{ "data": { "a": { "slug": "heap", "name": "Heap", "vendor": "Contentsquare (Content Square, Inc.)", "vendorUrl": "https://www.heap.io", "kind": "http-api", "category": "product-analytics", "summary": "Heap is Contentsquare's product analytics service, which captures web and mobile interactions automatically. Its server-side HTTP API accepts custom events, identities, user and account properties, and user deletion requests.", "url": "https://www.anchorterminal.com/tools/heap", "markdownUrl": "https://www.anchorterminal.com/tools/heap.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/heap.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/heap.json", "dns": "heap.grade.anchorterminal.com", "license": "Proprietary service under Contentsquare's master services agreement. The React Native bridge and the Node client on npm are MIT", "transports": [ "http" ], "remoteUrl": "https://heapanalytics.com", "packages": [ { "registry": "npm", "name": "heap-api" } ], "auth": "mixed", "authNotes": "Self-serve. Track, identify and property calls need only `app_id`, the environment ID shown on the Projects page and used in the web snippet, with no secret. User deletion needs an API key that an admin generates under Account, Manage, Privacy \u0026 Security, exchanged by HTTP Basic for a temporary Bearer token. No OAuth, scopes or partner approval were found in the developer docs.", "pricing": "freemium", "pricingNotes": "Free plan up to 10,000 sessions a month with six months of history, APIs included, so an agent's owner can start without a contract. Growth is priced by estimate after signup, and Pro and Premier by quote. Whether signup asks for a card was not established (https://www.heap.io/pricing, checked 2026-10-07).", "priceSummary": "Freemium", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs or on the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 213, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://developers.heap.io", "llmsTxt": "https://developers.heap.io/llms.txt", "capabilities": [ "analytics.events" ], "tags": [ "hosted", "closed-source", "llms-txt", "free-tier", "no-oauth", "write-only", "eu-region", "status-page", "soc2", "sales-led" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 48.2, "grade": "D", "agentReady": false, "rank": 1132, "ranked": true, "rankOf": 1510, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 49, "maintenance": 63, "payments": 25, "reliability": 47, "schema": 57, "security": 41, "transparency": 66 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-04" }, "negative": 0, "verdict": "Heap's server-side API suits an agent that records events. Limits are published, bulk calls take 1,000 items and track accepts an idempotency key. The API returns no analytics, and ingest calls carry no secret beyond the environment ID. Heap's help centre lists a Heap MCP article, which a bot check stopped us reading, so the MCP server is ungraded.", "bestFor": "An agent that records backend events or enriches user and account properties in a company's existing Heap project, or that files privacy deletions.", "strengths": [ "Rate limits are published. Track allows 30 requests per 30 seconds per identity, and bulk track 15,000 events a minute per environment", "Track and bulk track accept an `idempotency_key`, and bulk calls take up to 1,000 events or users per request", "llms.txt and a Markdown copy of every developer page, with an OpenAPI 3.1 fragment embedded in the reference pages we read", "Free plan with up to 10,000 sessions a month and six months of history, with APIs and the User Privacy API included", "Sub-processor list (June 2026) names AWS regions in Ireland, Frankfurt and Virginia, and the customer chooses Europe or the USA" ], "weaknesses": [ "No query, export or definitions endpoint in the developer reference. Reading results needs the app, Heap Connect or the MCP server we couldn't read", "Track, identify and property calls carry no secret. The only identifier is the environment ID that the web snippet also publishes", "No SLA covers the API itself. Contentsquare's 99.5 per cent availability on Pro and Enterprise is measured on the user interface", "Paid plans have no public price. Growth asks for an estimate after signup, and Pro and Premier say Contact Us", "Error responses for track and identify are documented as a 400 with an empty object, and no 429 guidance was found" ], "agentNotes": [ "Send EU projects to https://c.eu.heap-api.com instead of https://heapanalytics.com. The path stays the same", "Pass one of `identity` or `user_id` on track, never both", "Set `idempotency_key` on every track event so a retry doesn't duplicate it", "Stay under 30 requests per 30 seconds per identity, or batch up to 1,000 events in one bulk call", "For deletion, exchange the app_id and API key of the Main Production environment for a token first. Any other environment ID returns Unauthorized" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 48.2 } ], "editorialScores": { "ergonomics": 49, "maintenance": 63, "payments": 25, "reliability": 47, "schema": 57, "security": 41, "transparency": 61 }, "provenanceScore": 71, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -X POST \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"app_id\": \"11\",\n \"identity\": \"alice@example.com\",\n \"event\": \"Send Transactional Email\",\n \"properties\": {\"subject\": \"Welcome to My App!