{ "data": { "a": { "slug": "neckbeard", "name": "neckbeard", "vendor": "David Beale", "vendorUrl": "https://github.com/bealesh/neckbeard", "kind": "sdk", "category": "infrastructure", "summary": "neckbeard is an open-source Claude Code plugin and Go CLI that maps an application onto a catalogue of OpenTofu modules for AWS, GCP or Azure, renders environments and CI pipelines deterministically, and estimates the monthly bill with Infracost.", "url": "https://www.anchorterminal.com/tools/neckbeard", "markdownUrl": "https://www.anchorterminal.com/tools/neckbeard.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/neckbeard.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/neckbeard.json", "dns": "neckbeard.grade.anchorterminal.com", "repo": "https://github.com/bealesh/neckbeard", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "go", "name": "github.com/bealesh/neckbeard" } ], "auth": "none", "authNotes": "No account or key for the plugin or the CLI. `analyze`, `plan`, `scaffold` and `validate` need no cloud credentials. `estimate` needs Infracost 0.10.x signed in with `infracost auth login`. Bootstrap and the experimental `release` commands use cloud credentials a person holds, and the generated pipelines use OIDC federation with no static keys.", "pricing": "free", "pricingNotes": "Free under Apache-2.0 with nothing to buy. Cost estimates need a signed-in Infracost 0.10.x CLI, and any infrastructure applied is billed by the cloud provider.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, the README or the skill (checked 2026-10-17). The tool has no paid tier.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-17" }, "docsUrl": "https://github.com/bealesh/neckbeard#readme", "capabilities": [ "infra.terraform", "infra.cloud", "infra.aws", "infra.azure" ], "tags": [ "open-source", "local", "free", "no-card", "apache-2.0", "go", "cli", "agent-skill", "terraform", "pre-1.0", "new" ], "lastRelease": "2026-10-15", "graded": true, "anchor": { "graded": true, "score": 62.2, "grade": "B", "agentReady": false, "rank": 511, "ranked": true, "rankOf": 1349, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 68, "payments": 60, "reliability": 53, "schema": 75, "security": 68, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -2, "negativeNotes": [ "2026-11-02. neckbeard.sh, the project site linked from the README and plugin.json, still presents the reference cost table ($77 a month on Cloud Run to about $801 on AKS) as \"live prices\", with no notice, while the README and the postmortem dated 22 October 2026 say those figures are withdrawn as undercounted. A claim the project itself has withdrawn, standing on one page, the minimum for a misleading claim, -2 (https://neckbeard.sh/; https://github.com/bealesh/neckbeard/blob/main/docs/findings/2026-10-22-cost-estimator-postmortem.md)" ], "verdict": "The agent maps an app onto human-maintained OpenTofu modules and a deterministic CLI renders them, so it writes no infrastructure by hand, and the cost table comes before any file is scaffolded. The project is pre-alpha with no changelog file, and its site still shows reference cost figures the project withdrew in October. Live deployment has passed on two paths.", "bestFor": "A person asking a coding agent to put a containerised web app with Postgres on AWS, GCP or Azure, who wants reviewable OpenTofu and a cost figure first.", "strengths": [ "The agent writes only an evidence-backed profile and config. Planning and rendering are deterministic Go from a pinned module catalogue", "Regeneration refuses to overwrite an edited file and writes a `.neckbeard-new` copy instead", "Generated pipelines use OIDC federation, and a test fails the build if one mentions `AWS_SECRET_ACCESS_KEY`", "`finops.monthly_ceiling` makes `scaffold` refuse while the estimated total is over the limit or no estimate exists", "Validation reports PASSED, FAILED or NOT EXERCISED per check and says static checks do not prove a deployment" ], "weaknesses": [ "Pre-alpha, with v0.3.0 the stable release, and the README marks GCP, GitLab, Kubernetes and promotion as not exercised live", "No changelog file. Release notes are generated by GitHub, and the move to a