{ "data": { "a": { "slug": "growthbook", "name": "GrowthBook", "vendor": "GrowthBook, Inc.", "vendorUrl": "https://www.growthbook.io", "kind": "http-api", "category": "product-analytics", "summary": "GrowthBook is an open-source platform for feature flags, experiments and product analytics, sold as GrowthBook Cloud or run self-hosted. Agents reach it through a REST API with a public OpenAPI spec and an official MCP server.", "url": "https://www.anchorterminal.com/tools/growthbook", "markdownUrl": "https://www.anchorterminal.com/tools/growthbook.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/growthbook.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/growthbook.json", "dns": "growthbook.grade.anchorterminal.com", "repo": "https://github.com/growthbook/growthbook", "license": "MIT for the core and for the MCP server. Three enterprise directories in the main repository are under GrowthBook's enterprise licence. GrowthBook Cloud is a hosted service under the Customer Agreement", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.growthbook.io/mcp", "packages": [ { "registry": "npm", "name": "@growthbook/mcp" }, { "registry": "npm", "name": "@growthbook/growthbook" }, { "registry": "pypi", "name": "growthbook" } ], "auth": "mixed", "authNotes": "The hosted MCP server uses OAuth with PKCE, dynamic client registration, refresh tokens and a revocation endpoint, with api.growthbook.io as the authorisation server. A person signs in and consents in a browser. The only scopes are openid, profile, email and offline_access, so the token carries the user's own permissions. The REST API takes a Personal Access Token or a Secret Key as a Bearer token or as the HTTP Basic username. Both are self-serve in the app. A Secret Key can hold any built-in or custom role with per-project overrides and environment limits, and both key types can expire. On the Free plan members can only hold the Admin role.", "pricing": "freemium", "pricingNotes": "Starter is free with no card, for up to 3 users and 1 project, so an agent's owner can start without a contract. Pro is $40 a seat a month for up to 30 users. Enterprise is by contract. Flags, experiments and traffic are unlimited on every plan, and API and MCP calls are not billed. Pro meters CDN requests, CDN bandwidth and Managed Warehouse events above its allowance. Self-hosting the open-source edition is free (https://www.growthbook.io/pricing, checked 2026-10-08).", "priceSummary": "$40 / seat-mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs index, the OpenAPI spec, the MCP server source or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 4, "popularity": { "githubStars": 8484, "npmWeekly": 1290544, "pypiWeekly": 432892, "asOf": "2026-10-08" }, "docsUrl": "https://docs.growthbook.io", "llmsTxt": "https://docs.growthbook.io/llms.txt", "openapi": "https://api.growthbook.io/api/v1/openapi.yaml", "registryName": "io.github.growthbook/growthbook-mcp", "capabilities": [ "analytics.experiments", "analytics.flags", "analytics.query", "analytics.events" ], "tags": [ "official", "hosted", "open-source", "self-hosted", "mcp", "oauth", "openapi", "llms-txt", "free-tier", "no-card", "status-page", "soc2" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 68.6, "grade": "B", "agentReady": false, "rank": 279, "ranked": true, "rankOf": 1510, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 76, "maintenance": 89, "payments": 40, "reliability": 86, "schema": 76, "security": 76, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -6, "negativeNotes": [ "10 August 2026. MCP server 2.1.0 replaced `growthbook_call_api` with two tools in a minor version, eleven days after 2.0.0 removed every 1.x tool, while the docs tell users to install `@growthbook/mcp@latest`. Both are marked breaking in the changelog with migration steps, and we found no advance notice, so the deduction is the minimum (https://github.com/growthbook/growthbook-mcp/blob/main/CHANGELOG.md).", "13 to 30 October 2026. Security fixes merged into the main repository after GrowthBook 5.1.0 (21 September), the newest release, and in no release on 1 November. Commit 900a546b (#7172, 13 October) says the OAuth consent page's Deny button \"redirected to the raw redirect_uri query param with no server check\", so a `javascript:` redirect URI \"ran attacker script on the app origin after one click\", and dynamic client registration accepted `javascript:` and `data:` redirect URIs. Commit 106fc6a7 (#7519, 30 October) says `PUT /organization` let any org admin use `ownerEmail` as \"a regex oracle over every user's email across tenants\". `git tag --contains` finds neither in a release, and the consent page and the user lookup they fix are both in v5.1.0. One term at the floor for fixes in no release, as composio-rube and microsoft-execution-containers took, whatever their age. The repository's deploy workflow builds every push to main that touches `packages/` and rolls it to GrowthBook Cloud's production API services, so Cloud probably runs both fixes, though its run history wasn't readable. That doesn't lower the term. On Cloud they read as fixed, vendor-described flaws with no advisory, a script redirect on the app origin and a cross-tenant lookup, which this run deducts at -3 (terraform-mcp, spree-commerce). The two fold into one term, as claude-code's and claude-agent-sdk's repeated changelog-only security fixes fold into one. https://github.com/growthbook/growthbook/commit/900a546b1abbb3ed6d867146aa7ce8eed59af0e2 and https://github.com/growthbook/growthbook/commit/106fc6a75a749bb7234b705aa2ad43c2f28cc532 and https://github.com/growthbook/growthbook/blob/main/.github/workflows/deploy.yml" ], "verdict": "GrowthBook Cloud's MCP server has four annotated tools, OAuth whose consent page can grant read-only or confirmation-gated access, and a 442-operation OpenAPI spec behind it. The free plan needs no card. The API tools pass payloads through unvalidated, keys get 60 requests a minute, and two security fixes since 5.1.0 are unreleased.", "bestFor": "Teams that want flags and experiments analysed against their own warehouse, with an open-source core and a self-hosted option.", "strengths": [ "The MCP server has four tools, each with readOnlyHint and destructiveHint, and a second endpoint with only the two API tools", "OAuth consent can grant Read only, Human-in-the-Loop or custom permissions, and keys and tokens expire and rotate in place", "Human-in-the-Loop holds risky REST writes, MCP ones included, until a person confirms them, with each decision in the audit log", "Public OpenAPI 3.1 spec with 324 paths and 442 operations, plus llms.txt and a Markdown copy of every docs page", "Starter plan is free with no card, with unlimited flags, experiments and traffic for up to 3 users" ], "weaknesses": [ "The API tools take a path and a JSON string and don't validate payloads, so correct calls depend on the bundled skills", "Two security fixes merged in October 2026, an OAuth consent-page script redirect and a cross-tenant email oracle, are in no release", "API keys are limited to 60 requests a minute on Cloud, and no idempotency keys were found", "Confirmation and audit logs are on Enterprise only, and Free plan connections can only take Full access", "MCP 2.0.0 and 2.1.0 replaced the whole tool surface in July and August 2026, the second in a minor version" ], "agentNotes": [ "Connect to https://mcp.growthbook.io/mcp and complete OAuth in a browser. Ask for Read only at consent unless the task needs writes", "Call `growthbook_list_skills` and `growthbook_read_skill` before writing. The API tools don't validate payloads, so use the paths the skill names", "Expect a 202 with a confirmation link when Human-in-the-Loop holds a write. Tell the user and wait; a held request expires after an hour", "Stay under 60 requests a minute per key. On 429 wait for the `RateLimit-Reset` seconds before