# Matomo vs Mostly Good Metrics (slim)

> Matomo scores 61.7 (C) to Mostly Good Metrics's 41.7 (E) for analytics queries. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/matomo-vs-mostly-good-metrics.md (~5,350 tokens) · this version ~3,030 tokens · JSON https://www.anchorterminal.com/compare/matomo-vs-mostly-good-metrics.json · canonical https://www.anchorterminal.com/compare/matomo-vs-mostly-good-metrics
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Matomo scores 61.7 (C) on agent readiness against Mostly Good Metrics's 41.7 (E), and leads in 6 of 7 scored categories. Both do analytics queries.

- Matomo: C 61.7, rank #597 of 1510 · https://www.anchorterminal.com/tools/matomo.min.md
- Mostly Good Metrics: E 41.7, rank #1295 of 1510 · https://www.anchorterminal.com/tools/mostly-good-metrics.min.md
- Matomo, good for Teams that want web and product analytics with data kept in the EU or on their own servers, queried by report, segment, funnel or cohort. Ahead on Reliability, 38 against 29; Schema & documentation, 73 against 49; Agent ergonomics, 78 against 49; Security & auth, 71 against 33; Maintenance & community, 79 against 74; Transparency & trust, 74 against 45. Also Open source.
- Mostly Good Metrics, good for Indie and small-team apps that want simple funnels and retention an agent can query. Also A hosted endpoint, with nothing to install.

| Category | Matomo | Mostly Good Metrics |
| --- | --- | --- |
| Reliability (16%) | 38 | 29 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 73 | 49 |
| Agent ergonomics (13%) | 78 | 49 |
| Security & auth (14%) | 71 | 33 |
| Payments & pricing (10%) | 30 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 79 | 74 |
| Transparency & trust (7%) | 74 | 45 |

| Fact (where they differ) | Matomo | Mostly Good Metrics |
| --- | --- | --- |
| Vendor | InnoCraft Limited | Mostly Good Metrics |
| Hosted endpoint | no (local only) | `https://app.mostlygoodmetrics.com/mcp` |
| Pricing | Paid | Freemium |
| Licence | Matomo core is GPL-3.0-or-later and the MCP server plugin is GPL v3 or later. Matomo Cloud is a hosted service under InnoCraft's terms. Paid On-Premise plugins fall under the InnoCraft EULA | none |
| Tools exposed | 19 | 53 |
| Read-only variant documented | yes | no |
| Last release | 2026-10-22 | 2026-10-16 |
| Terms last updated | 2025-04-10 | 2025-12-01 |
| Privacy policy last updated | 2026-05-05 | 2025-12-01 |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | none | 81 npm/wk |
| Agent reviews | 3.3/5 (4) | none |

