\n- Payments \u0026 pricing, 40 against 15\n- Transparency \u0026 trust, 77 against 61\n\nAlso in its favour:\n- Open source\n\nWatch for: The MCP docs call the server an early release, and experiment tools are marked beta\n\n### Harness Feature Management \u0026 Experimentation (B)\n\nGood for: Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails.\n\nAhead on:\n- Reliability, 80 against 65\n- Agent ergonomics, 83 against 55\n- Security \u0026 auth, 79 against 65\n\nWatch for: No FME prices are published; Enterprise is by quotation and free plan limits are unstated\n\n\n## Why the edge\n\n### Agent ergonomics: Harness Feature Management \u0026 Experimentation +28\n\n- Flagsmith (55): 54 tools, more than 30, with no toolsets or read-only subset; enterprise tools only appear where installed (5 of 25). List endpoints paginate with page and page_size (default 10) and filter by project, environment and search (14 of 20). Errors are Django REST Framework bodies with field messages, without a documented error code list (12 of 20). Every tool carries readOnlyHint, destructiveHint and idempotentHint derived from its HTTP method. No idempotency keys for POST (14 of 20). Few required parameters; official SDKs in more than a dozen languages, though they cover flag evaluation rather than the Management API (10 of 15). 5+14+12+14+10 = 55.\n- Harness Feature Management \u0026 Experimentation (83): 11 consolidated tools, and `--toolsets=fme` narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.\n\n### Payments \u0026 pricing: Flagsmith +25\n\n- Flagsmith (40): No x402, MPP or L402 (0). Plan prices and the per-million overage are public without login, though the page gives two overage rates for Start-Up ($50 per million and $7 per 100,000) (20). A $0 Free plan with 50,000 requests a month and a free BSD-3-Clause self-hosted edition. The pricing page doesn't say whether a card is needed, but the Free plan has no charge and the self-hosted edition needs no account (20). A person signs up in a browser, then approves OAuth or creates a key (0). 0+20+20+0 = 40.\n- Harness Feature Management \u0026 Experimentation (15): No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.\n\n### Transparency \u0026 trust: Flagsmith +16\n\n- Flagsmith (77): BSD-3-Clause for the core and the MCP server; the about page says most of the product is under that licence and some CI runs with private packages, so not every Cloud feature is in the open repository (25 of 30). The terms set Flagsmith as processor with 48-hour breach notice and EEA transfer rules, and the sub-processor list is dated 13 October 2025. The privacy policy dates from October 2023 and states no retention periods (16 of 30). The Gram-hosted MCP server was retired with a dated notice (30 June 2026), and three spec operations are marked deprecated, without a stated deprecation policy (10 of 20). The sub-processor list names providers and their countries (16 of 20). 25+16+10+16 = 67.\n- Harness Feature Management \u0026 Experimentation (61): A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60.\n\n### Reliability: Harness Feature Management \u0026 Experimentation +15\n\n- Flagsmith (65): Graded on Flagsmith Cloud with the hosted lines. Statuspage at status.flagsmith.com with components for the Edge API, Admin API, dashboard and website (20). In the 90 days from 8 August, an Admin and SDK API outage on 28 October marked critical, posted at 21:56 UTC and resolved at 22:12 with no cause given, and a minor delay in processing flag changes on 10 September. The posted span of the outage is 16 minutes and its start isn't stated, so we read it as one serious incident under an hour (15 of 30). The Management API limit of 500 requests a minute is documented (15). No 429 handling, Retry-After or idempotency guidance was found in the docs (0). A public SLA commits to 99.95 per cent monthly uptime with service credits (10). The Management API is generally available, but the MCP docs call the server an early release, so half (5 of 10). 20+15+15+0+10+5 = 65.\n- Harness Feature Management \u0026 Experimentation (80): Graded on the hosted FME Admin API with the hosted lines. Statuspage at status.harness.io with an FME component among 196 (20). In the 90 days from 8 August, two FME incidents: API write operations returned 499 errors for 30 minutes on 20 August (minor) and the FME user interface was unavailable for 15 minutes on 23 August (major, interface only; flag evaluation was unaffected per the post). No API outage of an hour or more (20 of 30). About 20 Admin API requests per 10 seconds per organisation and per IP, documented on the MCP page (15). 429 responses carry remaining and reset headers with guidance to wait for the larger reset, and the MCP server backs off and retries three times (15). No SLA was found on harness.io/pricing or the FME docs (0). FME is generally available and the MCP server is at 3.2.40 (10). 