retrying", "List calls return 10 items by default. Pass `limit` up to 100 and `offset` to page" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.6 } ], "editorialScores": { "ergonomics": 76, "maintenance": 89, "payments": 40, "reliability": 86, "schema": 76, "security": 76, "transparency": 66 }, "provenanceScore": 84, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @growthbook/mcp@latest", "http": "curl https://api.growthbook.io/api/v1/features -H \"Authorization: Bearer secret_abc123DEF456\"", "claudeCode": "claude mcp add --transport http growthbook https://mcp.growthbook.io/mcp", "config": { "mcpServers": { "growthbook": { "url": "https://mcp.growthbook.io/mcp" } } } }, "letme": { "capability": "https://letme.dev/analytics.experiments", "tool": "https://letme.dev/growthbook" }, "area": "business", "unitPrices": [ { "item": "Pro plan seat", "unit": "seat-month", "usd": 40, "note": "Up to 30 users and 3 projects" }, { "item": "CDN requests", "unit": "1k-requests", "usd": 0.01, "note": "Pro plan, above 2 million a month ($10 per million)" }, { "item": "Managed Warehouse event", "unit": "tx", "usd": 0.00003, "note": "Pro plan, above 2 million a month ($30 per million)" }, { "item": "CDN bandwidth", "unit": "gb", "usd": 1, "note": "Pro plan, above 20 GB a month" } ], "provenance": { "legalEntity": "GrowthBook, Inc.", "domain": "growthbook.io", "domainRegistered": "2020-05-19", "endpointOnVendorDomain": true, "terms": "https://www.growthbook.io/legal/customer-agreement", "privacy": "https://www.growthbook.io/legal/privacy-notice", "statusPage": "https://status.growthbook.io", "changelog": "https://github.com/growthbook/growthbook/releases", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The Customer Agreement (effective 19 June 2025) is between the customer and GrowthBook, Inc., with notices to 1950 W Corporate Way #34560, Anaheim, CA 92801, under California law.", "The Privacy Notice (effective 8 June 2026) covers the website and related services and names GrowthBook, Inc. at the same address. The Customer Agreement refers to it for Customer Data.", "The MCP server answers at mcp.growthbook.io and the REST API at api.growthbook.io. OAuth metadata names https://api.growthbook.io as issuer.", "www.growthbook.io/.well-known/security.txt and growthbook.io/.well-known/security.txt return 404 (re-read 1 November 2026). Reports go to a form on the disclosure page or to security@growthbook.io.", "RDAP for growthbook.io gives a registration date of 2020-05-19.", "The MCP server keeps its own changelog at https://github.com/growthbook/growthbook-mcp/blob/main/CHANGELOG.md." ], "score": 84 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/growthbook.json", "live": { "slug": "growthbook", "probe": { "target": "https://mcp.growthbook.io/mcp", "method": "get", "lastAt": "2026-11-07T19:22:10.546299675Z", "lastOk": true, "lastStatus": 401, "lastMs": 368, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 267, "p95ms24h": 368, "samples24h": 238, "samples30d": 7450, "days": [ { "date": "2026-10-08", "probes": 70, "ok": 70 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "vendorStatus": { "page": "https://status.growthbook.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:53.006708259Z" }, "versions": [ { "registry": "github", "name": "growthbook/growthbook", "version": "v5.2.0", "released": "2026-11-03", "seenAt": "2026-11-06T23:31:45.349646939Z" }, { "registry": "mcp-registry", "name": "io.github.growthbook/growthbook-mcp", "version": "2.2.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@growthbook/growthbook", "version": "2.0.0", "seenAt": "2026-11-06T23:31:43.632815176Z" }, { "registry": "npm", "name": "@growthbook/mcp", "version": "2.2.0", "seenAt": "2026-11-06T23:31:42.874342993Z" }, { "registry": "pypi", "name": "growthbook", "version": "4.0.0", "released": "2026-11-02", "seenAt": "2026-11-06T23:31:45.155880521Z" } ], "githubStars": 8572, "npmWeekly": 9185, "pypiWeekly": 479785, "securityTxt": { "url": "https://growthbook.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:40.20454516Z" }, "llmsTxt": { "url": "https://docs.growthbook.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:39.975912104Z" }, "domain": { "domain": "growthbook.io", "checkedAt": "2026-11-01T14:23:41.368538454Z" }, "pages": [ { "url": "https://www.growthbook.io/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:29:29.272041513Z", "changedAt": "2026-11-04T08:40:45.015836681Z", "fingerprint": "18a31fd99466" }, { "url": "https://www.growthbook.io/legal/privacy-notice", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:29:27.3205356Z", "changedAt": "2026-11-06T13:50:11.648366307Z", "fingerprint": "2862dd2e25f5" }, { "url": "https://www.growthbook.io/legal/customer-agreement", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:29:25.188738505Z", "changedAt": "2026-11-04T08:40:40.81521479Z", "fingerprint": "84ab8480f2bd" } ], "mcpTools": { "url": "https://mcp.growthbook.io/mcp", "checkedAt": "2026-11-07T01:45:18.456947997Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:45:18.456947997Z" }, "github": { "repo": "growthbook/growthbook", "checkedAt": "2026-11-02T08:53:22.52476929Z", "stars": 8556, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T08:46:13Z", "openIssues": 524, "openPRs": 356, "issuesOpened90d": 59, "issuesClosed90d": 158, "prsMerged90d": 662, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-10-30T21:20:54Z" }, "advisories": [ { "ghsa": "GHSA-c4m3-8cgx-p88g", "severity": "critical", "published": "2026-08-19T19:38:41Z" }, { "ghsa": "GHSA-j24q-55xh-wm4r", "cve": "CVE-2022-36065", "severity": "high", "published": "2022-08-30T17:05:17Z" } ], "replies": { "sampled": 25, "unanswered": 17, "medianDays": 0.6 } }, "updatedAt": "2026-11-07T19:22:10.546299675Z" } }, "answer": "GrowthBook scores 68.6 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category.", "b": { "slug": "userpilot", "name": "Userpilot", "vendor": "Userpilot, Inc.", "vendorUrl": "https://userpilot.com", "kind": "http-api", "category": "product-analytics", "summary": "Userpilot is a product adoption platform with in-app guides, surveys and product analytics for SaaS and mobile apps. Agents query funnels, trends, retention, users and companies through its hosted MCP server, and send or export data through HTTP APIs.", "url": "https://www.anchorterminal.com/tools/userpilot", "markdownUrl": "https://www.anchorterminal.com/tools/userpilot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/userpilot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/userpilot.json", "dns": "userpilot.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://mcp.userpilot.io/mcp", "packages": [ { "registry": "npm", "name": "userpilot" } ], "auth": "mixed", "authNotes": "The hosted MCP server uses OAuth 2.0 with PKCE, dynamic client registration and a permission screen. Scopes are data:read (always required), people:read, sessions:read, segments:write, reports:write, feedback:write and offline_access; the connection runs under the user's own role and can't delete or reach administration. The HTTP APIs take one environment API key as `Authorization: Token \u003ckey\u003e`, shown on the Environment page; the docs say to contact support to regenerate it.", "pricing": "paid", "pricingNotes": "Starter $299 a month for up to 2,000 MAU with basic trends and funnels; Growth from $849 a month with advanced analytics and the HTTP API; Enterprise by quote with SSO, activity logs and a custom SLA. Bulk export, import and data warehouse sync are add-ons. 14-day free trial with no card required.", "priceSummary": "$299 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, llms.txt, the MCP docs or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 235722, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.userpilot.com/api-references/overview", "llmsTxt": "https://docs.userpilot.com/llms.txt", "registryName": "io.userpilot/mcp", "capabilities": [ "analytics.query", "analytics.funnels", "analytics.events" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "mcp-registry", "oauth", "llms-txt", "no-card", "status-page", "soc2", "closed-source", "webhooks", "eu-region" ], "lastRelease": "2026-10-11", "graded": true, "anchor": { "graded": true, "score": 64.4, "grade": "B", "agentReady": false, "rank": 473, "ranked": true, "rankOf": 1510, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 82, "schema": 71, "security": 62, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Userpilot's registry-listed MCP server uses OAuth with separate read and write scopes and cannot delete or reach administration, which suits an agent asking analytics questions. Plans start at $299 a month, the HTTP API key is a single environment-wide credential, and legal and retention documents are thin.", "bestFor": "SaaS teams already using Userpilot for onboarding who want an agent to answer analytics questions and draft segments and surveys.", "strengths": [ "Hosted MCP server in the official registry as io.userpilot/mcp, with OAuth and PKCE", "Scopes split reads of analytics, profiles and session replay from writes of segments, reports and survey drafts", "No delete, publish or administration actions are reachable through MCP", "Status page with three ingestion regions and no incidents from August to November 2026", "llms.txt and Markdown docs, with OpenAPI 3.0 on each API reference page" ], "weaknesses": [ "Plans start at $299 a month, and the HTTP API needs Growth from $849", "The HTTP API uses one environment-wide key that support has to regenerate", "The MCP tool list and its rate limits aren't published", "No security.txt, disclosure policy or bug bounty found", "The privacy policy and security page name different sub-processors" ], "agentNotes": [ "Ask for only the scopes the task needs; profile and session replay reads are separate grants", "Expect survey writes to stay drafts that a person reviews and publishes in Userpilot", "Refresh the connector's tool list after Userpilot adds tools, since clients cache it", "Back off exponentially on 429 from Identify and Track, which allow 600 requests a minute", "Use the bulk export job API for raw events rather than looping over analytics tools" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.4 } ], "editorialScores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 82, "schema": 71, "security": 62, "transparency": 42 }, "provenanceScore": 76, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add --transport http userpilot https://mcp.userpilot.io/mcp", "config": { "mcpServers": { "userpilot": { "url": "https://mcp.userpilot.io/mcp" } } } }, "letme": { "capability": "https://letme.dev/analytics.query", "tool": "https://letme.dev/userpilot" }, "area": "business", "unitPrices": [ { "item": "Starter plan", "unit": "month", "usd": 299, "note": "Up to 2,000 MAU" }, { "item": "Growth plan", "unit": "month", "usd": 849, "note": "Starting price; includes advanced product analytics and the HTTP API" } ], "provenance": { "legalEntity": "Userpilot, Inc.", "domain": "userpilot.com", "domainRegistered": "2011-01-08", "endpointOnVendorDomain": false, "terms": "https://userpilot.com/terms-of-use/", "privacy": "https://userpilot.com/privacy-policy/", "statusPage": "https://status.userpilot.io", "changelog": "https://docs.userpilot.com/developer/installation/mobile/ios/mobile-ios-release-notes", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The MCP server and APIs are on userpilot.io; the website and legal pages are on userpilot.com.", "The terms were last updated on 23 April 2024 and the privacy policy on 11 March 2025, which names a DPO and Userpilot, Inc. in Austin, Texas.", "docs.userpilot.com/robots.txt carries Content-Signal ai-train=yes, search=yes, ai-input=yes. userpilot.com/robots.txt disallows only search paths.", "userpilot.com/.well-known/security.txt returned 404, and the security page names no disclosure policy or bug bounty.", "RDAP gives userpilot.com a registration date of 8 January 2011." ], "score": 76 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/userpilot.json", "live": { "slug": "userpilot", "probe": { "target": "https://mcp.userpilot.io/mcp", "method": "get", "lastAt": "2026-11-07T19:22:42.360158981Z", "lastOk": true, "lastStatus": 405, "lastMs": 241, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 496, "p95ms24h": 586, "samples24h": 210, "samples30d": 210, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "vendorStatus": { "page": "https://status.userpilot.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:54.858690533Z" }, "versions": [ { "registry": "mcp-registry", "name": "io.userpilot/mcp", "version": "1.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "userpilot", "version": "1.4.3", "seenAt": "2026-11-07T00:14:26.929507083Z" } ], "npmWeekly": 235722, "securityTxt": { "url": "https://userpilot.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:10.604728076Z" }, "llmsTxt": { "url": "https://docs.userpilot.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:15.247254272Z" }, "pages": [ { "url": "https://docs.userpilot.com/developer/installation/mobile/ios/mobile-ios-release-notes", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:08:32.05689434Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b489ebf9a491" }, { "url": "https://userpilot.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:23:01.88432514Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "299f9d9cd275" }, { "url": "https://userpilot.com/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:23:04.076461926Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "dea374efccdb" } ], "mcpTools": { "url": "https://mcp.userpilot.io/mcp", "checkedAt": "2026-11-07T01:48:55.558250288Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:48:55.558250288Z" }, "updatedAt": "2026-11-07T19:22:42.360158981Z" } }, "edges": [ { "by": 16, "category": "ergonomics", "leads": "growthbook", "name": "Agent ergonomics", "reasons": { "a": "Four compact MCP tools, with skills loaded on demand and a /mcp/api endpoint that drops the skill tools (25). `limit` (default 10, maximum 100) and `offset` on 40 list operations, with filters by project, data source and status. No field selection was found, and the API tools return the raw response body (15 of 20). Errors are a status code and a `message` with no machine code. 422 marks a soft warning that can be resubmitted with `ignoreWarnings`, and the MCP server adds recovery hints for 401, 403, 404 and 429 (13 of 20). All four tools carry readOnlyHint and destructiveHint, and reads and writes are separate tools. Every write is marked destructive, and no idempotency keys were found (13 of 20). The API tools need one to three parameters. The SDKs cover flag evaluation in many languages, not the REST API (10 of 15). 25+15+13+13+10 = 76. Not re-read on 1 November beyond the MCP page and the spec, which still support each line.", "b": "The tool count isn't published; the docs say the assistant can search hundreds of extra read-only operations on demand, which reads as dynamic loading. Without the list we give the middle band (15 of 25). Export jobs filter by date range, users, events and segments, and job lists paginate (14 of 20). A documented error reference (13 of 20). No deletes or admin through MCP by design; annotations weren't readable and no idempotency keys were found (10 of 20). The HTTP APIs have no official server-side SDK; client SDKs for web and six mobile frameworks (8 of 15). 