Fullstory vs Harness Feature Management & Experimentation

Fullstory 81

Closed service under a published master services agreement (20 May 2026), with the skills repository and Node SDK under MIT (15). The DPA gives 30 days to retrieve data after termination and deletion within six months. The free plan keeps 12 months of data. The MSA lets Fullstory use data that doesn't identify the customer to improve the service, and the free plan terms add model training on de-identified data (24). A breaking-changes page says such changes ship as a new major version. No notice period or end date for v1 was found (8). Sub-processor list updated 2 June 2026 with locations, Google in the United States and Germany, and no location given for OpenAI, which is marked optional (18). Total 65.

Harness Feature Management & Experimentation 61

A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60.

Fullstory 65

Graded on the Server API with the hosted lines. Statuspage site at status.fullstory.com with per-region components, API among them (20). Read from its own history and incident pages on 2 November (the 8 October count came from the Statuspage API, which this run doesn't read, and is replaced). From 4 August to 2 November, on 1 September a Google Cloud fault took every NA1 service, the API included, out from 11:19 to 16:32 Eastern time (labelled critical, about five hours). That is all of NA1 at once, Fullstory's default data centre, so it's read as one major, as vapi's and google-drive-api's regional outages are. The other incidents in the window don't touch the API (EU1 playback on 23 September, NA1 Warehouse delays on 18 August, Guides and Surveys on 6 August) or name a subset of organisations (delayed session data on 7 September) (10). The general limit on the Server API has no published number. Batch imports do (50,000 requests a batch, 429 at 200 batches or 500,000 operations in progress), and the MCP server allows 3 requests a second with a burst of 20, re-read on 2 November (10 of 15). 429 responses carry Retry-After, and every create call accepts an Idempotency-Key kept for 24 hours (15). No SLA was found in the master services agreement of 20 May 2026 (0). The v2 Server API is generally available (10). 20 + 10 + 10 + 15 + 0 + 10 = 65.

Harness Feature Management & Experimentation 80

Graded on the hosted FME Admin API with the hosted lines. Statuspage at status.harness.io with an FME component among 196 (20). In the 90 days from 8 August, two FME incidents: API write operations returned 499 errors for 30 minutes on 20 August (minor) and the FME user interface was unavailable for 15 minutes on 23 August (major, interface only; flag evaluation was unaffected per the post). No API outage of an hour or more (20 of 30). About 20 Admin API requests per 10 seconds per organisation and per IP, documented on the MCP page (15). 429 responses carry remaining and reset headers with guidance to wait for the larger reset, and the MCP server backs off and retries three times (15). No SLA was found on harness.io/pricing or the FME docs (0). FME is generally available and the MCP server is at 3.2.40 (10). 20+20+15+15+0+10 = 80.

Fullstory 65

API keys come in three permission levels (Standard, Architect, Admin), are named, shown once, deletable at once and tied to the user who made them. The MCP server takes OAuth with PKCE, 16 scopes, dynamic client registration and a revocation endpoint. Keys travel in a header only (27 of 30). A Standard key cannot export or delete user data, and the MCP docs rule out administration. No confirmation step was found for Delete User, and build_segment saves a segment despite the page that says writes are unsupported (12). Session transcripts, screenshots and console and network data are untrusted page content. Masking and exclusion rules carry over, but no prompt-injection guidance was found (3). History endpoints record changes to privacy and capture settings. No per-call log for operators was found (6). Signed security.txt valid to 4 June 2027 (re-read on 2 November, contact psirt@fullstory.com), SOC 2 Type 2, ISO 27001, 27017, 27018, 27701 and 42001, and a yearly CREST penetration test. No bug bounty found (17). Total 65.

Harness Feature Management & Experimentation 79

Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.

Fullstory 70

The Server API has no changelog of its own. The vendor's dated sources count, the browser script changelog (latest entry 26 October 2026) and the official Claude plugin in the fullstory-skills repository, bumped to 0.2.1 on 22 October and 0.2.2 on 29 October 2026 (30). Thirteen browser script entries between 4 August and 26 October 2026, plus the two plugin versions (20). A public changelog for the capture script, a help centre community and a Slack community named in the MCP docs. Response times were not checked (8). The Node server client is 1.1.1 from 12 February 2024, and the MCP registry could not be reached (8). No CI workflow in the Node SDK repository (4). 30 + 20 + 8 + 8 + 4 = 70.

Harness Feature Management & Experimentation 81

harness-mcp-v2 3.2.40 was tagged on 4 November 2026 (30). 14 tagged MCP releases between 8 August and 4 November (20). 100 commits since 8 August in the clone; FME docs and SDK release notes are dated, with support and a community site. Issue response times weren't read because the GitHub API refused us for its rate limit (15 of 25). Not found in the official MCP registry under a Harness namespace; official SDKs are current (8 of 15). MIT package with npm shrinkwrap and tests; CI state not read (8 of 10). 30+20+15+8+8 = 81.

Fullstory 25

No x402, MPP or L402 (0). The plans page names Business, Advanced and Enterprise with no price and a Request pricing button. Only the free plan's limits are public (5). FullstoryFree needs no card per the plans page, re-read on 2 November, and the help centre lists API keys as available on it (20). A person signs up in a browser and creates the key in settings (0). Total 25.

Harness Feature Management & Experimentation 15

No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.

Fullstory 62

Each reference page carries the OpenAPI operation it is drawn from, with schemas, security and a permission level. No single downloadable spec was found on the docs site, and the swagger files in the Node SDK repository cover users and events only and date from 2024. The MCP tool schemas need a login we don't have (15 of 25). llms.txt returns 404 on 2 November and no Markdown copies were found (0). Descriptions state purpose and limits and say when another route fits better, such as Warehouse for export (15). Types, formats, required fields and enumerated event types are declared, with a free-form properties object (11). Request and response examples on each page, and 400, 401, 403, 404, 429 and 500 documented with a code and message (13). Paths are versioned and a breaking-changes page defines what forces a new major version, but the only changelog is for the browser script (8). Total 62.

Harness Feature Management & Experimentation 71

No public OpenAPI file for the Admin API was found; the reference is a ReadMe site with a Postman collection. The MCP server's 11 tools have typed inputs, and harness_describe returns each FME resource's fields (18 of 25). llms.txt on both developer.harness.io and docs.split.io, and every page as Markdown with .md (10). The README describes each tool and when writes ask for confirmation; resource details sit behind harness_describe rather than in the tool text (13 of 20). The generic tools take a resource_type string and a body, so per-resource constraints aren't in the schema (8 of 15). An error-code page lists 400, 401, 402, 403, 404, 409 and 429 with causes, and docs carry curl examples (10 of 15). Tagged MCP releases and dated SDK versioning policy; the Admin API has v1 and v2 paths and deprecation notices for Split-era endpoints (12 of 15). 18+10+13+8+10+12 = 71.