Harness Feature Management & Experimentation vs LaunchDarkly

Harness Feature Management & Experimentation 15

No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.

LaunchDarkly 40

No x402, MPP or L402 (0). Per-unit prices are public without a login, at $10 a service connection a month, $8.33 per 1,000 client-side MAU a month billed yearly and $5 per 1,000 additional AI runs. Enterprise is custom (20). The Developer plan is free with no card (20). A person signs up in a browser and approves OAuth or creates a token (0).

Harness Feature Management & Experimentation 61

A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60.

LaunchDarkly 81

Closed hosted service under published terms. The SDKs and ldcli are Apache-2.0 and the local MCP server is MIT (17 of 30). The privacy policy (8 April 2025) excludes data processed for customers, which the DPA (1 May 2024) covers, with deletion on written request after termination. The privacy policy gives no retention periods. The terms allow use of anonymised and aggregated data, and no clause on model training was found (20 of 30). The end-of-life policy gives API and SDK versions 12 months after a new release, and the version table lists end-of-life dates. Beta resources may change without notice (17 of 20). The sub-processor list (15 May 2026) gives locations, with Anthropic, OpenAI and Speakeasy under AI services, the DPA gives 30 days' notice of new sub-processors, and EU and federal instances exist (20).

Harness Feature Management & Experimentation 71

No public OpenAPI file for the Admin API was found; the reference is a ReadMe site with a Postman collection. The MCP server's 11 tools have typed inputs, and harness_describe returns each FME resource's fields (18 of 25). llms.txt on both developer.harness.io and docs.split.io, and every page as Markdown with .md (10). The README describes each tool and when writes ask for confirmation; resource details sit behind harness_describe rather than in the tool text (13 of 20). The generic tools take a resource_type string and a body, so per-resource constraints aren't in the schema (8 of 15). An error-code page lists 400, 401, 402, 403, 404, 409 and 429 with causes, and docs carry curl examples (10 of 15). Tagged MCP releases and dated SDK versioning policy; the Admin API has v1 and v2 paths and deprecation notices for Split-era endpoints (12 of 15). 18+10+13+8+10+12 = 71.

LaunchDarkly 89

OpenAPI 3.0.3 served without a login at app.launchdarkly.com/api/v2/openapi.json, with 253 paths and 401 operations (25). The hosted MCP input schemas need a sign-in and were not read. A docs index for agents at launchdarkly.com/docs/llms.txt, and docs pages answer as Markdown with .md (10). 399 of 401 operations have a description. The MCP tool descriptions on the server page average about 740 characters and state pagination, sorting, plan limits and which tool to call next (17). 169 enums across 746 schemas. JSON patch bodies and semantic patch instructions are loosely typed objects (9). 1,853 examples in the spec, 429 documented on 287 operations and 403 on 355, and an error table with a suggested fix for each status (13). Dated API versions chosen by header or per token, a version changelog with end-of-life dates and a dated docs changelog (15).

Harness Feature Management & Experimentation 83

11 consolidated tools, and --toolsets=fme narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.

LaunchDarkly 69

The hosted MCP server lists 141 tools, far past 30 (5). The OAuth metadata names reader, writer and observability scopes, but no tool filter for the hosted server was found. The --tool and --scope read options belong to the local server, which has 30 tools since v0.7.2 (27 October 2026), so 3 of 10 added back (8). The API has limit and offset on 61 operations, filters and sorting, summary and detailed representations and an expand parameter on 40 (18). Errors carry code, message and id, with a table of statuses and fixes (15). The server page marks 73 tools read-only, 35 destructive and 89 idempotent. There are no idempotency keys on REST writes, and JSON patch can test a version before applying (15). Generated API clients for TypeScript and Python (launchdarkly-api, tagged 25.1.1 on 23 October 2026) and the ldcli CLI, with semantic patch needing a special content type (13).

Harness Feature Management & Experimentation 79

Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.

LaunchDarkly 66

The hosted MCP server uses OAuth with PKCE (S256), dynamic client registration, a revocation endpoint and three scopes, and an authorised app can never do more than the member who approved it. API access tokens are revocable and resettable with a Reader, Writer, Admin or Owner role. Custom roles and inline policies need a plan with custom roles, and service tokens need Enterprise. No secret in a URL query string is documented (26 of 30). Reader role and reader scope, --scope read and --tool on the local server, and approval requests for changes on Enterprise. No confirmation step for destructive hosted tools was found (14 of 20). The observability tools return logs, traces, errors and session data written by end users. No prompt-injection guidance was found in the MCP docs, which warn only that an API key in a config file may appear in a conversation (3 of 15). Change history with an API at /api/v2/auditlog and comments on updates, limited to 30 days on the Developer plan, and the pricing table lists audit logging under Enterprise only (11 of 15). The security page lists SOC 2 Type II, ISO 27001 and FedRAMP authorisation. security.txt returns 404, and no disclosure policy or bug bounty was found on the pages read (12 of 20).

Harness Feature Management & Experimentation 80

Graded on the hosted FME Admin API with the hosted lines. Statuspage at status.harness.io with an FME component among 196 (20). In the 90 days from 8 August, two FME incidents: API write operations returned 499 errors for 30 minutes on 20 August (minor) and the FME user interface was unavailable for 15 minutes on 23 August (major, interface only; flag evaluation was unaffected per the post). No API outage of an hour or more (20 of 30). About 20 Admin API requests per 10 seconds per organisation and per IP, documented on the MCP page (15). 429 responses carry remaining and reset headers with guidance to wait for the larger reset, and the MCP server backs off and retries three times (15). No SLA was found on harness.io/pricing or the FME docs (0). FME is generally available and the MCP server is at 3.2.40 (10). 20+20+15+15+0+10 = 80.

LaunchDarkly 74

Graded on the hosted service with the hosted lines. Statuspage at status.launchdarkly.com with 51 components and incident history (20). Read from the history feed (the host's robots.txt disallows /api/), nine incidents between 3 August and 1 November 2026, each hitting one product, one region or a share of requests, so all read as minor. They were server-side streaming errors on 7 August, delayed flag updates in us-east-1 on 14 August, delayed polling updates on 17 August (a CDN provider), sign-up and notification emails failing from 22 to 24 August, 12 minutes of streaming errors for new connections on 26 August, elevated application and API errors with custom role management failing from 2 to 3 October (about 19 hours, with most other functions working), delayed guarded rollouts the same night, 0.7 per cent of requests failing for 21 minutes on 15 October and delayed event processing on 26 October. The 10 July outage, marked critical, has left the window (20). The API docs describe global, route, token and IP limits and say the numbers are not published. Limit and remaining headers report them at run time (5 of 15). 429s carry reset headers, IP limits carry Retry-After, and the docs ask for jitter and backoff. No idempotency keys were found, though JSON patch can test a resource version and 409 is documented as retryable (11 of 15). The SLA commits to 99.9 per cent for Enterprise support and 99.99 per cent for Premium support (10). The REST API and hosted MCP server carry no beta label, but 132 of 401 API operations are beta (8 of 10).