15+14+13+10+8 = 60." }, "scores": { "a": 76, "b": 60 } }, { "by": 16, "category": "transparency", "leads": "growthbook", "name": "Transparency \u0026 trust", "reasons": { "a": "The core and the MCP server are MIT. Three enterprise directories in the main repository are under GrowthBook's enterprise licence and are part of what Cloud runs (25 of 30). A Customer Agreement, a Privacy Notice of 8 June 2026 and a DPA of 19 June 2025 are published. The agreement grants GrowthBook an unrestricted right to use Customer Data, including to train its AI algorithms, then limits personal information to performing the Services. The Privacy Notice gives no retention periods, and the docs say only aggregate results are stored. We did not read the DPA, which is a download (16 of 30). Legacy v1 routes and 34 operations are marked deprecated with no removal dates, and no deprecation policy was found. The MCP changelog gives migration steps (8 of 20). The sub-processor list of 11 May 2026 names seven providers with locations, mostly in the United States. Notice of new ones is promised only as far as the law requires (17 of 20). 25+16+8+17 = 66. The legal documents are per the 8 October check, not re-read on 1 November.", "b": "A closed service with terms dated 23 April 2024 (15 of 30). The privacy policy of 11 March 2025 names a DPO and two sub-processors (AWS and Cloudflare), while the security page names AWS, Google Cloud and Stripe. The DPA is on request and no customer-data retention period is stated (14 of 30). No deprecation policy or dated API notices found (3 of 20). Sub-processors are named with addresses but not data locations, though an EU ingestion endpoint exists (10 of 20). 15+14+3+10 = 42." }, "scores": { "a": 75, "b": 59 } }, { "by": 14, "category": "security", "leads": "growthbook", "name": "Security \u0026 auth", "reasons": { "a": "OAuth with PKCE, dynamic client registration, refresh tokens and a revocation endpoint for the hosted MCP server. Since October the consent page asks what the connection may do, Read only, Human-in-the-Loop, Full access or a custom base role limited by project or environment, so a token no longer has to carry the user's full permissions. Secret Keys take any built-in or custom role with per-project overrides, environment limits and expiry, Personal Access Tokens can be scoped below their user (7 October), and since 21 October keys and tokens rotate in place with a grace period for the old secret. Secrets travel in headers only (30). A Read Only option, an endpoint with the API tools alone, and read and write tools with annotations. Since 16 October Human-in-the-Loop holds risky or destructive REST writes, including those from the hosted MCP endpoint, until a person confirms them on a linked page, and each decision goes to the audit log. Human-in-the-Loop is an Enterprise preset, and on a plan with only the admin role, which includes Free, Full access is the only option (18 of 20). No guidance on prompt injection was found, though the tools return names and descriptions that people wrote (3 of 15). Audit logging, with export, is on Enterprise only. Personal tokens attribute actions to a user, Secret Keys can name the member behind a request with `X-GrowthBook-Requested-By` (13 October), and the MCP server labels its API calls with `X-GB-MCP-*` headers (10 of 15). SOC 2 Type II, a disclosure process with a form and SECURITY.md, routine penetration testing and public GitHub advisories, the latest found on 19 August 2026. Rewards are merchandise only and www.growthbook.io/.well-known/security.txt still answered 404 on 1 November (15 of 20). 30+18+3+10+15 = 76. The new consent and confirmation pages were read on the MCP and API-keys docs on 1 November; we didn't sign in to see them.", "b": "The MCP server uses OAuth with PKCE, dynamic client registration, revocation, separate read and write scopes and the user's own role. The HTTP API key is one per environment with many privileges and is regenerated through support. Averaged over both surfaces (22 of 30). Write scopes are optional, profile and replay data need their own scopes, and deletes and administration are unavailable through MCP (19 of 20). Profiles, survey answers and event properties come from end users, and no prompt-injection guidance was found beyond a note that the AI provider processes the data (3 of 15). Access and Activity Logs exist, on Enterprise per the pricing page (9 of 15). SOC 2 Type II with the report on request and penetration tests by certified auditors. No security.txt, disclosure policy or bug bounty (9 of 20). 22+19+3+9+9 = 62." }, "scores": { "a": 76, "b": 62 } }, { "by": 10, "category": "payments", "leads": "growthbook", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Prices are public without a login. Pro is $40 a seat a month, with $10 per million CDN requests, $1 per GB and $30 per million Managed Warehouse events above the allowance; the $40 seat and $30 per million were re-read on 1 November (20). The Starter plan is free with \"No credit card required\", re-read on 1 November (20). A person signs up in a browser, then approves OAuth or creates a key (0). 0+20+20+0 = 40.", "b": "No x402, MPP or L402 (0). Plan prices are public ($299 and from $849 a month), with no per-unit prices (10). 14-day free trial with no card required (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30." }, "scores": { "a": 40, "b": 30 } }, { "by": 10, "category": "maintenance", "leads": "growthbook", "name": "Maintenance \u0026 community", "reasons": { "a": "MCP server 2.2.0 is dated 5 October 2026 and published to the registry on 6 October, GrowthBook 5.1.0 was tagged on 21 September 2026, and the main repository's commit releasing the JavaScript and React SDKs 2.0.0 landed on 30 October (npm not readable from here) (30). In the 90 days from 3 August, GrowthBook 5.0.1 (19 August) and 5.1.0, MCP 2.1.0 (10 August) and 2.2.0, and the SDK 2.0.0 release commit (20). The main repository's 200 newest commits run from 5 to 30 October 2026, and there is a community Slack. We did not read how quickly issues are answered (15 of 25). `io.github.growthbook/growthbook-mcp` is in the official MCP registry at 2.2.0, published 6 October 2026 and still latest on 1 November (15). The MCP repository runs CI on Node 22 and 26 and took dependency updates on 8 and 27 October 2026, both still unreleased. The package states Node 18 or later, which CI does not test (9 of 10). 30+20+15+15+9 = 89.", "b": "io.userpilot/mcp 1.0.0 was published to the registry on 11 October 2026 (30). The iOS SDK alone has dated releases on 6 August, 2 September, 27 September and 2 October 2026 (20). A closed service with no public API changelog, support by email and chat (8 of 25). Verified io.userpilot namespace in the official MCP registry (15). Client SDKs are current; there is nothing else public to inspect (6 of 10). 30+20+8+15+6 = 79." }, "scores": { "a": 89, "b": 79 } }, { "by": 5, "category": "schema", "leads": "growthbook", "name": "Schema \u0026 documentation", "reasons": { "a": "Public OpenAPI 3.1 spec, version 5.1.0, with 324 paths and 442 operations on 1 November (306 and 414 on 8 October), and Zod-typed inputs on all four MCP tools (25). llms.txt and a Markdown copy of each docs page (10). 441 of 442 operations have a summary and 205 have a description. The MCP tool descriptions say when to use each tool, and the bundled skills carry the workflows (13 of 20). The spec has 1,445 enums and marks required fields, but `growthbook_api_write` takes the path as a string and the body as a JSON string, and the docs still say the API tools do not validate payloads (9 of 15). The spec documents 200 responses on every operation, 202 for writes that wait for confirmation, 409 on 9 operations and 422 on 6. The introduction lists eight status codes and a `message` body (6 of 15). Path versions /v1 and /v2, 34 operations marked deprecated, GitHub releases, and an MCP changelog with breaking changes called out (13 of 15). 