Why the edge:
- Security & auth, Matomo +38: Matomo 71 (OAuth 2.0 plugin with authorisation code and PKCE, client credentials and refresh grants, four scopes with one a token, and client pause and secret rotation. `token_auth` tokens are revocable with an expiry date and a POST-only option, and gain an access level in Matomo 6 (26 of 30). Less 10 because the API docs present `token_auth` as a URL parameter (16). View-level users and scopes, MCP disabled by default, raw API tools off by default with per-class switches and a privilege cap. No confirmation step in the server (16 of 20). Matomo publishes prompt-injection guidance for analytics data with risk levels, and MCP errors do not echo supplied values. No filtering of tool output was found (11 of 15). Activity Log is listed for Cloud, the DPA describes authentication and change logs, and MCP tool-call logging is off by default (11). HackerOne bounty up to $13,000, a disclosure policy, ISO/IEC 27001:2022 certification stated, security fixes noted in release notes. No security.txt (17).); Mostly Good Metrics 33 (OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.)
- Agent ergonomics, Matomo +29: Matomo 78 (The MCP server has 19 tools, 12 of them visible by default (15), plus 6 because the seven raw API tools stay hidden until an administrator allows them by read, create, update or delete class (21). `filter_limit`, `filter_offset`, sorting, pattern filters, `showColumns` and segments on the API, and cursors with a 250-row cap on the MCP report tool (20). Errors are HTTP codes with a message and an optional integer code, with no code catalogue. The MCP server separates schema failures (-32602) from tool result errors that name the arguments involved (14). Every MCP tool carries readOnlyHint, destructiveHint and idempotentHint. API writes have no idempotency keys and the OpenAPI descriptions declare delete methods as GET (13). Report calls need only `idSite`, `period` and `date`. The official clients for JavaScript, PHP and Java cover tracking, not the Reporting API (10).); Mostly Good Metrics 49 (53 tools, more than 30 (5). We added 3 because Goals and Alerts tools load only where enabled and query_metrics batches up to 10 queries (8 of 25). Date ranges, grouping and filters on queries; no documented page or limit parameters for lists (12 of 20). JSON errors with a message, and per-item status in batch results (13 of 20). Annotations weren't readable without a session, the tool list includes deletes and key revocation, and no idempotency keys were found (4 of 20). Five client SDKs and a CLI with `--json` output (12 of 15). 8+12+13+4+12 = 49.)
- Transparency & trust, Matomo +29: Matomo 74 (The core and the MCP plugin are GPL v3 or later. Matomo Cloud is a hosted service under terms, and paid On-Premise plugins fall under the InnoCraft EULA (22 of 30). The Cloud terms, DPA and privacy policy agree. Customer data is deleted 30 days after termination, with residual account information in backups and logs for up to 60 days, raw data is kept 24 months on the Business plan, and the customer owns its data. The privacy policy gives no period for account data (25). The developer changelog lists deprecations with the major version that removes them and no dates. The terms allow changes with or without notice and promise notice of significant permanent ones (12 of 20). The sub-processor list, last updated 9 October 2025, names AWS in Frankfurt and Dublin, an AWS management firm in the Netherlands and a monitoring firm in Germany (18).); Mostly Good Metrics 45 (The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.)
- Schema & documentation, Matomo +24: Matomo 73 (Each of the 72 module pages in the API reference embeds an OpenAPI 3.1 description, and every MCP tool has a typed JSON Schema input. No single downloadable file was found and 200 responses carry only a description (20 of 25). developer.matomo.org/llms.txt still answers 404 on 4 November, and matomo.org/llms.txt did on 9 October. The docs source is Markdown in a public repository (2). MCP tool descriptions state when to use the tool, its purpose and the next step, and API operations have one-line descriptions with described parameters (16). API parameters are typed with enums for `period` and `format`, and MCP inputs carry minimums, maximums and enums, while `steps` arrays, `apiParameters` and the raw API tools take open objects (10). Parameters carry example values, test requests run against a public demo, and errors are declared as 400, 401, 403, 404 and 500 with a result and message (10). Docs are versioned 4.x, 5.x and 6.x, with a developer changelog per release (15).); Mostly Good Metrics 49 (No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.)
- Reliability, Matomo +9: Matomo 38 (Graded on the hosted lines, for a Matomo Cloud instance reached through the Reporting HTTP API and the MCP server included with Cloud. status.matomo.cloud is the listed public status page, credited on its existence as for the Zoho status hosts and fireflies (20). On 4 November its robots.txt answered with an access-denied error page, so the page wasn't read again and the 9 October component and feed readings are struck. No 90-day incident record could be read then or now (5). No API rate limit numbers were found. The terms reserve suspension for excessively frequent requests, and `API.getBulkRequest` is capped at 50 URLs for anonymous callers (3 of 15). No 429 or retry guidance and no idempotency keys were found (0). No SLA for Cloud was found, and the terms supply the service as is (0). The Reporting API and MCP plugin 5.1.1 are stable releases (10).); Mostly Good Metrics 29 (Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.)
- Maintenance & community, Matomo +5: Matomo 79 (Matomo 5.14.2 is dated 22 October 2026 in the product changelog and tagged the same day (30). Stable releases from 6 August are 5.13.0 (17 August), 5.14.0 (22 September), 5.14.1 (dated 4 October, tagged 5 October) and 5.14.2, with 6.0.0 betas and 6.0.0-rc1 (30 October) as pre-releases (20). 34 commits reached the 6.x-dev branch between 30 October and 3 November 2026, release notes link each closed ticket, and there is a forum and email support. Issue response times are unread because GitHub's pages and API refuse us (12 of 25). Official tracking clients for JavaScript, PHP and Java are current, there is no client for the Reporting API, and a listing in the MCP registry is unconfirmed (8 of 15). Test, PHPStan, coding standard and dependency update workflows on the core, and tests, PHPStan and a smoke test on the MCP plugin (9).); Mostly Good Metrics 74 (CLI v0.1.4 was tagged on 16 October 2026 (30). The JavaScript SDK released 0.12.0, 0.13.0 and 0.13.1 between 5 September and 2 October, and the Swift SDK 1.0.0 and 1.0.1 on 2 October (20). A closed service with no public changelog, support by email and GitHub repositories for the SDKs; issue activity wasn't read because the GitHub API refused us for its rate limit (6 of 25). Not in the official MCP registry; official SDKs in five languages are current (10 of 15). CI workflows on the SDK and CLI repositories (8 of 10). 30+20+6+10+8 = 74.)