plugin layout in 0.2.0 was not marked as breaking", "The project withdrew its reference cost figures as undercounted in late October, yet neckbeard.sh still showed them as live prices on 2 November", "Estimates need the older Infracost 0.10.x CLI signed in to Infracost, and the tool refuses the current Homebrew formula", "One main maintainer, with SECURITY.md saying there is no staffed response time" ], "agentNotes": [ "Run `neckbeard doctor -for plan` first, and `-for estimate` before estimating, to see which tools are missing", "Answer every assumption in `app-profile.yaml` with a `confirmed` entry of the same id, since `plan` refuses while any stays open", "Never edit `blueprint.yaml`. Change the profile or `neckbeard.yaml` and run `neckbeard plan` again", "Show the person `costs/estimate.md`, its usage assumptions and its unpriced section before running `scaffold`, and treat the totals as estimates, not bills", "Hand bootstrap and any `release` step to the person holding cloud credentials. Never ask for secret values" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.2 } ], "editorialScores": { "ergonomics": 71, "maintenance": 68, "payments": 60, "reliability": 53, "schema": 75, "security": 68, "transparency": 63 }, "provenanceScore": 40, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "go install github.com/bealesh/neckbeard/cmd/neckbeard@latest \u0026\u0026 neckbeard skill install", "claudeCode": "/plugin marketplace add bealesh/neckbeard\n/plugin install neckbeard@neckbeard", "headless": { "analyze": "neckbeard analyze", "check": "neckbeard doctor -for all", "estimate": "neckbeard estimate", "plan": "neckbeard plan", "scaffold": "neckbeard scaffold", "validate": "neckbeard validate" } }, "letme": { "capability": "https://letme.dev/infra.terraform", "tool": "https://letme.dev/neckbeard" }, "area": "developer", "provenance": { "legalEntity": "David Beale (individual, GitHub account bealesh)", "domain": "neckbeard.sh", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-02", "notes": [ "Since 19 October the README and plugin.json link a project site at neckbeard.sh, a single page with a contact address at that domain. Its registration date was not read. 47 of 51 commits are by David Beale under the bealesh GitHub account, three come from the team-humaki account and one from Greg Sadetsky. The LICENSE file carries the Apache-2.0 text with no copyright line filled in.", "SECURITY.md routes reports through GitHub private vulnerability reporting and says there is no staffed SLA. neckbeard.sh answers 404 for /.well-known/security.txt. No terms or privacy policy.", "No changelog file. The release workflow publishes GitHub Releases with generated notes, which could not be read, and pre-release tags are published as GitHub pre-releases. A written note for v0.4.0-beta.1 sits in docs/releases.", "The software runs on the owner's machine, so there is no vendor endpoint or status page to check." ], "score": 40 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/neckbeard.json", "live": { "slug": "neckbeard", "versions": [ { "registry": "github", "name": "bealesh/neckbeard", "version": "v0.4.0-beta.1", "released": "2026-10-26", "seenAt": "2026-11-04T20:39:21.143082588Z" } ], "githubStars": 278, "securityTxt": { "url": "https://neckbeard.sh/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:12.108939842Z" }, "github": { "repo": "bealesh/neckbeard", "checkedAt": "2026-11-02T08:34:52.27670542Z", "stars": 276, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-26T21:13:49Z", "openIssues": 13, "openPRs": 3, "issuesOpened90d": 18, "issuesClosed90d": 5, "prsMerged90d": 31, "ci": { "branch": "main", "runs": 47, "success": 35, "failure": 12, "other": 0, "latest": "success", "latestAt": "2026-10-26T21:10:19Z" }, "replies": { "sampled": 15, "unanswered": 10, "medianDays": 6.2 } }, "updatedAt": "2026-11-04T20:39:21.143082588Z" } }, "answer": "Netlify API + MCP scores 69.4 (B) on agent readiness against neckbeard's 62.2 (B), and leads in 4 of 7 scored categories. neckbeard leads on security \u0026 auth and payments \u0026 pricing.", "b": { "slug": "netlify", "name": "Netlify API + MCP", "vendor": "Netlify, Inc.", "vendorUrl": "https://www.netlify.com", "kind": "http-api", "category": "infrastructure", "summary": "Netlify's platform for deploying and running web projects, reached through a REST API with a public OpenAPI spec, the netlify-cli command line tool and an official MCP server, hosted at netlify-mcp.netlify.app or run locally from npm.", "url": "https://www.anchorterminal.com/tools/netlify", "markdownUrl": "https://www.anchorterminal.com/tools/netlify.