Mixpanel vs Mostly Good Metrics

Mixpanel 84

Closed service with public terms of use, last updated 2 June 2026. The SDKs are Apache-2.0 and Mixpanel Headless is MIT (16 of 30). The DPA of 2 June 2026 makes data available for 30 days after termination and then destroys it, and audit log retention is stated per plan. The privacy policy of 21 August 2026 covers only Mixpanel's own collection and names data centres in the US and EU, while the DPA adds India (24 of 30). Removals come with dated notices (Project Secret on 3 March 2027, TLS 1.0 and 1.1 in April 2026, US-to-EU forwarding in July 2026). No written policy with a minimum notice period was found (14 of 20). The sub-processor list, effective 21 October 2026, gives locations and names Anthropic, OpenAI and Google Vertex AI, with 30 days' notice of new sub-processors in the DPA (19 of 20).

Mostly Good Metrics 45

The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.

Mixpanel 70

OAuth authorisation code with PKCE, dynamic client registration and 24 scopes for MCP. Service accounts are revocable, take a project role and can expire. The legacy Project Secret, one key for a whole project, stays valid on older projects until 3 March 2027 (26 of 30). Consumer and Analyst roles, custom roles on Enterprise, scope subsets and an organisation switch for MCP limit access. The MCP docs describe no read-only mode and no confirmation before Delete-Dashboard, Delete-Cohort or bulk edits (11 of 20). Event properties and replay data reach the model. The docs warn that data goes to the AI provider and give no prompt-injection guidance (3 of 15). MCP writes are logged with an origin of MCP on all plans for 90 days, with an audit log API and streaming on Enterprise. Reads and failed calls aren't logged (12 of 15). SOC 2 Type II, ISO 27001 and ISO 27701, a security.txt valid to 18 May 2027 and a private HackerOne programme. We didn't search NVD (18 of 20).

Mostly Good Metrics 33

OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.

Mixpanel 65

Read with the hosted lines, on the Query API and the hosted MCP server. www.mixpanelstatus.com is a Statuspage site with 11 components by region (20). Its history feed lists five incidents between 4 August and 2 November 2026. The Query API failed for US projects for about 77 minutes on 26 August, 2:02 to 3:19 PM PT per the post-mortem, when query servers "across the region failed their health checks nearly simultaneously" and reports were unavailable, with EU and India projects unaffected. US is the default data residency. A core API down across one region for an hour or more reads as a regional major, as vapi's US calls outage and google-drive-api's did. The others were confined to one host, tool or a subset and read as minor. Ingestion was delayed for US projects on 8 October, requests to decide.mixpanel.com failed on 21 October with the regional API hosts as a workaround, the MCP Get-Report tool failed with skip_results false on 6 August, and property menus misbehaved on 19 August. One major outage (10). Limits have numbers, 60 queries an hour and five concurrent on the Query API and 600 MCP requests an hour per user (15). The import docs give exponential backoff with jitter from 2 seconds to 60 for 429, 502 and 503, and $insert_id makes import retries safe. No Retry-After header was found in the reviewed documentation (12 of 15). No uptime SLA was found. Section 9.4 of the terms says the service isn't warranted to be always available (0). The APIs and the MCP server are generally available, with service account sign-in for MCP, the experiment and flag tools and Get-Audit-Log in beta (8 of 10). 20 + 10 + 15 + 12 + 0 + 8 = 65.

Mostly Good Metrics 29

Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.

Mixpanel 79

14 OpenAPI 3.0 and 3.1 specs are public at docs.mixpanel.com/openapi/ with 106 operations. The MCP tool schemas sit behind sign-in, so the API carries this line (25). llms.txt with about 530 links, llms-full.txt, a Markdown copy of every page and a docs MCP server (10). All 106 operations carry a summary or description, and the MCP page gives each tool one line with no guidance on when not to use it (15 of 20). The specs hold about 250 enums, but Query API calls pass JSON-encoded strings and where expressions in query parameters and JQL takes a script (10 of 15). Examples are present, the ingestion spec documents 400, 401, 413 and 429, and the Query spec documents only a 200 on all 19 operations (9 of 15). The changelog is public and dated with 183 entries. The APIs carry no dated versions, with paths such as /api/2.0 and /v1 (10 of 15).

Mostly Good Metrics 49

No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.

Mixpanel 61

The MCP page names 64 tools, which is over 30 (5), with OAuth scope subsets and a Get-Query-Schema tool that keeps the query schema out of the tool list (5 back, 10 of 25). Query endpoints take date ranges, limit and where filters, and profile queries page with page and session_id. No field selection was found (16 of 20). /import with strict=1 returns the failing events with reasons, and the MCP server's 401 says how to recover. Query API errors aren't in the spec (12 of 20). $insert_id deduplicates imports. No idempotency key was found for management writes, and we couldn't read the MCP tools' readOnlyHint or destructiveHint (10 of 20). Tracking SDKs in 12 languages and a Python SDK and CLI for queries, which is pre-1.0. Every query needs a project ID and the right regional host (13 of 15).

Mostly Good Metrics 49

53 tools, more than 30 (5). We added 3 because Goals and Alerts tools load only where enabled and query_metrics batches up to 10 queries (8 of 25). Date ranges, grouping and filters on queries; no documented page or limit parameters for lists (12 of 20). JSON errors with a message, and per-item status in batch results (13 of 20). Annotations weren't readable without a session, the tool list includes deletes and key revocation, and no idempotency keys were found (4 of 20). Five client SDKs and a CLI with --json output (12 of 15). 8+12+13+4+12 = 49.

Mixpanel 37

Read with the hosted rubric. No x402, MPP or L402 (0). Prices are public without login. The docs give $0.00028 an event beyond the first 1M a month on the 1M Growth plan and the pricing page has a volume calculator. Enterprise is by quote, and the Query API limits on Free and Growth aren't given as figures (17 of 20). The Free plan covers 1M events a month with no card (20). A person signs up in a browser and approves OAuth or creates a service account. The MCP server supports dynamic client registration, but a user still signs in (0).

Mostly Good Metrics 30

No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.