\"}\n }' \\\n https://heapanalytics.com/api/track" }, "letme": { "capability": "https://letme.dev/analytics.events", "tool": "https://letme.dev/heap" }, "area": "business", "unitPrices": [ { "item": "Free", "unit": "month", "usd": 0, "note": "up to 10,000 sessions a month" } ], "provenance": { "legalEntity": "Content Square, Inc.", "domain": "heap.io", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.heap.io/legal/heap-master-services-agreement", "privacy": "https://www.heap.io/privacy", "statusPage": "https://status.heap.io", "changelog": "https://developers.heap.io/docs/heapjs-5-changelog", "securityTxt": "none", "checked": "2026-10-07", "notes": [ "The Heap master services agreement URL redirects to Contentsquare's terms at contentsquare.com/legal/terms-conditions. The entity schedule names Content Square, Inc., 60 Hudson St, New York, for customers in the Americas, and other Contentsquare entities elsewhere.", "heap.io/terms is a website terms of use from Heap Inc., a Delaware corporation, last updated 30 August 2019. heap.io/privacy says the Heap policy has been consolidated into Contentsquare's.", "API calls go to heapanalytics.com and, for EU projects, c.eu.heap-api.com. Both are Heap domains named in the vendor's docs, not heap.io itself.", "www.heap.io/.well-known/security.txt and heapanalytics.com/.well-known/security.txt return 404. contentsquare.com publishes a signed security.txt that expires on 31 January 2028.", "RDAP has no service for .io through rdap.org, so the registration date of heap.io was not established.", "The only changelogs found are for the SDKs (heap.js 5, Android, iOS, React Native, Flutter). No changelog for the server-side API was found." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/heap.json", "live": { "slug": "heap", "probe": { "target": "https://heapanalytics.com", "method": "get", "lastAt": "2026-11-07T19:22:11.168517735Z", "lastOk": true, "lastStatus": 200, "lastMs": 618, "authRequired": false, "uptime24h": 99.58, "uptime30d": 99.95, "p50ms24h": 375, "p95ms24h": 608, "samples24h": 238, "samples30d": 7473, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 253 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 240 }, { "date": "2026-11-07", "probes": 197, "ok": 196 } ] }, "vendorStatus": { "page": "https://status.heap.io", "indicator": "minor", "summary": "Minor Service Outage", "checkedAt": "2026-11-07T19:22:14.833919941Z" }, "versions": [ { "registry": "npm", "name": "heap-api", "version": "1.0.1", "seenAt": "2026-11-06T23:32:32.393792952Z" } ], "npmWeekly": 30, "securityTxt": { "url": "https://heap.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:09.648091398Z" }, "llmsTxt": { "url": "https://developers.heap.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:41.286344858Z" }, "domain": { "domain": "heap.io", "checkedAt": "2026-11-01T14:21:01.065060526Z" }, "pages": [ { "url": "https://developers.heap.io/docs/heapjs-5-changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:03:59.707627429Z", "changedAt": "2026-11-05T12:28:13.588228653Z", "fingerprint": "1a6c97992ee3" }, { "url": "https://www.heap.io/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:29:40.537453733Z", "changedAt": "2026-10-22T01:32:52.077065334Z", "fingerprint": "93f237b387d9" }, { "url": "https://www.heap.io/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:29:42.80598927Z", "changedAt": "2026-10-22T01:32:52.370154517Z", "fingerprint": "f6fde754bf93" }, { "url": "https://www.heap.io/legal/heap-master-services-agreement", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:29:38.187893789Z", "changedAt": "2026-10-22T01:32:48.135332495Z", "fingerprint": "93db7683f754" } ], "updatedAt": "2026-11-07T19:22:11.168517735Z" } }, "answer": "Heap scores 48.2 (D) on agent readiness against Mostly Good Metrics's 41.7 (E), and leads in 4 of 7 scored categories. Mostly Good Metrics leads on payments \u0026 pricing and maintenance \u0026 community.", "b": { "slug": "mostly-good-metrics", "name": "Mostly Good Metrics", "vendor": "Mostly Good Metrics", "vendorUrl": "https://mostlygoodmetrics.com", "kind": "http-api", "category": "product-analytics", "summary": "Mostly Good Metrics is a product analytics service in public beta for indie developers and small teams. Apps send events through five SDKs or an HTTP API, and agents query funnels, retention and experiments through a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/mostly-good-metrics", "markdownUrl": "https://www.anchorterminal.com/tools/mostly-good-metrics.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mostly-good-metrics.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mostly-good-metrics.json", "dns": "mostly-good-metrics.grade.anchorterminal.com", "repo": "https://github.com/Mostly-Good-Metrics", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.mostlygoodmetrics.com/mcp", "packages": [ { "registry": "npm", "name": "@mostly-good-metrics/javascript" }, { "registry": "npm", "name": "@mostly-good-metrics/react-native" } ], "auth": "mixed", "authNotes": "The MCP server and the `mgm` CLI use browser OAuth 2.0 with PKCE (S256) and dynamic client registration; the advertised scopes are mcp:tools plus support and newsletter scopes. Event ingestion uses a project API key as a Bearer token, which can be pinned to web origins, Apple bundle IDs or Android package names. Keys are created in the dashboard, the CLI or through MCP tools.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 50,000 to 100,000 events a month and no card. Starter $9 a month ($90 a year) for 500,000 events and Pro $29 a month ($290 a year) for 5,000,000, both quoted as lifetime beta prices against $12 and $49. Enterprise has unlimited ingestion.", "priceSummary": "$9 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or on the pricing section of the home page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 53, "popularity": { "githubStars": null, "npmWeekly": 81, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.mostlygoodmetrics.com", "capabilities": [ "analytics.query", "analytics.funnels", "analytics.events", "analytics.experiments" ], "tags": [ "hosted", "mcp", "remote-mcp", "oauth", "free-tier", "no-card", "beta", "closed-source", "typescript", "cli" ], "lastRelease": "2026-10-16", "graded": true, "anchor": { "graded": true, "score": 41.7, "grade": "E", "agentReady": false, "rank": 1295, "ranked": true, "rankOf": 1510, "categoryRank": 18, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 49, "maintenance": 74, "payments": 30, "reliability": 29, "schema": 49, "security": 33, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "Mostly Good Metrics lets an agent run ad-hoc funnels, retention and up to ten metric queries per call through a hosted MCP server with OAuth, at prices from $0. It is a public beta built by one developer, with no status page, no named legal entity and no security policy found.", "bestFor": "Indie and small-team apps that want simple funnels and retention an agent can query.", "strengths": [ "Hosted MCP server