{ "data": { "a": { "slug": "flagsmith", "name": "Flagsmith", "vendor": "Bullet Train Ltd", "vendorUrl": "https://www.flagsmith.com", "kind": "http-api", "category": "product-analytics", "summary": "Flagsmith is an open-source feature flag, remote config and experimentation service from Bullet Train Ltd. Teams use it on Flagsmith Cloud or self-hosted, through SDKs, a Management API and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/flagsmith", "markdownUrl": "https://www.anchorterminal.com/tools/flagsmith.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/flagsmith.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/flagsmith.json", "dns": "flagsmith.grade.anchorterminal.com", "repo": "https://github.com/Flagsmith/flagsmith", "license": "BSD-3-Clause", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.flagsmith.com", "packages": [ { "registry": "pypi", "name": "flagsmith" }, { "registry": "npm", "name": "flagsmith" } ], "auth": "mixed", "authNotes": "The hosted MCP server takes OAuth (the client discovers Flagsmith as the authorisation server and a person signs in) or an Organisation API key sent as `Authorization: Api-Key \u003ckey\u003e`. Organisation keys act as full organisation admin or with chosen RBAC roles; granular roles need Scale-Up or Enterprise. OIDC trust relationships let CI workloads such as GitHub Actions exchange their token for a short-lived one. SDK environment keys are separate.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 50,000 requests a month and one team member. Start-Up is $45 a month ($40 billed yearly) for 1,000,000 requests and three members, Scale-Up $300 a month ($250 yearly) for 5,000,000. Enterprise by quote. Extra API calls from $50 per million; the page also quotes $7 per 100,000 for Start-Up. The self-hosted edition is free under BSD-3-Clause.", "priceSummary": "$45 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI spec or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 54, "popularity": { "githubStars": 6639, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.flagsmith.com/", "openapi": "https://github.com/Flagsmith/flagsmith/blob/main/openapi.yaml", "capabilities": [ "analytics.flags", "analytics.experiments", "analytics.events" ], "tags": [ "official", "hosted", "open-source", "self-hosted", "mcp", "remote-mcp", "oauth", "openapi", "free-tier", "status-page", "soc2", "sla", "python", "typescript" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 61.2, "grade": "C", "agentReady": false, "rank": 620, "ranked": true, "rankOf": 1486, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 55, "maintenance": 83, "payments": 40, "reliability": 65, "schema": 67, "security": 65, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -2, "negativeNotes": [ "6 November 2026. The self-hosted API sends a heartbeat to https://api.flagsmith.com/api/v1/analytics/telemetry/ with counts of organisations, projects, environments, feature flags, segments and users, on by default (`ENABLE_TELEMETRY = env.bool(\"ENABLE_TELEMETRY\", default=True)`). The flag isn't in the environment-variable reference or anywhere else in the docs we read. Counts only, self-hosted only, so the minimum deduction (https://github.com/Flagsmith/flagsmith/blob/main/api/app/settings/common.py ; https://github.com/Flagsmith/flagsmith/blob/main/api/telemetry/telemetry.py)." ], "verdict": "Flagsmith pairs a BSD-licensed core with a hosted MCP server whose 54 tools come from its OpenAPI spec and carry read and destructive hints. A public 99.95 per cent SLA and SOC 2 report back the Cloud service. The MCP server is still an early release, and fine-grained key roles need a paid Scale-Up or Enterprise plan.", "bestFor": "Feature flags and experiments for teams that want open source or self-hosting, managed by an agent through MCP.", "strengths": [ "Hosted MCP server at mcp.flagsmith.com with OAuth or an Organisation API key, and a stdio option for local use", "Each of the 54 MCP tools has readOnlyHint, destructiveHint and idempotentHint set from its HTTP method", "Public SLA of 99.95 per cent monthly uptime with service credits, and a status page with component history", "BSD-3-Clause source with a free self-hosted edition and 34 tagged releases in the last 90 days", "OIDC trust relationships let CI jobs get short-lived Management API tokens without stored secrets" ], "weaknesses": [ "The MCP docs call the server an early release, and experiment tools are marked beta", "54 tools load at once, with no toolsets or read-only mode on the server", "Granular API key roles, change requests and audit logs need Scale-Up or Enterprise", "No llms.txt, no documented 429 handling, and few documented error responses in the spec", "Self-hosted installs send a usage heartbeat by default through a flag the docs don't mention" ], "agentNotes": [ "Send the key as `Authorization: Api-Key \u003ckey\u003e`; the `Api-Key ` prefix is required and a bare key fails", "Check whether the environment uses v2 feature versioning before choosing between segment-override and version-state tools", "Use a key with a read-only RBAC role for analysis tasks, since a Free plan key has organisation admin rights", "Pace Management API calls under 500 a minute; no Retry-After guidance is documented", "Treat experiment results as possibly null until Flagsmith has computed them" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.2 } ], "editorialScores": { "ergonomics": 55, "maintenance": 83, "payments": 40, "reliability": 65, "schema": 67, "security": 65, "transparency": 67 }, "provenanceScore": 86, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -H \"Authorization: Api-Key $FLAGSMITH_ORG_KEY\" https://api.flagsmith.com/api/v1/projects/", "claudeCode": "claude mcp add --transport http flagsmith https://mcp.flagsmith.com", "config": { "mcpServers": { "flagsmith": { "headers": { "Authorization": "Api-Key \u003cyour-api-key\u003e" }, "url": "https://mcp.flagsmith.com" } } } }, "letme": { "capability": "https://letme.dev/analytics.flags", "tool": "https://letme.dev/flagsmith" }, "area": "business", "unitPrices": [ { "item": "Start-Up plan", "unit": "month", "usd": 45, "note": "1,000,000 requests and 3 team members; $40 a month billed yearly" }, { "item": "Scale-Up plan", "unit": "month", "usd": 300, "note": "5,000,000 requests and 5 team members; $250 a month billed yearly" }, { "item": "Extra API calls", "unit": "1k-requests", "usd": 0.05, "note": "From $50 per million, lower with volume" }, { "item": "Extra Scale-Up team member", "unit": "seat-month", "usd": 50, "note": "Up to 20 members" } ], "provenance": { "legalEntity": "Bullet Train Ltd", "domain": "flagsmith.com", "domainRegistered": "2018-03-01", "endpointOnVendorDomain": true, "terms": "https://www.flagsmith.com/terms-of-service", "privacy": "https://www.flagsmith.com/privacy-policy", "statusPage": "https://status.flagsmith.com", "changelog": "https://github.com/Flagsmith/flagsmith/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms of service name Bullet Train Limited trading as Flagsmith, company number 12353266, registered at 66 Paul St, London, under the laws of England and Wales. Companies House lists the company with five active officers.", "The privacy policy was last updated in October 2023; the GDPR sub-processor list is dated 13 October 2025.", "www.flagsmith.com/robots.txt disallows only sign-up, login and similar paths. docs.flagsmith.com has no robots.txt. The terms contain no clause on automated access that we found.", "www.flagsmith.com/.well-known/security.txt returned 404. SECURITY.md in the repository asks for reports to support@flagsmith.com.", "RDAP gives flagsmith.com a registration date of 1 March 2018." ], "score": 86 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/flagsmith.json", "live": { "slug": "flagsmith", "probe": { "target": "https://mcp.flagsmith.com", "method": "get", "lastAt": "2026-11-07T18:20:25.400493249Z", "lastOk": true, "lastStatus": 401, "lastMs": 94, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 27, "p95ms24h": 100, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.flagsmith.