Mixpanel vs OpenPanel

Mixpanel 70

OAuth authorisation code with PKCE, dynamic client registration and 24 scopes for MCP. Service accounts are revocable, take a project role and can expire. The legacy Project Secret, one key for a whole project, stays valid on older projects until 3 March 2027 (26 of 30). Consumer and Analyst roles, custom roles on Enterprise, scope subsets and an organisation switch for MCP limit access. The MCP docs describe no read-only mode and no confirmation before Delete-Dashboard, Delete-Cohort or bulk edits (11 of 20). Event properties and replay data reach the model. The docs warn that data goes to the AI provider and give no prompt-injection guidance (3 of 15). MCP writes are logged with an origin of MCP on all plans for 90 days, with an audit log API and streaming on Enterprise. Reads and failed calls aren't logged (12 of 15). SOC 2 Type II, ISO 27001 and ISO 27701, a security.txt valid to 18 May 2027 and a private HackerOne programme. We didn't search NVD (18 of 20).

OpenPanel 41

Client credentials with three types (write, read for one project, root for the organisation), created and deleted in the dashboard (25), less 10 because the docs give ?token= in the MCP URL as an option (15 of 30). Read clients are read-only and limited to one project, and onboarding creates a read-only MCP client. No approval step for root-client writes (14 of 20). Tools return event properties, page titles and profile data sent from tracked sites, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). SECURITY.md with a private advisory route and response times, a valid security.txt, and no bug bounty or certification found (9 of 20). 15+14+3+0+9 = 41.

Mixpanel 61

The MCP page names 64 tools, which is over 30 (5), with OAuth scope subsets and a Get-Query-Schema tool that keeps the query schema out of the tool list (5 back, 10 of 25). Query endpoints take date ranges, limit and where filters, and profile queries page with page and session_id. No field selection was found (16 of 20). /import with strict=1 returns the failing events with reasons, and the MCP server's 401 says how to recover. Query API errors aren't in the spec (12 of 20). $insert_id deduplicates imports. No idempotency key was found for management writes, and we couldn't read the MCP tools' readOnlyHint or destructiveHint (10 of 20). Tracking SDKs in 12 languages and a Python SDK and CLI for queries, which is pre-1.0. Every query needs a project ID and the right regional host (13 of 15).

OpenPanel 54

51 MCP tools, more than 30 (5). We added 3 because a read client doesn't get the 9 dashboard management tools (8 of 25). Insights endpoints take startDate, endDate, range, filters, cursor and limit (18 of 20). Errors aren't documented beyond 401 and 429 (12 of 20). No readOnlyHint or destructiveHint in the MCP source, no idempotency keys; delete_dashboard refuses a non-empty dashboard without forceDelete (3 of 20). Few required parameters, and SDKs for JavaScript, React, Next.js, Vue, React Native, Swift, Kotlin and Python (13 of 15). 8+18+12+3+13 = 54.

Mixpanel 65

Read with the hosted lines, on the Query API and the hosted MCP server. www.mixpanelstatus.com is a Statuspage site with 11 components by region (20). Its history feed lists five incidents between 4 August and 2 November 2026. The Query API failed for US projects for about 77 minutes on 26 August, 2:02 to 3:19 PM PT per the post-mortem, when query servers "across the region failed their health checks nearly simultaneously" and reports were unavailable, with EU and India projects unaffected. US is the default data residency. A core API down across one region for an hour or more reads as a regional major, as vapi's US calls outage and google-drive-api's did. The others were confined to one host, tool or a subset and read as minor. Ingestion was delayed for US projects on 8 October, requests to decide.mixpanel.com failed on 21 October with the regional API hosts as a workaround, the MCP Get-Report tool failed with skip_results false on 6 August, and property menus misbehaved on 19 August. One major outage (10). Limits have numbers, 60 queries an hour and five concurrent on the Query API and 600 MCP requests an hour per user (15). The import docs give exponential backoff with jitter from 2 seconds to 60 for 429, 502 and 503, and $insert_id makes import retries safe. No Retry-After header was found in the reviewed documentation (12 of 15). No uptime SLA was found. Section 9.4 of the terms says the service isn't warranted to be always available (0). The APIs and the MCP server are generally available, with service account sign-in for MCP, the experiment and flag tools and Get-Audit-Log in beta (8 of 10). 20 + 10 + 15 + 12 + 0 + 8 = 65.

OpenPanel 70

Graded on OpenPanel Cloud with the hosted lines. OpenStatus page at status.openpanel.dev with API and Tracker components (20). In the 90 days from 8 August, one incident, degraded API performance for about two hours on 1 October 2026, caused by Hetzner private-network problems reaching the ClickHouse servers (15 of 30). Limits are documented with numbers for MCP (60 a minute per client) and the Export, Insights and Manage APIs (15). The docs say a 429 is returned and to back off exponentially; no Retry-After or idempotency guidance (10 of 15). No SLA was found (0). Generally available (10). 20+15+15+10+0+10 = 70.