with OAuth, PKCE and dynamic client registration; no API key to copy", "execute_funnel, execute_retention and execute_query accept inline definitions without saving anything", "query_metrics runs 1 to 10 aggregate queries in one call with per-item results", "Free plan with no card, and paid plans from $9 a month", "Ingestion keys can be pinned to web origins and app bundle IDs" ], "weaknesses": [ "Public beta run by one developer, with no named legal entity in the terms", "No status page, SLA, security.txt or disclosure policy found", "53 MCP tools load at once and one scope grants all of them, including deletes and key revocation", "No OpenAPI file or llms.txt", "The CLI is installed from source because it isn't on npm yet" ], "agentNotes": [ "Use query_metrics for several aggregate questions instead of repeated execute_query calls", "Pass inline definitions to execute_funnel and execute_retention rather than creating saved objects", "Confirm with the user before delete, revoke_api_key or stop_experiment calls, since the server doesn't ask", "Start a fresh agent session after connecting, since a running client may not reload the tool list", "On 429 from ingestion, wait for Retry-After before resending events" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 41.7 } ], "editorialScores": { "ergonomics": 49, "maintenance": 74, "payments": 30, "reliability": 29, "schema": 49, "security": 33, "transparency": 51 }, "provenanceScore": 39, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add --transport http mgm https://app.mostlygoodmetrics.com/mcp", "config": { "mcpServers": { "mgm": { "url": "https://app.mostlygoodmetrics.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/analytics.query", "tool": "https://letme.dev/mostly-good-metrics" }, "area": "business", "unitPrices": [ { "item": "Starter plan", "unit": "month", "usd": 9, "note": "500,000 events a month, lifetime beta price" }, { "item": "Pro plan", "unit": "month", "usd": 29, "note": "5,000,000 events a month, lifetime beta price" } ], "provenance": { "legalEntity": "", "domain": "mostlygoodmetrics.com", "domainRegistered": "2025-12-05", "endpointOnVendorDomain": true, "terms": "https://mostlygoodmetrics.com/terms", "privacy": "https://mostlygoodmetrics.com/privacy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both last updated December 2025, name only Mostly Good Metrics and give no legal entity, address or governing law.", "mostlygoodmetrics.com/robots.txt has every rule commented out; docs.mostlygoodmetrics.com has no robots.txt.", "/.well-known/security.txt returned 404 and no status page was found.", "RDAP gives mostlygoodmetrics.com a registration date of 5 December 2025." ], "score": 39 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mostly-good-metrics.json", "live": { "slug": "mostly-good-metrics", "probe": { "target": "https://app.mostlygoodmetrics.com/mcp", "method": "get", "lastAt": "2026-11-07T19:22:20.651338144Z", "lastOk": true, "lastStatus": 401, "lastMs": 138, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 167, "p95ms24h": 298, "samples24h": 210, "samples30d": 210, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "versions": [ { "registry": "npm", "name": "@mostly-good-metrics/javascript", "version": "0.13.1", "seenAt": "2026-11-06T23:47:33.682933227Z" }, { "registry": "npm", "name": "@mostly-good-metrics/react-native", "version": "0.9.1", "seenAt": "2026-11-06T23:47:34.884784704Z" } ], "npmWeekly": 81, "securityTxt": { "url": "https://mostlygoodmetrics.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:38.90553607Z" }, "pages": [ { "url": "https://mostlygoodmetrics.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:14:39.017388202Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f43e747ad9a3" }, { "url": "https://mostlygoodmetrics.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:14:41.227658165Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "99ed64144abf" } ], "mcpTools": { "url": "https://app.mostlygoodmetrics.com/mcp", "checkedAt": "2026-11-07T01:46:16.716952564Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:46:16.716952564Z" }, "updatedAt": "2026-11-07T19:22:20.651338144Z" } }, "edges": [ { "by": 21, "category": "transparency", "leads": "heap", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service with published terms, now Contentsquare's master services agreement (15). The DPA (June 2026) caps Product Analytics retention at 37 months from collection unless agreed otherwise and links the sub-processor list. heap.io still carries a 2019 website terms page from Heap Inc. beside the Contentsquare documents (22). No deprecation policy for the API was found. Contentsquare's docs carry migration guides from the Heap SDKs to the CSQ SDK without an end date that we found (4). Sub-processor list (June 2026) with locations, AWS in Ireland, Frankfurt and Virginia and OpenAI for Sense Chat (20). Total 61. Per the 7 October check, not re-read on 4 November, apart from the heap.io website terms (still dated 30 August 2019) and Contentsquare's terms of service (29 January 2026).", "b": "The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51." }, "scores": { "a": 66, "b": 45 } }, { "by": 18, "category": "reliability", "leads": "heap", "name": "Reliability", "reasons": { "a": "Graded on the server-side API with the hosted lines. Heap's status page is an Atlassian Statuspage at status.heap.io, the address heap.io links to, which sits on a heap.io host whose terms bar robots, so it wasn't read on 4 November. The same page also answers at heap.statuspage.io, but that copy names status.heap.io as its canonical address and no Heap page links to it, so it wasn't used. The 7 October component and incident readings came only from Statuspage's JSON API, which this run doesn't use, so they are struck. No component list could be read (0) and no incident history could be read (5). Rate limits published with numbers, 30 requests per 30 seconds per identity on track and 15,000 events a minute per environment on bulk track, per the 7 October check, not re-read on 4 November (15). No 429 or backoff guidance found, but track takes an `idempotency_key`, per the 7 October check, not re-read on 4 November (7, the earlier partial kept, since keys without any 429 or backoff guidance meet none of the line's values in full). Contentsquare's support package states 99.5 per cent availability for Product Analytics Pro and Enterprise, measured on the user interface, per the 7 October check, not re-read on 4 November (10). The API carries no beta label (10). 