# Heap vs Mostly Good Metrics (slim)

> Heap scores 48.2 (D) to Mostly Good Metrics's 41.7 (E) for event analytics. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.md (~4,950 tokens) · this version ~2,830 tokens · JSON https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.json · canonical https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Heap scores 48.2 (D) on agent readiness against Mostly Good Metrics's 41.7 (E), and leads in 4 of 7 scored categories. Mostly Good Metrics leads on payments & pricing and maintenance & community. Both do event analytics.

- Heap: D 48.2, rank #1132 of 1510 · https://www.anchorterminal.com/tools/heap.min.md
- Mostly Good Metrics: E 41.7, rank #1295 of 1510 · https://www.anchorterminal.com/tools/mostly-good-metrics.min.md
- Heap, good for An agent that records backend events or enriches user and account properties in a company's existing Heap project, or that files privacy deletions. Ahead on Reliability, 47 against 29; Schema & documentation, 57 against 49; Security & auth, 41 against 33; Transparency & trust, 66 against 45.
- Mostly Good Metrics, good for Indie and small-team apps that want simple funnels and retention an agent can query. Ahead on Payments & pricing, 30 against 25; Maintenance & community, 74 against 63. Also Free to start without a card.

| Category | Heap | Mostly Good Metrics |
| --- | --- | --- |
| Reliability (16%) | 47 | 29 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 57 | 49 |
| Agent ergonomics (13%) | 49 | 49 |
| Security & auth (14%) | 41 | 33 |
| Payments & pricing (10%) | 25 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 63 | 74 |
| Transparency & trust (7%) | 66 | 45 |

| Fact (where they differ) | Heap | Mostly Good Metrics |
| --- | --- | --- |
| Vendor | Contentsquare (Content Square, Inc.) | Mostly Good Metrics |
| Hosted endpoint | `https://heapanalytics.com` | `https://app.mostlygoodmetrics.com/mcp` |
| Transports | HTTP | HTTP, Streamable HTTP |
| Licence | Proprietary service under Contentsquare's master services agreement. The React Native bridge and the Node client on npm are MIT | none |
| Tools exposed | none | 53 |
| llms.txt | yes | no |
| Last release | 2026-10-06 | 2026-10-16 |
| Terms last updated | no date given | 2025-12-01 |
| Privacy policy last updated | couldn't be read | 2025-12-01 |
| Customer content may train models | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Popularity | 213 npm/wk | 81 npm/wk |

