# Harness Feature Management & Experimentation vs Matomo (slim)

> Harness Feature Management & Experimentation scores 69.2 (B) to Matomo's 61.7 (C) for feature flags and experiments. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/harness-fme-vs-matomo.md (~5,050 tokens) · this version ~2,730 tokens · JSON https://www.anchorterminal.com/compare/harness-fme-vs-matomo.json · canonical https://www.anchorterminal.com/compare/harness-fme-vs-matomo
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Harness Feature Management & Experimentation scores 69.2 (B) on agent readiness against Matomo's 61.7 (C), and leads in 4 of 7 scored categories. Matomo leads on payments & pricing and transparency & trust. Both do feature flags and experiments.

- Harness Feature Management & Experimentation: B 69.2, rank #257 of 1486 · https://www.anchorterminal.com/tools/harness-fme.min.md
- Matomo: C 61.7, rank #594 of 1486 · https://www.anchorterminal.com/tools/matomo.min.md
- Harness Feature Management & Experimentation, good for Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails. Ahead on Reliability, 80 against 38; Agent ergonomics, 83 against 78; Security & auth, 79 against 71. Also A hosted endpoint, with nothing to install; Runs on your own machine.
- Matomo, good for Teams that want web and product analytics with data kept in the EU or on their own servers, queried by report, segment, funnel or cohort. Ahead on Payments & pricing, 30 against 15; Transparency & trust, 74 against 61. Also Free to start without a card; Open source.

| Category | Harness Feature Management & Experimentation | Matomo |
| --- | --- | --- |
| Reliability (16%) | 80 | 38 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 71 | 73 |
| Agent ergonomics (13%) | 83 | 78 |
| Security & auth (14%) | 79 | 71 |
| Payments & pricing (10%) | 15 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 79 |
| Transparency & trust (7%) | 61 | 74 |

| Fact (where they differ) | Harness Feature Management & Experimentation | Matomo |
| --- | --- | --- |
| Vendor | Harness Inc. | InnoCraft Limited |
| Hosted endpoint | `https://mcp.harness.io/mcp` | no (local only) |
| Transports | HTTP, stdio, Streamable HTTP | HTTP, Streamable HTTP |
| Pricing | Freemium | Paid |
| Licence | none | Matomo core is GPL-3.0-or-later and the MCP server plugin is GPL v3 or later. Matomo Cloud is a hosted service under InnoCraft's terms. Paid On-Premise plugins fall under the InnoCraft EULA |
| Tools exposed | 11 | 19 |
| Read-only variant documented | no | yes |
| llms.txt | yes | no |
| Last release | 2026-11-04 | 2026-10-22 |
| Terms last updated | no date given | 2025-04-10 |
| Privacy policy last updated | no date given | 2026-05-05 |
| Terms restrict automated access | not found in the text | yes |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Popularity | 8.8k npm/wk | none |
| Agent reviews | none | 3.3/5 (4) |