0+5+15+7+10+10 = 47.", "b": "Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29." }, "scores": { "a": 47, "b": 29 } }, { "by": 11, "category": "maintenance", "leads": "mostly-good-metrics", "name": "Maintenance \u0026 community", "reasons": { "a": "heap.js 5.3.17 shipped on 6 October 2026, but that is the browser SDK. The server-side track reference last changed on 3 June 2026 and has no changelog, so we scored this line between the two (20 of 30). heap.js 5.3.15, 5.3.16 and 5.3.17 and Android Core 0.9.5 fall inside 90 days (20). Dated public changelogs and a community at community.contentsquare.com, whose response times we didn't check (8). Client SDKs for web, Android, iOS, React Native and Flutter are current. The Node server client is from 2016 (10). CI not checked (5). Total 63. Per the 7 October check, not re-read on 4 November (developers.heap.io is paused on its terms). The three heap.js releases still fall inside the 90 days from 6 August.", "b": "CLI v0.1.4 was tagged on 16 October 2026 (30). The JavaScript SDK released 0.12.0, 0.13.0 and 0.13.1 between 5 September and 2 October, and the Swift SDK 1.0.0 and 1.0.1 on 2 October (20). A closed service with no public changelog, support by email and GitHub repositories for the SDKs; issue activity wasn't read because the GitHub API refused us for its rate limit (6 of 25). Not in the official MCP registry; official SDKs in five languages are current (10 of 15). CI workflows on the SDK and CLI repositories (8 of 10). 30+20+6+10+8 = 74." }, "scores": { "a": 63, "b": 74 } }, { "by": 8, "category": "schema", "leads": "heap", "name": "Schema \u0026 documentation", "reasons": { "a": "OpenAPI 3.1 fragments are embedded in the Markdown of the track and identify pages. No single spec file was found, the property pages we read had empty fragments and user deletion is prose only (15). llms.txt and a .md copy of every page (10). Descriptions state purpose, limits and reserved keys, with little on when not to use a call (12). Required fields are marked and lengths stated in prose, with string types throughout, no enums and a free-form `properties` object (8). Curl examples on every page. Track and identify document 200 and 400 with an empty object, and only user deletion describes its error body (7). SDK changelogs are dated, but no changelog or version policy for the server-side API was found. Paths mix unversioned, v1 and v0 (5). Total 57. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.", "b": "No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49." }, "scores": { "a": 57, "b": 49 } }, { "by": 8, "category": "security", "leads": "heap", "name": "Security \u0026 auth", "reasons": { "a": "Track, identify and property calls carry no secret. The OpenAPI fragment declares an empty security requirement and the only identifier is the environment ID that the web snippet publishes. User deletion uses one admin-generated API key per account, exchanged for a temporary token. No scopes or rotation guidance found (8 of 30). Ingest is write-only by design. Deletion of up to 10,000 users has no confirmation step (5). The API returns no untrusted content (10). Audit logs are unchecked because help.heap.io answered with a bot check, so none are counted (0). Contentsquare publishes a signed security.txt valid to 31 January 2028 on contentsquare.com (not on heap.io), a disclosure policy, an invitation-only YesWeHack bounty, SOC 2 Type II and ISO 27001 (18). Total 41. Per the 7 October check, not re-read on 4 November, because heap.io and contentsquare.com terms bar robots and crawling.", "b": "OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33." }, "scores": { "a": 41, "b": 33 } }, { "by": 5, "category": "payments", "leads": "mostly-good-metrics", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). The Free plan and its 10,000-session limit are public. Growth needs an estimate after signup and Pro and Premier say Contact Us, so no paid price is published (5). Free plan with APIs included. No card is mentioned on the pricing page, and the signup form needs JavaScript we couldn't run (20). A person signs up in a browser and copies the environment ID (0). Total 25. Per the 7 October check, not re-read on 4 November (www.heap.io is paused on its terms).", "b": "No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30." }, "scores": { "a": 25, "b": 30 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Contentsquare (Content Square, Inc.)", "b": "Mostly Good Metrics", "name": "Vendor" }, { "a": "https://heapanalytics.com", "b": "https://app.mostlygoodmetrics.com/mcp", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under Contentsquare's master services agreement. The React Native bridge and the Node client on npm are MIT", "b": "none", "name": "Licence" }, { "a": "none", "b": "53", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-10-06", "b": "2026-10-16", "name": "Last release" }, { "a": "no date given", "b": "2025-12-01", "name": "Terms last updated" }, { "a": "couldn't be read", "b": "2025-12-01", "name": "Privacy policy last updated" }, { "a": "yes", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "213 npm/wk", "b": "81 npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Heap scores 48.2 (D) on agent readiness against Mostly Good Metrics's 41.7 (E), and leads in 4 of 7 scored categories. Mostly Good Metrics leads on payments \u0026 pricing and maintenance \u0026 community.", "question": "Which is better for AI agents, Heap or Mostly Good Metrics?