25+10+13+9+6+13 = 76.", "b": "Every API reference page embeds an OpenAPI 3.0 definition, though no standalone spec file was found (20 of 25). llms.txt and Markdown versions of every page (10). Endpoint pages state their purpose and the MCP docs say what each permission allows; the MCP tool definitions weren't read because that needs a session (12 of 20). Request bodies are typed, mostly as strings and string arrays with few enums (9 of 15). An error reference covers 400, 401, 422 and 429 with causes, and pages carry examples (12 of 15). /v1 paths and dated SDK release notes; no API changelog was found (8 of 15). 20+10+12+9+12+8 = 71." }, "scores": { "a": 76, "b": 71 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "GrowthBook, Inc.", "b": "Userpilot, Inc.", "name": "Vendor" }, { "a": "https://mcp.growthbook.io/mcp", "b": "https://mcp.userpilot.io/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT for the core and for the MCP server. Three enterprise directories in the main repository are under GrowthBook's enterprise licence. GrowthBook Cloud is a hosted service under the Customer Agreement", "b": "none", "name": "Licence" }, { "a": "4", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "io.github.growthbook/growthbook-mcp", "b": "io.userpilot/mcp", "name": "MCP registry" }, { "a": "2026-10-06", "b": "2026-10-11", "name": "Last release" }, { "a": "2025-06-19", "b": "2024-04-23", "name": "Terms last updated" }, { "a": "2026-06-08", "b": "2025-03-11", "name": "Privacy policy last updated" }, { "a": "yes", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "8.5k stars, 1.3M npm/wk, 433k PyPI/wk", "b": "236k npm/wk", "name": "Popularity" }, { "a": "3.3/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "GrowthBook scores 68.6 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category.", "question": "Which is better for AI agents, GrowthBook or Userpilot?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do GrowthBook and Userpilot need an API key?" }, { "answer": "Yes. GrowthBook has a hosted endpoint at https://mcp.growthbook.io/mcp and Userpilot at https://mcp.userpilot.io/mcp.", "question": "Can an agent call GrowthBook and Userpilot without installing anything?" }, { "answer": "GrowthBook is open source (MIT for the core and for the MCP server. Three enterprise directories in the main repository are under GrowthBook's enterprise licence. GrowthBook Cloud is a hosted service under the Customer Agreement). No open-source release is listed for Userpilot.", "question": "Are GrowthBook and Userpilot open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 76 against 71", "Agent ergonomics, 76 against 60", "Security \u0026 auth, 76 against 62", "Payments \u0026 pricing, 40 against 30", "Maintenance \u0026 community, 89 against 79", "Transparency \u0026 trust, 75 against 59" ], "also": [ "Runs on your own machine", "Open source" ], "goodFor": "Teams that want flags and experiments analysed against their own warehouse, with an open-source core and a self-hosted option.", "slug": "growthbook", "watchFor": "The API tools take a path and a JSON string and don't validate payloads, so correct calls depend on the bundled skills" }, { "aheadOn": null, "also": [ "No incidents deducted, where GrowthBook loses 6 points for them" ], "goodFor": "SaaS teams already using Userpilot for onboarding who want an agent to answer analytics questions and draft segments and surveys.", "slug": "userpilot", "watchFor": "Plans start at $299 a month, and the HTTP API needs Growth from $849" } ], "history": { "growthbook": [ { "causes": [ "product", "event" ], "date": "2026-11-01", "delta": -1.5, "from": 70.1, "fromGrade": "BB", "to": 68.6, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0, "from": 70.1, "fromGrade": "BB", "to": 70.1, "toGrade": "BB" } ], "userpilot": null }, "job": { "capability": "analytics.query", "name": "Analytics queries" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amplitude-vs-growthbook.json", "title": "Amplitude vs GrowthBook", "url": "https://www.anchorterminal.com/compare/amplitude-vs-growthbook" }, { "json": "https://www.anchorterminal.com/compare/amplitude-vs-userpilot.json", "title": "Amplitude vs Userpilot", "url": "https://www.anchorterminal.com/compare/amplitude-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/basedash-mcp-vs-userpilot.json", "title": "Basedash MCP vs Userpilot", "url": "https://www.anchorterminal.com/compare/basedash-mcp-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-growthbook.json", "title": "Countly vs GrowthBook", "url": "https://www.anchorterminal.com/compare/countly-vs-growthbook" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-userpilot.json", "title": "Countly vs Userpilot", "url": "https://www.anchorterminal.com/compare/countly-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-growthbook.json", "title": "Fullstory vs GrowthBook", "url": "https://www.anchorterminal.com/compare/fullstory-vs-growthbook" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-userpilot.json", "title": "Fullstory vs Userpilot", "url": "https://www.anchorterminal.com/compare/fullstory-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-openpanel.json", "title": "GrowthBook vs OpenPanel", "url": "https://www.anchorterminal.com/compare/growthbook-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-pendo.json", "title": "GrowthBook vs Pendo", "url": "https://www.anchorterminal.com/compare/growthbook-vs-pendo" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-woopra.json", "title": "GrowthBook vs Woopra", "url": "https://www.anchorterminal.com/compare/growthbook-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/matomo-vs-userpilot.json", "title": "Matomo vs Userpilot", "url": "https://www.anchorterminal.com/compare/matomo-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/mixpanel-vs-userpilot.json", "title": "Mixpanel vs Userpilot", "url": "https://www.anchorterminal.com/compare/mixpanel-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.json", "title": "Mostly Good Metrics vs Userpilot", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/openpanel-vs-userpilot.json", "title": "OpenPanel vs Userpilot", "url": "https://www.anchorterminal.com/compare/openpanel-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/optimizely-vs-userpilot.json", "title": "Optimizely Experimentation vs Userpilot", "url": "https://www.anchorterminal.com/compare/optimizely-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/pendo-vs-userpilot.json", "title": "Pendo vs Userpilot", "url": "https://www.anchorterminal.com/compare/pendo-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/posthog-vs-userpilot.json", "title": "PostHog vs Userpilot", "url": "https://www.anchorterminal.com/compare/posthog-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/statsig-vs-userpilot.json", "title": "Statsig vs Userpilot", "url": "https://www.anchorterminal.com/compare/statsig-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/userpilot-vs-woopra.json", "title": "Userpilot vs Woopra", "url": "https://www.anchorterminal.com/compare/userpilot-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-heap.json", "title": "GrowthBook vs Heap", "url": "https://www.anchorterminal.com/compare/growthbook-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-rudderstack-mcp.json", "title": "GrowthBook vs RudderStack MCP", "url": "https://www.anchorterminal.com/compare/growthbook-vs-rudderstack-mcp" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-userpilot.json", "title": "Heap vs Userpilot", "url": "https://www.anchorterminal.com/compare/heap-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/rudderstack-mcp-vs-userpilot.json", "title": "RudderStack MCP vs Userpilot", "url": "https://www.anchorterminal.com/compare/rudderstack-mcp-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-growthbook.json", "title": "Flagsmith vs GrowthBook", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-growthbook" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-harness-fme.json", "title": "GrowthBook vs Harness Feature Management \u0026 Experimentation", "url": "https://www.anchorterminal.com/compare/growthbook-vs-harness-fme" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-launchdarkly.json", "title": "GrowthBook vs LaunchDarkly", "url": "https://www.anchorterminal.com/compare/growthbook-vs-launchdarkly" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-matomo.json", "title": "GrowthBook vs Matomo", "url": "https://www.anchorterminal.com/compare/growthbook-vs-matomo" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-mixpanel.json", "title": "GrowthBook vs Mixpanel", "url": "https://www.anchorterminal.com/compare/growthbook-vs-mixpanel" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-mostly-good-metrics.json", "title": "GrowthBook vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/growthbook-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-optimizely.json", "title": "GrowthBook vs Optimizely Experimentation", "url": "https://www.anchorterminal.com/compare/growthbook-vs-optimizely" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-posthog.json", "title": "GrowthBook vs PostHog", "url": "https://www.anchorterminal.com/compare/growthbook-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-statsig.json", "title": "GrowthBook vs Statsig", "url": "https://www.anchorterminal.com/compare/growthbook-vs-statsig" } ], "panel": null, "scores": [ { "by": 4, "edge": "growthbook", "growthbook": 86, "key": "reliability", "name": "Reliability", "userpilot": 82, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 5, "edge": "growthbook", "growthbook": 76, "key": "schema", "name": "Schema \u0026 documentation", "userpilot": 71, "weight": 13 }, { "by": 16, "edge": "growthbook", "growthbook": 76, "key": "ergonomics", "name": "Agent ergonomics", "userpilot": 60, "weight": 13 }, { "by": 14, "edge": "growthbook", "growthbook": 76, "key": "security", "name": "Security \u0026 auth", "userpilot": 62, "weight": 14 }, { "by": 10, "edge": "growthbook", "growthbook": 40, "key": "payments", "name": "Payments \u0026 pricing", "userpilot": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 10, "edge": "growthbook", "growthbook": 89, "key": "maintenance", "name": "Maintenance \u0026 community", "userpilot": 79, "weight": 7 }, { "by": 16, "edge": "growthbook", "growthbook": 75, "key": "transparency", "name": "Transparency \u0026 trust", "userpilot": 59, "weight": 7 } ], "summary": "GrowthBook scores 68.6 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category. Both do analytics queries.", "tasks": null, "tutorials": [], "verdicts": { "growthbook": "GrowthBook Cloud's MCP server has four annotated tools, OAuth whose consent page can grant read-only or confirmation-gated access, and a 442-operation OpenAPI spec behind it. The free plan needs no card. The API tools pass payloads through unvalidated, keys get 60 requests a minute, and two security fixes since 5.1.0 are unreleased.", "userpilot": "Userpilot's registry-listed MCP server uses OAuth with separate read and write scopes and cannot delete or reach administration, which suits an agent asking analytics questions. Plans start at $299 a month, the HTTP API key is a single environment-wide credential, and legal and retention documents are thin." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/growthbook-vs-userpilot", "json": "https://www.anchorterminal.com/compare/growthbook-vs-userpilot.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/growthbook-vs-userpilot.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/growthbook-vs-userpilot.min.md" }, "markdown": "GrowthBook scores 68.6 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category. Both do analytics queries.\n\n- GrowthBook: grade B, 68.6/100, rank #279 of 1510. Markdown https://www.anchorterminal.com/tools/growthbook.md · JSON https://www.anchorterminal.com/api/v1/tools/growthbook.json\n- Userpilot: grade B, 64.4/100, rank #473 of 1510. Markdown https://www.anchorterminal.com/tools/userpilot.md · JSON https://www.anchorterminal.com/api/v1/tools/userpilot.json\n- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md\n- All 170 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md\n\n## Which one, for what\n\n### GrowthBook (B)\n\nGood for: Teams that want flags and experiments analysed against their own warehouse, with an open-source core and a self-hosted option.\n\nAhead on:\n- Schema \u0026 documentation, 76 against 71\n- Agent ergonomics, 76 against 60\n- Security \u0026 auth, 76 against 62\n- Payments \u0026 pricing, 40 against 30\n- Maintenance \u0026 community, 89 against 79\n- Transparency \u0026 trust, 75 against 59\n\nAlso in its favour:\n- Runs on your own machine\n- Open source\n\nWatch for: The API tools take a path and a JSON string and don't validate payloads, so correct calls depend on the bundled skills\n\n### Userpilot (B)\n\nGood for: SaaS teams already using Userpilot for onboarding who want an agent to answer analytics questions and draft segments and surveys.\n\nAlso in its favour:\n- No incidents deducted, where GrowthBook loses 6 points for them\n\nWatch for: Plans start at $299 a month, and the HTTP API needs Growth from $849\n\n\n## Why the edge\n\n### Agent ergonomics: GrowthBook +16\n\n- GrowthBook (76): Four compact MCP tools, with skills loaded on demand and a /mcp/api endpoint that drops the skill tools (25). `limit` (default 10, maximum 100) and `offset` on 40 list operations, with filters by project, data source and status. No field selection was found, and the API tools return the raw response body (15 of 20). Errors are a status code and a `message` with no machine code. 422 marks a soft warning that can be resubmitted with `ignoreWarnings`, and the MCP server adds recovery hints for 401, 403, 404 and 429 (13 of 20). All four tools carry readOnlyHint and destructiveHint, and reads and writes are separate tools. Every write is marked destructive, and no idempotency keys were found (13 of 20). The API tools need one to three parameters. The SDKs cover flag evaluation in many languages, not the REST API (10 of 15). 25+15+13+13+10 = 76. Not re-read on 1 November beyond the MCP page and the spec, which still support each line.\n- Userpilot (60): The tool count isn't published; the docs say the assistant can search hundreds of extra read-only operations on demand, which reads as dynamic loading. Without the list we give the middle band (15 of 25). Export jobs filter by date range, users, events and segments, and job lists paginate (14 of 20). A documented error reference (13 of 20). No deletes or admin through MCP by design; annotations weren't readable and no idempotency keys were found (10 of 20). The HTTP APIs have no official server-side SDK; client SDKs for web and six mobile frameworks (8 of 15). 15+14+13+10+8 = 60.\n\n### Transparency \u0026 trust: GrowthBook +16\n\n- GrowthBook (75): The core and the MCP server are MIT. Three enterprise directories in the main repository are under GrowthBook's enterprise licence and are part of what Cloud runs (25 of 30). A Customer Agreement, a Privacy Notice of 8 June 2026 and a DPA of 19 June 2025 are published. The agreement grants GrowthBook an unrestricted right to use Customer Data, including to train its AI algorithms, then limits personal information to performing the Services. The Privacy Notice gives no retention periods, and the docs say only aggregate results are stored. We did not read the DPA, which is a download (16 of 30). Legacy v1 routes and 34 operations are marked deprecated with no removal dates, and no deprecation policy was found. The MCP changelog gives migration steps (8 of 20). The sub-processor list of 11 May 2026 names seven providers with locations, mostly in the United States. Notice of new ones is promised only as far as the law requires (17 of 20). 25+16+8+17 = 66. The legal documents are per the 8 October check, not re-read on 1 November.\n- Userpilot (59): A closed service with terms dated 23 April 2024 (15 of 30). The privacy policy of 11 March 2025 names a DPO and two sub-processors (AWS and Cloudflare), while the security page names AWS, Google Cloud and Stripe. The DPA is on request and no customer-data retention period is stated (14 of 30). No deprecation policy or dated API notices found (3 of 20). Sub-processors are named with addresses but not data locations, though an EU ingestion endpoint exists (10 of 20). 15+14+3+10 = 42.\n\n### Security \u0026 auth: GrowthBook +14\n\n- GrowthBook (76): OAuth with PKCE, dynamic client registration, refresh tokens and a revocation endpoint for the hosted MCP server. Since October the consent page asks what the connection may do, Read only, Human-in-the-Loop, Full access or a custom base role limited by project or environment, so a token no longer has to carry the user's full permissions. Secret Keys take any built-in or custom role with per-project overrides, environment limits and expiry, Personal Access Tokens can be scoped below their user (7 October), and since 21 October keys and tokens rotate in place with a grace period for the old secret. Secrets travel in headers only (30). A Read Only option, an endpoint with the API tools alone, and read and write tools with annotations. Since 16 October Human-in-the-Loop holds risky or destructive REST writes, including those from the hosted MCP endpoint, until a person confirms them on a linked page, and each decision goes to the audit log. Human-in-the-Loop is an Enterprise preset, and on a plan with only the admin role, which includes Free, Full access is the only option (18 of 20). No guidance on prompt injection was found, though the tools return names and descriptions that people wrote (3 of 15). Audit logging, with export, is on Enterprise only. Personal tokens attribute actions to a user, Secret Keys can name the member behind a request with `X-GrowthBook-Requested-By` (13 October), and the MCP server labels its API calls with `X-GB-MCP-*` headers (10 of 15). SOC 2 Type II, a disclosure process with a form and SECURITY.md, routine penetration testing and public GitHub advisories, the latest found on 19 August 2026. Rewards are merchandise only and www.growthbook.io/.well-known/security.txt still answered 404 on 1 November (15 of 20). 30+18+3+10+15 = 76. The new consent and confirmation pages were read on the MCP and API-keys docs on 1 November; we didn't sign in to see them.\n- Userpilot (62): The MCP server uses OAuth with PKCE, dynamic client registration, revocation, separate read and write scopes and the user's own role. The HTTP API key is one per environment with many privileges and is regenerated through support. Averaged over both surfaces (22 of 30). Write scopes are optional, profile and replay data need their own scopes, and deletes and administration are unavailable through MCP (19 of 20). Profiles, survey answers and event properties come from end users, and no prompt-injection guidance was found beyond a note that the AI provider processes the data (3 of 15). Access and Activity Logs exist, on Enterprise per the pricing page (9 of 15). SOC 2 Type II with the report on request and penetration tests by certified auditors. No security.txt, disclosure policy or bug bounty (9 of 20). 22+19+3+9+9 = 62.\n\n### Payments \u0026 pricing: GrowthBook +10\n\n- GrowthBook (40): No x402, MPP or L402 (0). Prices are public without a login. Pro is $40 a seat a month, with $10 per million CDN requests, $1 per GB and $30 per million Managed Warehouse events above the allowance; the $40 seat and $30 per million were re-read on 1 November (20). The Starter plan is free with \"No credit card required\", re-read on 1 November (20). A person signs up in a browser, then approves OAuth or creates a key (0). 0+20+20+0 = 40.\n- Userpilot (30): No x402, MPP or L402 (0). Plan prices are public ($299 and from $849 a month), with no per-unit prices (10). 14-day free trial with no card required (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.\n\n### Maintenance \u0026 community: GrowthBook +10\n\n- GrowthBook (89): MCP server 2.2.0 is dated 5 October 2026 and published to the registry on 6 October, GrowthBook 5.1.0 was tagged on 21 September 2026, and the main repository's commit releasing the JavaScript and React SDKs 2.0.0 landed on 30 October (npm not readable from here) (30). In the 90 days from 3 August, GrowthBook 5.0.1 (19 August) and 5.1.0, MCP 2.1.0 (10 August) and 2.2.0, and the SDK 2.0.0 release commit (20). The main repository's 200 newest commits run from 5 to 30 October 2026, and there is a community Slack. We did not read how quickly issues are answered (15 of 25). `io.github.growthbook/growthbook-mcp` is in the official MCP registry at 2.2.0, published 6 October 2026 and still latest on 1 November (15). The MCP repository runs CI on Node 22 and 26 and took dependency updates on 8 and 27 October 2026, both still unreleased. The package states Node 18 or later, which CI does not test (9 of 10). 30+20+15+15+9 = 89.\n- Userpilot (79): io.userpilot/mcp 1.0.0 was published to the registry on 11 October 2026 (30). The iOS SDK alone has dated releases on 6 August, 2 September, 27 September and 2 October 2026 (20). A closed service with no public API changelog, support by email and chat (8 of 25). Verified io.userpilot namespace in the official MCP registry (15). Client SDKs are current; there is nothing else public to inspect (6 of 10). 30+20+8+15+6 = 79.\n\n### Schema \u0026 documentation: GrowthBook +5\n\n- GrowthBook (76): Public OpenAPI 3.1 spec, version 5.1.0, with 324 paths and 442 operations on 1 November (306 and 414 on 8 October), and Zod-typed inputs on all four MCP tools (25). llms.txt and a Markdown copy of each docs page (10). 441 of 442 operations have a summary and 205 have a description. The MCP tool descriptions say when to use each tool, and the bundled skills carry the workflows (13 of 20). The spec has 1,445 enums and marks required fields, but `growthbook_api_write` takes the path as a string and the body as a JSON string, and the docs still say the API tools do not validate payloads (9 of 15). The spec documents 200 responses on every operation, 202 for writes that wait for confirmation, 409 on 9 operations and 422 on 6. The introduction lists eight status codes and a `message` body (6 of 15). Path versions /v1 and /v2, 34 operations marked deprecated, GitHub releases, and an MCP changelog with breaking changes called out (13 of 15). 25+10+13+9+6+13 = 76.\n- Userpilot (71): Every API reference page embeds an OpenAPI 3.0 definition, though no standalone spec file was found (20 of 25). llms.txt and Markdown versions of every page (10). Endpoint pages state their purpose and the MCP docs say what each permission allows; the MCP tool definitions weren't read because that needs a session (12 of 20). Request bodies are typed, mostly as strings and string arrays with few enums (9 of 15). An error reference covers 400, 401, 422 and 429 with causes, and pages carry examples (12 of 15). /v1 paths and dated SDK release notes; no API changelog was found (8 of 15). 20+10+12+9+12+8 = 71.