# Heap vs Userpilot

> Userpilot scores 64.4 (B) to Heap's 48.2 (D) for event analytics. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/heap-vs-userpilot
- Markdown: https://www.anchorterminal.com/compare/heap-vs-userpilot.md (~4,800 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Userpilot scores 64.4 (B) on agent readiness against Heap's 48.2 (D), and leads in 6 of 7 scored categories. Heap leads on transparency & trust. Both do event analytics.

- Heap: grade D, 48.2/100, rank #1120 of 1486. Markdown https://www.anchorterminal.com/tools/heap.md · JSON https://www.anchorterminal.com/api/v1/tools/heap.json
- Userpilot: grade B, 64.4/100, rank #471 of 1486. Markdown https://www.anchorterminal.com/tools/userpilot.md · JSON https://www.anchorterminal.com/api/v1/tools/userpilot.json
- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md
- All 153 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md

## Which one, for what

### Heap (D)

Good for: An agent that records backend events or enriches user and account properties in a company's existing Heap project, or that files privacy deletions.

Ahead on:
- Transparency & trust, 66 against 59

Watch for: No query, export or definitions endpoint in the developer reference. Reading results needs the app, Heap Connect or the MCP server we couldn't read

### Userpilot (B)

Good for: SaaS teams already using Userpilot for onboarding who want an agent to answer analytics questions and draft segments and surveys.

Ahead on:
- Reliability, 82 against 47
- Schema & documentation, 71 against 57
- Agent ergonomics, 60 against 49
- Security & auth, 62 against 41
- Payments & pricing, 30 against 25
- Maintenance & community, 79 against 63

Also in its favour:
- Free to start without a card

Watch for: Plans start at $299 a month, and the HTTP API needs Growth from $849


## Why the edge

### Reliability: Userpilot +35

- Heap (47): Graded on the server-side API with the hosted lines. Heap's status page is an Atlassian Statuspage at status.heap.io, the address heap.io links to, which sits on a heap.io host whose terms bar robots, so it wasn't read on 4 November. The same page also answers at heap.statuspage.io, but that copy names status.heap.io as its canonical address and no Heap page links to it, so it wasn't used. The 7 October component and incident readings came only from Statuspage's JSON API, which this run doesn't use, so they are struck. No component list could be read (0) and no incident history could be read (5). Rate limits published with numbers, 30 requests per 30 seconds per identity on track and 15,000 events a minute per environment on bulk track, per the 7 October check, not re-read on 4 November (15). No 429 or backoff guidance found, but track takes an `idempotency_key`, per the 7 October check, not re-read on 4 November (7, the earlier partial kept, since keys without any 429 or backoff guidance meet none of the line's values in full). Contentsquare's support package states 99.5 per cent availability for Product Analytics Pro and Enterprise, measured on the user interface, per the 7 October check, not re-read on 4 November (10). The API carries no beta label (10). 0+5+15+7+10+10 = 47.
- Userpilot (82): Graded on the hosted service with the hosted lines. Better Stack status page at status.userpilot.io with components for ingestion in three regions, the SDKs, the web application APIs and the website (20). From August to November 2026 the page shows only scheduled maintenance windows of two to four hours, with no incidents; the MCP server isn't a component (30). 600 requests a minute per token for the real-time APIs, but no numbers for MCP or export (12 of 15). 429 documented with exponential backoff guidance; no Retry-After or idempotency guidance (10 of 15). The SLA is a custom Enterprise contract term, not published (0). The MCP server is 1.0.0 in the registry with no beta label (10). 20+30+12+10+0+10 = 82.