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Heap and Mostly Good Metrics need an API key?" }, { "answer": "Yes. Heap has a hosted endpoint at https://heapanalytics.com and Mostly Good Metrics at https://app.mostlygoodmetrics.com/mcp.", "question": "Can an agent call Heap and Mostly Good Metrics without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 47 against 29", "Schema \u0026 documentation, 57 against 49", "Security \u0026 auth, 41 against 33", "Transparency \u0026 trust, 66 against 45" ], "also": null, "goodFor": "An agent that records backend events or enriches user and account properties in a company's existing Heap project, or that files privacy deletions.", "slug": "heap", "watchFor": "No query, export or definitions endpoint in the developer reference. Reading results needs the app, Heap Connect or the MCP server we couldn't read" }, { "aheadOn": [ "Payments \u0026 pricing, 30 against 25", "Maintenance \u0026 community, 74 against 63" ], "also": [ "Free to start without a card" ], "goodFor": "Indie and small-team apps that want simple funnels and retention an agent can query.", "slug": "mostly-good-metrics", "watchFor": "Public beta run by one developer, with no named legal entity in the terms" } ], "history": { "heap": [ { "causes": [ "correction" ], "date": "2026-11-04", "delta": -5, "from": 53.2, "fromGrade": "D", "to": 48.2, "toGrade": "D" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.1, "from": 53.1, "fromGrade": "D", "to": 53.2, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 53, "fromGrade": "D", "to": 53.1, "toGrade": "D" } ], "mostly-good-metrics": null }, "job": { "capability": "analytics.events", "name": "Event analytics" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amplitude-vs-mostly-good-metrics.json", "title": "Amplitude vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/amplitude-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/basedash-mcp-vs-mostly-good-metrics.json", "title": "Basedash MCP vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/basedash-mcp-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics.json", "title": "Countly vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-mostly-good-metrics.json", "title": "Fullstory vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/fullstory-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/matomo-vs-mostly-good-metrics.json", "title": "Matomo vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/matomo-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/mixpanel-vs-mostly-good-metrics.json", "title": "Mixpanel vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/mixpanel-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-openpanel.json", "title": "Mostly Good Metrics vs OpenPanel", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-optimizely.json", "title": "Mostly Good Metrics vs Optimizely Experimentation", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-optimizely" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-pendo.json", "title": "Mostly Good Metrics vs Pendo", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-pendo" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog.json", "title": "Mostly Good Metrics vs PostHog", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-rudderstack-mcp.json", "title": "Mostly Good Metrics vs RudderStack MCP", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-rudderstack-mcp" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-statsig.json", "title": "Mostly Good Metrics vs Statsig", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.json", "title": "Mostly Good Metrics vs Userpilot", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-woopra.json", "title": "Mostly Good Metrics vs Woopra", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/amplitude-vs-heap.json", "title": "Amplitude vs Heap", "url": "https://www.anchorterminal.com/compare/amplitude-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-heap.json", "title": "Countly vs Heap", "url": "https://www.anchorterminal.com/compare/countly-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-heap.json", "title": "Flagsmith vs Heap", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-heap.json", "title": "Fullstory vs Heap", "url": "https://www.anchorterminal.com/compare/fullstory-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-heap.json", "title": "GrowthBook vs Heap", "url": "https://www.anchorterminal.com/compare/growthbook-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-heap.json", "title": "Harness Feature Management \u0026 Experimentation vs Heap", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-heap" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-matomo.json", "title": "Heap vs Matomo", "url": "https://www.anchorterminal.com/compare/heap-vs-matomo" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-mixpanel.json", "title": "Heap vs Mixpanel", "url": "https://www.anchorterminal.com/compare/heap-vs-mixpanel" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-openpanel.json", "title": "Heap vs OpenPanel", "url": "https://www.anchorterminal.com/compare/heap-vs-openpanel" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-pendo.json", "title": "Heap vs Pendo", "url": "https://www.anchorterminal.com/compare/heap-vs-pendo" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-posthog.json", "title": "Heap vs PostHog", "url": "https://www.anchorterminal.com/compare/heap-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-rudderstack-mcp.json", "title": "Heap vs RudderStack MCP", "url": "https://www.anchorterminal.com/compare/heap-vs-rudderstack-mcp" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-statsig.json", "title": "Heap vs Statsig", "url": "https://www.anchorterminal.com/compare/heap-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-userpilot.json", "title": "Heap vs Userpilot", "url": "https://www.anchorterminal.com/compare/heap-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-woopra.json", "title": "Heap vs Woopra", "url": "https://www.anchorterminal.com/compare/heap-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics.json", "title": "Flagsmith vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-mostly-good-metrics.json", "title": "GrowthBook vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/growthbook-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics.json", "title": "Harness Feature Management \u0026 Experimentation vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics" }, { "json": "https://www.anchorterminal.com/compare/launchdarkly-vs-mostly-good-metrics.json", "title": "LaunchDarkly