# Harness Feature Management & Experimentation vs Optimizely Experimentation (slim)

> Harness Feature Management & Experimentation scores 69.2 (B) to Optimizely Experimentation's 64.9 (B) for feature flags. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/harness-fme-vs-optimizely.md (~5,400 tokens) · this version ~2,980 tokens · JSON https://www.anchorterminal.com/compare/harness-fme-vs-optimizely.json · canonical https://www.anchorterminal.com/compare/harness-fme-vs-optimizely
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Harness Feature Management & Experimentation scores 69.2 (B) on agent readiness against Optimizely Experimentation's 64.9 (B), and leads in 4 of 7 scored categories. Optimizely Experimentation leads on schema & documentation and transparency & trust. Both do feature flags.

- Harness Feature Management & Experimentation: B 69.2, rank #258 of 1510 · https://www.anchorterminal.com/tools/harness-fme.min.md
- Optimizely Experimentation: B 64.9, rank #445 of 1510 · https://www.anchorterminal.com/tools/optimizely.min.md
- Harness Feature Management & Experimentation, good for Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails. Ahead on Agent ergonomics, 83 against 68; Security & auth, 79 against 66; Payments & pricing, 15 against 0. Also Runs on your own machine.
- Optimizely Experimentation, good for An agent working for an existing Optimizely customer that lists and creates flags, experiments and audiences, reads experiment results and writes SDK integration code. Ahead on Schema & documentation, 76 against 71; Transparency & trust, 75 against 61.

| Category | Harness Feature Management & Experimentation | Optimizely Experimentation |
| --- | --- | --- |
| Reliability (16%) | 80 | 83 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 71 | 76 |
| Agent ergonomics (13%) | 83 | 68 |
| Security & auth (14%) | 79 | 66 |
| Payments & pricing (10%) | 15 | 0 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 78 |
| Transparency & trust (7%) | 61 | 75 |

| Fact (where they differ) | Harness Feature Management & Experimentation | Optimizely Experimentation |
| --- | --- | --- |
| Vendor | Harness Inc. | Optimizely |
| Hosted endpoint | `https://mcp.harness.io/mcp` | `https://exp.mcp.opal.optimizely.com/mcp` |
| Transports | HTTP, stdio, Streamable HTTP | HTTP, Streamable HTTP |
| Pricing | Freemium | Paid |
| Licence | none | Proprietary hosted service under Optimizely's Online Software Subscription Agreement and its API, SDK and MCP terms. The Feature Experimentation SDKs on GitHub are Apache 2.0 |
| Tools exposed | 11 | 8 |
| Last release | 2026-11-04 | 2026-10-15 |
| Popularity | 8.8k npm/wk | 460k npm/wk, 86k PyPI/wk |
| Agent reviews | none | 2/5 (4) |

Why the edge:
- Agent ergonomics, Harness Feature Management & Experimentation +15: Harness Feature Management & Experimentation 83 (11 consolidated tools, and `--toolsets=fme` narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.); Optimizely Experimentation 68 (The MCP server lists eight tools since `exp_program_reporting_execute_query` was added on 13 October 2026, which is 25 on the checklist. We took 2 off because the tool definitions were unread and their size is unknown (23 of 25). `per_page` up to 100 and `page` on the v2 lists, `page_token`, `sort` and `query` on the flags list, and time windows on results (17 of 20). The Optimizely API returns `code`, `message` and a `uuid`, and the Feature Experimentation API returns a problem detail object. MCP error results were unread (13 of 20). No idempotency keys were found and the tool annotations were unread. The docs say the agent confirms project, environment and details before a change, which is client behaviour, and entities are archived through the lifecycle tool (5 of 20). The MCP server needs only a URL. The official SDKs in eleven languages evaluate flags and log events and do not cover the management APIs (10 of 15).)
- Payments & pricing, Harness Feature Management & Experimentation +15: Harness Feature Management & Experimentation 15 (No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.); Optimizely Experimentation 0 (No x402, MPP or L402 (0). No price is published. The plans page says every plan is individually packaged and leads to a demo request (0). No free plan or trial was found on the plans page, the product pages or the docs (0). Access needs a subscription and a browser sign-in through Opti ID (0).)
- Transparency & trust, Optimizely Experimentation +14: Harness Feature Management & Experimentation 61 (A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60.); Optimizely Experimentation 75 (Closed hosted service under a published Online Software Subscription Agreement and API, SDK and MCP terms. The SDKs are open source under Apache 2.0 (17 of 30). The privacy notice of 1 July 2026 says it does not cover customer data and points to the subscription agreement and the Data Processing Agreement (V 2026-01), which agree. Event data is kept 18 months, and customer data may be deleted 30 days after a subscription ends. How the MCP server and Opal handle prompts for Experimentation is not stated on the MCP pages (22 of 30). The API, SDK and MCP terms let Optimizely revise, suspend or cancel any API or MCP at any time under its documentation and policies. An SDK compatibility matrix exists. No deprecation policy with a notice period was found for the APIs (6 of 20). The sub-processor list, updated 14 September 2026, names providers by product with hosting locations. Web and Feature Experimentation list Amazon Web Services in the United States and Google Cloud in the United States and Europe (18 of 20).)
- Security & auth, Harness Feature Management & Experimentation +13: Harness Feature Management & Experimentation 79 (Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.); Optimizely Experimentation 66 (The MCP server uses OAuth 2.0 with PKCE (S256), dynamic client registration and a revocation endpoint, with one API scope, `mcp:tools`, beside the OpenID scopes (re-read on 2 November). REST personal access tokens are revocable, named and sent in a header, and administrators can revoke any collaborator's token. The REST OAuth flow has the single scope `all`, described as full access to the account (22 of 30). Sessions and tokens carry the user's role, Feature Experimentation has granular roles for flags, environments and audiences, and change approvals have routed flag changes to reviewers since 6 August 2026. No read-only mode for the MCP server was found, and confirmation before a write is left to the client (13 of 20). No guidance on prompt injection was found, though tools return names, descriptions and hypotheses that people wrote (3 of 15). Change history for projects and flags is in the application, at `/v2/changes` and in webhooks (12 of 15). ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2 and PCI DSS are stated for Web and Feature Experimentation, with annual penetration tests and a bug bounty programme reachable at securityeng@optimizely.com. No security.txt and no public programme link (16 of 20).)
- Schema & documentation, Optimizely Experimentation +5: Harness Feature Management & Experimentation 71 (No public OpenAPI file for the Admin API was found; the reference is a ReadMe site with a Postman collection. The MCP server's 11 tools have typed inputs, and harness_describe returns each FME resource's fields (18 of 25). llms.txt on both developer.harness.io and docs.split.io, and every page as Markdown with `.md` (10). The README describes each tool and when writes ask for confirmation; resource details sit behind harness_describe rather than in the tool text (13 of 20). The generic tools take a resource_type string and a body, so per-resource constraints aren't in the schema (8 of 15). An error-code page lists 400, 401, 402, 403, 404, 409 and 429 with causes, and docs carry curl examples (10 of 15). Tagged MCP releases and dated SDK versioning policy; the Admin API has v1 and v2 paths and deprecation notices for Split-era endpoints (12 of 15). 18+10+13+8+10+12 = 71.); Optimizely Experimentation 76 (The Swagger 2.0 file for the Optimizely API sits at api.optimizely.com, whose robots.txt now disallows every path, so it wasn't read on 2 November and the 8 October counts taken from it are struck. Each reference page on docs.optimizely.com carries the operation's structured OpenAPI definition, with typed parameters, defaults, limits, enums and responses (read for List Experiments on 2 November; the Feature Experimentation pages per the 8 October check). We could not read the MCP tool schemas, which need a sign-in (20 of 25). llms.txt and a Markdown copy of every docs page (10). Reference pages describe each operation's purpose. The MCP overview gives each of the eight tools one line of purpose and no guidance on when not to use it (12 of 20). Reference pages give enums and required fields (19 enum lists and 9 required lists on List Experiments alone). The MCP server puts queries and writes behind general tools, `exp_execute_query`, `exp_program_reporting_execute_query` and `exp_manage_entity_lifecycle`, with schemas and templates fetched by two more (10 of 15). Reference pages carry examples and 401, 403 and 404 responses, and the API conventions page lists every status from 400 to 5xx, 409, 413 and 429 among them, with what to do and an example error body (13 of 15). Versions are in the path (`/v2`, `/flags/v1`) and each product has dated release notes with an RSS feed. No changelog for the APIs alone was found (11 of 15). 20 + 10 + 12 + 10 + 13 + 11 = 76.)