Mostly Good Metrics vs Optimizely Experimentation

Mostly Good Metrics 29

Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.

Optimizely Experimentation 83

Graded on the hosted service with the hosted lines. Statuspage at status.optimizely.com with 174 components, among them Optimizely REST API, Results API, Events API, Snippet Delivery and Snippet Building for Feature and Web Experimentation (20). From 4 August to 2 November 2026 its history shows three incidents that reach Experimentation, all minor. On 25 August a provider's network fault degraded service for a subset of customers in Southeast Asia (05:15 to 07:37 UTC). On 17 September Optimizely Identity sent users to the wrong SSO page for about 3 minutes, which touches the sign-in the MCP server uses. On 15 October snippet publishing for Web Experimentation was delayed for some customers while existing experiences kept serving. The 23 July Okta sign-in incident has left the window (20 of 30). The Feature Experimentation API is limited to 2 requests a second and 120 a minute, the Optimizely API to 100 a minute and the results endpoints to 20 a minute. No limit was found for the MCP server (13 of 15). The API conventions page documents 429 - Too Many Requests with X-RATELIMIT-LIMIT, X-RATELIMIT-REMAINING and X-RATELIMIT-RESET on every response and says to wait for the reset, but no idempotency key or safe-retry guidance for writes was found (10 of 15). The Service Level Agreement V 2024-05 gives credits from 10 per cent once downtime passes 43 minutes in a month, capped at 50 per cent (10). The REST APIs are versioned and the MCP pages carry no beta label (10). 20 + 20 + 13 + 10 + 10 + 10 = 83.

Mostly Good Metrics 33

OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.

Optimizely Experimentation 66

The MCP server uses OAuth 2.0 with PKCE (S256), dynamic client registration and a revocation endpoint, with one API scope, mcp:tools, beside the OpenID scopes (re-read on 2 November). REST personal access tokens are revocable, named and sent in a header, and administrators can revoke any collaborator's token. The REST OAuth flow has the single scope all, described as full access to the account (22 of 30). Sessions and tokens carry the user's role, Feature Experimentation has granular roles for flags, environments and audiences, and change approvals have routed flag changes to reviewers since 6 August 2026. No read-only mode for the MCP server was found, and confirmation before a write is left to the client (13 of 20). No guidance on prompt injection was found, though tools return names, descriptions and hypotheses that people wrote (3 of 15). Change history for projects and flags is in the application, at /v2/changes and in webhooks (12 of 15). ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2 and PCI DSS are stated for Web and Feature Experimentation, with annual penetration tests and a bug bounty programme reachable at securityeng@optimizely.com. No security.txt and no public programme link (16 of 20).

Mostly Good Metrics 30

No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.

Optimizely Experimentation 0

No x402, MPP or L402 (0). No price is published. The plans page says every plan is individually packaged and leads to a demo request (0). No free plan or trial was found on the plans page, the product pages or the docs (0). Access needs a subscription and a browser sign-in through Opti ID (0).

Mostly Good Metrics 45

The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.

Optimizely Experimentation 75

Closed hosted service under a published Online Software Subscription Agreement and API, SDK and MCP terms. The SDKs are open source under Apache 2.0 (17 of 30). The privacy notice of 1 July 2026 says it does not cover customer data and points to the subscription agreement and the Data Processing Agreement (V 2026-01), which agree. Event data is kept 18 months, and customer data may be deleted 30 days after a subscription ends. How the MCP server and Opal handle prompts for Experimentation is not stated on the MCP pages (22 of 30). The API, SDK and MCP terms let Optimizely revise, suspend or cancel any API or MCP at any time under its documentation and policies. An SDK compatibility matrix exists. No deprecation policy with a notice period was found for the APIs (6 of 20). The sub-processor list, updated 14 September 2026, names providers by product with hosting locations. Web and Feature Experimentation list Amazon Web Services in the United States and Google Cloud in the United States and Europe (18 of 20).

Mostly Good Metrics 49

No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.

Optimizely Experimentation 76

The Swagger 2.0 file for the Optimizely API sits at api.optimizely.com, whose robots.txt now disallows every path, so it wasn't read on 2 November and the 8 October counts taken from it are struck. Each reference page on docs.optimizely.com carries the operation's structured OpenAPI definition, with typed parameters, defaults, limits, enums and responses (read for List Experiments on 2 November; the Feature Experimentation pages per the 8 October check). We could not read the MCP tool schemas, which need a sign-in (20 of 25). llms.txt and a Markdown copy of every docs page (10). Reference pages describe each operation's purpose. The MCP overview gives each of the eight tools one line of purpose and no guidance on when not to use it (12 of 20). Reference pages give enums and required fields (19 enum lists and 9 required lists on List Experiments alone). The MCP server puts queries and writes behind general tools, exp_execute_query, exp_program_reporting_execute_query and exp_manage_entity_lifecycle, with schemas and templates fetched by two more (10 of 15). Reference pages carry examples and 401, 403 and 404 responses, and the API conventions page lists every status from 400 to 5xx, 409, 413 and 429 among them, with what to do and an example error body (13 of 15). Versions are in the path (/v2, /flags/v1) and each product has dated release notes with an RSS feed. No changelog for the APIs alone was found (11 of 15). 20 + 10 + 12 + 10 + 13 + 11 = 76.

Mostly Good Metrics 49

53 tools, more than 30 (5). We added 3 because Goals and Alerts tools load only where enabled and query_metrics batches up to 10 queries (8 of 25). Date ranges, grouping and filters on queries; no documented page or limit parameters for lists (12 of 20). JSON errors with a message, and per-item status in batch results (13 of 20). Annotations weren't readable without a session, the tool list includes deletes and key revocation, and no idempotency keys were found (4 of 20). Five client SDKs and a CLI with --json output (12 of 15). 8+12+13+4+12 = 49.

Optimizely Experimentation 68

The MCP server lists eight tools since exp_program_reporting_execute_query was added on 13 October 2026, which is 25 on the checklist. We took 2 off because the tool definitions were unread and their size is unknown (23 of 25). per_page up to 100 and page on the v2 lists, page_token, sort and query on the flags list, and time windows on results (17 of 20). The Optimizely API returns code, message and a uuid, and the Feature Experimentation API returns a problem detail object. MCP error results were unread (13 of 20). No idempotency keys were found and the tool annotations were unread. The docs say the agent confirms project, environment and details before a change, which is client behaviour, and entities are archived through the lifecycle tool (5 of 20). The MCP server needs only a URL. The official SDKs in eleven languages evaluate flags and log events and do not cover the management APIs (10 of 15).