Harness Feature Management & Experimentation vs Optimizely Experimentation

Harness Feature Management & Experimentation 83

11 consolidated tools, and --toolsets=fme narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.

Optimizely Experimentation 68

The MCP server lists eight tools since exp_program_reporting_execute_query was added on 13 October 2026, which is 25 on the checklist. We took 2 off because the tool definitions were unread and their size is unknown (23 of 25). per_page up to 100 and page on the v2 lists, page_token, sort and query on the flags list, and time windows on results (17 of 20). The Optimizely API returns code, message and a uuid, and the Feature Experimentation API returns a problem detail object. MCP error results were unread (13 of 20). No idempotency keys were found and the tool annotations were unread. The docs say the agent confirms project, environment and details before a change, which is client behaviour, and entities are archived through the lifecycle tool (5 of 20). The MCP server needs only a URL. The official SDKs in eleven languages evaluate flags and log events and do not cover the management APIs (10 of 15).

Harness Feature Management & Experimentation 15

No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.

Optimizely Experimentation 0

No x402, MPP or L402 (0). No price is published. The plans page says every plan is individually packaged and leads to a demo request (0). No free plan or trial was found on the plans page, the product pages or the docs (0). Access needs a subscription and a browser sign-in through Opti ID (0).

Harness Feature Management & Experimentation 61

A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60.

Optimizely Experimentation 75

Closed hosted service under a published Online Software Subscription Agreement and API, SDK and MCP terms. The SDKs are open source under Apache 2.0 (17 of 30). The privacy notice of 1 July 2026 says it does not cover customer data and points to the subscription agreement and the Data Processing Agreement (V 2026-01), which agree. Event data is kept 18 months, and customer data may be deleted 30 days after a subscription ends. How the MCP server and Opal handle prompts for Experimentation is not stated on the MCP pages (22 of 30). The API, SDK and MCP terms let Optimizely revise, suspend or cancel any API or MCP at any time under its documentation and policies. An SDK compatibility matrix exists. No deprecation policy with a notice period was found for the APIs (6 of 20). The sub-processor list, updated 14 September 2026, names providers by product with hosting locations. Web and Feature Experimentation list Amazon Web Services in the United States and Google Cloud in the United States and Europe (18 of 20).

Harness Feature Management & Experimentation 79

Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.

Optimizely Experimentation 66

The MCP server uses OAuth 2.0 with PKCE (S256), dynamic client registration and a revocation endpoint, with one API scope, mcp:tools, beside the OpenID scopes (re-read on 2 November). REST personal access tokens are revocable, named and sent in a header, and administrators can revoke any collaborator's token. The REST OAuth flow has the single scope all, described as full access to the account (22 of 30). Sessions and tokens carry the user's role, Feature Experimentation has granular roles for flags, environments and audiences, and change approvals have routed flag changes to reviewers since 6 August 2026. No read-only mode for the MCP server was found, and confirmation before a write is left to the client (13 of 20). No guidance on prompt injection was found, though tools return names, descriptions and hypotheses that people wrote (3 of 15). Change history for projects and flags is in the application, at /v2/changes and in webhooks (12 of 15). ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2 and PCI DSS are stated for Web and Feature Experimentation, with annual penetration tests and a bug bounty programme reachable at securityeng@optimizely.com. No security.txt and no public programme link (16 of 20).

Harness Feature Management & Experimentation 71

No public OpenAPI file for the Admin API was found; the reference is a ReadMe site with a Postman collection. The MCP server's 11 tools have typed inputs, and harness_describe returns each FME resource's fields (18 of 25). llms.txt on both developer.harness.io and docs.split.io, and every page as Markdown with .md (10). The README describes each tool and when writes ask for confirmation; resource details sit behind harness_describe rather than in the tool text (13 of 20). The generic tools take a resource_type string and a body, so per-resource constraints aren't in the schema (8 of 15). An error-code page lists 400, 401, 402, 403, 404, 409 and 429 with causes, and docs carry curl examples (10 of 15). Tagged MCP releases and dated SDK versioning policy; the Admin API has v1 and v2 paths and deprecation notices for Split-era endpoints (12 of 15). 18+10+13+8+10+12 = 71.

Optimizely Experimentation 76

The Swagger 2.0 file for the Optimizely API sits at api.optimizely.com, whose robots.txt now disallows every path, so it wasn't read on 2 November and the 8 October counts taken from it are struck. Each reference page on docs.optimizely.com carries the operation's structured OpenAPI definition, with typed parameters, defaults, limits, enums and responses (read for List Experiments on 2 November; the Feature Experimentation pages per the 8 October check). We could not read the MCP tool schemas, which need a sign-in (20 of 25). llms.txt and a Markdown copy of every docs page (10). Reference pages describe each operation's purpose. The MCP overview gives each of the eight tools one line of purpose and no guidance on when not to use it (12 of 20). Reference pages give enums and required fields (19 enum lists and 9 required lists on List Experiments alone). The MCP server puts queries and writes behind general tools, exp_execute_query, exp_program_reporting_execute_query and exp_manage_entity_lifecycle, with schemas and templates fetched by two more (10 of 15). Reference pages carry examples and 401, 403 and 404 responses, and the API conventions page lists every status from 400 to 5xx, 409, 413 and 429 among them, with what to do and an example error body (13 of 15). Versions are in the path (/v2, /flags/v1) and each product has dated release notes with an RSS feed. No changelog for the APIs alone was found (11 of 15). 20 + 10 + 12 + 10 + 13 + 11 = 76.