LaunchDarkly vs Mostly Good Metrics

LaunchDarkly 74

Graded on the hosted service with the hosted lines. Statuspage at status.launchdarkly.com with 51 components and incident history (20). Read from the history feed (the host's robots.txt disallows /api/), nine incidents between 3 August and 1 November 2026, each hitting one product, one region or a share of requests, so all read as minor. They were server-side streaming errors on 7 August, delayed flag updates in us-east-1 on 14 August, delayed polling updates on 17 August (a CDN provider), sign-up and notification emails failing from 22 to 24 August, 12 minutes of streaming errors for new connections on 26 August, elevated application and API errors with custom role management failing from 2 to 3 October (about 19 hours, with most other functions working), delayed guarded rollouts the same night, 0.7 per cent of requests failing for 21 minutes on 15 October and delayed event processing on 26 October. The 10 July outage, marked critical, has left the window (20). The API docs describe global, route, token and IP limits and say the numbers are not published. Limit and remaining headers report them at run time (5 of 15). 429s carry reset headers, IP limits carry Retry-After, and the docs ask for jitter and backoff. No idempotency keys were found, though JSON patch can test a resource version and 409 is documented as retryable (11 of 15). The SLA commits to 99.9 per cent for Enterprise support and 99.99 per cent for Premium support (10). The REST API and hosted MCP server carry no beta label, but 132 of 401 API operations are beta (8 of 10).

Mostly Good Metrics 29

Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.

LaunchDarkly 89

OpenAPI 3.0.3 served without a login at app.launchdarkly.com/api/v2/openapi.json, with 253 paths and 401 operations (25). The hosted MCP input schemas need a sign-in and were not read. A docs index for agents at launchdarkly.com/docs/llms.txt, and docs pages answer as Markdown with .md (10). 399 of 401 operations have a description. The MCP tool descriptions on the server page average about 740 characters and state pagination, sorting, plan limits and which tool to call next (17). 169 enums across 746 schemas. JSON patch bodies and semantic patch instructions are loosely typed objects (9). 1,853 examples in the spec, 429 documented on 287 operations and 403 on 355, and an error table with a suggested fix for each status (13). Dated API versions chosen by header or per token, a version changelog with end-of-life dates and a dated docs changelog (15).

Mostly Good Metrics 49

No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.

LaunchDarkly 81

Closed hosted service under published terms. The SDKs and ldcli are Apache-2.0 and the local MCP server is MIT (17 of 30). The privacy policy (8 April 2025) excludes data processed for customers, which the DPA (1 May 2024) covers, with deletion on written request after termination. The privacy policy gives no retention periods. The terms allow use of anonymised and aggregated data, and no clause on model training was found (20 of 30). The end-of-life policy gives API and SDK versions 12 months after a new release, and the version table lists end-of-life dates. Beta resources may change without notice (17 of 20). The sub-processor list (15 May 2026) gives locations, with Anthropic, OpenAI and Speakeasy under AI services, the DPA gives 30 days' notice of new sub-processors, and EU and federal instances exist (20).

Mostly Good Metrics 45

The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.

LaunchDarkly 66

The hosted MCP server uses OAuth with PKCE (S256), dynamic client registration, a revocation endpoint and three scopes, and an authorised app can never do more than the member who approved it. API access tokens are revocable and resettable with a Reader, Writer, Admin or Owner role. Custom roles and inline policies need a plan with custom roles, and service tokens need Enterprise. No secret in a URL query string is documented (26 of 30). Reader role and reader scope, --scope read and --tool on the local server, and approval requests for changes on Enterprise. No confirmation step for destructive hosted tools was found (14 of 20). The observability tools return logs, traces, errors and session data written by end users. No prompt-injection guidance was found in the MCP docs, which warn only that an API key in a config file may appear in a conversation (3 of 15). Change history with an API at /api/v2/auditlog and comments on updates, limited to 30 days on the Developer plan, and the pricing table lists audit logging under Enterprise only (11 of 15). The security page lists SOC 2 Type II, ISO 27001 and FedRAMP authorisation. security.txt returns 404, and no disclosure policy or bug bounty was found on the pages read (12 of 20).

Mostly Good Metrics 33

OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.

LaunchDarkly 69

The hosted MCP server lists 141 tools, far past 30 (5). The OAuth metadata names reader, writer and observability scopes, but no tool filter for the hosted server was found. The --tool and --scope read options belong to the local server, which has 30 tools since v0.7.2 (27 October 2026), so 3 of 10 added back (8). The API has limit and offset on 61 operations, filters and sorting, summary and detailed representations and an expand parameter on 40 (18). Errors carry code, message and id, with a table of statuses and fixes (15). The server page marks 73 tools read-only, 35 destructive and 89 idempotent. There are no idempotency keys on REST writes, and JSON patch can test a version before applying (15). Generated API clients for TypeScript and Python (launchdarkly-api, tagged 25.1.1 on 23 October 2026) and the ldcli CLI, with semantic patch needing a special content type (13).

Mostly Good Metrics 49

53 tools, more than 30 (5). We added 3 because Goals and Alerts tools load only where enabled and query_metrics batches up to 10 queries (8 of 25). Date ranges, grouping and filters on queries; no documented page or limit parameters for lists (12 of 20). JSON errors with a message, and per-item status in batch results (13 of 20). Annotations weren't readable without a session, the tool list includes deletes and key revocation, and no idempotency keys were found (4 of 20). Five client SDKs and a CLI with --json output (12 of 15). 8+12+13+4+12 = 49.

LaunchDarkly 40

No x402, MPP or L402 (0). Per-unit prices are public without a login, at $10 a service connection a month, $8.33 per 1,000 client-side MAU a month billed yearly and $5 per 1,000 additional AI runs. Enterprise is custom (20). The Developer plan is free with no card (20). A person signs up in a browser and approves OAuth or creates a token (0).

Mostly Good Metrics 30

No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.