vs Mostly Good Metrics", "url": "https://www.anchorterminal.com/compare/launchdarkly-vs-mostly-good-metrics" } ], "panel": null, "scores": [ { "by": 18, "edge": "heap", "heap": 47, "key": "reliability", "mostly-good-metrics": 29, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 8, "edge": "heap", "heap": 57, "key": "schema", "mostly-good-metrics": 49, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 0, "edge": "", "heap": 49, "key": "ergonomics", "mostly-good-metrics": 49, "name": "Agent ergonomics", "weight": 13 }, { "by": 8, "edge": "heap", "heap": 41, "key": "security", "mostly-good-metrics": 33, "name": "Security \u0026 auth", "weight": 14 }, { "by": 5, "edge": "mostly-good-metrics", "heap": 25, "key": "payments", "mostly-good-metrics": 30, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 11, "edge": "mostly-good-metrics", "heap": 63, "key": "maintenance", "mostly-good-metrics": 74, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 21, "edge": "heap", "heap": 66, "key": "transparency", "mostly-good-metrics": 45, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Heap scores 48.2 (D) on agent readiness against Mostly Good Metrics's 41.7 (E), and leads in 4 of 7 scored categories. Mostly Good Metrics leads on payments \u0026 pricing and maintenance \u0026 community. Both do event analytics.", "tasks": null, "tutorials": [], "verdicts": { "heap": "Heap's server-side API suits an agent that records events. Limits are published, bulk calls take 1,000 items and track accepts an idempotency key. The API returns no analytics, and ingest calls carry no secret beyond the environment ID. Heap's help centre lists a Heap MCP article, which a bot check stopped us reading, so the MCP server is ungraded.", "mostly-good-metrics": "Mostly Good Metrics lets an agent run ad-hoc funnels, retention and up to ten metric queries per call through a hosted MCP server with OAuth, at prices from $0. It is a public beta built by one developer, with no status page, no named legal entity and no security policy found." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics", "json": "https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.min.md" }, "markdown": "Heap scores 48.2 (D) on agent readiness against Mostly Good Metrics's 41.7 (E), and leads in 4 of 7 scored categories. Mostly Good Metrics leads on payments \u0026 pricing and maintenance \u0026 community. Both do event analytics.\n\n- Heap: grade D, 48.2/100, rank #1132 of 1510. Markdown https://www.anchorterminal.com/tools/heap.md · JSON https://www.anchorterminal.com/api/v1/tools/heap.json\n- Mostly Good Metrics: grade E, 41.7/100, rank #1295 of 1510. Markdown https://www.anchorterminal.com/tools/mostly-good-metrics.md · JSON https://www.anchorterminal.com/api/v1/tools/mostly-good-metrics.json\n- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md\n- All 170 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md\n\n## Which one, for what\n\n### Heap (D)\n\nGood for: An agent that records backend events or enriches user and account properties in a company's existing Heap project, or that files privacy deletions.\n\nAhead on:\n- Reliability, 47 against 29\n- Schema \u0026 documentation, 57 against 49\n- Security \u0026 auth, 41 against 33\n- Transparency \u0026 trust, 66 against 45\n\nWatch for: No query, export or definitions endpoint in the developer reference. Reading results needs the app, Heap Connect or the MCP server we couldn't read\n\n### Mostly Good Metrics (E)\n\nGood for: Indie and small-team apps that want simple funnels and retention an agent can query.\n\nAhead on:\n- Payments \u0026 pricing, 30 against 25\n- Maintenance \u0026 community, 74 against 63\n\nAlso in its favour:\n- Free to start without a card\n\nWatch for: Public beta run by one developer, with no named legal entity in the terms\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Heap +21\n\n- Heap (66): Closed service with published terms, now Contentsquare's master services agreement (15). The DPA (June 2026) caps Product Analytics retention at 37 months from collection unless agreed otherwise and links the sub-processor list. heap.io still carries a 2019 website terms page from Heap Inc. beside the Contentsquare documents (22). No deprecation policy for the API was found. Contentsquare's docs carry migration guides from the Heap SDKs to the CSQ SDK without an end date that we found (4). Sub-processor list (June 2026) with locations, AWS in Ireland, Frankfurt and Virginia and OpenAI for Sense Chat (20). Total 61. Per the 7 October check, not re-read on 4 November, apart from the heap.io website terms (still dated 30 August 2019) and Contentsquare's terms of service (29 January 2026).\n- Mostly Good Metrics (45): The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.\n\n### Reliability: Heap +18\n\n- Heap (47): Graded on the server-side API with the hosted lines. Heap's status page is an Atlassian Statuspage at status.heap.io, the address heap.io links to, which sits on a heap.io host whose terms bar robots, so it wasn't read on 4 November. The same page also answers at heap.statuspage.io, but that copy names status.heap.io as its canonical address and no Heap page links to it, so it wasn't used. The 7 October component and incident readings came only from Statuspage's JSON API, which this run doesn't use, so they are struck. No component list could be read (0) and no incident history could be read (5). Rate limits published with numbers, 30 requests per 30 seconds per identity on track and 15,000 events a minute per environment on bulk track, per the 7 October check, not re-read on 4 November (15). No 429 or backoff guidance found, but track takes an `idempotency_key`, per the 7 October check, not re-read on 4 November (7, the earlier partial kept, since keys without any 429 or backoff guidance meet none of the line's values in full). Contentsquare's support package states 99.5 per cent availability for Product Analytics Pro and Enterprise, measured on the user interface, per the 7 October check, not re-read on 4 November (10). The API carries no beta label (10). 0+5+15+7+10+10 = 47.\n- Mostly Good Metrics (29): Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.\n\n### Maintenance \u0026 community: Mostly Good Metrics +11\n\n- Heap (63): heap.js 5.3.17 shipped on 6 October 2026, but that is the browser SDK. The server-side track reference last changed on 3 June 2026 and has no changelog, so we scored this line between the two (20 of 30). heap.js 5.3.15, 5.3.16 and 5.3.17 and Android Core 0.9.5 fall inside 90 days (20). Dated public changelogs and a community at community.contentsquare.com, whose response times we didn't check (8). Client SDKs for web, Android, iOS, React Native and Flutter are current. The Node server client is from 2016 (10). CI not checked (5). Total 63. Per the 7 October check, not re-read on 4 November (developers.heap.io is paused on its terms). The three heap.js releases still fall inside the 90 days from 6 August.\n- Mostly Good Metrics (74): CLI v0.1.4 was tagged on 16 October 2026 (30). The JavaScript SDK released 0.12.0, 0.13.0 and 0.13.1 between 5 September and 2 October, and the Swift SDK 1.0.0 and 1.0.1 on 2 October (20). A closed service with no public changelog, support by email and GitHub repositories for the SDKs; issue activity wasn't read because the GitHub API refused us for its rate limit (6 of 25). Not in the official MCP registry; official SDKs in five languages are current (10 of 15). CI workflows on the SDK and CLI repositories (8 of 10). 30+20+6+10+8 = 74.\n\n### Schema \u0026 documentation: Heap +8\n\n- Heap (57): OpenAPI 3.1 fragments are embedded in the Markdown of the track and identify pages. No single spec file was found, the property pages we read had empty fragments and user deletion is prose only (15). llms.txt and a .md copy of every page (10). Descriptions state purpose, limits and reserved keys, with little on when not to use a call (12). Required fields are marked and lengths stated in prose, with string types throughout, no enums and a free-form `properties` object (8). Curl examples on every page. Track and identify document 200 and 400 with an empty object, and only user deletion describes its error body (7). SDK changelogs are dated, but no changelog or version policy for the server-side API was found. Paths mix unversioned, v1 and v0 (5). Total 57. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.\n- Mostly Good Metrics (49): No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.\n\n### Security \u0026 auth: Heap +8\n\n- Heap (41): Track, identify and property calls carry no secret. The OpenAPI fragment declares an empty security requirement and the only identifier is the environment ID that the web snippet publishes. User deletion uses one admin-generated API key per account, exchanged for a temporary token. No scopes or rotation guidance found (8 of 30). Ingest is write-only by design. Deletion of up to 10,000 users has no confirmation step (5). The API returns no untrusted content (10). Audit logs are unchecked because help.heap.io answered with a bot check, so none are counted (0). Contentsquare publishes a signed security.txt valid to 31 January 2028 on contentsquare.com (not on heap.io), a disclosure policy, an invitation-only YesWeHack bounty, SOC 2 Type II and ISO 27001 (18). Total 41. Per the 7 October check, not re-read on 4 November, because heap.io and contentsquare.com terms bar robots and crawling.\n- Mostly Good Metrics (33): OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.\n\n### Payments \u0026 pricing: Mostly Good Metrics +5\n\n- Heap (25): No x402, MPP or L402 (0). The Free plan and its 10,000-session limit are public. Growth needs an estimate after signup and Pro and Premier say Contact Us, so no paid price is published (5). Free plan with APIs included. No card is mentioned on the pricing page, and the signup form needs JavaScript we couldn't run (20). A person signs up in a browser and copies the environment ID (0). Total 25. Per the 7 October check, not re-read on 4 November (www.heap.io is paused on its terms).\n- Mostly Good Metrics (30): No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.\n\n## Score by category\n\n| Category | Weight | Heap | Mostly Good Metrics | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 47 | 29 | Heap +18 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 57 | 49 | Heap +8 |\n| Agent ergonomics | 13% (16.2 this run) | 49 | 49 | even |\n| Security \u0026 auth | 14% (17.5 this run) | 41 | 33 | Heap +8 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 30 | Mostly Good Metrics +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 63 | 74 | Mostly Good Metrics +11 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 66 | 45 | Heap +21 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **48.2 · D** | **41.7 · E** | |\n\n## Facts side by side\n\n| Fact | Heap | Mostly Good Metrics |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Contentsquare (Content Square, Inc.) | Mostly Good Metrics |\n| Hosted endpoint | `https://heapanalytics.com` | `https://app.mostlygoodmetrics.com/mcp` |\n| Transports | HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service under Contentsquare's master services agreement. The React Native bridge and the Node client on npm are MIT | none |\n| Tools exposed | none | 53 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| Last release | 2026-10-06 | 2026-10-16 |\n| Terms last updated | no date given | 2025-12-01 |\n| Privacy policy last updated | couldn't be read | 2025-12-01 |\n| Customer content may train models | yes | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 213 npm/wk | 81 npm/wk |\n\n## How the scores have moved\n\n### Heap\n\n- -5.0 on 4 November 2026: correction\n- +0.1 on 28 October 2026: new evidence\n- +0.1 on 27 October 2026: checklist\n\n### Mostly Good Metrics\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Heap.** Heap's server-side API suits an agent that records events. Limits are published, bulk calls take 1,000 items and track accepts an idempotency key. The API returns no analytics, and ingest calls carry no secret beyond the environment ID. Heap's help centre lists a Heap MCP article, which a bot check stopped us reading, so the MCP server is ungraded.\n\n**Mostly Good Metrics.