# Harness Feature Management & Experimentation vs Heap (slim)

> Harness Feature Management & Experimentation scores 69.2 (B) to Heap's 48.2 (D) for event analytics. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/harness-fme-vs-heap.md (~5,300 tokens) · this version ~3,130 tokens · JSON https://www.anchorterminal.com/compare/harness-fme-vs-heap.json · canonical https://www.anchorterminal.com/compare/harness-fme-vs-heap
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Harness Feature Management & Experimentation scores 69.2 (B) on agent readiness against Heap's 48.2 (D), and leads in 5 of 7 scored categories. Heap leads on payments & pricing and transparency & trust. Both do event analytics.

- Harness Feature Management & Experimentation: B 69.2, rank #257 of 1486 · https://www.anchorterminal.com/tools/harness-fme.min.md
- Heap: D 48.2, rank #1120 of 1486 · https://www.anchorterminal.com/tools/heap.min.md
- Harness Feature Management & Experimentation, good for Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails. Ahead on Reliability, 80 against 47; Schema & documentation, 71 against 57; Agent ergonomics, 83 against 49; Security & auth, 79 against 41; Maintenance & community, 81 against 63. Also Runs on your own machine.
- Heap, good for An agent that records backend events or enriches user and account properties in a company's existing Heap project, or that files privacy deletions. Ahead on Payments & pricing, 25 against 15; Transparency & trust, 66 against 61.

| Category | Harness Feature Management & Experimentation | Heap |
| --- | --- | --- |
| Reliability (16%) | 80 | 47 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 71 | 57 |
| Agent ergonomics (13%) | 83 | 49 |
| Security & auth (14%) | 79 | 41 |
| Payments & pricing (10%) | 15 | 25 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 63 |
| Transparency & trust (7%) | 61 | 66 |

| Fact (where they differ) | Harness Feature Management & Experimentation | Heap |
| --- | --- | --- |
| Vendor | Harness Inc. | Contentsquare (Content Square, Inc.) |
| Hosted endpoint | `https://mcp.harness.io/mcp` | `https://heapanalytics.com` |
| Transports | HTTP, stdio, Streamable HTTP | HTTP |
| Licence | none | Proprietary service under Contentsquare's master services agreement. The React Native bridge and the Node client on npm are MIT |
| Tools exposed | 11 | none |
| Last release | 2026-11-04 | 2026-10-06 |
| Privacy policy last updated | no date given | couldn't be read |
| Customer content may train models | not found in the text | yes |
| Popularity | 8.8k npm/wk | 213 npm/wk |