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/netlify.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/netlify.json", "dns": "netlify.grade.anchorterminal.com", "repo": "https://github.com/netlify/netlify-mcp", "license": "ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://api.netlify.com/api/v1", "packages": [ { "registry": "npm", "name": "@netlify/mcp" }, { "registry": "npm", "name": "netlify-cli" } ], "auth": "mixed", "authNotes": "Personal access tokens from Applications \u003e Personal access tokens, named, given an expiry date at creation and sent as `Authorization: Bearer`; no scopes are documented, SAML teams need an opt-in at creation, and a password reset invalidates every token. Public integrations use OAuth2 apps registered at app.netlify.com/applications (the spec declares an implicit flow with no scopes). The CLI stores a token from `netlify login` in config.json or reads `NETLIFY_AUTH_TOKEN`. The hosted MCP server signs in with OAuth 2.1 (PKCE, dynamic client registration) and advertises the scopes offline_access, read, write and claudeai; the local server reads the CLI's token or `NETLIFY_PERSONAL_ACCESS_TOKEN`.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 300 credits a month, deploys from the API, functions, Blobs, Database and custom domains. Personal $9 a month with 1,000 credits, Pro $20 a month with unlimited members and 3,000 credits, Enterprise custom with a 99.99 per cent SLA. Usage is metered in credits, about $0.00667 each at the Pro pack rate (1,500 for $10; Personal 500 for $5). A production deploy is 15 credits, bandwidth 20 a GB, compute 10 a GB-hour and web requests 2 per 10,000. Whether a card is needed is not stated. `netlify deploy --allow-anonymous` publishes without an account, to be claimed within an hour.", "priceSummary": "$9 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the OpenAPI spec (no 402 response), the API guide, the MCP source or the pricing page (checked 2026-11-03).", "endpoints": [] }, "toolCount": 11, "popularity": { "githubStars": null, "npmWeekly": 58373, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.netlify.com/api-and-cli-guides/api-guides/get-started-with-api/", "llmsTxt": "https://docs.netlify.com/llms.txt", "openapi": "https://raw.githubusercontent.com/netlify/open-api/master/swagger.yml", "capabilities": [ "infra.cloud", "code.deploy", "observability.logs" ], "tags": [ "hosted", "freemium", "free-tier", "mcp", "remote-mcp", "cli", "oauth", "pat", "llms-txt", "openapi", "status-page", "bug-bounty", "soc2", "iso27001", "sla", "typescript", "go", "agent-skills", "enterprise" ], "lastRelease": "2026-10-26", "graded": true, "anchor": { "graded": true, "score": 69.4, "grade": "B", "agentReady": false, "rank": 226, "ranked": true, "rankOf": 1349, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 87, "payments": 55, "reliability": 67, "schema": 79, "security": 59, "transparency": 81 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November.", "bestFor": "An agent that builds and deploys web projects, sets environment variables and reads forms or logs on a team's Netlify account, including with no account through anonymous deploys.", "strengths": [ "OpenAPI spec (Swagger 2.0, version 2.63.1) with 188 operations, llms.txt and a Markdown twin of every docs page", "Rate limits published (500 a minute, 3 deploys a minute, 100 a day) with X-RateLimit headers on every response", "`netlify deploy --allow-anonymous` publishes a project without an account, claimable within an hour", "MCP server with OAuth 2.1 and PKCE, every tool hint declared since v1.18.0 (7 October 2026), and six tagged releases between 25 September and 26 October", "Public HackerOne bug bounty, SOC 2 Type II, ISO 27001 and 27018, and a