# Heap vs RudderStack MCP (slim)

> RudderStack MCP scores 54.7 (C) to Heap's 48.2 (D) for event analytics. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/heap-vs-rudderstack-mcp.md (~4,200 tokens) · this version ~2,330 tokens · JSON https://www.anchorterminal.com/compare/heap-vs-rudderstack-mcp.json · canonical https://www.anchorterminal.com/compare/heap-vs-rudderstack-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

RudderStack MCP scores 54.7 (C) on agent readiness against Heap's 48.2 (D), and leads in 5 of 7 scored categories. Heap leads on transparency & trust. Both do event analytics.

- Heap: D 48.2, rank #1132 of 1510 · https://www.anchorterminal.com/tools/heap.min.md
- RudderStack MCP: C 54.7, rank #901 of 1510 · https://www.anchorterminal.com/tools/rudderstack-mcp.min.md
- Heap, good for An agent that records backend events or enriches user and account properties in a company's existing Heap project, or that files privacy deletions. Ahead on Transparency & trust, 66 against 51.
- RudderStack MCP, good for Data teams on RudderStack who want an agent to find why events, syncs or transformations failed and fix the configuration. Ahead on Schema & documentation, 66 against 57; Security & auth, 62 against 41; Payments & pricing, 30 against 25; Maintenance & community, 85 against 63.

| Category | Heap | RudderStack MCP |
| --- | --- | --- |
| Reliability (16%) | 47 | 45 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 57 | 66 |
| Agent ergonomics (13%) | 49 | 52 |
| Security & auth (14%) | 41 | 62 |
| Payments & pricing (10%) | 25 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 63 | 85 |
| Transparency & trust (7%) | 66 | 51 |

| Fact (where they differ) | Heap | RudderStack MCP |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Contentsquare (Content Square, Inc.) | RudderStack, Inc. |
| Hosted endpoint | `https://heapanalytics.com` | `https://mcp.rudderstack.com/mcp` |
| Transports | HTTP | Streamable HTTP |
| Auth | OAuth or key | OAuth |
| Licence | Proprietary service under Contentsquare's master services agreement. The React Native bridge and the Node client on npm are MIT | Proprietary service. The repository's MIT licence covers docs and metadata only |
| Tools exposed | none | 62 |
| Read-only variant documented | no | yes |
| MCP registry | not listed | `io.github.rudderlabs/rudderstack-mcp` |
| Last release | 2026-10-06 | none |
| Terms last updated | no date given | not read yet |
| Privacy policy last updated | couldn't be read | not read yet |
| Customer content may train models | yes | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | yes | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 213 npm/wk | none |

