Fullstory vs OpenPanel

Fullstory 65

API keys come in three permission levels (Standard, Architect, Admin), are named, shown once, deletable at once and tied to the user who made them. The MCP server takes OAuth with PKCE, 16 scopes, dynamic client registration and a revocation endpoint. Keys travel in a header only (27 of 30). A Standard key cannot export or delete user data, and the MCP docs rule out administration. No confirmation step was found for Delete User, and build_segment saves a segment despite the page that says writes are unsupported (12). Session transcripts, screenshots and console and network data are untrusted page content. Masking and exclusion rules carry over, but no prompt-injection guidance was found (3). History endpoints record changes to privacy and capture settings. No per-call log for operators was found (6). Signed security.txt valid to 4 June 2027 (re-read on 2 November, contact psirt@fullstory.com), SOC 2 Type 2, ISO 27001, 27017, 27018, 27701 and 42001, and a yearly CREST penetration test. No bug bounty found (17). Total 65.

OpenPanel 41

Client credentials with three types (write, read for one project, root for the organisation), created and deleted in the dashboard (25), less 10 because the docs give ?token= in the MCP URL as an option (15 of 30). Read clients are read-only and limited to one project, and onboarding creates a read-only MCP client. No approval step for root-client writes (14 of 20). Tools return event properties, page titles and profile data sent from tracked sites, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). SECURITY.md with a private advisory route and response times, a valid security.txt, and no bug bounty or certification found (9 of 20). 15+14+3+0+9 = 41.

Fullstory 77

Session context calls take event and duration limits and include or exclude lists by event type, and List Sessions takes limit (18 of 25). page_token paging on users and batch results, and filters on users. List Sessions returns one page only, as its reference says (14). Errors are JSON with a snake-case code documented as safe to handle in code, such as session_page_limit_exceeded (17). Idempotency-Key on every create call, with body comparison and 24-hour expiry. MCP tool annotations were not read (20). Create Event needs a name and one identifier and timestamps default to server time. The only official server SDK found is Node, last published 12 February 2024 (8). Total 77.

OpenPanel 54

51 MCP tools, more than 30 (5). We added 3 because a read client doesn't get the 9 dashboard management tools (8 of 25). Insights endpoints take startDate, endDate, range, filters, cursor and limit (18 of 20). Errors aren't documented beyond 401 and 429 (12 of 20). No readOnlyHint or destructiveHint in the MCP source, no idempotency keys; delete_dashboard refuses a non-empty dashboard without forceDelete (3 of 20). Few required parameters, and SDKs for JavaScript, React, Next.js, Vue, React Native, Swift, Kotlin and Python (13 of 15). 8+18+12+3+13 = 54.

Fullstory 62

Each reference page carries the OpenAPI operation it is drawn from, with schemas, security and a permission level. No single downloadable spec was found on the docs site, and the swagger files in the Node SDK repository cover users and events only and date from 2024. The MCP tool schemas need a login we don't have (15 of 25). llms.txt returns 404 on 2 November and no Markdown copies were found (0). Descriptions state purpose and limits and say when another route fits better, such as Warehouse for export (15). Types, formats, required fields and enumerated event types are declared, with a free-form properties object (11). Request and response examples on each page, and 400, 401, 403, 404, 429 and 500 documented with a code and message (13). Paths are versioned and a breaking-changes page defines what forces a new major version, but the only changelog is for the browser script (8). Total 62.

OpenPanel 75

A live OpenAPI 3.0.3 document with 93 operations, 67 described, generated by the framework and titled 'Elysia Documentation' version 0.0.0; MCP tools are defined in TypeScript with typed inputs (22 of 25). llms.txt, llms-full.txt and Markdown pages (10). Tool descriptions say when to use them, for example list_event_names is to be called first when event names aren't known (14 of 20). 143 enums in the spec and typed MCP inputs (11 of 15). Curl examples in the API docs; error responses aren't documented per endpoint (9 of 15). Tagged releases on GitHub with notes, unversioned API paths and no changelog page (9 of 15). 22+10+14+11+9+9 = 75.