Why the edge:
- Reliability, Harness Feature Management & Experimentation +42: Harness Feature Management & Experimentation 80 (Graded on the hosted FME Admin API with the hosted lines. Statuspage at status.harness.io with an FME component among 196 (20). In the 90 days from 8 August, two FME incidents: API write operations returned 499 errors for 30 minutes on 20 August (minor) and the FME user interface was unavailable for 15 minutes on 23 August (major, interface only; flag evaluation was unaffected per the post). No API outage of an hour or more (20 of 30). About 20 Admin API requests per 10 seconds per organisation and per IP, documented on the MCP page (15). 429 responses carry remaining and reset headers with guidance to wait for the larger reset, and the MCP server backs off and retries three times (15). No SLA was found on harness.io/pricing or the FME docs (0). FME is generally available and the MCP server is at 3.2.40 (10). 20+20+15+15+0+10 = 80.); Matomo 38 (Graded on the hosted lines, for a Matomo Cloud instance reached through the Reporting HTTP API and the MCP server included with Cloud. status.matomo.cloud is the listed public status page, credited on its existence as for the Zoho status hosts and fireflies (20). On 4 November its robots.txt answered with an access-denied error page, so the page wasn't read again and the 9 October component and feed readings are struck. No 90-day incident record could be read then or now (5). No API rate limit numbers were found. The terms reserve suspension for excessively frequent requests, and `API.getBulkRequest` is capped at 50 URLs for anonymous callers (3 of 15). No 429 or retry guidance and no idempotency keys were found (0). No SLA for Cloud was found, and the terms supply the service as is (0). The Reporting API and MCP plugin 5.1.1 are stable releases (10).)
- Payments & pricing, Matomo +15: Harness Feature Management & Experimentation 15 (No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.); Matomo 30 (Scored for Matomo Cloud, the hosted option. No x402, MPP or L402 (0). Plan prices by monthly hits are public without a login, from $26 for 50,000 hits to $17,900 for 100 million, and API calls are not priced by unit (10). The Cloud trial needs no credit card, and On-Premise is free to self-host (20). A person signs up in a browser, and the terms forbid accounts registered by bots or other automated methods (0).)
- Transparency & trust, Matomo +13: Harness Feature Management & Experimentation 61 (A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60.); Matomo 74 (The core and the MCP plugin are GPL v3 or later. Matomo Cloud is a hosted service under terms, and paid On-Premise plugins fall under the InnoCraft EULA (22 of 30). The Cloud terms, DPA and privacy policy agree. Customer data is deleted 30 days after termination, with residual account information in backups and logs for up to 60 days, raw data is kept 24 months on the Business plan, and the customer owns its data. The privacy policy gives no period for account data (25). The developer changelog lists deprecations with the major version that removes them and no dates. The terms allow changes with or without notice and promise notice of significant permanent ones (12 of 20). The sub-processor list, last updated 9 October 2025, names AWS in Frankfurt and Dublin, an AWS management firm in the Netherlands and a monitoring firm in Germany (18).)
- Security & auth, Harness Feature Management & Experimentation +8: Harness Feature Management & Experimentation 79 (Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.); Matomo 71 (OAuth 2.0 plugin with authorisation code and PKCE, client credentials and refresh grants, four scopes with one a token, and client pause and secret rotation. `token_auth` tokens are revocable with an expiry date and a POST-only option, and gain an access level in Matomo 6 (26 of 30). Less 10 because the API docs present `token_auth` as a URL parameter (16). View-level users and scopes, MCP disabled by default, raw API tools off by default with per-class switches and a privilege cap. No confirmation step in the server (16 of 20). Matomo publishes prompt-injection guidance for analytics data with risk levels, and MCP errors do not echo supplied values. No filtering of tool output was found (11 of 15). Activity Log is listed for Cloud, the DPA describes authentication and change logs, and MCP tool-call logging is off by default (11). HackerOne bounty up to $13,000, a disclosure policy, ISO/IEC 27001:2022 certification stated, security fixes noted in release notes. No security.txt (17).)
- Agent ergonomics, Harness Feature Management & Experimentation +5: Harness Feature Management & Experimentation 83 (11 consolidated tools, and `--toolsets=fme` narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.); Matomo 78 (The MCP server has 19 tools, 12 of them visible by default (15), plus 6 because the seven raw API tools stay hidden until an administrator allows them by read, create, update or delete class (21). `filter_limit`, `filter_offset`, sorting, pattern filters, `showColumns` and segments on the API, and cursors with a 250-row cap on the MCP report tool (20). Errors are HTTP codes with a message and an optional integer code, with no code catalogue. The MCP server separates schema failures (-32602) from tool result errors that name the arguments involved (14). Every MCP tool carries readOnlyHint, destructiveHint and idempotentHint. API writes have no idempotency keys and the OpenAPI descriptions declare delete methods as GET (13). Report calls need only `idSite`, `period` and `date`. The official clients for JavaScript, PHP and Java cover tracking, not the Reporting API (10).)