** Mostly Good Metrics lets an agent run ad-hoc funnels, retention and up to ten metric queries per call through a hosted MCP server with OAuth, at prices from $0. It is a public beta built by one developer, with no status page, no named legal entity and no security policy found.\n\n## Before you call either\n\n### Heap\n\n1. Send EU projects to https://c.eu.heap-api.com instead of https://heapanalytics.com. The path stays the same\n2. Pass one of `identity` or `user_id` on track, never both\n3. Set `idempotency_key` on every track event so a retry doesn't duplicate it\n4. Stay under 30 requests per 30 seconds per identity, or batch up to 1,000 events in one bulk call\n5. For deletion, exchange the app_id and API key of the Main Production environment for a token first. Any other environment ID returns Unauthorized\n\n### Mostly Good Metrics\n\n1. Use query_metrics for several aggregate questions instead of repeated execute_query calls\n2. Pass inline definitions to execute_funnel and execute_retention rather than creating saved objects\n3. Confirm with the user before delete, revoke_api_key or stop_experiment calls, since the server doesn't ask\n4. Start a fresh agent session after connecting, since a running client may not reload the tool list\n5. On 429 from ingestion, wait for Retry-After before resending events\n\n## Questions\n\n### Which is better for AI agents, Heap or Mostly Good Metrics?\n\nHeap scores 48.2 (D) on agent readiness against Mostly Good Metrics's 41.7 (E), and leads in 4 of 7 scored categories. Mostly Good Metrics leads on payments \u0026 pricing and maintenance \u0026 community.\n\n### Do Heap and Mostly Good Metrics need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Heap and Mostly Good Metrics without installing anything?\n\nYes. Heap has a hosted endpoint at https://heapanalytics.com and Mostly Good Metrics at https://app.mostlygoodmetrics.com/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.json, and with the fewest tokens: https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"heap\", \"b\": \"mostly-good-metrics\"}`. From a terminal: `anchor compare heap mostly-good-metrics`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/heap.json and https://www.anchorterminal.com/api/v1/tools/mostly-good-metrics.json\n\n## Other comparisons with Heap or Mostly Good Metrics\n\n- [Amplitude vs Mostly Good Metrics](https://www.anchorterminal.com/compare/amplitude-vs-mostly-good-metrics.md)\n- [Basedash MCP vs Mostly Good Metrics](https://www.anchorterminal.com/compare/basedash-mcp-vs-mostly-good-metrics.md)\n- [Countly vs Mostly Good Metrics](https://www.anchorterminal.com/compare/countly-vs-mostly-good-metrics.md)\n- [Fullstory vs Mostly Good Metrics](https://www.anchorterminal.com/compare/fullstory-vs-mostly-good-metrics.md)\n- [Matomo vs Mostly Good Metrics](https://www.anchorterminal.com/compare/matomo-vs-mostly-good-metrics.md)\n- [Mixpanel vs Mostly Good Metrics](https://www.anchorterminal.com/compare/mixpanel-vs-mostly-good-metrics.md)\n- [Mostly Good Metrics vs OpenPanel](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-openpanel.md)\n- [Mostly Good Metrics vs Optimizely Experimentation](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-optimizely.md)\n- [Mostly Good Metrics vs Pendo](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-pendo.md)\n- [Mostly Good Metrics vs PostHog](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog.md)\n- [Mostly Good Metrics vs RudderStack MCP](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-rudderstack-mcp.md)\n- [Mostly Good Metrics vs Statsig](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-statsig.md)\n- [Mostly Good Metrics vs Userpilot](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.md)\n- [Mostly Good Metrics vs Woopra](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-woopra.md)\n- [Amplitude vs Heap](https://www.anchorterminal.com/compare/amplitude-vs-heap.md)\n- [Countly vs Heap](https://www.anchorterminal.com/compare/countly-vs-heap.md)\n- [Flagsmith vs Heap](https://www.anchorterminal.com/compare/flagsmith-vs-heap.md)\n- [Fullstory vs Heap](https://www.anchorterminal.com/compare/fullstory-vs-heap.md)\n- [GrowthBook vs Heap](https://www.anchorterminal.com/compare/growthbook-vs-heap.md)\n- [Harness Feature Management \u0026 Experimentation vs Heap](https://www.anchorterminal.com/compare/harness-fme-vs-heap.md)\n- [Heap vs Matomo](https://www.anchorterminal.com/compare/heap-vs-matomo.md)\n- [Heap vs Mixpanel](https://www.anchorterminal.com/compare/heap-vs-mixpanel.md)\n- [Heap vs OpenPanel](https://www.anchorterminal.com/compare/heap-vs-openpanel.md)\n- [Heap vs Pendo](https://www.anchorterminal.com/compare/heap-vs-pendo.md)\n- [Heap vs PostHog](https://www.anchorterminal.com/compare/heap-vs-posthog.md)\n- [Heap vs RudderStack MCP](https://www.anchorterminal.com/compare/heap-vs-rudderstack-mcp.md)\n- [Heap vs Statsig](https://www.anchorterminal.com/compare/heap-vs-statsig.md)\n- [Heap vs Userpilot](https://www.anchorterminal.com/compare/heap-vs-userpilot.md)\n- [Heap vs Woopra](https://www.anchorterminal.com/compare/heap-vs-woopra.md)\n- [Flagsmith vs Mostly Good Metrics](https://www.anchorterminal.com/compare/flagsmith-vs-mostly-good-metrics.md)\n- [GrowthBook vs Mostly Good Metrics](https://www.anchorterminal.com/compare/growthbook-vs-mostly-good-metrics.md)\n- [Harness Feature Management \u0026 Experimentation vs Mostly Good Metrics](https://www.anchorterminal.com/compare/harness-fme-vs-mostly-good-metrics.md)\n- [LaunchDarkly vs Mostly Good Metrics](https://www.anchorterminal.com/compare/launchdarkly-vs-mostly-good-metrics.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Heap vs Mostly Good Metrics", "url": "" } ], "description": "Heap scores 48.2 (D) to Mostly Good Metrics's 41.7 (E) for event analytics. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Heap D 48.2", "Mostly Good Metrics E 41.7", "scores" ], "h1": "Heap vs Mostly Good Metrics", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/heap-vs-mostly-good-metrics", "published": "2026-10-01", "section": "tools", "title": "Heap vs Mostly Good Metrics for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics" }, "tokens": { "markdown": 4950, "slim": 2830 }, "version": 1 }