Why the edge:
- Security & auth, Harness Feature Management & Experimentation +38: Harness Feature Management & Experimentation 79 (Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.); Heap 41 (Track, identify and property calls carry no secret. The OpenAPI fragment declares an empty security requirement and the only identifier is the environment ID that the web snippet publishes. User deletion uses one admin-generated API key per account, exchanged for a temporary token. No scopes or rotation guidance found (8 of 30). Ingest is write-only by design. Deletion of up to 10,000 users has no confirmation step (5). The API returns no untrusted content (10). Audit logs are unchecked because help.heap.io answered with a bot check, so none are counted (0). Contentsquare publishes a signed security.txt valid to 31 January 2028 on contentsquare.com (not on heap.io), a disclosure policy, an invitation-only YesWeHack bounty, SOC 2 Type II and ISO 27001 (18). Total 41. Per the 7 October check, not re-read on 4 November, because heap.io and contentsquare.com terms bar robots and crawling.)
- Agent ergonomics, Harness Feature Management & Experimentation +34: Harness Feature Management & Experimentation 83 (11 consolidated tools, and `--toolsets=fme` narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.); Heap 49 (Responses are an empty object, so context cost is small, but there is nothing to read back (15). No pagination or filtering because the reference has no read endpoint. Bulk calls take 1,000 events or users (5). Errors on track and identify are a bare 400. User deletion returns `err.message` with 401 and 404 explained (6). `idempotency_key` on track and bulk track, and property writes overwrite, so retries are safe (15). Track needs three fields and timestamps default to now. No current official server SDK was found. heap-api on npm is 1.0.1 from 2016 (8). Total 49. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.)
- Reliability, Harness Feature Management & Experimentation +33: Harness Feature Management & Experimentation 80 (Graded on the hosted FME Admin API with the hosted lines. Statuspage at status.harness.io with an FME component among 196 (20). In the 90 days from 8 August, two FME incidents: API write operations returned 499 errors for 30 minutes on 20 August (minor) and the FME user interface was unavailable for 15 minutes on 23 August (major, interface only; flag evaluation was unaffected per the post). No API outage of an hour or more (20 of 30). About 20 Admin API requests per 10 seconds per organisation and per IP, documented on the MCP page (15). 429 responses carry remaining and reset headers with guidance to wait for the larger reset, and the MCP server backs off and retries three times (15). No SLA was found on harness.io/pricing or the FME docs (0). FME is generally available and the MCP server is at 3.2.40 (10). 20+20+15+15+0+10 = 80.); Heap 47 (Graded on the server-side API with the hosted lines. Heap's status page is an Atlassian Statuspage at status.heap.io, the address heap.io links to, which sits on a heap.io host whose terms bar robots, so it wasn't read on 4 November. The same page also answers at heap.statuspage.io, but that copy names status.heap.io as its canonical address and no Heap page links to it, so it wasn't used. The 7 October component and incident readings came only from Statuspage's JSON API, which this run doesn't use, so they are struck. No component list could be read (0) and no incident history could be read (5). Rate limits published with numbers, 30 requests per 30 seconds per identity on track and 15,000 events a minute per environment on bulk track, per the 7 October check, not re-read on 4 November (15). No 429 or backoff guidance found, but track takes an `idempotency_key`, per the 7 October check, not re-read on 4 November (7, the earlier partial kept, since keys without any 429 or backoff guidance meet none of the line's values in full). Contentsquare's support package states 99.5 per cent availability for Product Analytics Pro and Enterprise, measured on the user interface, per the 7 October check, not re-read on 4 November (10). The API carries no beta label (10). 0+5+15+7+10+10 = 47.)
- Maintenance & community, Harness Feature Management & Experimentation +18: Harness Feature Management & Experimentation 81 (harness-mcp-v2 3.2.40 was tagged on 4 November 2026 (30). 14 tagged MCP releases between 8 August and 4 November (20). 100 commits since 8 August in the clone; FME docs and SDK release notes are dated, with support and a community site. Issue response times weren't read because the GitHub API refused us for its rate limit (15 of 25). Not found in the official MCP registry under a Harness namespace; official SDKs are current (8 of 15). MIT package with npm shrinkwrap and tests; CI state not read (8 of 10). 30+20+15+8+8 = 81.); Heap 63 (heap.js 5.3.17 shipped on 6 October 2026, but that is the browser SDK. The server-side track reference last changed on 3 June 2026 and has no changelog, so we scored this line between the two (20 of 30). heap.js 5.3.15, 5.3.16 and 5.3.17 and Android Core 0.9.5 fall inside 90 days (20). Dated public changelogs and a community at community.contentsquare.com, whose response times we didn't check (8). Client SDKs for web, Android, iOS, React Native and Flutter are current. The Node server client is from 2016 (10). CI not checked (5). Total 63. Per the 7 October check, not re-read on 4 November (developers.heap.io is paused on its terms). The three heap.js releases still fall inside the 90 days from 6 August.)
- Schema & documentation, Harness Feature Management & Experimentation +14: Harness Feature Management & Experimentation 71 (No public OpenAPI file for the Admin API was found; the reference is a ReadMe site with a Postman collection. The MCP server's 11 tools have typed inputs, and harness_describe returns each FME resource's fields (18 of 25). llms.txt on both developer.harness.io and docs.split.io, and every page as Markdown with `.md` (10). The README describes each tool and when writes ask for confirmation; resource details sit behind harness_describe rather than in the tool text (13 of 20). The generic tools take a resource_type string and a body, so per-resource constraints aren't in the schema (8 of 15). An error-code page lists 400, 401, 402, 403, 404, 409 and 429 with causes, and docs carry curl examples (10 of 15). Tagged MCP releases and dated SDK versioning policy; the Admin API has v1 and v2 paths and deprecation notices for Split-era endpoints (12 of 15). 18+10+13+8+10+12 = 71.); Heap 57 (OpenAPI 3.1 fragments are embedded in the Markdown of the track and identify pages. No single spec file was found, the property pages we read had empty fragments and user deletion is prose only (15). llms.txt and a .md copy of every page (10). Descriptions state purpose, limits and reserved keys, with little on when not to use a call (12). Required fields are marked and lengths stated in prose, with string types throughout, no enums and a free-form `properties` object (8). Curl examples on every page. Track and identify document 200 and 400 with an empty object, and only user deletion describes its error body (7). SDK changelogs are dated, but no changelog or version policy for the server-side API was found. Paths mix unversioned, v1 and v0 (5). Total 57. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.)
- Payments & pricing, Heap +10: Harness Feature Management & Experimentation 15 (No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.); Heap 25 (No x402, MPP or L402 (0). The Free plan and its 10,000-session limit are public. Growth needs an estimate after signup and Pro and Premier say Contact Us, so no paid price is published (5). Free plan with APIs included. No card is mentioned on the pricing page, and the signup form needs JavaScript we couldn't run (20). A person signs up in a browser and copies the environment ID (0). Total 25. Per the 7 October check, not re-read on 4 November (www.heap.io is paused on its terms).)