# Harness Feature Management & Experimentation vs Heap

> Harness Feature Management & Experimentation scores 69.2 (B) to Heap's 48.2 (D) for event analytics. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/harness-fme-vs-heap
- Markdown: https://www.anchorterminal.com/compare/harness-fme-vs-heap.md (~5,300 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Harness Feature Management & Experimentation scores 69.2 (B) on agent readiness against Heap's 48.2 (D), and leads in 5 of 7 scored categories. Heap leads on payments & pricing and transparency & trust. Both do event analytics.

- Harness Feature Management & Experimentation: grade B, 69.2/100, rank #257 of 1486. Markdown https://www.anchorterminal.com/tools/harness-fme.md · JSON https://www.anchorterminal.com/api/v1/tools/harness-fme.json
- Heap: grade D, 48.2/100, rank #1120 of 1486. Markdown https://www.anchorterminal.com/tools/heap.md · JSON https://www.anchorterminal.com/api/v1/tools/heap.json
- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md
- All 153 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md

## Which one, for what

### Harness Feature Management & Experimentation (B)

Good for: Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails.

Ahead on:
- Reliability, 80 against 47
- Schema & documentation, 71 against 57
- Agent ergonomics, 83 against 49
- Security & auth, 79 against 41
- Maintenance & community, 81 against 63

Also in its favour:
- Runs on your own machine

Watch for: No FME prices are published; Enterprise is by quotation and free plan limits are unstated

### Heap (D)

Good for: An agent that records backend events or enriches user and account properties in a company's existing Heap project, or that files privacy deletions.

Ahead on:
- Payments & pricing, 25 against 15
- Transparency & trust, 66 against 61

Watch for: No query, export or definitions endpoint in the developer reference. Reading results needs the app, Heap Connect or the MCP server we couldn't read


## Why the edge

### Security & auth: Harness Feature Management & Experimentation +38

- Harness Feature Management & Experimentation (79): Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.
- Heap (41): Track, identify and property calls carry no secret. The OpenAPI fragment declares an empty security requirement and the only identifier is the environment ID that the web snippet publishes. User deletion uses one admin-generated API key per account, exchanged for a temporary token. No scopes or rotation guidance found (8 of 30). Ingest is write-only by design. Deletion of up to 10,000 users has no confirmation step (5). The API returns no untrusted content (10). Audit logs are unchecked because help.heap.io answered with a bot check, so none are counted (0). Contentsquare publishes a signed security.txt valid to 31 January 2028 on contentsquare.com (not on heap.io), a disclosure policy, an invitation-only YesWeHack bounty, SOC 2 Type II and ISO 27001 (18). Total 41. Per the 7 October check, not re-read on 4 November, because heap.io and contentsquare.com terms bar robots and crawling.

### Agent ergonomics: Harness Feature Management & Experimentation +34

- Harness Feature Management & Experimentation (83): 11 consolidated tools, and `--toolsets=fme` narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.
- Heap (49): Responses are an empty object, so context cost is small, but there is nothing to read back (15). No pagination or filtering because the reference has no read endpoint. Bulk calls take 1,000 events or users (5). Errors on track and identify are a bare 400. User deletion returns `err.message` with 401 and 404 explained (6). `idempotency_key` on track and bulk track, and property writes overwrite, so retries are safe (15). Track needs three fields and timestamps default to now. No current official server SDK was found. heap-api on npm is 1.0.1 from 2016 (8). Total 49. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.