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:11.347876696Z" }, "versions": [ { "registry": "github", "name": "Flagsmith/flagsmith", "version": "v2.290.0", "released": "2026-11-05", "seenAt": "2026-11-06T23:26:24.068130998Z" }, { "registry": "npm", "name": "flagsmith", "version": "10.0.0", "seenAt": "2026-11-06T23:26:23.147625706Z" }, { "registry": "pypi", "name": "flagsmith", "version": "6.5.0", "released": "2026-11-06", "seenAt": "2026-11-06T23:26:23.005711379Z" } ], "githubStars": 6642, "npmWeekly": 156837, "pypiWeekly": 401488, "securityTxt": { "url": "https://flagsmith.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:18.95883898Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/Flagsmith/flagsmith/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:21.223652009Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "34b306151856" }, { "url": "https://www.flagsmith.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:28:36.671052285Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ba6cc5c7a64f" }, { "url": "https://www.flagsmith.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:28:38.746283857Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "6ada20e0c356" } ], "mcpTools": { "url": "https://mcp.flagsmith.com", "checkedAt": "2026-11-07T01:44:38.567136868Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:44:38.567136868Z" }, "updatedAt": "2026-11-07T18:21:11.347876696Z" } }, "answer": "PostHog scores 67.4 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 6 of 7 scored categories.", "b": { "slug": "posthog", "name": "PostHog", "vendor": "PostHog Inc.", "vendorUrl": "https://posthog.com", "kind": "http-api", "category": "product-analytics", "summary": "PostHog is an open-source product analytics platform with session replay, feature flags, experiments, error tracking and a data warehouse. Agents reach PostHog Cloud through a REST API with a public OpenAPI spec and an official hosted MCP server.", "url": "https://www.anchorterminal.com/tools/posthog", "markdownUrl": "https://www.anchorterminal.com/tools/posthog.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/posthog.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/posthog.json", "dns": "posthog.grade.anchorterminal.com", "repo": "https://github.com/PostHog/posthog", "license": "MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://us.posthog.com", "packages": [ { "registry": "npm", "name": "posthog-node" }, { "registry": "npm", "name": "posthog-js" }, { "registry": "pypi", "name": "posthog" }, { "registry": "npm", "name": "@posthog/cli" } ], "auth": "mixed", "authNotes": "Self-serve. Private endpoints take a Bearer personal API key (`phx_`) that a signed-in user creates with chosen scopes and project or organisation access, or an OAuth access token. OAuth at oauth.posthog.com supports PKCE, dynamic client registration and client ID metadata documents, with no app review needed to go live. The MCP server uses OAuth by default or a personal API key made with the MCP Server preset. Project secret API keys are in beta. Capture and flag evaluation take the public project token.", "pricing": "freemium", "pricingNotes": "Free plan with no card, covering 1 million analytics events and 1 million flag requests a month. The paid plan has no base fee and no seat charge, and bills per unit above the free allowance (analytics events from $0.00005). API and MCP calls are not billed, but personal API key queries draw on an hourly read budget that is larger on a paid plan (https://posthog.com/pricing, checked 2026-10-07).", "priceSummary": "$0.0001 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI spec or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": 1183, "popularity": { "githubStars": 40176, "npmWeekly": 15243417, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://posthog.com/docs/api", "llmsTxt": "https://posthog.com/llms.txt", "openapi": "https://app.posthog.com/api/schema/", "registryName": "io.github.PostHog/mcp", "capabilities": [ "analytics.query", "analytics.events", "analytics.funnels", "analytics.experiments", "analytics.flags", "observability.errors", "observability.logs" ], "tags": [ "official", "hosted", "open-source", "mcp", "oauth", "openapi", "llms-txt", "free-tier", "no-card", "eu-region", "status-page", "soc2", "typescript", "python" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 67.4, "grade": "B", "agentReady": false, "rank": 327, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 78, "maintenance": 89, "payments": 40, "reliability": 84, "schema": 81, "security": 84, "transparency": 83 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -10, "negativeNotes": [ "-3: 2025-11-24. Malicious versions of posthog-node, posthog-js and six other npm packages were published with a stolen token after an attacker took CI secrets through a pull request workflow. PostHog removed them in about five hours and published a post-mortem on 26 November 2025, so the deduction is reduced (https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem).", "-2: 2026-05-29, disclosed 2026-06-02 as PSA-2026-00001 (critical). Researchers used an unsandboxed, outdated Chromium to reach a US Cloud pod and read internal production credentials. PostHog says no customer data was accessed and the credentials were rotated. Fixed and documented (https://posthog.com/handbook/company/security-advisories).", "-2: 2026-07-11 to 2026-08-04, disclosed 2026-08-21 as PSA-2026-00002 (high). Customer-run nginx proxies set up as PostHog's guide showed sent traffic to released AWS addresses, and a researcher read traffic from six EU customers. The report sat in triage for five weeks. Fixed and documented (https://posthog.com/handbook/company/security-advisories).", "-3: 2026-10-23. posthog 7.75.11 (PyPI) and posthog-node 5.57.1 (npm) stopped copying the `headers` and `authorization` of MCP tool definitions into `$ai_tools` on AI events, and stopped sending exception text that can quote prompts in `$ai_error` when privacy mode is on. The package changelogs describe the fix, and PostHog's security advisories page lists no advisory for it (https://github.com/PostHog/posthog-python/blob/main/posthog/CHANGELOG.md)." ], "verdict": "PostHog suits agents that need to query product data and manage flags or experiments. Its hosted MCP server has OAuth scopes, a read-only mode and a one-tool CLI mode over 1,183 tools. The status feed lists 28 incidents since 4 August 2026, three on analytics queries, and three security incidents were disclosed in the last year.", "bestFor": "An agent that answers product questions in SQL or with funnel, retention and trends queries, and that manages feature flags, experiments and error tracking in the same project.", "strengths": [ "Public OpenAPI 3.1 spec with 2,347 operations and a scope on most of them, plus llms.txt and a Markdown copy of every docs page", "Hosted MCP server with OAuth, a read-only switch, filters by product area or tool name and pinning to one project", "CLI mode registers one `exec` tool that searches, inspects and calls the 1,183 tools on demand", "Free plan without a card, with 1 million analytics events and 1 million flag requests a month, and public per-unit prices above that", "MIT source outside the `ee` directory, a public SOC 2 Type 2 report and a public security advisories page" ], "weaknesses": [ "28 incidents on the status feed between 4 August and 27 October 2026, three of them analytics query timeouts or failures", "Three security