### Security & auth: Userpilot +21

- Heap (41): Track, identify and property calls carry no secret. The OpenAPI fragment declares an empty security requirement and the only identifier is the environment ID that the web snippet publishes. User deletion uses one admin-generated API key per account, exchanged for a temporary token. No scopes or rotation guidance found (8 of 30). Ingest is write-only by design. Deletion of up to 10,000 users has no confirmation step (5). The API returns no untrusted content (10). Audit logs are unchecked because help.heap.io answered with a bot check, so none are counted (0). Contentsquare publishes a signed security.txt valid to 31 January 2028 on contentsquare.com (not on heap.io), a disclosure policy, an invitation-only YesWeHack bounty, SOC 2 Type II and ISO 27001 (18). Total 41. Per the 7 October check, not re-read on 4 November, because heap.io and contentsquare.com terms bar robots and crawling.
- Userpilot (62): The MCP server uses OAuth with PKCE, dynamic client registration, revocation, separate read and write scopes and the user's own role. The HTTP API key is one per environment with many privileges and is regenerated through support. Averaged over both surfaces (22 of 30). Write scopes are optional, profile and replay data need their own scopes, and deletes and administration are unavailable through MCP (19 of 20). Profiles, survey answers and event properties come from end users, and no prompt-injection guidance was found beyond a note that the AI provider processes the data (3 of 15). Access and Activity Logs exist, on Enterprise per the pricing page (9 of 15). SOC 2 Type II with the report on request and penetration tests by certified auditors. No security.txt, disclosure policy or bug bounty (9 of 20). 22+19+3+9+9 = 62.

### Maintenance & community: Userpilot +16

- Heap (63): heap.js 5.3.17 shipped on 6 October 2026, but that is the browser SDK. The server-side track reference last changed on 3 June 2026 and has no changelog, so we scored this line between the two (20 of 30). heap.js 5.3.15, 5.3.16 and 5.3.17 and Android Core 0.9.5 fall inside 90 days (20). Dated public changelogs and a community at community.contentsquare.com, whose response times we didn't check (8). Client SDKs for web, Android, iOS, React Native and Flutter are current. The Node server client is from 2016 (10). CI not checked (5). Total 63. Per the 7 October check, not re-read on 4 November (developers.heap.io is paused on its terms). The three heap.js releases still fall inside the 90 days from 6 August.
- Userpilot (79): io.userpilot/mcp 1.0.0 was published to the registry on 11 October 2026 (30). The iOS SDK alone has dated releases on 6 August, 2 September, 27 September and 2 October 2026 (20). A closed service with no public API changelog, support by email and chat (8 of 25). Verified io.userpilot namespace in the official MCP registry (15). Client SDKs are current; there is nothing else public to inspect (6 of 10). 30+20+8+15+6 = 79.

### Schema & documentation: Userpilot +14

- Heap (57): OpenAPI 3.1 fragments are embedded in the Markdown of the track and identify pages. No single spec file was found, the property pages we read had empty fragments and user deletion is prose only (15). llms.txt and a .md copy of every page (10). Descriptions state purpose, limits and reserved keys, with little on when not to use a call (12). Required fields are marked and lengths stated in prose, with string types throughout, no enums and a free-form `properties` object (8). Curl examples on every page. Track and identify document 200 and 400 with an empty object, and only user deletion describes its error body (7). SDK changelogs are dated, but no changelog or version policy for the server-side API was found. Paths mix unversioned, v1 and v0 (5). Total 57. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.
- Userpilot (71): Every API reference page embeds an OpenAPI 3.0 definition, though no standalone spec file was found (20 of 25). llms.txt and Markdown versions of every page (10). Endpoint pages state their purpose and the MCP docs say what each permission allows; the MCP tool definitions weren't read because that needs a session (12 of 20). Request bodies are typed, mostly as strings and string arrays with few enums (9 of 15). An error reference covers 400, 401, 422 and 429 with causes, and pages carry examples (12 of 15). /v1 paths and dated SDK release notes; no API changelog was found (8 of 15). 20+10+12+9+12+8 = 71.

### Agent ergonomics: Userpilot +11

- Heap (49): Responses are an empty object, so context cost is small, but there is nothing to read back (15). No pagination or filtering because the reference has no read endpoint. Bulk calls take 1,000 events or users (5). Errors on track and identify are a bare 400. User deletion returns `err.message` with 401 and 404 explained (6). `idempotency_key` on track and bulk track, and property writes overwrite, so retries are safe (15). Track needs three fields and timestamps default to now. No current official server SDK was found. heap-api on npm is 1.0.1 from 2016 (8). Total 49. Per the 7 October check, not re-read on 4 November, because developers.heap.io sits on a host whose terms bar robots.
- Userpilot (60): The tool count isn't published; the docs say the assistant can search hundreds of extra read-only operations on demand, which reads as dynamic loading. Without the list we give the middle band (15 of 25). Export jobs filter by date range, users, events and segments, and job lists paginate (14 of 20). A documented error reference (13 of 20). No deletes or admin through MCP by design; annotations weren't readable and no idempotency keys were found (10 of 20). The HTTP APIs have no official server-side SDK; client SDKs for web and six mobile frameworks (8 of 15). 15+14+13+10+8 = 60.