Why the edge:
- Transparency & trust, Heap +21: Heap 66 (Closed service with published terms, now Contentsquare's master services agreement (15). The DPA (June 2026) caps Product Analytics retention at 37 months from collection unless agreed otherwise and links the sub-processor list. heap.io still carries a 2019 website terms page from Heap Inc. beside the Contentsquare documents (22). No deprecation policy for the API was found. Contentsquare's docs carry migration guides from the Heap SDKs to the CSQ SDK without an end date that we found (4). Sub-processor list (June 2026) with locations, AWS in Ireland, Frankfurt and Virginia and OpenAI for Sense Chat (20). Total 61. Per the 7 October check, not re-read on 4 November, apart from the heap.io website terms (still dated 30 August 2019) and Contentsquare's terms of service (29 January 2026).); Mostly Good Metrics 45 (The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.)
- Reliability, Heap +18: Heap 47 (Graded on the server-side API with the hosted lines. Heap's status page is an Atlassian Statuspage at status.heap.io, the address heap.io links to, which sits on a heap.io host whose terms bar robots, so it wasn't read on 4 November. The same page also answers at heap.statuspage.io, but that copy names status.heap.io as its canonical address and no Heap page links to it, so it wasn't used. The 7 October component and incident readings came only from Statuspage's JSON API, which this run doesn't use, so they are struck. No component list could be read (0) and no incident history could be read (5). Rate limits published with numbers, 30 requests per 30 seconds per identity on track and 15,000 events a minute per environment on bulk track, per the 7 October check, not re-read on 4 November (15). No 429 or backoff guidance found, but track takes an `idempotency_key`, per the 7 October check, not re-read on 4 November (7, the earlier partial kept, since keys without any 429 or backoff guidance meet none of the line's values in full). Contentsquare's support package states 99.5 per cent availability for Product Analytics Pro and Enterprise, measured on the user interface, per the 7 October check, not re-read on 4 November (10). The API carries no beta label (10). 0+5+15+7+10+10 = 47.); Mostly Good Metrics 29 (Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.)
- Maintenance & community, Mostly Good Metrics +11: Heap 63 (heap.js 5.3.17 shipped on 6 October 2026, but that is the browser SDK. The server-side track reference last changed on 3 June 2026 and has no changelog, so we scored this line between the two (20 of 30). heap.js 5.3.15, 5.3.16 and 5.3.17 and Android Core 0.9.5 fall inside 90 days (20). Dated public changelogs and a community at community.contentsquare.com, whose response times we didn't check (8). Client SDKs for web, Android, iOS, React Native and Flutter are current. The Node server client is from 2016 (10). CI not checked (5). Total 63. Per the 7 October check, not re-read on 4 November (developers.heap.io is paused on its terms). The three heap.js releases still fall inside the 90 days from 6 August.); Mostly Good Metrics 74 (CLI v0.1.4 was tagged on 16 October 2026 (30). The JavaScript SDK released 0.12.0, 0.13.0 and 0.13.1 between 5 September and 2 October, and the Swift SDK 1.0.0 and 1.0.1 on 2 October (20). A closed service with no public changelog, support by email and GitHub repositories for the SDKs; issue activity wasn't read because the GitHub API refused us for its rate limit (6 of 25). Not in the official MCP registry; official SDKs in five languages are current (10 of 15). CI workflows on the SDK and CLI repositories (8 of 10). 30+20+6+10+8 = 74.)
- Schema & documentation, Heap +8: Heap 57 (OpenAPI 3.1 fragments are embedded in the Markdown of the track and identify pages. No single spec file was found, the property pages we read had empty fragments and user deletion is prose only (15). llms.txt and a .md copy of every page (10). Descriptions state purpose, limits and reserved keys, with little on when not to use a call (12). Required fields are marked and lengths stated in prose, with string types throughout, no enums and a free-form `properties` object (8). Curl examples on every page. Track and identify document 200 and 400 with an empty object, and only user deletion describes its error body (7). SDK changelogs are dated, but no changelog or version policy for the server-side API was found. Paths mix unversioned, v1 and v0 (5). Total 57. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.); Mostly Good Metrics 49 (No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.)
- Security & auth, Heap +8: Heap 41 (Track, identify and property calls carry no secret. The OpenAPI fragment declares an empty security requirement and the only identifier is the environment ID that the web snippet publishes. User deletion uses one admin-generated API key per account, exchanged for a temporary token. No scopes or rotation guidance found (8 of 30). Ingest is write-only by design. Deletion of up to 10,000 users has no confirmation step (5). The API returns no untrusted content (10). Audit logs are unchecked because help.heap.io answered with a bot check, so none are counted (0). Contentsquare publishes a signed security.txt valid to 31 January 2028 on contentsquare.com (not on heap.io), a disclosure policy, an invitation-only YesWeHack bounty, SOC 2 Type II and ISO 27001 (18). Total 41. Per the 7 October check, not re-read on 4 November, because heap.io and contentsquare.com terms bar robots and crawling.); Mostly Good Metrics 33 (OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.)
- Payments & pricing, Mostly Good Metrics +5: Heap 25 (No x402, MPP or L402 (0). The Free plan and its 10,000-session limit are public. Growth needs an estimate after signup and Pro and Premier say Contact Us, so no paid price is published (5). Free plan with APIs included. No card is mentioned on the pricing page, and the signup form needs JavaScript we couldn't run (20). A person signs up in a browser and copies the environment ID (0). Total 25. Per the 7 October check, not re-read on 4 November (www.heap.io is paused on its terms).); Mostly Good Metrics 30 (No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.)