incidents in twelve months, among them malicious npm SDK versions on 24 November 2025. A 23 October 2026 SDK fix for MCP credentials in AI events had no advisory", "API queries stop at 10 seconds of execution, three at a time per project, with an hourly read budget on personal API keys", "No API versioning or deprecation policy was found, and the query docs reserve the right to restrict export-like queries without notice", "Customer content can be used to train PostHog's own models unless the customer opts out in settings" ], "agentNotes": [ "Add `?readonly=true` or the `x-posthog-read-only` header to the MCP URL unless the task needs writes", "Pin the session with `x-posthog-project-id`, which also removes the `switch-project` and `switch-organization` tools", "In CLI mode run `info \u003ctool\u003e` once before `call`, and send one `exec` command per request", "On a 429 with code `api_queries_budget_exceeded`, wait for `Retry-After` and read `X-PostHog-Query-Budget-Remaining-Bytes`", "Page SQL results by keyset on `timestamp`. `OFFSET` returns 400 for personal API keys, and results cap at 50,000 rows" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.4 } ], "editorialScores": { "ergonomics": 78, "maintenance": 89, "payments": 40, "reliability": 84, "schema": 81, "security": 84, "transparency": 71 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @posthog/wizard mcp add", "http": "curl \\\n -H 'Content-Type: application/json' \\\n -H \"Authorization: Bearer $POSTHOG_PERSONAL_API_KEY\" \\\n https://us.posthog.com/api/projects/:project_id/query/ \\\n -d '{\"query\": {\"kind\": \"HogQLQuery\", \"query\": \"select event, count() from events group by event limit 100\"}}'", "claudeCode": "claude mcp add --transport http posthog https://mcp.posthog.com/mcp -s user", "config": { "mcpServers": { "posthog": { "url": "https://mcp.posthog.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/analytics.query", "tool": "https://letme.dev/posthog" }, "area": "business", "unitPrices": [ { "item": "Product analytics event", "unit": "tx", "usd": 0.00005, "note": "1 to 2 million a month, first 1 million free, lower above" }, { "item": "Feature flag request", "unit": "tx", "usd": 0.0001, "note": "1 to 2 million a month, first 1 million free, lower above" }, { "item": "Session recording", "unit": "tx", "usd": 0.005, "note": "5,001 to 15,000 a month, first 5,000 free" }, { "item": "Data warehouse row", "unit": "record", "usd": 0.000015, "note": "1 to 10 million a month, first 1 million free" }, { "item": "Boost package", "unit": "month", "usd": 250 }, { "item": "Scale package", "unit": "month", "usd": 750 }, { "item": "Enterprise package", "unit": "month", "usd": 2000 } ], "provenance": { "legalEntity": "PostHog Inc. (formerly Hiberly Inc.)", "domain": "posthog.com", "domainRegistered": "2020-01-23", "endpointOnVendorDomain": true, "terms": "https://posthog.com/terms", "privacy": "https://posthog.com/privacy", "statusPage": "https://www.posthogstatus.com", "changelog": "https://posthog.com/changelog", "securityTxt": "valid", "checked": "2026-10-07", "notes": [ "The privacy policy names PostHog Inc., formerly known as Hiberly Inc., and its subsidiaries. The security handbook names Hiberly Ltd. as the UK entity.", "posthog.com/.well-known/security.txt expires 2027-08-30 and points to the security handbook. The copy on us.posthog.com expired 2024-03-14.", "status.posthog.com redirects to www.posthogstatus.com.", "RDAP for posthog.com gives a registration date of 2020-01-23.", "The API, OAuth server and MCP server answer on posthog.com subdomains." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/posthog.json", "live": { "slug": "posthog", "probe": { "target": "https://us.posthog.com", "method": "get", "lastAt": "2026-11-07T18:20:48.109201502Z", "lastOk": true, "lastStatus": 200, "lastMs": 475, "authRequired": false, "uptime24h": 100, "uptime30d": 99.99, "p50ms24h": 446, "p95ms24h": 569, "samples24h": 239, "samples30d": 7463, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 252 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://www.posthogstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:37.450387165Z" }, "versions": [ { "registry": "github", "name": "PostHog/posthog", "version": "desktop-v0.61.959", "released": "2026-11-06", "seenAt": "2026-11-06T23:57:41.813768908Z" }, { "registry": "mcp-registry", "name": "io.github.PostHog/mcp", "version": "1.0.1", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@posthog/cli", "version": "0.19.0", "seenAt": "2026-11-06T23:57:40.070966304Z" }, { "registry": "npm", "name": "posthog-js", "version": "1.447.3", "seenAt": "2026-11-06T23:57:38.624326161Z" }, { "registry": "npm", "name": "posthog-node", "version": "5.63.1", "seenAt": "2026-11-06T23:57:37.623108072Z" }, { "registry": "pypi", "name": "posthog", "version": "7.86.0", "released": "2026-11-06", "seenAt": "2026-11-06T23:57:39.946740628Z" } ], "githubStars": 40679, "npmWeekly": 20839148, "pypiWeekly": 12063741, "securityTxt": { "url": "https://posthog.com/.well-known/security.txt", "state": "valid", "expires": "2027-08-30T00:00:00.000Z", "checkedAt": "2026-11-07T16:00:18.698644072Z" }, "llmsTxt": { "url": "https://posthog.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:40.03441392Z" }, "domain": { "domain": "posthog.com", "registered": "2020-01-23", "source": "https://rdap.verisign.com/com/v1/domain/posthog.com", "checkedAt": "2026-11-01T14:23:59.370052225Z" }, "pages": [ { "url": "https://posthog.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:17:07.593863392Z", "changedAt": "2026-11-07T14:17:07.593863392Z", "fingerprint": "e3af71f7b627" }, { "url": "https://posthog.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:17:09.971897037Z", "changedAt": "2026-11-07T14:17:09.971897037Z", "fingerprint": "b6bf14465bc4" }, { "url": "https://posthog.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:17:12.346376074Z", "changedAt": "2026-11-07T14:17:12.346376074Z", "fingerprint": "562ec288cab5" }, { "url": "https://posthog.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:17:15.548582875Z", "changedAt": "2026-11-07T14:17:15.548582875Z", "fingerprint": "78b5df11b9ff" } ], "mcpTools": { "url": "https://mcp.posthog.com/mcp", "checkedAt": "2026-11-07T01:46:54.661711518Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:46:54.661711518Z" }, "github": { "repo": "posthog/posthog", "checkedAt": "2026-11-02T09:17:59.883331399Z", "stars": 40594, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:17:42Z", "openIssues": 3875, "openPRs": 1342, "issuesOpened90d": 1602, "issuesClosed90d": 1028, "prsMerged90d": 18318, "ci": { "branch": "master", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-10-23T00:10:29Z" }, "advisories": [ { "ghsa": "GHSA-wqqw-r8c5-j67c", "cve": "CVE-2023-46746", "severity": "low", "published": "2023-11-28T12:07:41Z" } ] }, "updatedAt": "2026-11-07T18:20:48.109201502Z" } }, "edges": [ { "by": 23, "category": "ergonomics", "leads": "posthog", "name": "Agent ergonomics", "reasons": { "a": "54 tools, more than 30, with no toolsets or read-only subset; enterprise tools only appear where installed (5 of 25). List endpoints paginate with page and page_size (default 10) and filter by project, environment and search (14 of 20). Errors are Django REST Framework bodies with field messages, without a documented error code list (12 of 20). Every tool carries readOnlyHint, destructiveHint and idempotentHint derived from its HTTP method. No idempotency keys for POST (14 of 20). Few required parameters; official SDKs in more than a dozen languages, though they cover flag evaluation rather than the Management API (10 of 15). 