trust centre with a downloadable DPA and subprocessor list" ], "weaknesses": [ "Personal access tokens and OAuth apps have no scopes, so a token reaches every team its owner belongs to", "The hosted MCP server advertises read and write scopes but its source enforces none on tool calls", "No idempotency keys for deploys or site creation, and no documented 429 retry guidance beyond the headers", "19 incidents in the status feed from 18 August to 2 November 2026, including errors reaching hosted sites for about 85 minutes on 21 September", "No entry in the official MCP registry, and the privacy statement contradicts itself on AI training (opt-in in one section, never in another)" ], "agentNotes": [ "Send a `User-Agent` naming your app and `Authorization: Bearer $NETLIFY_AUTH_TOKEN`; watch X-RateLimit-Remaining and stop before 3 deploys a minute or 100 a day", "Deploy with `netlify deploy --allow-anonymous` when the person has no account yet, and tell them to claim the project within an hour", "Poll GET /api/v1/deploys/{deploy_id} until `state` is `ready`; a deploy call that runs over 30 seconds is cut off, so send large deploys with `\"async\": true`", "Page lists with `page` and `per_page` (100 at most) and follow the `Link` header's `rel=\"next\"`", "Expect the hosted MCP's deploy tool to hand back a CLI command for the person to run; the local server deploys from the working directory itself" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.4 } ], "editorialScores": { "ergonomics": 69, "maintenance": 87, "payments": 55, "reliability": 67, "schema": 79, "security": 59, "transparency": 73 }, "provenanceScore": 89, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g netlify-cli", "http": "curl -H \"User-Agent: MyApp (you@example.com)\" -H \"Authorization: Bearer $NETLIFY_AUTH_TOKEN\" https://api.netlify.com/api/v1/sites", "claudeCode": "claude mcp add --transport http netlify https://netlify-mcp.netlify.app/mcp", "config": { "mcpServers": { "netlify": { "url": "https://netlify-mcp.netlify.app/mcp" } } } }, "letme": { "capability": "https://letme.dev/infra.cloud", "tool": "https://letme.dev/netlify" }, "area": "developer", "unitPrices": [ { "item": "Personal", "unit": "month", "usd": 9, "note": "1,000 credits a month" }, { "item": "Pro", "unit": "month", "usd": 20, "note": "Unlimited members, 3,000 credits a month" }, { "item": "Credit (Pro pack)", "unit": "credit", "usd": 0.00667, "note": "1,500 credits for $10. A production deploy is 15 credits, bandwidth 20 a GB, compute 10 a GB-hour" }, { "item": "Bandwidth", "unit": "gb", "usd": 0.13, "note": "20 credits a GB at the Pro pack rate" } ], "provenance": { "legalEntity": "Netlify, Inc.", "domain": "netlify.com", "domainRegistered": "2014-06-09", "endpointOnVendorDomain": true, "terms": "https://www.netlify.com/legal/terms-of-use/", "privacy": "https://www.netlify.com/privacy/", "statusPage": "https://www.netlifystatus.com", "changelog": "https://www.netlify.com/changelog/", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of use (last updated 14 October 2026) name Netlify, Inc. under California law and contain no clause on automated access or scraping; the services run under separate self-serve and enterprise subscription agreements, the self-serve one served as a PDF our reader could not extract.", "The privacy statement (last updated 10 April 2026) names Netlify, Inc. and affiliates, a DPA for enterprise customers, and says in one place that content is not used to train AI models unless the user opts in and in another that Customer Content is never used for training.", "www.netlify.com and docs.netlify.com robots.txt allow every crawler, name ClaudeBot and Claude-Web among allowed AI crawlers, and set Content-Signal search=yes, ai-input=yes, ai-train=yes. www.netlifystatus.com disallows /api/ and /embed/, so the status history was read from /history.atom.", "RDAP gives netlify.com a registration date of 9 June 2014.", "www.netlify.com/.well-known/security.txt returns 404. Vulnerability reports go to the public HackerOne programme per the security transparency post.", "The trust centre at netlify.com/trust-center lists subprocessors (all US) with CSV and PDF downloads and an RSS feed, and the DPA as a direct download." ], "score": 89 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/netlify.json", "live": { "slug": "netlify", "probe": { "target": "https://api.netlify.com/api/v1", "method": "get", "lastAt": "2026-11-04T20:47:02.5486596Z", "lastOk": true, "lastStatus": 401, "lastMs": 511, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 457, "p95ms24h": 548, "samples24h": 55, "samples30d": 55, "days": [ { "date": "2026-11-04", "probes": 55, "ok": 55 } ] }, "vendorStatus": { "page": "https://www.netlifystatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T20:39:30.739538782Z" }, "versions": [ { "registry": "github", "name": "netlify/netlify-mcp", "version": "mcp-v1.21.0", "released": "2026-10-26", "seenAt": "2026-11-04T20:39:31.488292719Z" }, { "registry": "npm", "name": "@netlify/mcp", "version": "1.21.0", "seenAt": "2026-11-04T20:39:29.42118318Z" }, { "registry": "npm", "name": "netlify-cli", "version": "27.16.2", "seenAt": "2026-11-04T20:39:30.256102488Z" } ], "githubStars": 69, "npmWeekly": 54818, "securityTxt": { "url": "https://netlify.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:05.436387975Z" }, "updatedAt": "2026-11-04T20:47:02.5486596Z" } }, "edges": [ { "by": 29, "category": "transparency", "leads": "netlify", "name": "Transparency \u0026 trust", "reasons": { "a": "Apache-2.0 in LICENSE and plugin.json (30). No privacy statement. The README says secret values never pass through neckbeard, its state or git history, and the source we read has no telemetry. What `estimate` sends to Infracost's pricing service is not described (15 of 30). DESIGN.md section 6.3 commits the catalogue to stable input schemas and resource addresses within a major version, with a migration path for a major, and allows planner default changes before 1.0 with migration notes. No dated deprecation notices (8 of 20). No telemetry found, and the docs don't address it (10 of 20). Total 63.", "b": "The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc. (25 of 30). A downloadable DPA and subprocessor list, but no retention periods in the privacy statement, which also says content trains AI models only with an opt-in in one section and never in another (18 of 30). Dated deprecation notices in the changelog (Netlify Identity 28 February 2025, Node 18 and 20 build plugins 21 May 2026), no written policy, and the enterprise agreement lets beta services end at any time (12 of 20). Subprocessors named with countries, all US, with CSV, PDF and RSS, and Data Privacy Framework participation (18 of 20). 25 + 18 + 12 + 18 = 73." }, "scores": { "a": 52, "b": 81 } }, { "by": 19, "category": "maintenance", "leads": "netlify", "name": "Maintenance \u0026 community", "reasons": { "a": "v0.3.0 on 15 October 2026 is the newest stable release, 18 days old on 2 November, and the pre-release v0.4.0-beta.1 with catalog-v0.4.1 followed on 26 October (30). v0.1.0 (commit of 11 September), v0.2.0 and v0.2.1 (14 October), v0.3.0 (15 October) and v0.4.0-beta.1 (26 October) inside 90 days, plus catalogue tags (20). GitHub's issue and pull request pages couldn't be read. The author answered about 20 comments on the Hacker News thread on 14 and 15 October, and pull requests from two other accounts were merged on 12 September, 15 October, 20 October (the Disco target, the first outside contribution) and 21 October (10 of 25). Not an MCP server and no SDK, and the plugin is in its own marketplace, not an official one (0). Dependabot runs weekly on actions and Go modules, actions are pinned by SHA and CI runs on every push. CI status unread (8 of 10). Total 68.", "b": "@netlify/mcp 1.21.0 tagged on 26 October 2026 (changelog 23 October), a commit on 28 October, the spec at 2.63.1 and changelog entries to 26 October (30). Six MCP tags between 25 September and 26 October 2026 (20). Issue and pull request responsiveness could not be read (github.com refuses our reader and the API answered empty), while the changelog, the answers.netlify.com forum, Discord and a support hub exist and the MCP changelog cites numbered pull requests (12 of 25). Current official SDKs, a Go client, a JS client and netlify-cli 27.16.2, though the server card names com.netlify/mcp and no such entry is in the official MCP registry (15). CI runs typecheck, build and 31 tests on pinned actions, releases through release-please with npm provenance, and the server runs on @modelcontextprotocol/server 2.2.0 (10). 