Fullstory vs Mostly Good Metrics

Fullstory 65

Graded on the Server API with the hosted lines. Statuspage site at status.fullstory.com with per-region components, API among them (20). Read from its own history and incident pages on 2 November (the 8 October count came from the Statuspage API, which this run doesn't read, and is replaced). From 4 August to 2 November, on 1 September a Google Cloud fault took every NA1 service, the API included, out from 11:19 to 16:32 Eastern time (labelled critical, about five hours). That is all of NA1 at once, Fullstory's default data centre, so it's read as one major, as vapi's and google-drive-api's regional outages are. The other incidents in the window don't touch the API (EU1 playback on 23 September, NA1 Warehouse delays on 18 August, Guides and Surveys on 6 August) or name a subset of organisations (delayed session data on 7 September) (10). The general limit on the Server API has no published number. Batch imports do (50,000 requests a batch, 429 at 200 batches or 500,000 operations in progress), and the MCP server allows 3 requests a second with a burst of 20, re-read on 2 November (10 of 15). 429 responses carry Retry-After, and every create call accepts an Idempotency-Key kept for 24 hours (15). No SLA was found in the master services agreement of 20 May 2026 (0). The v2 Server API is generally available (10). 20 + 10 + 10 + 15 + 0 + 10 = 65.

Mostly Good Metrics 29

Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.

Fullstory 81

Closed service under a published master services agreement (20 May 2026), with the skills repository and Node SDK under MIT (15). The DPA gives 30 days to retrieve data after termination and deletion within six months. The free plan keeps 12 months of data. The MSA lets Fullstory use data that doesn't identify the customer to improve the service, and the free plan terms add model training on de-identified data (24). A breaking-changes page says such changes ship as a new major version. No notice period or end date for v1 was found (8). Sub-processor list updated 2 June 2026 with locations, Google in the United States and Germany, and no location given for OpenAI, which is marked optional (18). Total 65.

Mostly Good Metrics 45

The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.

Fullstory 65

API keys come in three permission levels (Standard, Architect, Admin), are named, shown once, deletable at once and tied to the user who made them. The MCP server takes OAuth with PKCE, 16 scopes, dynamic client registration and a revocation endpoint. Keys travel in a header only (27 of 30). A Standard key cannot export or delete user data, and the MCP docs rule out administration. No confirmation step was found for Delete User, and build_segment saves a segment despite the page that says writes are unsupported (12). Session transcripts, screenshots and console and network data are untrusted page content. Masking and exclusion rules carry over, but no prompt-injection guidance was found (3). History endpoints record changes to privacy and capture settings. No per-call log for operators was found (6). Signed security.txt valid to 4 June 2027 (re-read on 2 November, contact psirt@fullstory.com), SOC 2 Type 2, ISO 27001, 27017, 27018, 27701 and 42001, and a yearly CREST penetration test. No bug bounty found (17). Total 65.

Mostly Good Metrics 33

OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.

Fullstory 77

Session context calls take event and duration limits and include or exclude lists by event type, and List Sessions takes limit (18 of 25). page_token paging on users and batch results, and filters on users. List Sessions returns one page only, as its reference says (14). Errors are JSON with a snake-case code documented as safe to handle in code, such as session_page_limit_exceeded (17). Idempotency-Key on every create call, with body comparison and 24-hour expiry. MCP tool annotations were not read (20). Create Event needs a name and one identifier and timestamps default to server time. The only official server SDK found is Node, last published 12 February 2024 (8). Total 77.

Mostly Good Metrics 49

53 tools, more than 30 (5). We added 3 because Goals and Alerts tools load only where enabled and query_metrics batches up to 10 queries (8 of 25). Date ranges, grouping and filters on queries; no documented page or limit parameters for lists (12 of 20). JSON errors with a message, and per-item status in batch results (13 of 20). Annotations weren't readable without a session, the tool list includes deletes and key revocation, and no idempotency keys were found (4 of 20). Five client SDKs and a CLI with --json output (12 of 15). 8+12+13+4+12 = 49.

Fullstory 62

Each reference page carries the OpenAPI operation it is drawn from, with schemas, security and a permission level. No single downloadable spec was found on the docs site, and the swagger files in the Node SDK repository cover users and events only and date from 2024. The MCP tool schemas need a login we don't have (15 of 25). llms.txt returns 404 on 2 November and no Markdown copies were found (0). Descriptions state purpose and limits and say when another route fits better, such as Warehouse for export (15). Types, formats, required fields and enumerated event types are declared, with a free-form properties object (11). Request and response examples on each page, and 400, 401, 403, 404, 429 and 500 documented with a code and message (13). Paths are versioned and a breaking-changes page defines what forces a new major version, but the only changelog is for the browser script (8). Total 62.

Mostly Good Metrics 49

No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.

Fullstory 25

No x402, MPP or L402 (0). The plans page names Business, Advanced and Enterprise with no price and a Request pricing button. Only the free plan's limits are public (5). FullstoryFree needs no card per the plans page, re-read on 2 November, and the help centre lists API keys as available on it (20). A person signs up in a browser and creates the key in settings (0). Total 25.

Mostly Good Metrics 30

No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.