5+14+12+14+10 = 55.", "b": "1,183 MCP tool definitions in the repository on 1 November 2026 (375 behind feature flags) is far past 30 (5). Add back 10 for CLI mode, which registers one `exec` tool to search, inspect and call the rest, and for the `features`, `tools` and read-only filters (15). Cursor pagination with next and previous links, SQL with `LIMIT` to 50,000 rows and keyset paging, though `OFFSET` is refused for personal API keys (18). Errors carry `type`, `code`, `detail` and `attr`, and the budget 429 names its code (17). Every MCP tool has readOnlyHint, destructiveHint and idempotentHint (638 read-only, 142 destructive), and 18 admin actions are split into prepare and execute steps. No idempotency keys on REST writes (15). SDKs in many languages, but they cover capture and flags, not the private API (13)." }, "scores": { "a": 55, "b": 78 } }, { "by": 19, "category": "reliability", "leads": "posthog", "name": "Reliability", "reasons": { "a": "Graded on Flagsmith Cloud with the hosted lines. Statuspage at status.flagsmith.com with components for the Edge API, Admin API, dashboard and website (20). In the 90 days from 8 August, an Admin and SDK API outage on 28 October marked critical, posted at 21:56 UTC and resolved at 22:12 with no cause given, and a minor delay in processing flag changes on 10 September. The posted span of the outage is 16 minutes and its start isn't stated, so we read it as one serious incident under an hour (15 of 30). The Management API limit of 500 requests a minute is documented (15). No 429 handling, Retry-After or idempotency guidance was found in the docs (0). A public SLA commits to 99.95 per cent monthly uptime with service credits (10). The Management API is generally available, but the MCP docs call the server an early release, so half (5 of 10). 20+15+15+0+10+5 = 65.", "b": "Graded on PostHog Cloud with the hosted lines. Status page on incident.io at posthogstatus.com with per-region components, among them MCP Server and REST API Query endpoints (20). Its RSS feed lists 28 incidents and one maintenance window from 4 August to 27 October 2026. Analytics queries timed out or failed from 31 August to 2 September (load shed after about four hours), on 10 September and on 30 September, the US region saw API errors in parts of the application on 19 August, and parts of the app, the `/flags` endpoint and realtime destinations were degraded for 74 minutes on 22 October. Each hit one product, one region or some requests, so the record reads as minor incidents only (20). Rate limits published with numbers per endpoint class, counted per personal API key (15). The query read budget answers 429 with `Retry-After` and budget headers, but there is no backoff guidance for the general limits and no idempotency keys for writes were found (9). 99.95 per cent uptime SLA in the terms for the Enterprise package (10). The REST API is generally available and the MCP docs carry no beta label (10)." }, "scores": { "a": 65, "b": 84 } }, { "by": 19, "category": "security", "leads": "posthog", "name": "Security \u0026 auth", "reasons": { "a": "OAuth for interactive MCP clients with Flagsmith as the authorisation server, Organisation API keys in the Authorization header that act as admin or with chosen RBAC roles, and OIDC trust relationships that swap a CI token for a short-lived one. Granular key roles need Scale-Up or Enterprise, so a Free key is all-powerful (25 of 30). RBAC roles can limit a key to reads, and change requests put a flag change through approval on Scale-Up and Enterprise. There is no read-only switch on the MCP server itself (14 of 20). No prompt-injection guidance; tools return names, descriptions and trait values written by people (3 of 15). Audit logs record every admin action and stream by webhook, on Scale-Up and Enterprise (11 of 15). The docs say Flagsmith has a SOC 2 Type 2 report available on request, the terms promise a yearly third-party penetration test, and SECURITY.md routes reports to support email. No security.txt, bug bounty or public advisory process was found (12 of 20). 25+14+3+11+12 = 65.", "b": "OAuth 2 with PKCE, 226 scopes, a revocation endpoint and dynamic registration, or personal API keys with scopes, project limits and rolling. A key can still be created with full access, and keys found in public GitHub repositories are rolled automatically (28). Read-only mode, filters by product area or tool, project pinning, and a typed confirmation for 18 admin actions (18). The MCP docs warn about prompt injection and tell users to review tool calls, and the CLI escapes informational responses. No further mitigation is documented for event and replay data that end users wrote (9). Activity logs with an API, MCP calls recorded with the caller's IP, and an admin view of every key with last use. Longer retention needs a platform package (12). security.txt valid to 30 August 2027, Bugcrowd disclosure programme paid in merchandise, public SOC 2 Type 2 report, annual penetration test and a public advisories page (17)." }, "scores": { "a": 65, "b": 84 } }, { "by": 14, "category": "schema", "leads": "posthog", "name": "Schema \u0026 documentation", "reasons": { "a": "openapi.yaml in the repository is OpenAPI 3.1 with 624 operations, and the MCP server builds its 54 tools from the operations tagged `mcp`, so every tool has a JSON Schema input (25). No llms.txt (404) and no Markdown served for agents on docs.flagsmith.com; the docs are Markdown only in the repository (0). Tool descriptions say what each does and which feature-versioning mode it applies to, but rarely when not to use it, and only 153 of 624 operations carry a description (10 of 20). 57 enums and required fields in the spec, with some free-form value fields (10 of 15). Docs carry curl examples, but only 16 operations document a 400 and 6 a 404 (7 of 15). A /api/v1 path, release-please changelog and dated release notes (15). 25+0+10+10+7+15 = 67.", "b": "OpenAPI 3.1 served without a login, 1,742 paths and 2,347 operations, and typed JSON Schema inputs on the MCP tools (25). llms.txt, and every docs page has a Markdown copy at the same address with .md (10). 1,487 of 2,347 operations (63 per cent) have a description. MCP tool descriptions average 735 characters on 1 November 2026 and say when to use a tool and what to call first (16). 1,243 enums across 4,792 schemas and a required scope on most operations (13). 706 examples in the spec. It documents 400 on 224 operations and 429 on 55, and the docs show the error shape with examples (9). Dated public changelog with RSS, but the spec version is fixed at 1.0.0 and the API has no versions (8)." }, "scores": { "a": 67, "b": 81 } }, { "by": 6, "category": "maintenance", "leads": "posthog", "name": "Maintenance \u0026 community", "reasons": { "a": "v2.290.0 was released on 5 November 2026 (30). 34 tagged releases between 8 August and 5 November (20). Commits land daily (60 since 8 August in the 60-commit clone), with a Discord server and support email. We couldn't read issue response times because GitHub's API refused us for its rate limit (15 of 25). Not in the official MCP registry, which returned no Flagsmith entry; official SDKs are current (8 of 15). Renovate updates, CI workflows for the API, frontend, docs and MCP, and a Trivy scan (10). 30+20+15+8+10 = 83.", "b": "The changelog's newest entries are dated 30 October 2026, and posthog-node 5.61.1 and the Python SDK's posthog-v7.81.1 came out the same day (30). 204 dated changelog entries since 3 August 2026 (20). Public changelog, community questions and in-app support. Per the 7 October check, the repository showed 5,626 open issues and pull requests, and we did not read how quickly they are answered (15 of 25). `io.github.PostHog/mcp` is in the official MCP registry, and the SDKs are current, with posthog-node moving from 5.55.0 to 5.61.1 between 7 and 30 October 2026 (15). 