# Harness Feature Management & Experimentation vs Statsig (slim)

> Statsig scores 72.4 (BB) to Harness Feature Management & Experimentation's 69.2 (B) for feature flags. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/harness-fme-vs-statsig.md (~4,950 tokens) · this version ~2,730 tokens · JSON https://www.anchorterminal.com/compare/harness-fme-vs-statsig.json · canonical https://www.anchorterminal.com/compare/harness-fme-vs-statsig
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Statsig scores 72.4 (BB) on agent readiness against Harness Feature Management & Experimentation's 69.2 (B), and leads in 3 of 7 scored categories. Harness Feature Management & Experimentation leads on agent ergonomics and security & auth. Both do feature flags.

- Harness Feature Management & Experimentation: B 69.2, rank #258 of 1510 · https://www.anchorterminal.com/tools/harness-fme.min.md
- Statsig: BB 72.4, rank #128 of 1510 · https://www.anchorterminal.com/tools/statsig.min.md
- Harness Feature Management & Experimentation, good for Teams already on Harness, or Split customers, who want agents to inspect and change flags and segments with guard rails. Ahead on Agent ergonomics, 83 against 71; Security & auth, 79 against 74. Also Runs on your own machine.
- Statsig, good for An agent that creates, updates and cleans up feature gates, dynamic configs and experiments, and reads experiment results and audit history. Ahead on Schema & documentation, 82 against 71; Payments & pricing, 40 against 15; Transparency & trust, 76 against 61. Also Agent-ready, a grade of BB or better; Free to start without a card.

| Category | Harness Feature Management & Experimentation | Statsig |
| --- | --- | --- |
| Reliability (16%) | 80 | 79 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 71 | 82 |
| Agent ergonomics (13%) | 83 | 71 |
| Security & auth (14%) | 79 | 74 |
| Payments & pricing (10%) | 15 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 81 |
| Transparency & trust (7%) | 61 | 76 |

| Fact (where they differ) | Harness Feature Management & Experimentation | Statsig |
| --- | --- | --- |
| Vendor | Harness Inc. | Amplitude, Inc. |
| Hosted endpoint | `https://mcp.harness.io/mcp` | `https://api.statsig.com/v3/mcp` |
| Transports | HTTP, stdio, Streamable HTTP | HTTP, Streamable HTTP |
| Licence | none | Proprietary hosted service under Statsig's self-service or enterprise terms. The SDKs and the agent skills repository on GitHub are ISC |
| Tools exposed | 11 | 18 |
| MCP registry | not listed | `com.statsig/statsig-mcp-server` |
| Last release | 2026-11-04 | 2026-10-28 |
| Terms last updated | no date given | 2025-08-04 |
| Privacy policy last updated | no date given | 2026-08-31 |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 8.8k npm/wk | 4.2M npm/wk, 894k PyPI/wk |
| Agent reviews | none | 3.8/5 (4) |

Why the edge:
- Payments & pricing, Statsig +25: Harness Feature Management & Experimentation 15 (No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.); Statsig 40 (No x402, MPP or L402 (0). Prices are public without a login. Pro is $150 a month with 5 million events, then $0.05 per 1,000 events (20). The Developer plan is free with no card and 2 million events a month (20). A person signs up in a browser, then creates a key or approves OAuth (0).)
- Transparency & trust, Statsig +15: Harness Feature Management & Experimentation 61 (A closed service under Harness's subscription terms; the MCP server is MIT (18 of 30). The privacy statement covers website and sales data and defers customer data to the customer agreement and a published DPA; retention periods for customer data weren't found (18 of 30). A versioning policy for SDKs with support windows, and Split-era API endpoints marked deprecated with migration guides (14 of 20). Sub-processors are on the trust centre, which we didn't read, and the security page doesn't name data locations (10 of 20). 18+18+14+10 = 60.); Statsig 76 (Closed hosted service under a published self-service agreement and enterprise terms. The SDKs are open source under ISC (17 of 30). The terms, DPA and AI governance page mostly agree. The DPA names Amplitude, Inc. as processor and keeps data as long as necessary, the pricing page gives 1 year of analytics retention on the free plan, and the docs say customer data is not used to build AI models without written consent. The privacy notice is Amplitude's and doesn't name Statsig, and the self-service terms name Amplitude, Inc. under an effective date of 4 August 2025, before Statsig joined Amplitude on 5 May 2026 (18 of 30). Each Console API version is promised not to break, a deprecation notices page gives dates, and MCP V1 stays supported. No notice period is stated (12 of 20). Amplitude's sub-processor list, updated 13 May 2026, gives locations and marks the providers used for Statsig-branded services. EU hosting is an Enterprise option (17 of 20).)
- Agent ergonomics, Harness Feature Management & Experimentation +12: Harness Feature Management & Experimentation 83 (11 consolidated tools, and `--toolsets=fme` narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.); Statsig 71 (The MCP V3 server shows 18 default tools, which is 15 on the checklist. Add back 8 for the discovery layer that reaches other operations on demand, `query_fields` on experiment reads and read-only access (23 of 25). `limit` and `page` on 49 list operations with pagination metadata per the 8 October check, a cursor on the Logs Explorer query, and filters by tag, status, creator and date (17 of 20). Errors are a `status` and a `message` with no machine code, and MCP results set `isError` (11 of 20). No idempotency keys were found. Updates and `api_destructive` calls need a `confirmation` object, and operations are split into read, write and destructive lanes. We could not read the live tool annotations (10 of 20). The SDKs cover flag evaluation and event logging in many languages, not the Console API, and the `siggy` CLI on npm is version 0.0.4 from September 2024 (10 of 15).)
- Schema & documentation, Statsig +11: Harness Feature Management & Experimentation 71 (No public OpenAPI file for the Admin API was found; the reference is a ReadMe site with a Postman collection. The MCP server's 11 tools have typed inputs, and harness_describe returns each FME resource's fields (18 of 25). llms.txt on both developer.harness.io and docs.split.io, and every page as Markdown with `.md` (10). The README describes each tool and when writes ask for confirmation; resource details sit behind harness_describe rather than in the tool text (13 of 20). The generic tools take a resource_type string and a body, so per-resource constraints aren't in the schema (8 of 15). An error-code page lists 400, 401, 402, 403, 404, 409 and 429 with causes, and docs carry curl examples (10 of 15). Tagged MCP releases and dated SDK versioning policy; the Admin API has v1 and v2 paths and deprecation notices for Split-era endpoints (12 of 15). 18+10+13+8+10+12 = 71.); Statsig 82 (Public OpenAPI 3.0 spec for Console API version 20240601 with 209 paths and 325 operations, per the 8 October check, not re-read on 1 November, and typed MCP tools per the tool reference (25). llms.txt, llms-full.txt, a Markdown copy of each page and a public docs MCP server (10). Every operation has a summary but only 29 of 325 have a description, per the 8 October check. The MCP tool reference states each tool's purpose and when to ask the user first (11 of 20). 1,164 enums across 188 schemas, with required fields marked, per the 8 October check (12 of 15). Examples on most responses. The spec documents 401 on 156 operations, 404 on 126 and 400 on 106, and no 429, per the 8 October check (11 of 15). A dated API version sent in the `STATSIG-API-VERSION` header with a promise not to break a version, and a dated product updates page. No changelog for the API alone was found (13 of 15).)
- Security & auth, Harness Feature Management & Experimentation +5: Harness Feature Management & Experimentation 79 (Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.); Statsig 74 (OAuth for the MCP server with PKCE, dynamic client registration and a device code grant, issuing personal Console API keys that carry the user's role. Console keys can be created read-only or read and write, and rotated or deactivated through the API. The OAuth metadata lists no scopes, and a project Console key reaches every Console API endpoint (25 of 30). MCP scope is set per project and per role as no access, read only or read and write. Updates and destructive operations need a confirmation, and project review policies still apply (19 of 20). No guidance on prompt injection was found, though tools return names, descriptions and log data that people wrote. The docs tell users to review each change before the agent confirms (4 of 15). Audit logs are kept indefinitely with an API, and personal keys attribute changes to a user (14 of 15). SOC 2 Type II and a bug bounty programme are stated on the security page, with no public programme link and no security.txt (12 of 20).)