### Transparency & trust: Heap +7

- Heap (66): Closed service with published terms, now Contentsquare's master services agreement (15). The DPA (June 2026) caps Product Analytics retention at 37 months from collection unless agreed otherwise and links the sub-processor list. heap.io still carries a 2019 website terms page from Heap Inc. beside the Contentsquare documents (22). No deprecation policy for the API was found. Contentsquare's docs carry migration guides from the Heap SDKs to the CSQ SDK without an end date that we found (4). Sub-processor list (June 2026) with locations, AWS in Ireland, Frankfurt and Virginia and OpenAI for Sense Chat (20). Total 61. Per the 7 October check, not re-read on 4 November, apart from the heap.io website terms (still dated 30 August 2019) and Contentsquare's terms of service (29 January 2026).
- Userpilot (59): A closed service with terms dated 23 April 2024 (15 of 30). The privacy policy of 11 March 2025 names a DPO and two sub-processors (AWS and Cloudflare), while the security page names AWS, Google Cloud and Stripe. The DPA is on request and no customer-data retention period is stated (14 of 30). No deprecation policy or dated API notices found (3 of 20). Sub-processors are named with addresses but not data locations, though an EU ingestion endpoint exists (10 of 20). 15+14+3+10 = 42.

## Score by category

| Category | Weight | Heap | Userpilot | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 47 | 82 | Userpilot +35 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 57 | 71 | Userpilot +14 |
| Agent ergonomics | 13% (16.2 this run) | 49 | 60 | Userpilot +11 |
| Security & auth | 14% (17.5 this run) | 41 | 62 | Userpilot +21 |
| Payments & pricing | 10% (12.5 this run) | 25 | 30 | Userpilot +5 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 63 | 79 | Userpilot +16 |
| Transparency & trust | 7% (8.8 this run) | 66 | 59 | Heap +7 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **48.2 · D** | **64.4 · B** | |

## Facts side by side

| Fact | Heap | Userpilot |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Contentsquare (Content Square, Inc.) | Userpilot, Inc. |
| Hosted endpoint | `https://heapanalytics.com` | `https://mcp.userpilot.io/mcp` |
| Transports | HTTP | HTTP, Streamable HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Freemium | Paid |
| x402 | no | no |
| Licence | Proprietary service under Contentsquare's master services agreement. The React Native bridge and the Node client on npm are MIT | none |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| MCP registry | not listed | `io.userpilot/mcp` |
| Last release | 2026-10-06 | 2026-10-11 |
| Terms last updated | no date given | 2024-04-23 |
| Privacy policy last updated | couldn't be read | 2025-03-11 |
| Customer content may train models | yes | not found in the text |
| Terms restrict automated access | not found in the text | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 213 npm/wk | 236k npm/wk |

## How the scores have moved

### Heap

- -5.0 on 4 November 2026: correction
- +0.1 on 28 October 2026: new evidence
- +0.1 on 27 October 2026: checklist

### Userpilot

No score change since it was listed.

## Verdicts

**Heap.** Heap's server-side API suits an agent that records events. Limits are published, bulk calls take 1,000 items and track accepts an idempotency key. The API returns no analytics, and ingest calls carry no secret beyond the environment ID. Heap's help centre lists a Heap MCP article, which a bot check stopped us reading, so the MCP server is ungraded.

**Userpilot.** Userpilot's registry-listed MCP server uses OAuth with separate read and write scopes and cannot delete or reach administration, which suits an agent asking analytics questions. Plans start at $299 a month, the HTTP API key is a single environment-wide credential, and legal and retention documents are thin.