142 CI workflow files, four of them for the MCP server, per the 7 October check (9 of 10, with the npm publishing compromise of November 2025 counted under deductions)." }, "scores": { "a": 83, "b": 89 } }, { "by": 6, "category": "transparency", "leads": "posthog", "name": "Transparency \u0026 trust", "reasons": { "a": "BSD-3-Clause for the core and the MCP server; the about page says most of the product is under that licence and some CI runs with private packages, so not every Cloud feature is in the open repository (25 of 30). The terms set Flagsmith as processor with 48-hour breach notice and EEA transfer rules, and the sub-processor list is dated 13 October 2025. The privacy policy dates from October 2023 and states no retention periods (16 of 30). The Gram-hosted MCP server was retired with a dated notice (30 June 2026), and three spec operations are marked deprecated, without a stated deprecation policy (10 of 20). The sub-processor list names providers and their countries (16 of 20). 25+16+10+16 = 67.", "b": "MIT outside the `ee` directory, which has its own licence and is part of what PostHog Cloud runs (25 of 30). Privacy policy, a self-serve DPA and the terms agree. The terms let PostHog use de-identified customer content to train its own models unless the customer opts out, and bar third parties from training on it. The privacy policy gives no retention periods, while the pricing page gives 1 year on the free plan and 7 on paid (22). No deprecation policy was found, and the query docs reserve the right to restrict export-like queries without notice. 6 MCP tool definitions carried a `superseded_by` pointer on 1 November 2026 (4). Sub-processor list updated 12 June 2026 with locations, 14 days' notice of changes, and data in Virginia or Germany (20)." }, "scores": { "a": 77, "b": 83 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Bullet Train Ltd", "b": "PostHog Inc.", "name": "Vendor" }, { "a": "https://mcp.flagsmith.com", "b": "https://us.posthog.com", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "not published", "b": "$0.0001 per transaction", "name": "Price for feature flags" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "BSD-3-Clause", "b": "MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms", "name": "Licence" }, { "a": "54", "b": "1183", "name": "Tools exposed" }, { "a": "yes", "b": "yes", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "io.github.PostHog/mcp", "name": "MCP registry" }, { "a": "2026-11-05", "b": "2026-10-30", "name": "Last release" }, { "a": "2026-09-01", "b": "2026-06-29", "name": "Terms last updated" }, { "a": "2023-10-01", "b": "2026-06-29", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "6.6k stars", "b": "40k stars, 15.2M npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "PostHog scores 67.4 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, Flagsmith or PostHog?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Flagsmith and PostHog need an API key?" }, { "answer": "Yes. Flagsmith has a hosted endpoint at https://mcp.flagsmith.com and PostHog at https://us.posthog.com.", "question": "Can an agent call Flagsmith and PostHog without installing anything?" }, { "answer": "Yes. Flagsmith is open source (BSD-3-Clause). PostHog is open source (MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms).", "question": "Are Flagsmith and PostHog open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Runs on your own machine" ], "goodFor": "Feature flags and experiments for teams that want open source or self-hosting, managed by an agent through MCP.", "slug": "flagsmith", "watchFor": "The MCP docs call the server an early release, and experiment tools are marked beta" }, { "aheadOn": [ "Reliability, 84 against 65", "Schema \u0026 documentation, 81 against 67", "Agent ergonomics, 78 against 55", "Security \u0026 auth, 84 against 65", "Maintenance \u0026 community, 89 against 83", "Transparency \u0026 trust, 83 against 77" ], "also": [ "Free to start without a card" ], "goodFor": "An agent that answers product questions in SQL or with funnel, retention and trends queries, and that manages feature flags, experiments and error tracking in the same project.", "slug": "posthog", "watchFor": "28 incidents on the status feed between 4 August and 27 October 2026, three of them analytics query timeouts or failures" } ], "history": { "flagsmith": null, "posthog": [ { "causes": [ "security", "correction" ], "date": "2026-11-01", "delta": -1, "from": 68.4, "fromGrade": "B", "to": 67.4, "toGrade": "B" } ] }, "job": { "capability": "analytics.flags", "name": "Feature flags" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amplitude-vs-posthog.json", "title": "Amplitude vs PostHog", "url": "https://www.anchorterminal.com/compare/amplitude-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/basedash-mcp-vs-posthog.json", "title": "Basedash MCP vs PostHog", "url": "https://www.anchorterminal.com/compare/basedash-mcp-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-posthog.json", "title": "Countly vs PostHog", "url": "https://www.anchorterminal.com/compare/countly-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-posthog.json", "title": "Fullstory vs PostHog", "url": "https://www.anchorterminal.com/compare/fullstory-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/matomo-vs-posthog.json", "title": "Matomo vs PostHog", "url": "https://www.anchorterminal.com/compare/matomo-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/mixpanel-vs-posthog.json", "title": "Mixpanel vs PostHog", "url": "https://www.anchorterminal.com/compare/mixpanel-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog.json", "title": "Mostly Good Metrics vs PostHog", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/openpanel-vs-posthog.json", "title": "OpenPanel vs PostHog", "url": "https://www.anchorterminal.com/compare/openpanel-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/pendo-vs-posthog.json", "title": "Pendo vs PostHog", "url": "https://www.anchorterminal.com/compare/pendo-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/posthog-vs-statsig.json", "title": "PostHog vs Statsig", "url": "https://www.anchorterminal.com/compare/posthog-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/posthog-vs-userpilot.json", "title": "PostHog vs Userpilot", "url": "https://www.anchorterminal.com/compare/posthog-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/posthog-vs-woopra.json", "title": "PostHog vs Woopra", "url": "https://www.anchorterminal.com/compare/posthog-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/amplitude-vs-flagsmith.json", "title": "Amplitude vs Flagsmith", "url": "https://www.anchorterminal.com/compare/amplitude-vs-flagsmith" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-flagsmith.json", "title": "Countly vs Flagsmith", "url": "https://www.anchorterminal.com/compare/countly-vs-flagsmith" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-growthbook.json", "title": "Flagsmith vs GrowthBook", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-growthbook" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.json", "title": "Flagsmith vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-launchdarkly.json", "title": "Flagsmith vs LaunchDarkly", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-launchdarkly" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-mixpanel.json", "title": "Flagsmith vs Mixpanel", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-mixpanel" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-optimizely.json", "title": "Flagsmith vs Optimizely Experimentation", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-optimizely" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-statsig.json", "title": "Flagsmith vs Statsig", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-posthog.json", "title": "Harness Feature Management \u0026 Experimentation vs PostHog", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/launchdarkly-vs-posthog.json", "title": "LaunchDarkly vs PostHog", "url": "https://www.anchorterminal.com/compare/launchdarkly-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-fullstory.json", "title": "Flagsmith vs Fullstory", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-fullstory" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-heap.json", "title": "Flagsmith vs Heap", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-openpanel.json", "title": "Flagsmith vs OpenPanel", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-woopra.json", "title": "Flagsmith vs Woopra", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-posthog.json", "title": "Heap vs PostHog", "url": "https://www.anchorterminal.com/compare/heap-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-matomo.json", "title": "Flagsmith vs Matomo", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-matomo" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics.json", "title": "Flagsmith vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-posthog.json", "title": "GrowthBook vs PostHog", "url": "https://www.anchorterminal.com/compare/growthbook-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/optimizely-vs-posthog.json", "title": "Optimizely Experimentation vs PostHog", "url": "https://www.anchorterminal.com/compare/optimizely-vs-posthog" } ], "panel": null, "scores": [ { "by": 19, "edge": "posthog", "flagsmith": 65, "key": "reliability", "name": "Reliability", "posthog": 84, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 14, "edge": "posthog", "flagsmith": 67, "key": "schema", "name": "Schema \u0026 documentation", "posthog": 81, "weight": 13 }, { "by": 23, "edge": "posthog", "flagsmith": 55, "key": "ergonomics", "name": "Agent ergonomics", "posthog": 78, "weight": 13 }, { "by": 19, "edge": "posthog", "flagsmith": 65, "key": "security", "name": "Security \u0026 auth", "posthog": 84, "weight": 14 }, { "by": 0, "edge": "", "flagsmith": 40, "key": "payments", "name": "Payments \u0026 pricing", "posthog": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 6, "edge": "posthog", "flagsmith": 83, "key": "maintenance", "name": "Maintenance \u0026 community", "posthog": 89, "weight": 7 }, { "by": 6, "edge": "posthog", "flagsmith": 77, "key": "transparency", "name": "Transparency \u0026 trust", "posthog": 83, "weight": 7 } ], "summary": "PostHog scores 67.4 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 6 of 7 scored categories. Both do feature flags.", "tasks": null, "tutorials": [], "verdicts": { "flagsmith": "Flagsmith pairs a BSD-licensed core with a hosted MCP server whose 54 tools come from its OpenAPI spec and carry read and destructive hints. A public 99.95 per cent SLA and SOC 2 report back the Cloud service. The MCP server is still an early release, and fine-grained key roles need a paid Scale-Up or Enterprise plan.", "posthog": "PostHog suits agents that need to query product data and manage flags or experiments. Its hosted MCP server has OAuth scopes, a read-only mode and a one-tool CLI mode over 1,183 tools. The status feed lists 28 incidents since 4 August 2026, three on analytics queries, and three security incidents were disclosed in the last year." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/flagsmith-vs-posthog", "json": "https://www.anchorterminal.com/compare/flagsmith-vs-posthog.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/flagsmith-vs-posthog.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/flagsmith-vs-posthog.min.md" }, "markdown": "PostHog scores 67.4 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 6 of 7 scored categories. Both do feature flags.\n\n- Flagsmith: grade C, 61.2/100, rank #620 of 1486. Markdown https://www.anchorterminal.com/tools/flagsmith.md · JSON https://www.anchorterminal.com/api/v1/tools/flagsmith.json\n- PostHog: grade B, 67.4/100, rank #327 of 1486. Markdown https://www.anchorterminal.com/tools/posthog.md · JSON https://www.anchorterminal.com/api/v1/tools/posthog.json\n- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md\n- All 153 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md\n\n## Which one, for what\n\n### Flagsmith (C)\n\nGood for: Feature flags and experiments for teams that want open source or self-hosting, managed by an agent through MCP.\n\nAlso in its favour:\n- Runs on your own machine\n\nWatch for: The MCP docs call the server an early release, and experiment tools are marked beta\n\n### PostHog (B)\n\nGood for: An agent that answers product questions in SQL or with funnel, retention and trends queries, and that manages feature flags, experiments and error tracking in the same project.\n\nAhead on:\n- Reliability, 84 against 65\n- Schema \u0026 documentation, 81 against 67\n- Agent ergonomics, 78 against 55\n- Security \u0026 auth, 84 against 65\n- Maintenance \u0026 community, 89 against 83\n- Transparency \u0026 trust, 83 against 77\n\nAlso in its favour:\n- Free to start without a card\n\nWatch for: 28 incidents on the status feed between 4 August and 27 October 2026, three of them analytics query timeouts or failures\n\n\n## Why the edge\n\n### Agent ergonomics: PostHog +23\n\n- Flagsmith (55): 54 tools, more than 30, with no toolsets or read-only subset; enterprise tools only appear where installed (5 of 25). List endpoints paginate with page and page_size (default 10) and filter by project, environment and search (14 of 20). Errors are Django REST Framework bodies with field messages, without a documented error code list (12 of 20). Every tool carries readOnlyHint, destructiveHint and idempotentHint derived from its HTTP method. No idempotency keys for POST (14 of 20). Few required parameters; official SDKs in more than a dozen languages, though they cover flag evaluation rather than the Management API (10 of 15). 5+14+12+14+10 = 55.\n- PostHog (78): 1,183 MCP tool definitions in the repository on 1 November 2026 (375 behind feature flags) is far past 30 (5). Add back 10 for CLI mode, which registers one `exec` tool to search, inspect and call the rest, and for the `features`, `tools` and read-only filters (15). Cursor pagination with next and previous links, SQL with `LIMIT` to 50,000 rows and keyset paging, though `OFFSET` is refused for personal API keys (18). Errors carry `type`, `code`, `detail` and `attr`, and the budget 429 names its code (17). Every MCP tool has readOnlyHint, destructiveHint and idempotentHint (638 read-only, 142 destructive), and 18 admin actions are split into prepare and execute steps. No idempotency keys on REST writes (15). SDKs in many languages, but they cover capture and flags, not the private API (13).\n\n### Reliability: PostHog +19\n\n- Flagsmith (65): Graded on Flagsmith Cloud with the hosted lines. Statuspage at status.flagsmith.com with components for the Edge API, Admin API, dashboard and website (20). In the 90 days from 8 August, an Admin and SDK API outage on 28 October marked critical, posted at 21:56 UTC and resolved at 22:12 with no cause given, and a minor delay in processing flag changes on 10 September. The posted span of the outage is 16 minutes and its start isn't stated, so we read it as one serious incident under an hour (15 of 30). The Management API limit of 500 requests a minute is documented (15). No 429 handling, Retry-After or idempotency guidance was found in the docs (0). A public SLA commits to 99.95 per cent monthly uptime with service credits (10). The Management API is generally available, but the MCP docs call the server an early release, so half (5 of 10). 20+15+15+0+10+5 = 65.