Mostly Good Metrics vs Pendo

Mostly Good Metrics 45

The service is closed; the SDKs and CLI are MIT. Terms of December 2025 with no legal entity named (18 of 30). The privacy policy and terms agree on raw-event retention for the subscription's life and deletion within 14 days of account deletion; the about page says data is not used to train models. No DPA was found (18 of 30). The legacy X-MGM-Key header is still supported, and no deprecation policy was found (3 of 20). The terms name eight sub-processors with their purpose, without data locations (12 of 20). 18+18+3+12 = 51.

Pendo 77

Closed service with a published Software Services Agreement, dated August 2022 on the page, which points to the contract centre for current terms (15 of 30). Privacy policy effective 4 November 2024, a DPA updated 24 February 2025, raw event retention of 7 years adjustable from 1 to 84 months, and an AI article stating that providers keep data for essentially zero days. These agree with each other, per the 7 October check (22 of 30). The October 2026 release notes announce listCountables renamed to listPagesFeaturesAndEvents, with the old name kept as a deprecated alias. A dated notice with no stated period takes 15, as settled in this run (15 of 20). Five data regions and the AI providers are named (Azure OpenAI, OpenAI, Amazon Bedrock, Google Gemini), but the sub-processor list sits on a Trust Centre page that we couldn't read (12 of 20). 15+22+15+12 = 64.

Mostly Good Metrics 33

OAuth 2.0 with PKCE, dynamic client registration and a revocation endpoint for MCP and the CLI; project ingest keys in a Bearer header that can be pinned to origins or app IDs. The only tool scope advertised is mcp:tools, so a connection gets every tool the user can use (24 of 30). Restricted keys and a confirmation step for unrestricted keys in the CLI; no read-only MCP mode or approval for deletes was found (6 of 20). Event properties come from apps and end users and reach the agent, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). No security.txt, disclosure policy or certification was found (0). 24+6+3+0+0 = 33.

Pendo 58

OAuth with PKCE S256, dynamic client registration and client ID metadata documents, scopes limited to mcp:tools and mcp:resources, service accounts limited to chosen applications with rotation and 60-minute tokens, and integration keys that are read-only or read-write with no stated expiry (26 of 30). Read-only tools by default, write tools an admin opt-in after read-only tools, calls inherit the user's permissions, and Command Centre changes need confirmation, though guideSetState can publish a guide (16 of 20). Tools return end-user text such as feedback and agent conversations, and the only guidance found warns against using a service account where end users submit queries (3 of 15). No audit log of MCP or API calls found in the reviewed documentation (0 of 15). Yearly SOC 2 Type II, penetration tests twice a year and a security@pendo.io address, per the 7 October check, with no security.txt (404 on 4 November) or bug bounty found (13 of 20). 26+16+3+0+13 = 58.

Mostly Good Metrics 30

No x402, MPP or L402 (0). Plan prices with event allowances are on the home page; no per-event price (10). Free plan with no card, stated on the home and about pages (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.

Pendo 5

No x402, MPP or L402 (0). Paid plans are priced on request, and the only published plan is Free (0). Pendo Free needs no card but excludes the API and integrations, and the MCP server is for paid customers, so the free plan doesn't reach the graded surface. The 30-day trial goes through sales (5 of 20). An admin must sign in and enable access in a browser (0). Total 5.

Mostly Good Metrics 29

Graded on the hosted service with the hosted lines. No status page was found (0) and no incident history could be read (5). Ingestion limits are documented per plan (1,000 to 100,000 events a minute and 10,000 to 1,000,000 an hour), but no limit for MCP or query calls was found (12 of 15). 429 with Retry-After in the header and body, and the SDKs queue events and back off. No idempotency or safe-retry guidance for writes (12 of 15). No SLA (0). The press kit calls the product a public beta (0). 0+5+12+12+0+0 = 29.