### Reliability: Harness Feature Management & Experimentation +33

- Harness Feature Management & Experimentation (80): Graded on the hosted FME Admin API with the hosted lines. Statuspage at status.harness.io with an FME component among 196 (20). In the 90 days from 8 August, two FME incidents: API write operations returned 499 errors for 30 minutes on 20 August (minor) and the FME user interface was unavailable for 15 minutes on 23 August (major, interface only; flag evaluation was unaffected per the post). No API outage of an hour or more (20 of 30). About 20 Admin API requests per 10 seconds per organisation and per IP, documented on the MCP page (15). 429 responses carry remaining and reset headers with guidance to wait for the larger reset, and the MCP server backs off and retries three times (15). No SLA was found on harness.io/pricing or the FME docs (0). FME is generally available and the MCP server is at 3.2.40 (10). 20+20+15+15+0+10 = 80.
- Heap (47): Graded on the server-side API with the hosted lines. Heap's status page is an Atlassian Statuspage at status.heap.io, the address heap.io links to, which sits on a heap.io host whose terms bar robots, so it wasn't read on 4 November. The same page also answers at heap.statuspage.io, but that copy names status.heap.io as its canonical address and no Heap page links to it, so it wasn't used. The 7 October component and incident readings came only from Statuspage's JSON API, which this run doesn't use, so they are struck. No component list could be read (0) and no incident history could be read (5). Rate limits published with numbers, 30 requests per 30 seconds per identity on track and 15,000 events a minute per environment on bulk track, per the 7 October check, not re-read on 4 November (15). No 429 or backoff guidance found, but track takes an `idempotency_key`, per the 7 October check, not re-read on 4 November (7, the earlier partial kept, since keys without any 429 or backoff guidance meet none of the line's values in full). Contentsquare's support package states 99.5 per cent availability for Product Analytics Pro and Enterprise, measured on the user interface, per the 7 October check, not re-read on 4 November (10). The API carries no beta label (10). 0+5+15+7+10+10 = 47.

### Maintenance & community: Harness Feature Management & Experimentation +18

- Harness Feature Management & Experimentation (81): harness-mcp-v2 3.2.40 was tagged on 4 November 2026 (30). 14 tagged MCP releases between 8 August and 4 November (20). 100 commits since 8 August in the clone; FME docs and SDK release notes are dated, with support and a community site. Issue response times weren't read because the GitHub API refused us for its rate limit (15 of 25). Not found in the official MCP registry under a Harness namespace; official SDKs are current (8 of 15). MIT package with npm shrinkwrap and tests; CI state not read (8 of 10). 30+20+15+8+8 = 81.
- Heap (63): heap.js 5.3.17 shipped on 6 October 2026, but that is the browser SDK. The server-side track reference last changed on 3 June 2026 and has no changelog, so we scored this line between the two (20 of 30). heap.js 5.3.15, 5.3.16 and 5.3.17 and Android Core 0.9.5 fall inside 90 days (20). Dated public changelogs and a community at community.contentsquare.com, whose response times we didn't check (8). Client SDKs for web, Android, iOS, React Native and Flutter are current. The Node server client is from 2016 (10). CI not checked (5). Total 63. Per the 7 October check, not re-read on 4 November (developers.heap.io is paused on its terms). The three heap.js releases still fall inside the 90 days from 6 August.

### Schema & documentation: Harness Feature Management & Experimentation +14

- Harness Feature Management & Experimentation (71): No public OpenAPI file for the Admin API was found; the reference is a ReadMe site with a Postman collection. The MCP server's 11 tools have typed inputs, and harness_describe returns each FME resource's fields (18 of 25). llms.txt on both developer.harness.io and docs.split.io, and every page as Markdown with `.md` (10). The README describes each tool and when writes ask for confirmation; resource details sit behind harness_describe rather than in the tool text (13 of 20). The generic tools take a resource_type string and a body, so per-resource constraints aren't in the schema (8 of 15). An error-code page lists 400, 401, 402, 403, 404, 409 and 429 with causes, and docs carry curl examples (10 of 15). Tagged MCP releases and dated SDK versioning policy; the Admin API has v1 and v2 paths and deprecation notices for Split-era endpoints (12 of 15). 18+10+13+8+10+12 = 71.
- Heap (57): OpenAPI 3.1 fragments are embedded in the Markdown of the track and identify pages. No single spec file was found, the property pages we read had empty fragments and user deletion is prose only (15). llms.txt and a .md copy of every page (10). Descriptions state purpose, limits and reserved keys, with little on when not to use a call (12). Required fields are marked and lengths stated in prose, with string types throughout, no enums and a free-form `properties` object (8). Curl examples on every page. Track and identify document 200 and 400 with an empty object, and only user deletion describes its error body (7). SDK changelogs are dated, but no changelog or version policy for the server-side API was found. Paths mix unversioned, v1 and v0 (5). Total 57. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.