20+20+15+15+0+10 = 80.\n\n### Security \u0026 auth: Harness Feature Management \u0026 Experimentation +14\n\n- Flagsmith (65): OAuth for interactive MCP clients with Flagsmith as the authorisation server, Organisation API keys in the Authorization header that act as admin or with chosen RBAC roles, and OIDC trust relationships that swap a CI token for a short-lived one. Granular key roles need Scale-Up or Enterprise, so a Free key is all-powerful (25 of 30). RBAC roles can limit a key to reads, and change requests put a flag change through approval on Scale-Up and Enterprise. There is no read-only switch on the MCP server itself (14 of 20). No prompt-injection guidance; tools return names, descriptions and trait values written by people (3 of 15). Audit logs record every admin action and stream by webhook, on Scale-Up and Enterprise (11 of 15). The docs say Flagsmith has a SOC 2 Type 2 report available on request, the terms promise a yearly third-party penetration test, and SECURITY.md routes reports to support email. No security.txt, bug bounty or public advisory process was found (12 of 20). 25+14+3+11+12 = 65.\n- Harness Feature Management \u0026 Experimentation (79): Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.\n\n## Score by category\n\n| Category | Weight | Flagsmith | Harness Feature Management \u0026 Experimentation | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 80 | Harness Feature Management \u0026 Experimentation +15 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 67 | 71 | Harness Feature Management \u0026 Experimentation +4 |\n| Agent ergonomics | 13% (16.2 this run) | 55 | 83 | Harness Feature Management \u0026 Experimentation +28 |\n| Security \u0026 auth | 14% (17.5 this run) | 65 | 79 | Harness Feature Management \u0026 Experimentation +14 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 15 | Flagsmith +25 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 83 | 81 | Flagsmith +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 77 | 61 | Flagsmith +16 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **61.2 · C** | **69.2 · B** | |\n\n## Facts side by side\n\n| Fact | Flagsmith | Harness Feature Management \u0026 Experimentation |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Bullet Train Ltd | Harness Inc. |\n| Hosted endpoint | `https://mcp.flagsmith.com` | `https://mcp.harness.io/mcp` |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, stdio, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | BSD-3-Clause | none |\n| Tools exposed | 54 | 11 |\n| Read-only variant documented | yes | no |\n| llms.txt | no | yes |\n| Last release | 2026-11-05 | 2026-11-04 |\n| Terms last updated | 2026-09-01 | no date given |\n| Privacy policy last updated | 2023-10-01 | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 6.6k stars | 8.8k npm/wk |\n\n## Verdicts\n\n**Flagsmith.** Flagsmith pairs a BSD-licensed core with a hosted MCP server whose 54 tools come from its OpenAPI spec and carry read and destructive hints. A public 99.95 per cent SLA and SOC 2 report back the Cloud service. The MCP server is still an early release, and fine-grained key roles need a paid Scale-Up or Enterprise plan.\n\n**Harness Feature Management \u0026 Experimentation.** Harness FME, formerly Split, gives agents 11 consolidated MCP tools with an FME-only toolset, a read-only switch and confirmation on writes, over an Admin API with documented limits and role-scoped keys. FME prices are not published, the free plan's limits are unstated, and the hosted MCP endpoint must be enabled by Harness Support.\n\n## Before you call either\n\n### Flagsmith\n\n1. Send the key as `Authorization: Api-Key \u003ckey\u003e`; the `Api-Key ` prefix is required and a bare key fails\n2. Check whether the environment uses v2 feature versioning before choosing between segment-override and version-state tools\n3. Use a key with a read-only RBAC role for analysis tasks, since a Free plan key has organisation admin rights\n4. Pace Management API calls under 500 a minute; no Retry-After guidance is documented\n5. Treat experiment results as possibly null until Flagsmith has computed them\n\n### Harness Feature Management \u0026 Experimentation\n\n1. Start the MCP server with `--toolsets=fme` so only FME resource types load\n2. Call `harness_describe(resource_type='fme_feature_flag')` before a create or update to see the fields\n3. Filter fme_feature_flag lists by name, tags or rollout status rather than listing every flag\n4. Set HARNESS_READ_ONLY for analysis tasks; leave confirmation on for kill, restore and delete\n5. On 429, wait at least the larger X-RateLimit-Reset-Seconds value before retrying\n\n## Questions\n\n### Which is better for AI agents, Flagsmith or Harness Feature Management \u0026 Experimentation?\n\nHarness Feature Management \u0026 Experimentation scores 69.2 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 4 of 7 scored categories. Flagsmith leads on payments \u0026 pricing and transparency \u0026 trust.