Matomo vs RudderStack MCP

Matomo 78

The MCP server has 19 tools, 12 of them visible by default (15), plus 6 because the seven raw API tools stay hidden until an administrator allows them by read, create, update or delete class (21). filter_limit, filter_offset, sorting, pattern filters, showColumns and segments on the API, and cursors with a 250-row cap on the MCP report tool (20). Errors are HTTP codes with a message and an optional integer code, with no code catalogue. The MCP server separates schema failures (-32602) from tool result errors that name the arguments involved (14). Every MCP tool carries readOnlyHint, destructiveHint and idempotentHint. API writes have no idempotency keys and the OpenAPI descriptions declare delete methods as GET (13). Report calls need only idSite, period and date. The official clients for JavaScript, PHP and Java cover tracking, not the Reporting API (10).

RudderStack MCP 52

62 tools (5), plus a separately controlled read-only web surface (5). Filters on some list tools, not documented generally (8 of 20). One documented error (5 of 20). Read, Sensitive execution and Write classes, with Write tools to be confirmed by the client; annotations not read (14 of 20). One URL with OAuth and RudderStack SDKs in many languages (15). 10 + 8 + 5 + 14 + 15 = 52.

Matomo 74

The core and the MCP plugin are GPL v3 or later. Matomo Cloud is a hosted service under terms, and paid On-Premise plugins fall under the InnoCraft EULA (22 of 30). The Cloud terms, DPA and privacy policy agree. Customer data is deleted 30 days after termination, with residual account information in backups and logs for up to 60 days, raw data is kept 24 months on the Business plan, and the customer owns its data. The privacy policy gives no period for account data (25). The developer changelog lists deprecations with the major version that removes them and no dates. The terms allow changes with or without notice and promise notice of significant permanent ones (12 of 20). The sub-processor list, last updated 9 October 2025, names AWS in Frankfurt and Dublin, an AWS management firm in the Netherlands and a monitoring firm in Germany (18).

RudderStack MCP 51

The server's source is closed; the repository's MIT licence covers only its docs and metadata. Terms in a master service agreement naming RudderStack, Inc. (15). Privacy policy read, retention given by purpose, not as periods (12 of 30). No deprecation policy for the MCP server (5 of 20). Subprocessors not found in the pages read (5 of 20). The MCP docs say live events, schemas, profile artifacts, transformation code and audit data stay within the workspace view. 15 + 12 + 5 + 5 = 37.

Matomo 71

OAuth 2.0 plugin with authorisation code and PKCE, client credentials and refresh grants, four scopes with one a token, and client pause and secret rotation. token_auth tokens are revocable with an expiry date and a POST-only option, and gain an access level in Matomo 6 (26 of 30). Less 10 because the API docs present token_auth as a URL parameter (16). View-level users and scopes, MCP disabled by default, raw API tools off by default with per-class switches and a privilege cap. No confirmation step in the server (16 of 20). Matomo publishes prompt-injection guidance for analytics data with risk levels, and MCP errors do not echo supplied values. No filtering of tool output was found (11 of 15). Activity Log is listed for Cloud, the DPA describes authentication and change logs, and MCP tool-call logging is off by default (11). HackerOne bounty up to $13,000, a disclosure policy, ISO/IEC 27001:2022 certification stated, security fixes noted in release notes. No security.txt (17).

RudderStack MCP 62

OAuth with PKCE and dynamic registration, scopes not published (22 of 30). Access classes, a read-only surface and confirmation advice for writes (16 of 20). Selected sensitive fields in event payloads and errors are redacted or hashed before they reach the model, but event payloads are still untrusted text (8 of 15). No audit log of MCP calls found (0). SOC 2 Type 2, HIPAA with a BAA, and a SECURITY.md with a private reporting address; no security.txt (404) (16 of 20). 22 + 16 + 8 + 0 + 16 = 62.

Matomo 38

Graded on the hosted lines, for a Matomo Cloud instance reached through the Reporting HTTP API and the MCP server included with Cloud. status.matomo.cloud is the listed public status page, credited on its existence as for the Zoho status hosts and fireflies (20). On 4 November its robots.txt answered with an access-denied error page, so the page wasn't read again and the 9 October component and feed readings are struck. No 90-day incident record could be read then or now (5). No API rate limit numbers were found. The terms reserve suspension for excessively frequent requests, and API.getBulkRequest is capped at 50 URLs for anonymous callers (3 of 15). No 429 or retry guidance and no idempotency keys were found (0). No SLA for Cloud was found, and the terms supply the service as is (0). The Reporting API and MCP plugin 5.1.1 are stable releases (10).

RudderStack MCP 45

Statuspage at status.rudderstack.com with regional components and none for MCP (15). Since August the history shows an EU ingestion issue, increased US latency, a Python transformations issue, free-tier processing delays and scheduled maintenance (20, minor incidents). No MCP rate limits found (0). No retry guidance for the MCP server found (0). No SLA found in the pages read (0). Not labelled beta (10). 15 + 20 + 0 + 0 + 0 + 10 = 45.

Matomo 73

Each of the 72 module pages in the API reference embeds an OpenAPI 3.1 description, and every MCP tool has a typed JSON Schema input. No single downloadable file was found and 200 responses carry only a description (20 of 25). developer.matomo.org/llms.txt still answers 404 on 4 November, and matomo.org/llms.txt did on 9 October. The docs source is Markdown in a public repository (2). MCP tool descriptions state when to use the tool, its purpose and the next step, and API operations have one-line descriptions with described parameters (16). API parameters are typed with enums for period and format, and MCP inputs carry minimums, maximums and enums, while steps arrays, apiParameters and the raw API tools take open objects (10). Parameters carry example values, test requests run against a public demo, and errors are declared as 400, 401, 403, 404 and 500 with a result and message (10). Docs are versioned 4.x, 5.x and 6.x, with a developer changelog per release (15).

RudderStack MCP 66

The public repository's docs/tools.md lists 62 tools with an access class for each; JSON Schemas not read without a session (15 of 25). llms.txt (10). Every tool has a one-line purpose and a Read, Sensitive execution or Write class (15 of 20). Inputs not verifiable (5 of 15). Example prompts and a documented 'workspace_id is required' error (6 of 15). Versioned in the registry (0.43.1, 6 November) and dated release notes (15). 15 + 10 + 15 + 5 + 6 + 15 = 66.

Matomo 79

Matomo 5.14.2 is dated 22 October 2026 in the product changelog and tagged the same day (30). Stable releases from 6 August are 5.13.0 (17 August), 5.14.0 (22 September), 5.14.1 (dated 4 October, tagged 5 October) and 5.14.2, with 6.0.0 betas and 6.0.0-rc1 (30 October) as pre-releases (20). 34 commits reached the 6.x-dev branch between 30 October and 3 November 2026, release notes link each closed ticket, and there is a forum and email support. Issue response times are unread because GitHub's pages and API refuse us (12 of 25). Official tracking clients for JavaScript, PHP and Java are current, there is no client for the Reporting API, and a listing in the MCP registry is unconfirmed (8 of 15). Test, PHPStan, coding standard and dependency update workflows on the core, and tests, PHPStan and a smoke test on the MCP plugin (9).

RudderStack MCP 85

Release notes dated 4 November 2026 and a registry version on 6 November (30). Many dated releases in 90 days (20). Public issue templates on the MCP repository, issues not read, plus release notes (10 of 25). Official registry entry io.github.rudderlabs/rudderstack-mcp and current official SDKs (15). A repository workflow publishes to the registry (10). 30 + 20 + 10 + 15 + 10 = 85. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.