Fullstory 70

The Server API has no changelog of its own. The vendor's dated sources count, the browser script changelog (latest entry 26 October 2026) and the official Claude plugin in the fullstory-skills repository, bumped to 0.2.1 on 22 October and 0.2.2 on 29 October 2026 (30). Thirteen browser script entries between 4 August and 26 October 2026, plus the two plugin versions (20). A public changelog for the capture script, a help centre community and a Slack community named in the MCP docs. Response times were not checked (8). The Node server client is 1.1.1 from 12 February 2024, and the MCP registry could not be reached (8). No CI workflow in the Node SDK repository (4). 30 + 20 + 8 + 8 + 4 = 70.

OpenPanel 83

v3.30.0 was tagged on 6 November 2026 (30). 60 tagged releases between 8 August and 6 November (20). 572 commits since 8 August, a Discord server, a feedback board and email; issue response times weren't read because the GitHub API refused us for its rate limit (15 of 25). The official MCP registry has only a third-party OpenPanel server, not OpenPanel's own; official SDKs are current (10 of 15). Workflows build Docker images, SDKs and self-hosting releases; no test workflow was found in .github/workflows (8 of 10). 30+20+15+10+8 = 83.

Fullstory 25

No x402, MPP or L402 (0). The plans page names Business, Advanced and Enterprise with no price and a Request pricing button. Only the free plan's limits are public (5). FullstoryFree needs no card per the plans page, re-read on 2 November, and the help centre lists API keys as available on it (20). A person signs up in a browser and creates the key in settings (0). Total 25.

OpenPanel 35

No x402, MPP or L402 (0). Public prices by event tier from $2.50 a month, with no overage charges; tiers rather than a per-event rate (15 of 20). 30-day free trial with no card, and free self-hosting (20). Signup is in a browser and client keys are created in the dashboard (0). 0+15+20+0 = 35.

Fullstory 65

Graded on the Server API with the hosted lines. Statuspage site at status.fullstory.com with per-region components, API among them (20). Read from its own history and incident pages on 2 November (the 8 October count came from the Statuspage API, which this run doesn't read, and is replaced). From 4 August to 2 November, on 1 September a Google Cloud fault took every NA1 service, the API included, out from 11:19 to 16:32 Eastern time (labelled critical, about five hours). That is all of NA1 at once, Fullstory's default data centre, so it's read as one major, as vapi's and google-drive-api's regional outages are. The other incidents in the window don't touch the API (EU1 playback on 23 September, NA1 Warehouse delays on 18 August, Guides and Surveys on 6 August) or name a subset of organisations (delayed session data on 7 September) (10). The general limit on the Server API has no published number. Batch imports do (50,000 requests a batch, 429 at 200 batches or 500,000 operations in progress), and the MCP server allows 3 requests a second with a burst of 20, re-read on 2 November (10 of 15). 429 responses carry Retry-After, and every create call accepts an Idempotency-Key kept for 24 hours (15). No SLA was found in the master services agreement of 20 May 2026 (0). The v2 Server API is generally available (10). 20 + 10 + 10 + 15 + 0 + 10 = 65.

OpenPanel 70

Graded on OpenPanel Cloud with the hosted lines. OpenStatus page at status.openpanel.dev with API and Tracker components (20). In the 90 days from 8 August, one incident, degraded API performance for about two hours on 1 October 2026, caused by Hetzner private-network problems reaching the ClickHouse servers (15 of 30). Limits are documented with numbers for MCP (60 a minute per client) and the Export, Insights and Manage APIs (15). The docs say a 429 is returned and to back off exponentially; no Retry-After or idempotency guidance (10 of 15). No SLA was found (0). Generally available (10). 20+15+15+10+0+10 = 70.