Why the edge:
- Maintenance & community, RudderStack MCP +22: Heap 63 (heap.js 5.3.17 shipped on 6 October 2026, but that is the browser SDK. The server-side track reference last changed on 3 June 2026 and has no changelog, so we scored this line between the two (20 of 30). heap.js 5.3.15, 5.3.16 and 5.3.17 and Android Core 0.9.5 fall inside 90 days (20). Dated public changelogs and a community at community.contentsquare.com, whose response times we didn't check (8). Client SDKs for web, Android, iOS, React Native and Flutter are current. The Node server client is from 2016 (10). CI not checked (5). Total 63. Per the 7 October check, not re-read on 4 November (developers.heap.io is paused on its terms). The three heap.js releases still fall inside the 90 days from 6 August.); RudderStack MCP 85 (Release notes dated 4 November 2026 and a registry version on 6 November (30). Many dated releases in 90 days (20). Public issue templates on the MCP repository, issues not read, plus release notes (10 of 25). Official registry entry io.github.rudderlabs/rudderstack-mcp and current official SDKs (15). A repository workflow publishes to the registry (10). 30 + 20 + 10 + 15 + 10 = 85. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.)
- Security & auth, RudderStack MCP +21: Heap 41 (Track, identify and property calls carry no secret. The OpenAPI fragment declares an empty security requirement and the only identifier is the environment ID that the web snippet publishes. User deletion uses one admin-generated API key per account, exchanged for a temporary token. No scopes or rotation guidance found (8 of 30). Ingest is write-only by design. Deletion of up to 10,000 users has no confirmation step (5). The API returns no untrusted content (10). Audit logs are unchecked because help.heap.io answered with a bot check, so none are counted (0). Contentsquare publishes a signed security.txt valid to 31 January 2028 on contentsquare.com (not on heap.io), a disclosure policy, an invitation-only YesWeHack bounty, SOC 2 Type II and ISO 27001 (18). Total 41. Per the 7 October check, not re-read on 4 November, because heap.io and contentsquare.com terms bar robots and crawling.); RudderStack MCP 62 (OAuth with PKCE and dynamic registration, scopes not published (22 of 30). Access classes, a read-only surface and confirmation advice for writes (16 of 20). Selected sensitive fields in event payloads and errors are redacted or hashed before they reach the model, but event payloads are still untrusted text (8 of 15). No audit log of MCP calls found (0). SOC 2 Type 2, HIPAA with a BAA, and a SECURITY.md with a private reporting address; no security.txt (404) (16 of 20). 22 + 16 + 8 + 0 + 16 = 62.)
- Transparency & trust, Heap +15: Heap 66 (Closed service with published terms, now Contentsquare's master services agreement (15). The DPA (June 2026) caps Product Analytics retention at 37 months from collection unless agreed otherwise and links the sub-processor list. heap.io still carries a 2019 website terms page from Heap Inc. beside the Contentsquare documents (22). No deprecation policy for the API was found. Contentsquare's docs carry migration guides from the Heap SDKs to the CSQ SDK without an end date that we found (4). Sub-processor list (June 2026) with locations, AWS in Ireland, Frankfurt and Virginia and OpenAI for Sense Chat (20). Total 61. Per the 7 October check, not re-read on 4 November, apart from the heap.io website terms (still dated 30 August 2019) and Contentsquare's terms of service (29 January 2026).); RudderStack MCP 51 (The server's source is closed; the repository's MIT licence covers only its docs and metadata. Terms in a master service agreement naming RudderStack, Inc. (15). Privacy policy read, retention given by purpose, not as periods (12 of 30). No deprecation policy for the MCP server (5 of 20). Subprocessors not found in the pages read (5 of 20). The MCP docs say live events, schemas, profile artifacts, transformation code and audit data stay within the workspace view. 15 + 12 + 5 + 5 = 37.)
- Schema & documentation, RudderStack MCP +9: Heap 57 (OpenAPI 3.1 fragments are embedded in the Markdown of the track and identify pages. No single spec file was found, the property pages we read had empty fragments and user deletion is prose only (15). llms.txt and a .md copy of every page (10). Descriptions state purpose, limits and reserved keys, with little on when not to use a call (12). Required fields are marked and lengths stated in prose, with string types throughout, no enums and a free-form `properties` object (8). Curl examples on every page. Track and identify document 200 and 400 with an empty object, and only user deletion describes its error body (7). SDK changelogs are dated, but no changelog or version policy for the server-side API was found. Paths mix unversioned, v1 and v0 (5). Total 57. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.); RudderStack MCP 66 (The public repository's docs/tools.md lists 62 tools with an access class for each; JSON Schemas not read without a session (15 of 25). llms.txt (10). Every tool has a one-line purpose and a Read, Sensitive execution or Write class (15 of 20). Inputs not verifiable (5 of 15). Example prompts and a documented 'workspace_id is required' error (6 of 15). Versioned in the registry (0.43.1, 6 November) and dated release notes (15). 15 + 10 + 15 + 5 + 6 + 15 = 66.)
- Payments & pricing, RudderStack MCP +5: Heap 25 (No x402, MPP or L402 (0). The Free plan and its 10,000-session limit are public. Growth needs an estimate after signup and Pro and Premier say Contact Us, so no paid price is published (5). Free plan with APIs included. No card is mentioned on the pricing page, and the signup form needs JavaScript we couldn't run (20). A person signs up in a browser and copies the environment ID (0). Total 25. Per the 7 October check, not re-read on 4 November (www.heap.io is paused on its terms).); RudderStack MCP 30 (No machine payment protocol (0). Public plan prices with event allowances, nothing per call (10). Free plan with 250,000 events a month (20). A person signs up in a browser and approves OAuth (0). 0 + 10 + 20 + 0 = 30.)