### Payments & pricing: Heap +10

- Harness Feature Management & Experimentation (15): No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.
- Heap (25): No x402, MPP or L402 (0). The Free plan and its 10,000-session limit are public. Growth needs an estimate after signup and Pro and Premier say Contact Us, so no paid price is published (5). Free plan with APIs included. No card is mentioned on the pricing page, and the signup form needs JavaScript we couldn't run (20). A person signs up in a browser and copies the environment ID (0). Total 25. Per the 7 October check, not re-read on 4 November (www.heap.io is paused on its terms).

## Score by category

| Category | Weight | Harness Feature Management & Experimentation | Heap | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 80 | 47 | Harness Feature Management & Experimentation +33 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 71 | 57 | Harness Feature Management & Experimentation +14 |
| Agent ergonomics | 13% (16.2 this run) | 83 | 49 | Harness Feature Management & Experimentation +34 |
| Security & auth | 14% (17.5 this run) | 79 | 41 | Harness Feature Management & Experimentation +38 |
| Payments & pricing | 10% (12.5 this run) | 15 | 25 | Heap +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 81 | 63 | Harness Feature Management & Experimentation +18 |
| Transparency & trust | 7% (8.8 this run) | 61 | 66 | Heap +5 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **69.2 · B** | **48.2 · D** | |

## Facts side by side

| Fact | Harness Feature Management & Experimentation | Heap |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Harness Inc. | Contentsquare (Content Square, Inc.) |
| Hosted endpoint | `https://mcp.harness.io/mcp` | `https://heapanalytics.com` |
| Transports | HTTP, stdio, Streamable HTTP | HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | none | Proprietary service under Contentsquare's master services agreement. The React Native bridge and the Node client on npm are MIT |
| Tools exposed | 11 | none |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-11-04 | 2026-10-06 |
| Terms last updated | no date given | no date given |
| Privacy policy last updated | no date given | couldn't be read |
| Customer content may train models | not found in the text | yes |
| Terms restrict automated access | not found in the text | not found in the text |
| Terms restrict benchmarking | yes | yes |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 8.8k npm/wk | 213 npm/wk |

## How the scores have moved

### Harness Feature Management & Experimentation

No score change since it was listed.

### Heap

- -5.0 on 4 November 2026: correction
- +0.1 on 28 October 2026: new evidence
- +0.1 on 27 October 2026: checklist

## Verdicts

**Harness Feature Management & Experimentation.** Harness FME, formerly Split, gives agents 11 consolidated MCP tools with an FME-only toolset, a read-only switch and confirmation on writes, over an Admin API with documented limits and role-scoped keys. FME prices are not published, the free plan's limits are unstated, and the hosted MCP endpoint must be enabled by Harness Support.

**Heap.** Heap's server-side API suits an agent that records events. Limits are published, bulk calls take 1,000 items and track accepts an idempotency key. The API returns no analytics, and ingest calls carry no secret beyond the environment ID. Heap's help centre lists a Heap MCP article, which a bot check stopped us reading, so the MCP server is ungraded.

## Before you call either

### Harness Feature Management & Experimentation

1. Start the MCP server with `--toolsets=fme` so only FME resource types load
2. Call `harness_describe(resource_type='fme_feature_flag')` before a create or update to see the fields
3. Filter fme_feature_flag lists by name, tags or rollout status rather than listing every flag
4. Set HARNESS_READ_ONLY for analysis tasks; leave confirmation on for kill, restore and delete
5. On 429, wait at least the larger X-RateLimit-Reset-Seconds value before retrying

### Heap

1. Send EU projects to https://c.eu.heap-api.com instead of https://heapanalytics.com. The path stays the same
2. Pass one of `identity` or `user_id` on track, never both
3. Set `idempotency_key` on every track event so a retry doesn't duplicate it
4. Stay under 30 requests per 30 seconds per identity, or batch up to 1,000 events in one bulk call
5. For deletion, exchange the app_id and API key of the Main Production environment for a token first. Any other environment ID returns Unauthorized

## Questions

### Which is better for AI agents, Harness Feature Management & Experimentation or Heap?

Harness Feature Management & Experimentation scores 69.2 (B) on agent readiness against Heap's 48.2 (D), and leads in 5 of 7 scored categories. Heap leads on payments & pricing and transparency & trust.