## Before you call either

### Heap

1. Send EU projects to https://c.eu.heap-api.com instead of https://heapanalytics.com. The path stays the same
2. Pass one of `identity` or `user_id` on track, never both
3. Set `idempotency_key` on every track event so a retry doesn't duplicate it
4. Stay under 30 requests per 30 seconds per identity, or batch up to 1,000 events in one bulk call
5. For deletion, exchange the app_id and API key of the Main Production environment for a token first. Any other environment ID returns Unauthorized

### Userpilot

1. Ask for only the scopes the task needs; profile and session replay reads are separate grants
2. Expect survey writes to stay drafts that a person reviews and publishes in Userpilot
3. Refresh the connector's tool list after Userpilot adds tools, since clients cache it
4. Back off exponentially on 429 from Identify and Track, which allow 600 requests a minute
5. Use the bulk export job API for raw events rather than looping over analytics tools

## Questions

### Which is better for AI agents, Heap or Userpilot?

Userpilot scores 64.4 (B) on agent readiness against Heap's 48.2 (D), and leads in 6 of 7 scored categories. Heap leads on transparency & trust.

### Do Heap and Userpilot need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call Heap and Userpilot without installing anything?

Yes. Heap has a hosted endpoint at https://heapanalytics.com and Userpilot at https://mcp.userpilot.io/mcp.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/heap-vs-userpilot.json, and with the fewest tokens: https://www.anchorterminal.com/compare/heap-vs-userpilot.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "heap", "b": "userpilot"}`. From a terminal: `anchor compare heap userpilot`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/heap.json and https://www.anchorterminal.com/api/v1/tools/userpilot.json

## Other comparisons with Heap or Userpilot

- [Amplitude vs Userpilot](https://www.anchorterminal.com/compare/amplitude-vs-userpilot.md)
- [Basedash MCP vs Userpilot](https://www.anchorterminal.com/compare/basedash-mcp-vs-userpilot.md)
- [Countly vs Userpilot](https://www.anchorterminal.com/compare/countly-vs-userpilot.md)
- [Fullstory vs Userpilot](https://www.anchorterminal.com/compare/fullstory-vs-userpilot.md)
- [GrowthBook vs Userpilot](https://www.anchorterminal.com/compare/growthbook-vs-userpilot.md)
- [Matomo vs Userpilot](https://www.anchorterminal.com/compare/matomo-vs-userpilot.md)
- [Mixpanel vs Userpilot](https://www.anchorterminal.com/compare/mixpanel-vs-userpilot.md)
- [Mostly Good Metrics vs Userpilot](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.md)
- [OpenPanel vs Userpilot](https://www.anchorterminal.com/compare/openpanel-vs-userpilot.md)
- [Optimizely Experimentation vs Userpilot](https://www.anchorterminal.com/compare/optimizely-vs-userpilot.md)
- [Pendo vs Userpilot](https://www.anchorterminal.com/compare/pendo-vs-userpilot.md)
- [PostHog vs Userpilot](https://www.anchorterminal.com/compare/posthog-vs-userpilot.md)
- [Statsig vs Userpilot](https://www.anchorterminal.com/compare/statsig-vs-userpilot.md)
- [Userpilot vs Woopra](https://www.anchorterminal.com/compare/userpilot-vs-woopra.md)
- [Amplitude vs Heap](https://www.anchorterminal.com/compare/amplitude-vs-heap.md)
- [Countly vs Heap](https://www.anchorterminal.com/compare/countly-vs-heap.md)
- [Flagsmith vs Heap](https://www.anchorterminal.com/compare/flagsmith-vs-heap.md)
- [Fullstory vs Heap](https://www.anchorterminal.com/compare/fullstory-vs-heap.md)
- [GrowthBook vs Heap](https://www.anchorterminal.com/compare/growthbook-vs-heap.md)
- [Harness Feature Management & Experimentation vs Heap](https://www.anchorterminal.com/compare/harness-fme-vs-heap.md)
- [Heap vs Matomo](https://www.anchorterminal.com/compare/heap-vs-matomo.md)
- [Heap vs Mixpanel](https://www.anchorterminal.com/compare/heap-vs-mixpanel.md)
- [Heap vs Mostly Good Metrics](https://www.anchorterminal.com/compare/heap-vs-mostly-good-metrics.md)
- [Heap vs OpenPanel](https://www.anchorterminal.com/compare/heap-vs-openpanel.md)
- [Heap vs Pendo](https://www.anchorterminal.com/compare/heap-vs-pendo.md)
- [Heap vs PostHog](https://www.anchorterminal.com/compare/heap-vs-posthog.md)
- [Heap vs Statsig](https://www.anchorterminal.com/compare/heap-vs-statsig.md)
- [Heap vs Woopra](https://www.anchorterminal.com/compare/heap-vs-woopra.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp