# Matomo vs RudderStack MCP (slim)

> Matomo scores 61.7 (C) to RudderStack MCP's 54.7 (C) for analytics queries. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/matomo-vs-rudderstack-mcp.md (~5,050 tokens) · this version ~2,980 tokens · JSON https://www.anchorterminal.com/compare/matomo-vs-rudderstack-mcp.json · canonical https://www.anchorterminal.com/compare/matomo-vs-rudderstack-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Matomo scores 61.7 (C) on agent readiness against RudderStack MCP's 54.7 (C), and leads in 4 of 7 scored categories. RudderStack MCP leads on reliability and maintenance & community. Both do analytics queries.

- Matomo: C 61.7, rank #597 of 1510 · https://www.anchorterminal.com/tools/matomo.min.md
- RudderStack MCP: C 54.7, rank #901 of 1510 · https://www.anchorterminal.com/tools/rudderstack-mcp.min.md
- Matomo, good for Teams that want web and product analytics with data kept in the EU or on their own servers, queried by report, segment, funnel or cohort. Ahead on Schema & documentation, 73 against 66; Agent ergonomics, 78 against 52; Security & auth, 71 against 62; Transparency & trust, 74 against 51. Also Free to start without a card; Open source.
- RudderStack MCP, good for Data teams on RudderStack who want an agent to find why events, syncs or transformations failed and fix the configuration. Ahead on Reliability, 45 against 38; Maintenance & community, 85 against 79. Also A hosted endpoint, with nothing to install.

| Category | Matomo | RudderStack MCP |
| --- | --- | --- |
| Reliability (16%) | 38 | 45 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 73 | 66 |
| Agent ergonomics (13%) | 78 | 52 |
| Security & auth (14%) | 71 | 62 |
| Payments & pricing (10%) | 30 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 79 | 85 |
| Transparency & trust (7%) | 74 | 51 |

| Fact (where they differ) | Matomo | RudderStack MCP |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | InnoCraft Limited | RudderStack, Inc. |
| Hosted endpoint | no (local only) | `https://mcp.rudderstack.com/mcp` |
| Transports | HTTP, Streamable HTTP | Streamable HTTP |
| Auth | OAuth or key | OAuth |
| Pricing | Paid | Freemium |
| Licence | Matomo core is GPL-3.0-or-later and the MCP server plugin is GPL v3 or later. Matomo Cloud is a hosted service under InnoCraft's terms. Paid On-Premise plugins fall under the InnoCraft EULA | Proprietary service. The repository's MIT licence covers docs and metadata only |
| Tools exposed | 19 | 62 |
| llms.txt | no | yes |
| MCP registry | not listed | `io.github.rudderlabs/rudderstack-mcp` |
| Last release | 2026-10-22 | none |
| Terms last updated | 2025-04-10 | not read yet |
| Privacy policy last updated | 2026-05-05 | not read yet |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | yes | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Agent reviews | 3.3/5 (4) | none |

Why the edge:
- Agent ergonomics, Matomo +26: Matomo 78 (The MCP server has 19 tools, 12 of them visible by default (15), plus 6 because the seven raw API tools stay hidden until an administrator allows them by read, create, update or delete class (21). `filter_limit`, `filter_offset`, sorting, pattern filters, `showColumns` and segments on the API, and cursors with a 250-row cap on the MCP report tool (20). Errors are HTTP codes with a message and an optional integer code, with no code catalogue. The MCP server separates schema failures (-32602) from tool result errors that name the arguments involved (14). Every MCP tool carries readOnlyHint, destructiveHint and idempotentHint. API writes have no idempotency keys and the OpenAPI descriptions declare delete methods as GET (13). Report calls need only `idSite`, `period` and `date`. The official clients for JavaScript, PHP and Java cover tracking, not the Reporting API (10).); RudderStack MCP 52 (62 tools (5), plus a separately controlled read-only web surface (5). Filters on some list tools, not documented generally (8 of 20). One documented error (5 of 20). Read, Sensitive execution and Write classes, with Write tools to be confirmed by the client; annotations not read (14 of 20). One URL with OAuth and RudderStack SDKs in many languages (15). 10 + 8 + 5 + 14 + 15 = 52.)
- Transparency & trust, Matomo +23: Matomo 74 (The core and the MCP plugin are GPL v3 or later. Matomo Cloud is a hosted service under terms, and paid On-Premise plugins fall under the InnoCraft EULA (22 of 30). The Cloud terms, DPA and privacy policy agree. Customer data is deleted 30 days after termination, with residual account information in backups and logs for up to 60 days, raw data is kept 24 months on the Business plan, and the customer owns its data. The privacy policy gives no period for account data (25). The developer changelog lists deprecations with the major version that removes them and no dates. The terms allow changes with or without notice and promise notice of significant permanent ones (12 of 20). The sub-processor list, last updated 9 October 2025, names AWS in Frankfurt and Dublin, an AWS management firm in the Netherlands and a monitoring firm in Germany (18).); RudderStack MCP 51 (The server's source is closed; the repository's MIT licence covers only its docs and metadata. Terms in a master service agreement naming RudderStack, Inc. (15). Privacy policy read, retention given by purpose, not as periods (12 of 30). No deprecation policy for the MCP server (5 of 20). Subprocessors not found in the pages read (5 of 20). The MCP docs say live events, schemas, profile artifacts, transformation code and audit data stay within the workspace view. 15 + 12 + 5 + 5 = 37.)
- Security & auth, Matomo +9: Matomo 71 (OAuth 2.0 plugin with authorisation code and PKCE, client credentials and refresh grants, four scopes with one a token, and client pause and secret rotation. `token_auth` tokens are revocable with an expiry date and a POST-only option, and gain an access level in Matomo 6 (26 of 30). Less 10 because the API docs present `token_auth` as a URL parameter (16). View-level users and scopes, MCP disabled by default, raw API tools off by default with per-class switches and a privilege cap. No confirmation step in the server (16 of 20). Matomo publishes prompt-injection guidance for analytics data with risk levels, and MCP errors do not echo supplied values. No filtering of tool output was found (11 of 15). Activity Log is listed for Cloud, the DPA describes authentication and change logs, and MCP tool-call logging is off by default (11). HackerOne bounty up to $13,000, a disclosure policy, ISO/IEC 27001:2022 certification stated, security fixes noted in release notes. No security.txt (17).); RudderStack MCP 62 (OAuth with PKCE and dynamic registration, scopes not published (22 of 30). Access classes, a read-only surface and confirmation advice for writes (16 of 20). Selected sensitive fields in event payloads and errors are redacted or hashed before they reach the model, but event payloads are still untrusted text (8 of 15). No audit log of MCP calls found (0). SOC 2 Type 2, HIPAA with a BAA, and a SECURITY.md with a private reporting address; no security.txt (404) (16 of 20). 22 + 16 + 8 + 0 + 16 = 62.)
- Reliability, RudderStack MCP +7: Matomo 38 (Graded on the hosted lines, for a Matomo Cloud instance reached through the Reporting HTTP API and the MCP server included with Cloud. status.matomo.cloud is the listed public status page, credited on its existence as for the Zoho status hosts and fireflies (20). On 4 November its robots.txt answered with an access-denied error page, so the page wasn't read again and the 9 October component and feed readings are struck. No 90-day incident record could be read then or now (5). No API rate limit numbers were found. The terms reserve suspension for excessively frequent requests, and `API.getBulkRequest` is capped at 50 URLs for anonymous callers (3 of 15). No 429 or retry guidance and no idempotency keys were found (0). No SLA for Cloud was found, and the terms supply the service as is (0). The Reporting API and MCP plugin 5.1.1 are stable releases (10).); RudderStack MCP 45 (Statuspage at status.rudderstack.com with regional components and none for MCP (15). Since August the history shows an EU ingestion issue, increased US latency, a Python transformations issue, free-tier processing delays and scheduled maintenance (20, minor incidents). No MCP rate limits found (0). No retry guidance for the MCP server found (0). No SLA found in the pages read (0). Not labelled beta (10). 15 + 20 + 0 + 0 + 0 + 10 = 45.)
- Schema & documentation, Matomo +7: Matomo 73 (Each of the 72 module pages in the API reference embeds an OpenAPI 3.1 description, and every MCP tool has a typed JSON Schema input. No single downloadable file was found and 200 responses carry only a description (20 of 25). developer.matomo.org/llms.txt still answers 404 on 4 November, and matomo.org/llms.txt did on 9 October. The docs source is Markdown in a public repository (2). MCP tool descriptions state when to use the tool, its purpose and the next step, and API operations have one-line descriptions with described parameters (16). API parameters are typed with enums for `period` and `format`, and MCP inputs carry minimums, maximums and enums, while `steps` arrays, `apiParameters` and the raw API tools take open objects (10). Parameters carry example values, test requests run against a public demo, and errors are declared as 400, 401, 403, 404 and 500 with a result and message (10). Docs are versioned 4.x, 5.x and 6.x, with a developer changelog per release (15).); RudderStack MCP 66 (The public repository's docs/tools.md lists 62 tools with an access class for each; JSON Schemas not read without a session (15 of 25). llms.txt (10). Every tool has a one-line purpose and a Read, Sensitive execution or Write class (15 of 20). Inputs not verifiable (5 of 15). Example prompts and a documented 'workspace_id is required' error (6 of 15). Versioned in the registry (0.43.1, 6 November) and dated release notes (15). 15 + 10 + 15 + 5 + 6 + 15 = 66.)
- Maintenance & community, RudderStack MCP +6: Matomo 79 (Matomo 5.14.2 is dated 22 October 2026 in the product changelog and tagged the same day (30). Stable releases from 6 August are 5.13.0 (17 August), 5.14.0 (22 September), 5.14.1 (dated 4 October, tagged 5 October) and 5.14.2, with 6.0.0 betas and 6.0.0-rc1 (30 October) as pre-releases (20). 34 commits reached the 6.x-dev branch between 30 October and 3 November 2026, release notes link each closed ticket, and there is a forum and email support. Issue response times are unread because GitHub's pages and API refuse us (12 of 25). Official tracking clients for JavaScript, PHP and Java are current, there is no client for the Reporting API, and a listing in the MCP registry is unconfirmed (8 of 15). Test, PHPStan, coding standard and dependency update workflows on the core, and tests, PHPStan and a smoke test on the MCP plugin (9).); RudderStack MCP 85 (Release notes dated 4 November 2026 and a registry version on 6 November (30). Many dated releases in 90 days (20). Public issue templates on the MCP repository, issues not read, plus release notes (10 of 25). Official registry entry io.github.rudderlabs/rudderstack-mcp and current official SDKs (15). A repository workflow publishes to the registry (10). 30 + 20 + 10 + 15 + 10 = 85. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.)