### Do Harness Feature Management & Experimentation and Heap need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call Harness Feature Management & Experimentation and Heap without installing anything?

Yes. Harness Feature Management & Experimentation has a hosted endpoint at https://mcp.harness.io/mcp and Heap at https://heapanalytics.com.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/harness-fme-vs-heap.json, and with the fewest tokens: https://www.anchorterminal.com/compare/harness-fme-vs-heap.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "harness-fme", "b": "heap"}`. From a terminal: `anchor compare harness-fme heap`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/harness-fme.json and https://www.anchorterminal.com/api/v1/tools/heap.json

## Other comparisons with Harness Feature Management & Experimentation or Heap

- [Amplitude vs Harness Feature Management & Experimentation](https://www.anchorterminal.com/compare/amplitude-vs-harness-fme.md)
- [Countly vs Harness Feature Management & Experimentation](https://www.anchorterminal.com/compare/countly-vs-harness-fme.md)
- [Flagsmith vs Harness Feature Management & Experimentation](https://www.anchorterminal.com/compare/flagsmith-vs-harness-fme.md)
- [Harness Feature Management & Experimentation vs LaunchDarkly](https://www.anchorterminal.com/compare/harness-fme-vs-launchdarkly.md)
- [Harness Feature Management & Experimentation vs Mixpanel](https://www.anchorterminal.com/compare/harness-fme-vs-mixpanel.md)
- [Harness Feature Management & Experimentation vs Optimizely Experimentation](https://www.anchorterminal.com/compare/harness-fme-vs-optimizely.md)
- [Harness Feature Management & Experimentation vs PostHog](https://www.anchorterminal.com/compare/harness-fme-vs-posthog.md)
- [Harness Feature Management & Experimentation vs Statsig](https://www.anchorterminal.com/compare/harness-fme-vs-statsig.md)
- [Amplitude vs Heap](https://www.anchorterminal.com/compare/amplitude-vs-heap.md)
- [Countly vs Heap](https://www.anchorterminal.com/compare/countly-vs-heap.md)
- [Flagsmith vs Heap](https://www.anchorterminal.com/compare/flagsmith-vs-heap.md)
- [Fullstory vs Harness Feature Management & Experimentation](https://www.anchorterminal.com/compare/fullstory-vs-harness-fme.md)
- [Fullstory vs Heap](https://www.anchorterminal.com/compare/fullstory-vs-heap.md)
- [GrowthBook vs Heap](https://www.anchorterminal.com/compare/growthbook-vs-heap.md)
- [Harness Feature Management & Experimentation vs OpenPanel](https://www.anchorterminal.com/compare/harness-fme-vs-openpanel.md)
- [Harness Feature Management & Experimentation vs Woopra](https://www.anchorterminal.com/compare/harness-fme-vs-woopra.md)
- [Heap vs Matomo](https://www.anchorterminal.com/compare/heap-vs-matomo.md)
- [Heap vs Mixpanel](https://www.anchorterminal.com/compare/heap-vs-mixpanel.md)
- [Heap vs Mostly Good Metrics](https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.md)
- [Heap vs OpenPanel](https://www.anchorterminal.com/compare/heap-vs-openpanel.md)
- [Heap vs Pendo](https://www.anchorterminal.com/compare/heap-vs-pendo.md)
- [Heap vs PostHog](https://www.anchorterminal.com/compare/heap-vs-posthog.md)
- [Heap vs Statsig](https://www.anchorterminal.com/compare/heap-vs-statsig.md)
- [Heap vs Userpilot](https://www.anchorterminal.com/compare/heap-vs-userpilot.md)
- [Heap vs Woopra](https://www.anchorterminal.com/compare/heap-vs-woopra.md)
- [GrowthBook vs Harness Feature Management & Experimentation](https://www.anchorterminal.com/compare/growthbook-vs-harness-fme.md)
- [Harness Feature Management & Experimentation vs Matomo](https://www.anchorterminal.com/compare/harness-fme-vs-matomo.md)
- [Harness Feature Management & Experimentation vs Mostly Good Metrics](https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp