Harness Feature Management & Experimentation vs Woopra

Harness Feature Management & Experimentation 81

harness-mcp-v2 3.2.40 was tagged on 4 November 2026 (30). 14 tagged MCP releases between 8 August and 4 November (20). 100 commits since 8 August in the clone; FME docs and SDK release notes are dated, with support and a community site. Issue response times weren't read because the GitHub API refused us for its rate limit (15 of 25). Not found in the official MCP registry under a Harness namespace; official SDKs are current (8 of 15). MIT package with npm shrinkwrap and tests; CI state not read (8 of 10). 30+20+15+8+8 = 81.

Woopra 9

The newest dated change found is a commit to the browser tracker on 16 March 2026, and the REST intro page was last edited on 13 March 2026, both more than 180 days before the check (0). No releases or dated changelog entries in the last 90 days (0). No API changelog. Support is by email and in-app, and response times were not checked (3). The browser tracker's last tag is v5.3.0 from 2021, iOS and Android were last committed to in November 2024, and the Node, Python, Java and Rails SDKs in 2017 (4). The Node README carries a Travis CI badge and no current CI was found (2). Total 9.

Harness Feature Management & Experimentation 79

Admin API keys with combinable roles that can't be widened after creation, Harness PATs and SATs for central management, and Harness Platform OAuth on the hosted MCP endpoint. Credentials travel in headers (28 of 30). HARNESS_READ_ONLY removes every write, writes go through elicitation with a risk threshold for auto-approval, and FME change requests add approval for flag changes (19 of 20). No prompt-injection guidance; the tools return flag names, descriptions and rule data written by people (3 of 15). FME admin, environment and object audit logs, plus structured MCP audit events to file, webhook or OpenTelemetry sinks (13 of 15). SOC 1 and SOC 2 Type II, ISO 27001, 27017 and 27018, FedRAMP 20x, a security@harness.io disclosure route with a 24-hour response, a private bug bounty on request and annual external penetration tests. No security.txt (16 of 20). 28+19+3+13+16 = 79.

Woopra 22

REST calls use per-user access keys sent by HTTP Basic, with no scopes or rotation guidance found. Tracking calls need only the project name by default, with an optional Secure Tracking secret. Docs examples still show http:// tracking URLs (15 of 30). The pricing page states group and individual permission controls, but no read-only key or confirmation on /profile/delete was found (5). The API returns event and profile text that any caller who knows the project name can write, and no guidance on untrusted content was found (0). No audit log found in the docs (0). No security page, bug bounty or certification was found on the pages read, and security.txt timed out. The privacy policy states Data Privacy Framework certification (2). Total 22.

Harness Feature Management & Experimentation 83

11 consolidated tools, and --toolsets=fme narrows the server to FME (25). Flag lists filter server-side by name, tag and rollout status, and the Admin API paginates with markerLimit (17 of 20). Documented status codes, 429 headers, and a harness_diagnose tool. Error bodies aren't documented per endpoint (14 of 20). harness_list and harness_get carry readOnlyHint, write tools ask for confirmation by elicitation, and harness_delete is marked destructive. No idempotency keys (15 of 20). Two required settings (API key, optional org and project, account ID read from the token); a Python Admin API wrapper and CLI, and SDKs in more than a dozen languages for evaluation (12 of 15). 25+17+14+15+12 = 83.

Woopra 45

Report responses can be capped with limit, but a report can only be run from a report_id saved in the web app, so an agent can't shape a query through the API (12). limit, offset, a snapshot ID for consistent paging and timeframe overrides on reports, and position headers on log export (14). Tracking codes 401, 402 and 403 each name a cause. REST error bodies are not documented (8). No idempotency key or dedupe field was found, and tracking is by GET. Imports return a batch ID to poll (3). Report calls need two parameters. Official SDKs exist in several languages, but the server ones date from 2017 (8). Total 45.

Harness Feature Management & Experimentation 71

No public OpenAPI file for the Admin API was found; the reference is a ReadMe site with a Postman collection. The MCP server's 11 tools have typed inputs, and harness_describe returns each FME resource's fields (18 of 25). llms.txt on both developer.harness.io and docs.split.io, and every page as Markdown with .md (10). The README describes each tool and when writes ask for confirmation; resource details sit behind harness_describe rather than in the tool text (13 of 20). The generic tools take a resource_type string and a body, so per-resource constraints aren't in the schema (8 of 15). An error-code page lists 400, 401, 402, 403, 404, 409 and 429 with causes, and docs carry curl examples (10 of 15). Tagged MCP releases and dated SDK versioning policy; the Admin API has v1 and v2 paths and deprecation notices for Split-era endpoints (12 of 15). 18+10+13+8+10+12 = 71.

Woopra 45

Each REST reference page embeds an OpenAPI 3.1 fragment in its Markdown copy. No single spec file was found, most operations define no responses, and the tracking endpoints are documented as tables (12). llms.txt and a .md copy of each page, though llms.txt lists four of fourteen REST operations (10). Descriptions are one line. The /profiles page repeats the /trends text, three profile operations have none, and one page still holds template placeholder text (6). Query parameters carry types and required flags. There are no enums, and profile edits take a JSON string in data (6). One curl example for REST and several tracking examples. Tracking response codes are explained, while REST errors are a 400 with an empty object (6). The version sits in the path and 3.10 is the only one supported. No changelog found (5). Total 45.

Harness Feature Management & Experimentation 15

No x402, MPP or L402 (0). No FME prices are published; harness.io/pricing lists FME only under Enterprise, priced by quotation (0). The docs describe a Start FME Free Plan step inside a Harness account; its limits and whether a card is needed aren't stated (15 of 20). A person signs up for Harness in a browser and creates a key or token (0). 0+0+15+0 = 15.

Woopra 30

No x402, MPP or L402 (0). Pro is public at a starting price of $999 a month for 5 million events. Overage rates and Enterprise prices are not published (10). 30-day trial of Pro. The terms say a customer may add a card during the trial, which suggests none is needed to start, but we did not see the signup form (20). A person signs up in a browser and generates keys in the members area (0). Total 30.