\n\n### Do Flagsmith and Harness Feature Management \u0026 Experimentation need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Flagsmith and Harness Feature Management \u0026 Experimentation without installing anything?\n\nYes. Flagsmith has a hosted endpoint at https://mcp.flagsmith.com and Harness Feature Management \u0026 Experimentation at https://mcp.harness.io/mcp.\n\n### Are Flagsmith and Harness Feature Management \u0026 Experimentation open source?\n\nFlagsmith is open source (BSD-3-Clause). No open-source release is listed for Harness Feature Management \u0026 Experimentation.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.json, and with the fewest tokens: https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"flagsmith\", \"b\": \"harness-fme\"}`. From a terminal: `anchor compare flagsmith harness-fme`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/flagsmith.json and https://www.anchorterminal.com/api/v1/tools/harness-fme.json\n\n## Other comparisons with Flagsmith or Harness Feature Management \u0026 Experimentation\n\n- [Amplitude vs Flagsmith](https://www.anchorterminal.com/compare/amplitude-vs-flagsmith.md)\n- [Amplitude vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/amplitude-vs-harness-fme.md)\n- [Countly vs Flagsmith](https://www.anchorterminal.com/compare/countly-vs-flagsmith.md)\n- [Countly vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/countly-vs-harness-fme.md)\n- [Flagsmith vs GrowthBook](https://www.anchorterminal.com/compare/flagsmith-vs-growthbook.md)\n- [Flagsmith vs LaunchDarkly](https://www.anchorterminal.com/compare/flagsmith-vs-launchdarkly.md)\n- [Flagsmith vs Mixpanel](https://www.anchorterminal.com/compare/flagsmith-vs-mixpanel.md)\n- [Flagsmith vs Optimizely Experimentation](https://www.anchorterminal.com/compare/flagsmith-vs-optimizely.md)\n- [Flagsmith vs PostHog](https://www.anchorterminal.com/compare/flagsmith-vs-posthog.md)\n- [Flagsmith vs Statsig](https://www.anchorterminal.com/compare/flagsmith-vs-statsig.md)\n- [Harness Feature Management \u0026 Experimentation vs LaunchDarkly](https://www.anchorterminal.com/compare/harness-fme-vs-launchdarkly.md)\n- [Harness Feature Management \u0026 Experimentation vs Mixpanel](https://www.anchorterminal.com/compare/harness-fme-vs-mixpanel.md)\n- [Harness Feature Management \u0026 Experimentation vs Optimizely Experimentation](https://www.anchorterminal.com/compare/harness-fme-vs-optimizely.md)\n- [Harness Feature Management \u0026 Experimentation vs PostHog](https://www.anchorterminal.com/compare/harness-fme-vs-posthog.md)\n- [Harness Feature Management \u0026 Experimentation vs Statsig](https://www.anchorterminal.com/compare/harness-fme-vs-statsig.md)\n- [Flagsmith vs Fullstory](https://www.anchorterminal.com/compare/flagsmith-vs-fullstory.md)\n- [Flagsmith vs Heap](https://www.anchorterminal.com/compare/flagsmith-vs-heap.md)\n- [Flagsmith vs OpenPanel](https://www.anchorterminal.com/compare/flagsmith-vs-openpanel.md)\n- [Flagsmith vs Woopra](https://www.anchorterminal.com/compare/flagsmith-vs-woopra.md)\n- [Fullstory vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/fullstory-vs-harness-fme.md)\n- [Harness Feature Management \u0026 Experimentation vs Heap](https://www.anchorterminal.com/compare/harness-fme-vs-heap.md)\n- [Harness Feature Management \u0026 Experimentation vs OpenPanel](https://www.anchorterminal.com/compare/harness-fme-vs-openpanel.md)\n- [Harness Feature Management \u0026 Experimentation vs Woopra](https://www.anchorterminal.com/compare/harness-fme-vs-woopra.md)\n- [Flagsmith vs Matomo](https://www.anchorterminal.com/compare/flagsmith-vs-matomo.md)\n- [Flagsmith vs Mostly Good Metrics](https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics.md)\n- [GrowthBook vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/growthbook-vs-harness-fme.md)\n- [Harness Feature Management \u0026 Experimentation vs Matomo](https://www.anchorterminal.com/compare/harness-fme-vs-matomo.md)\n- [Harness Feature Management \u0026 Experimentation vs Mostly Good Metrics](https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Flagsmith vs Harness Feature Management \u0026 Experimentation", "url": "" } ], "description": "Harness Feature Management \u0026 Experimentation scores 69.2 (B) to Flagsmith's 61.2 (C) for feature flags. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Flagsmith C 61.2", "Harness Feature Management \u0026 Experimentation B 69.2", "scores" ], "h1": "Flagsmith vs Harness Feature Management \u0026 Experimentation", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/flagsmith-vs-harness-fme", "published": "2026-10-01", "section": "tools", "title": "Flagsmith vs Harness Feature Management \u0026 Experimentation (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme" }, "tokens": { "markdown": 4700, "slim": 2580 }, "version": 1 }