Pendo 50

Graded as a hosted service on the MCP server and the Engage API. Statuspage site with API and MCP components in each of five regional environments, read from the page on 4 November (20). The incident feed lists six incidents from 6 August to 4 November 2026, each scoped to a subset of users, one region or one function. They are intermittent sign-outs for some US users (2 September), latency in the US region affecting login, guide delivery and event processing (14 September), guide targeting for a subset of US visitors (21 September), mobile pairing (1 October), authentication errors on new MCP connections for some customers from 16:49 on 1 October to 05:19 on 2 October, with existing connections unaffected, and Account and Visitor reports failing to load (4 November). All partial, so minor only (20). No request rate limits found for the API or the MCP server (0). The earlier 429 reading came from the Engage API's Postman collection, which the documentation page loads by script and this run doesn't read, and no 429 or retry guidance was found on the readable pages (0). No SLA found on the public legal pages, and the contract centre wasn't read (0). The MCP server has been generally available since April 2026 (10). 20+20+0+0+0+10 = 50.

Mostly Good Metrics 49

No OpenAPI file was found. The docs say every MCP tool describes its own parameters, and the query definition object is documented in full; we didn't open an MCP session to read the schemas (12 of 25). No llms.txt (404) and no Markdown pages served for agents (0). Each tool area is documented with examples, and the docs say when to use query_metrics instead of repeated execute_query calls (10 of 20). The query definition lists metrics, dimensions, date ranges and filter operators (9 of 15). The ingestion API documents its error body and status codes, and query_metrics reports per-item errors (11 of 15). /v1 and /api/v2 paths and dated SDK tags, but no product changelog (7 of 15). 12+0+10+9+11+7 = 49.

Pendo 28

No machine-readable contract can be read. The Engage API's Postman collection is fetched by the documentation page's script with only a Run in Postman button, so it isn't a published contract under this run's reading, and the MCP input schemas need a paid subscription (0 of 25). www.pendo.io/llms.txt exists but is marketing copy with a section telling AI assistants when to recommend Pendo, and no Markdown docs were found (3 of 10). The MCP tools reference (updated 3 November 2026) gives each of 96 tools a purpose, example prompts and limits, and some entries say when to use another tool. Per-request API descriptions are no longer counted (12 of 20). No typed input schema or attribute table can be read. The tools reference states required IDs and some valid values in prose only (0 of 15). Example prompts for every tool and help articles for the 400 and timeout errors, with the collection's saved responses and status table no longer counted (5 of 15). The API path is v1 and the MCP path v0, with monthly release notes but no API changelog (8 of 15). 0+3+12+0+5+8 = 28.

Mostly Good Metrics 74

CLI v0.1.4 was tagged on 16 October 2026 (30). The JavaScript SDK released 0.12.0, 0.13.0 and 0.13.1 between 5 September and 2 October, and the Swift SDK 1.0.0 and 1.0.1 on 2 October (20). A closed service with no public changelog, support by email and GitHub repositories for the SDKs; issue activity wasn't read because the GitHub API refused us for its rate limit (6 of 25). Not in the official MCP registry; official SDKs in five languages are current (10 of 15). CI workflows on the SDK and CLI repositories (8 of 10). 30+20+6+10+8 = 74.

Pendo 60

The AI release notes (updated 3 November 2026) carry October 2026 entries for the MCP server, among them promoteDiscoveryApp, labels and assignees on Listen tools, resolveObjectInstance, and the rename of listCountables to listPagesFeaturesAndEvents. Entries are dated by month, counted from their month as settled in this run (30). Several MCP entries in September and October 2026 (20). Dated release notes, a community site and technical support, with no public issue tracker (10 of 25). Not checked in the official MCP registry, and no API client libraries, though the Claude Code plugin repository had its last commit on 30 October 2026 (6 of 15). The plugin repository is active, with 28 commits since 6 August, no tags and no CI workflow (4 of 10). 20+20+10+6+4 = 60.