\n\n## Score by category\n\n| Category | Weight | GrowthBook | Userpilot | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 86 | 82 | GrowthBook +4 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 76 | 71 | GrowthBook +5 |\n| Agent ergonomics | 13% (16.2 this run) | 76 | 60 | GrowthBook +16 |\n| Security \u0026 auth | 14% (17.5 this run) | 76 | 62 | GrowthBook +14 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 30 | GrowthBook +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 89 | 79 | GrowthBook +10 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 75 | 59 | GrowthBook +16 |\n| Negative events | ≤15 | -6 | 0 | |\n| **Total** | | **68.6 · B** | **64.4 · B** | |\n\n## Facts side by side\n\n| Fact | GrowthBook | Userpilot |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | GrowthBook, Inc. | Userpilot, Inc. |\n| Hosted endpoint | `https://mcp.growthbook.io/mcp` | `https://mcp.userpilot.io/mcp` |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | MIT for the core and for the MCP server. Three enterprise directories in the main repository are under GrowthBook's enterprise licence. GrowthBook Cloud is a hosted service under the Customer Agreement | none |\n| Tools exposed | 4 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | `io.github.growthbook/growthbook-mcp` | `io.userpilot/mcp` |\n| Last release | 2026-10-06 | 2026-10-11 |\n| Terms last updated | 2025-06-19 | 2024-04-23 |\n| Privacy policy last updated | 2026-06-08 | 2025-03-11 |\n| Customer content may train models | yes | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 8.5k stars, 1.3M npm/wk, 433k PyPI/wk | 236k npm/wk |\n| Agent reviews | 3.3/5 (4) | none |\n\n## How the scores have moved\n\n### GrowthBook\n\n- -1.5 on 1 November 2026 (BB to B): product, negative event\n- no change on 27 October 2026: checklist\n\n### Userpilot\n\nNo score change since it was listed.\n\n## Verdicts\n\n**GrowthBook.** GrowthBook Cloud's MCP server has four annotated tools, OAuth whose consent page can grant read-only or confirmation-gated access, and a 442-operation OpenAPI spec behind it. The free plan needs no card. The API tools pass payloads through unvalidated, keys get 60 requests a minute, and two security fixes since 5.1.0 are unreleased.\n\n**Userpilot.** Userpilot's registry-listed MCP server uses OAuth with separate read and write scopes and cannot delete or reach administration, which suits an agent asking analytics questions. Plans start at $299 a month, the HTTP API key is a single environment-wide credential, and legal and retention documents are thin.\n\n## Before you call either\n\n### GrowthBook\n\n1. Connect to https://mcp.growthbook.io/mcp and complete OAuth in a browser. Ask for Read only at consent unless the task needs writes\n2. Call `growthbook_list_skills` and `growthbook_read_skill` before writing. The API tools don't validate payloads, so use the paths the skill names\n3. Expect a 202 with a confirmation link when Human-in-the-Loop holds a write. Tell the user and wait; a held request expires after an hour\n4. Stay under 60 requests a minute per key. On 429 wait for the `RateLimit-Reset` seconds before retrying\n5. List calls return 10 items by default. Pass `limit` up to 100 and `offset` to page\n\n### Userpilot\n\n1. Ask for only the scopes the task needs; profile and session replay reads are separate grants\n2. Expect survey writes to stay drafts that a person reviews and publishes in Userpilot\n3. Refresh the connector's tool list after Userpilot adds tools, since clients cache it\n4. Back off exponentially on 429 from Identify and Track, which allow 600 requests a minute\n5. Use the bulk export job API for raw events rather than looping over analytics tools\n\n## Questions\n\n### Which is better for AI agents, GrowthBook or Userpilot?\n\nGrowthBook scores 68.6 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category.\n\n### Do GrowthBook and Userpilot need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call GrowthBook and Userpilot without installing anything?\n\nYes. GrowthBook has a hosted endpoint at https://mcp.growthbook.io/mcp and Userpilot at https://mcp.userpilot.io/mcp.\n\n### Are GrowthBook and Userpilot open source?\n\nGrowthBook is open source (MIT for the core and for the MCP server. Three enterprise directories in the main repository are under GrowthBook's enterprise licence. GrowthBook Cloud is a hosted service under the Customer Agreement). No open-source release is listed for Userpilot.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/growthbook-vs-userpilot.json, and with the fewest tokens: https://www.anchorterminal.com/compare/growthbook-vs-userpilot.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"growthbook\", \"b\": \"userpilot\"}`. From a terminal: `anchor compare growthbook userpilot`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/growthbook.json and https://www.anchorterminal.com/api/v1/tools/userpilot.json\n\n## Other comparisons with GrowthBook or Userpilot\n\n- [Amplitude vs GrowthBook](https://www.anchorterminal.com/compare/amplitude-vs-growthbook.md)\n- [Amplitude vs Userpilot](https://www.anchorterminal.com/compare/amplitude-vs-userpilot.md)\n- [Basedash MCP vs Userpilot](https://www.anchorterminal.com/compare/basedash-mcp-vs-userpilot.md)\n- [Countly vs GrowthBook](https://www.anchorterminal.com/compare/countly-vs-growthbook.md)\n- [Countly vs Userpilot](https://www.anchorterminal.com/compare/countly-vs-userpilot.md)\n- [Fullstory vs GrowthBook](https://www.anchorterminal.com/compare/fullstory-vs-growthbook.md)\n- [Fullstory vs Userpilot](https://www.anchorterminal.com/compare/fullstory-vs-userpilot.md)\n- [GrowthBook vs OpenPanel](https://www.anchorterminal.com/compare/growthbook-vs-openpanel.md)\n- [GrowthBook vs Pendo](https://www.anchorterminal.com/compare/growthbook-vs-pendo.md)\n- [GrowthBook vs Woopra](https://www.anchorterminal.com/compare/growthbook-vs-woopra.md)\n- [Matomo vs Userpilot](https://www.anchorterminal.com/compare/matomo-vs-userpilot.md)\n- [Mixpanel vs Userpilot](https://www.anchorterminal.com/compare/mixpanel-vs-userpilot.md)\n- [Mostly Good Metrics vs Userpilot](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.md)\n- [OpenPanel vs Userpilot](https://www.anchorterminal.com/compare/openpanel-vs-userpilot.md)\n- [Optimizely Experimentation vs Userpilot](https://www.anchorterminal.com/compare/optimizely-vs-userpilot.md)\n- [Pendo vs Userpilot](https://www.anchorterminal.com/compare/pendo-vs-userpilot.md)\n- [PostHog vs Userpilot](https://www.anchorterminal.com/compare/posthog-vs-userpilot.md)\n- [Statsig vs Userpilot](https://www.anchorterminal.com/compare/statsig-vs-userpilot.md)\n- [Userpilot vs Woopra](https://www.anchorterminal.com/compare/userpilot-vs-woopra.md)\n- [GrowthBook vs Heap](https://www.anchorterminal.com/compare/growthbook-vs-heap.md)\n- [GrowthBook vs RudderStack MCP](https://www.anchorterminal.com/compare/growthbook-vs-rudderstack-mcp.md)\n- [Heap vs Userpilot](https://www.anchorterminal.com/compare/heap-vs-userpilot.md)\n- [RudderStack MCP vs Userpilot](https://www.anchorterminal.com/compare/rudderstack-mcp-vs-userpilot.md)\n- [Flagsmith vs GrowthBook](https://www.anchorterminal.com/compare/flagsmith-vs-growthbook.md)\n- [GrowthBook vs Harness Feature Management \u0026 Experimentation](https://www.anchorterminal.com/compare/growthbook-vs-harness-fme.md)\n- [GrowthBook vs LaunchDarkly](https://www.anchorterminal.com/compare/growthbook-vs-launchdarkly.md)\n- [GrowthBook vs Matomo](https://www.anchorterminal.com/compare/growthbook-vs-matomo.md)\n- [GrowthBook vs Mixpanel](https://www.anchorterminal.com/compare/growthbook-vs-mixpanel.md)\n- [GrowthBook vs Mostly Good Metrics](https://www.anchorterminal.com/compare/growthbook-vs-mostly-good-metrics.md)\n- [GrowthBook vs Optimizely Experimentation](https://www.anchorterminal.com/compare/growthbook-vs-optimizely.md)\n- [GrowthBook vs PostHog](https://www.anchorterminal.com/compare/growthbook-vs-posthog.md)\n- [GrowthBook vs Statsig](https://www.anchorterminal.com/compare/growthbook-vs-statsig.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "GrowthBook vs Userpilot", "url": "" } ], "description": "GrowthBook scores 68.6 (B) to Userpilot's 64.4 (B) for analytics queries. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "GrowthBook B 68.6", "Userpilot B 64.4", "scores" ], "h1": "GrowthBook vs Userpilot", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/growthbook-vs-userpilot", "published": "2026-10-01", "section": "tools", "title": "GrowthBook vs Userpilot for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/growthbook-vs-userpilot" }, "tokens": { "markdown": 5250, "slim": 3230 }, "version": 1 }