neckbeard vs Netlify API + MCP

neckbeard 52

Apache-2.0 in LICENSE and plugin.json (30). No privacy statement. The README says secret values never pass through neckbeard, its state or git history, and the source we read has no telemetry. What estimate sends to Infracost's pricing service is not described (15 of 30). DESIGN.md section 6.3 commits the catalogue to stable input schemas and resource addresses within a major version, with a migration path for a major, and allows planner default changes before 1.0 with migration notes. No dated deprecation notices (8 of 20). No telemetry found, and the docs don't address it (10 of 20). Total 63.

Netlify API + MCP 81

The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc. (25 of 30). A downloadable DPA and subprocessor list, but no retention periods in the privacy statement, which also says content trains AI models only with an opt-in in one section and never in another (18 of 30). Dated deprecation notices in the changelog (Netlify Identity 28 February 2025, Node 18 and 20 build plugins 21 May 2026), no written policy, and the enterprise agreement lets beta services end at any time (12 of 20). Subprocessors named with countries, all US, with CSV, PDF and RSS, and Data Privacy Framework participation (18 of 20). 25 + 18 + 12 + 18 = 73.

neckbeard 68

v0.3.0 on 15 October 2026 is the newest stable release, 18 days old on 2 November, and the pre-release v0.4.0-beta.1 with catalog-v0.4.1 followed on 26 October (30). v0.1.0 (commit of 11 September), v0.2.0 and v0.2.1 (14 October), v0.3.0 (15 October) and v0.4.0-beta.1 (26 October) inside 90 days, plus catalogue tags (20). GitHub's issue and pull request pages couldn't be read. The author answered about 20 comments on the Hacker News thread on 14 and 15 October, and pull requests from two other accounts were merged on 12 September, 15 October, 20 October (the Disco target, the first outside contribution) and 21 October (10 of 25). Not an MCP server and no SDK, and the plugin is in its own marketplace, not an official one (0). Dependabot runs weekly on actions and Go modules, actions are pinned by SHA and CI runs on every push. CI status unread (8 of 10). Total 68.

Netlify API + MCP 87

@netlify/mcp 1.21.0 tagged on 26 October 2026 (changelog 23 October), a commit on 28 October, the spec at 2.63.1 and changelog entries to 26 October (30). Six MCP tags between 25 September and 26 October 2026 (20). Issue and pull request responsiveness could not be read (github.com refuses our reader and the API answered empty), while the changelog, the answers.netlify.com forum, Discord and a support hub exist and the MCP changelog cites numbered pull requests (12 of 25). Current official SDKs, a Go client, a JS client and netlify-cli 27.16.2, though the server card names com.netlify/mcp and no such entry is in the official MCP registry (15). CI runs typecheck, build and 31 tests on pinned actions, releases through release-please with npm provenance, and the server runs on @modelcontextprotocol/server 2.2.0 (10). 30 + 20 + 12 + 15 + 10 = 87.

neckbeard 53

Read with the local-software lines, since the owner runs the plugin and the CLI. The project is about six weeks old (first commit 8 September 2026) and was launched on Hacker News on 14 October. The Go module is on pkg.go.dev and the plugin's installer fetches a checksummed release binary for Linux or macOS, falling back to go install. The Go version is stated only in go.mod (1.27.1), and the release assets themselves couldn't be seen (17 of 20). A public test workflow runs gofmt, go vet, go test, the plugin and installer checks and a six-lane plan, scaffold and validate matrix on every pull request and push to main. We couldn't see whether main passes (20 of 25). GitHub's issue pages couldn't be read, so there is no readable record of open bugs. INSTALL.md no longer links issue #27 (it now cites a pairing trial that passed on 21 October), and the beta notes name open issues #28 and #44 (10 of 25). Semantic version tags and a written semver contract for the catalogue, but no changelog file, and the plugin-first change in 0.2.0 was not marked as breaking (6 of 15). The README still calls it pre-alpha. v0.3.0 is the stable release and v0.4.0-beta.1 (26 October 2026) a pre-release (0). Total 53.

Netlify API + MCP 67

Read with the hosted lines. Statuspage at netlifystatus.com with component history and an Atom feed (20). From 5 August to 3 November 2026 the feed lists 19 incidents and no maintenance. None names the API or the MCP server. Errors reaching hosted sites and the Netlify application for about 85 minutes on 21 September read as one major outage; errors on the edge network for 55 minutes on 5 October, CDN DNS errors for 34 minutes on 24 September, 6 minutes of 500s on 18 August, and build, Agent Runner, AI Gateway and log-delay incidents read as minor (10 of 30). Limits are published with numbers, about 500 requests a minute, 3 deploys a minute and 100 a day, with X-RateLimit headers (15). The docs say retrying a timed-out upload is safe and give the reset header, but no backoff guidance, no idempotency key for deploys or site creation, and 429 appears in the spec only on agent runner endpoints (7 of 15). A 99.99 per cent SLA is named for Enterprise on the pricing page, with its terms in order forms (5 of 10). The API is generally available (10). 20 + 10 + 15 + 7 + 5 + 10 = 67.

neckbeard 68

Read with the framework lines, as for other local agent tools, since neckbeard holds no secret of its own. Analysis, planning, scaffolding and validation need no cloud credentials, and the skill and README say the agent never gets them. Generated pipelines use OIDC federation with no static keys, and a test fails if a rendered pipeline mentions AWS_SECRET_ACCESS_KEY. No telemetry found in the source. estimate relies on Infracost's Cloud Pricing API, and the experimental release commands can run with operator credentials from a workstation (25 of 30). Generated pipelines plan under a read-only identity and apply on main under a write identity, with production behind environment protection. foundation-apply refuses updates, replacements and deletes after a person reviews the saved plan (17 of 20). The agent reads the user's own repository. No guidance on untrusted content in it, beyond never transcribing secret values (8 of 15). The blueprint is a hash-verified lockfile, release receipts are committed to the repository, and validation reports each check. No log of agent actions (9 of 15). SECURITY.md with GitHub private vulnerability reporting and a stated scope, no staffed response time and no bug bounty. OSV holds no advisory for the module, and neckbeard.sh serves no security.txt. Actions pinned by commit SHA, a fork-safety CI job and a checksum-checked installer (9 of 20). Total 68.

Netlify API + MCP 59

Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59.

neckbeard 60

No payment protocol (0). Read with the self-hosted rule. Free under Apache-2.0 with nothing to buy (20). No card or account for the plugin (20). Installs from the plugin marketplace or go install with no signup (20). Estimates need a person to sign in to Infracost, which is outside the product and not deducted. Total 60.

Netlify API + MCP 55

No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). netlify deploy --allow-anonymous publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55.