\n- PostHog (84): Graded on PostHog Cloud with the hosted lines. Status page on incident.io at posthogstatus.com with per-region components, among them MCP Server and REST API Query endpoints (20). Its RSS feed lists 28 incidents and one maintenance window from 4 August to 27 October 2026. Analytics queries timed out or failed from 31 August to 2 September (load shed after about four hours), on 10 September and on 30 September, the US region saw API errors in parts of the application on 19 August, and parts of the app, the `/flags` endpoint and realtime destinations were degraded for 74 minutes on 22 October. Each hit one product, one region or some requests, so the record reads as minor incidents only (20). Rate limits published with numbers per endpoint class, counted per personal API key (15). The query read budget answers 429 with `Retry-After` and budget headers, but there is no backoff guidance for the general limits and no idempotency keys for writes were found (9). 99.95 per cent uptime SLA in the terms for the Enterprise package (10). The REST API is generally available and the MCP docs carry no beta label (10).\n\n### Security \u0026 auth: PostHog +19\n\n- Flagsmith (65): OAuth for interactive MCP clients with Flagsmith as the authorisation server, Organisation API keys in the Authorization header that act as admin or with chosen RBAC roles, and OIDC trust relationships that swap a CI token for a short-lived one. Granular key roles need Scale-Up or Enterprise, so a Free key is all-powerful (25 of 30). RBAC roles can limit a key to reads, and change requests put a flag change through approval on Scale-Up and Enterprise. There is no read-only switch on the MCP server itself (14 of 20). No prompt-injection guidance; tools return names, descriptions and trait values written by people (3 of 15). Audit logs record every admin action and stream by webhook, on Scale-Up and Enterprise (11 of 15). The docs say Flagsmith has a SOC 2 Type 2 report available on request, the terms promise a yearly third-party penetration test, and SECURITY.md routes reports to support email. No security.txt, bug bounty or public advisory process was found (12 of 20). 25+14+3+11+12 = 65.\n- PostHog (84): OAuth 2 with PKCE, 226 scopes, a revocation endpoint and dynamic registration, or personal API keys with scopes, project limits and rolling. A key can still be created with full access, and keys found in public GitHub repositories are rolled automatically (28). Read-only mode, filters by product area or tool, project pinning, and a typed confirmation for 18 admin actions (18). The MCP docs warn about prompt injection and tell users to review tool calls, and the CLI escapes informational responses. No further mitigation is documented for event and replay data that end users wrote (9). Activity logs with an API, MCP calls recorded with the caller's IP, and an admin view of every key with last use. Longer retention needs a platform package (12). security.txt valid to 30 August 2027, Bugcrowd disclosure programme paid in merchandise, public SOC 2 Type 2 report, annual penetration test and a public advisories page (17).\n\n### Schema \u0026 documentation: PostHog +14\n\n- Flagsmith (67): openapi.yaml in the repository is OpenAPI 3.1 with 624 operations, and the MCP server builds its 54 tools from the operations tagged `mcp`, so every tool has a JSON Schema input (25). No llms.txt (404) and no Markdown served for agents on docs.flagsmith.com; the docs are Markdown only in the repository (0). Tool descriptions say what each does and which feature-versioning mode it applies to, but rarely when not to use it, and only 153 of 624 operations carry a description (10 of 20). 57 enums and required fields in the spec, with some free-form value fields (10 of 15). Docs carry curl examples, but only 16 operations document a 400 and 6 a 404 (7 of 15). A /api/v1 path, release-please changelog and dated release notes (15). 25+0+10+10+7+15 = 67.\n- PostHog (81): OpenAPI 3.1 served without a login, 1,742 paths and 2,347 operations, and typed JSON Schema inputs on the MCP tools (25). llms.txt, and every docs page has a Markdown copy at the same address with .md (10). 1,487 of 2,347 operations (63 per cent) have a description. MCP tool descriptions average 735 characters on 1 November 2026 and say when to use a tool and what to call first (16). 1,243 enums across 4,792 schemas and a required scope on most operations (13). 706 examples in the spec. It documents 400 on 224 operations and 429 on 55, and the docs show the error shape with examples (9). Dated public changelog with RSS, but the spec version is fixed at 1.0.0 and the API has no versions (8).\n\n### Maintenance \u0026 community: PostHog +6\n\n- Flagsmith (83): v2.290.0 was released on 5 November 2026 (30). 34 tagged releases between 8 August and 5 November (20). Commits land daily (60 since 8 August in the 60-commit clone), with a Discord server and support email. We couldn't read issue response times because GitHub's API refused us for its rate limit (15 of 25). Not in the official MCP registry, which returned no Flagsmith entry; official SDKs are current (8 of 15). Renovate updates, CI workflows for the API, frontend, docs and MCP, and a Trivy scan (10). 30+20+15+8+10 = 83.\n- PostHog (89): The changelog's newest entries are dated 30 October 2026, and posthog-node 5.61.1 and the Python SDK's posthog-v7.81.1 came out the same day (30). 204 dated changelog entries since 3 August 2026 (20). Public changelog, community questions and in-app support. Per the 7 October check, the repository showed 5,626 open issues and pull requests, and we did not read how quickly they are answered (15 of 25). `io.github.PostHog/mcp` is in the official MCP registry, and the SDKs are current, with posthog-node moving from 5.55.0 to 5.61.1 between 7 and 30 October 2026 (15). 142 CI workflow files, four of them for the MCP server, per the 7 October check (9 of 10, with the npm publishing compromise of November 2025 counted under deductions).\n\n### Transparency \u0026 trust: PostHog +6\n\n- Flagsmith (77): BSD-3-Clause for the core and the MCP server; the about page says most of the product is under that licence and some CI runs with private packages, so not every Cloud feature is in the open repository (25 of 30). The terms set Flagsmith as processor with 48-hour breach notice and EEA transfer rules, and the sub-processor list is dated 13 October 2025. The privacy policy dates from October 2023 and states no retention periods (16 of 30). The Gram-hosted MCP server was retired with a dated notice (30 June 2026), and three spec operations are marked deprecated, without a stated deprecation policy (10 of 20). The sub-processor list names providers and their countries (16 of 20). 25+16+10+16 = 67.\n- PostHog (83): MIT outside the `ee` directory, which has its own licence and is part of what PostHog Cloud runs (25 of 30). Privacy policy, a self-serve DPA and the terms agree. The terms let PostHog use de-identified customer content to train its own models unless the customer opts out, and bar third parties from training on it. The privacy policy gives no retention periods, while the pricing page gives 1 year on the free plan and 7 on paid (22). No deprecation policy was found, and the query docs reserve the right to restrict export-like queries without notice. 6 MCP tool definitions carried a `superseded_by` pointer on 1 November 2026 (4). Sub-processor list updated 12 June 2026 with locations, 14 days' notice of changes, and data in Virginia or Germany (20).\n\n## Score by category\n\n| Category | Weight | Flagsmith | PostHog | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 84 | PostHog +19 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 67 | 81 | PostHog +14 |\n| Agent ergonomics | 13% (16.2 this run) | 55 | 78 | PostHog +23 |\n| Security \u0026 auth | 14% (17.5 this run) | 65 | 84 | PostHog +19 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 40 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 83 | 89 | PostHog +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 77 | 83 | PostHog +6 |\n| Negative events | ≤15 | -2 | -10 | |\n| **Total** | | **61.2 · C** | **67.4 · B** | |\n\n## Facts side by side\n\n| Fact | Flagsmith | PostHog |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Bullet Train Ltd | PostHog Inc. |\n| Hosted endpoint | `https://mcp.flagsmith.com` | `https://us.posthog.com` |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| Price for feature flags | not published | $0.0001 per transaction |\n| x402 | no | no |\n| Licence | BSD-3-Clause | MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms |\n| Tools exposed | 54 | 1183 |\n| Read-only variant documented | yes | yes |\n| llms.txt | no | yes |\n| MCP registry | not listed | `io.github.PostHog/mcp` |\n| Last release | 2026-11-05 | 2026-10-30 |\n| Terms last updated | 2026-09-01 | 2026-06-29 |\n| Privacy policy last updated | 2023-10-01 | 2026-06-29 |\n| Customer content may train models | not found in the text | yes, with an opt-out |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 6.6k stars | 40k stars, 15.2M npm/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### Flagsmith\n\nNo score change since it was listed.\n\n### PostHog\n\n- -1.0 on 1 November 2026: security, correction\n\n## Verdicts\n\n**Flagsmith.** Flagsmith pairs a BSD-licensed core with a hosted MCP server whose 54 tools come from its OpenAPI spec and carry read and destructive hints. A public 99.95 per cent SLA and SOC 2 report back the Cloud service. The MCP server is still an early release, and fine-grained key roles need a paid Scale-Up or Enterprise plan.\n\n**PostHog.** PostHog suits agents that need to query product data and manage flags or experiments. Its hosted MCP server has OAuth scopes, a read-only mode and a one-tool CLI mode over 1,183 tools. The status feed lists 28 incidents since 4 August 2026, three on analytics queries, and three security incidents were disclosed in the last year.\n\n## Before you call either\n\n### Flagsmith\n\n1. Send the key as `Authorization: Api-Key \u003ckey\u003e`; the `Api-Key ` prefix is required and a bare key fails\n2. Check whether the environment uses v2 feature versioning before choosing between segment-override and version-state tools\n3. Use a key with a read-only RBAC role for analysis tasks, since a Free plan key has organisation admin rights\n4. Pace Management API calls under 500 a minute; no Retry-After guidance is documented\n5. Treat experiment results as possibly null until Flagsmith has computed them\n\n### PostHog\n\n1. Add `?readonly=true` or the `x-posthog-read-only` header to the MCP URL unless the task needs writes\n2. Pin the session with `x-posthog-project-id`, which also removes the `switch-project` and `switch-organization` tools\n3. In CLI mode run `info \u003ctool\u003e` once before `call`, and send one `exec` command per request\n4. On a 429 with code `api_queries_budget_exceeded`, wait for `Retry-After` and read `X-PostHog-Query-Budget-Remaining-Bytes`\n5. Page SQL results by keyset on `timestamp`. `OFFSET` returns 400 for personal API keys, and results cap at 50,000 rows\n\n## Questions\n\n### Which is better for AI agents, Flagsmith or PostHog?\n\nPostHog scores 67.4 (B) on agent readiness against Flagsmith's 61.2 (C), and leads in 6 of 7 scored categories.\n\n### Do Flagsmith and PostHog need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Flagsmith and PostHog without installing anything?\n\nYes. Flagsmith has a hosted endpoint at https://mcp.flagsmith.com and PostHog at https://us.posthog.com.\n\n### Are Flagsmith and PostHog open source?\n\nYes. Flagsmith is open source (BSD-3-Clause). PostHog is open source (MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/flagsmith-vs-posthog.json, and with the fewest tokens: https://www.anchorterminal.com/compare/flagsmith-vs-posthog.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"flagsmith\", \"b\": \"posthog\"}`. From a terminal: `anchor compare flagsmith posthog`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/flagsmith.json and https://www.anchorterminal.com/api/v1/tools/posthog.json\n\n## Other comparisons with Flagsmith or PostHog\n\n- [Amplitude vs PostHog](https://www.anchorterminal.com/compare/amplitude-vs-posthog.md)\n- [Basedash MCP vs PostHog](https://www.anchorterminal.com/compare/basedash-mcp-vs-posthog.md)\n- [Countly vs PostHog](https://www.anchorterminal.com/compare/countly-vs-posthog.md)\n- [Fullstory vs PostHog](https://www.anchorterminal.com/compare/fullstory-vs-posthog.md)\n- [Matomo vs PostHog](https://www.anchorterminal.com/compare/matomo-vs-posthog.md)\n- [Mixpanel vs PostHog](https://www.anchorterminal.com/compare/mixpanel-vs-posthog.md)\n- [Mostly Good Metrics vs PostHog](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog.md)\n- [OpenPanel vs PostHog](https://www.anchorterminal.com/compare/openpanel-vs-posthog.md)\n- [Pendo vs PostHog](https://www.anchorterminal.com/compare/pendo-vs-posthog.md)\n- [PostHog vs Statsig](https://www.anchorterminal.com/compare/posthog-vs-statsig.md)\n- [PostHog vs Userpilot](https://www.anchorterminal.com/compare/posthog-vs-userpilot.md)\n- [PostHog vs Woopra](https://www.anchorterminal.com/compare/posthog-vs-woopra.md)\n- [Amplitude vs Flagsmith](https://www.anchorterminal.com/compare/amplitude-vs-flagsmith.md)\n- [Countly vs Flagsmith](https://www.anchorterminal.com/compare/countly-vs-flagsmith.md)\n- [Flagsmith vs GrowthBook](https://www.anchorterminal.com/compare/flagsmith-vs-growthbook.md)\n- [Flagsmith vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.md)\n- [Flagsmith vs LaunchDarkly](https://www.anchorterminal.com/compare/flagsmith-vs-launchdarkly.md)\n- [Flagsmith vs Mixpanel](https://www.anchorterminal.com/compare/flagsmith-vs-mixpanel.md)\n- [Flagsmith vs Optimizely Experimentation](https://www.anchorterminal.com/compare/flagsmith-vs-optimizely.md)\n- [Flagsmith vs Statsig](https://www.anchorterminal.com/compare/flagsmith-vs-statsig.md)\n- [Harness Feature Management \u0026 Experimentation vs PostHog](https://www.anchorterminal.com/compare/harness-fme-vs-posthog.md)\n- [LaunchDarkly vs PostHog](https://www.anchorterminal.com/compare/launchdarkly-vs-posthog.md)\n- [Flagsmith vs Fullstory](https://www.anchorterminal.com/compare/flagsmith-vs-fullstory.md)\n- [Flagsmith vs Heap](https://www.anchorterminal.com/compare/flagsmith-vs-heap.md)\n- [Flagsmith vs OpenPanel](https://www.anchorterminal.com/compare/flagsmith-vs-openpanel.md)\n- [Flagsmith vs Woopra](https://www.anchorterminal.com/compare/flagsmith-vs-woopra.md)\n- [Heap vs PostHog](https://www.anchorterminal.com/compare/heap-vs-posthog.md)\n- [Flagsmith vs Matomo](https://www.anchorterminal.com/compare/flagsmith-vs-matomo.md)\n- [Flagsmith vs Mostly Good Metrics](https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics.md)\n- [GrowthBook vs PostHog](https://www.anchorterminal.com/compare/growthbook-vs-posthog.md)\n- [Optimizely Experimentation vs PostHog](https://www.anchorterminal.com/compare/optimizely-vs-posthog.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Flagsmith vs PostHog", "url": "" } ], "description": "PostHog scores 67.4 (B) to Flagsmith's 61.2 (C) for feature flags. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Flagsmith C 61.2", "PostHog B 67.4", "scores" ], "h1": "Flagsmith vs PostHog", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/flagsmith-vs-posthog", "published": "2026-10-01", "section": "tools", "title": "Flagsmith vs PostHog for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-posthog" }, "tokens": { "markdown": 5200, "slim": 3180 }, "version": 1 }