30 + 20 + 12 + 15 + 10 = 87." }, "scores": { "a": 68, "b": 87 } }, { "by": 14, "category": "reliability", "leads": "netlify", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, since the owner runs the plugin and the CLI. The project is about six weeks old (first commit 8 September 2026) and was launched on Hacker News on 14 October. The Go module is on pkg.go.dev and the plugin's installer fetches a checksummed release binary for Linux or macOS, falling back to `go install`. The Go version is stated only in go.mod (1.27.1), and the release assets themselves couldn't be seen (17 of 20). A public test workflow runs gofmt, `go vet`, `go test`, the plugin and installer checks and a six-lane plan, scaffold and validate matrix on every pull request and push to main. We couldn't see whether main passes (20 of 25). GitHub's issue pages couldn't be read, so there is no readable record of open bugs. INSTALL.md no longer links issue #27 (it now cites a pairing trial that passed on 21 October), and the beta notes name open issues #28 and #44 (10 of 25). Semantic version tags and a written semver contract for the catalogue, but no changelog file, and the plugin-first change in 0.2.0 was not marked as breaking (6 of 15). The README still calls it pre-alpha. v0.3.0 is the stable release and v0.4.0-beta.1 (26 October 2026) a pre-release (0). Total 53.", "b": "Read with the hosted lines. Statuspage at netlifystatus.com with component history and an Atom feed (20). From 5 August to 3 November 2026 the feed lists 19 incidents and no maintenance. None names the API or the MCP server. Errors reaching hosted sites and the Netlify application for about 85 minutes on 21 September read as one major outage; errors on the edge network for 55 minutes on 5 October, CDN DNS errors for 34 minutes on 24 September, 6 minutes of 500s on 18 August, and build, Agent Runner, AI Gateway and log-delay incidents read as minor (10 of 30). Limits are published with numbers, about 500 requests a minute, 3 deploys a minute and 100 a day, with X-RateLimit headers (15). The docs say retrying a timed-out upload is safe and give the reset header, but no backoff guidance, no idempotency key for deploys or site creation, and 429 appears in the spec only on agent runner endpoints (7 of 15). A 99.99 per cent SLA is named for Enterprise on the pricing page, with its terms in order forms (5 of 10). The API is generally available (10). 20 + 10 + 15 + 7 + 5 + 10 = 67." }, "scores": { "a": 53, "b": 67 } }, { "by": 9, "category": "security", "leads": "neckbeard", "name": "Security \u0026 auth", "reasons": { "a": "Read with the framework lines, as for other local agent tools, since neckbeard holds no secret of its own. Analysis, planning, scaffolding and validation need no cloud credentials, and the skill and README say the agent never gets them. Generated pipelines use OIDC federation with no static keys, and a test fails if a rendered pipeline mentions `AWS_SECRET_ACCESS_KEY`. No telemetry found in the source. `estimate` relies on Infracost's Cloud Pricing API, and the experimental `release` commands can run with operator credentials from a workstation (25 of 30). Generated pipelines plan under a read-only identity and apply on main under a write identity, with production behind environment protection. `foundation-apply` refuses updates, replacements and deletes after a person reviews the saved plan (17 of 20). The agent reads the user's own repository. No guidance on untrusted content in it, beyond never transcribing secret values (8 of 15). The blueprint is a hash-verified lockfile, release receipts are committed to the repository, and validation reports each check. No log of agent actions (9 of 15). SECURITY.md with GitHub private vulnerability reporting and a stated scope, no staffed response time and no bug bounty. OSV holds no advisory for the module, and neckbeard.sh serves no security.txt. Actions pinned by commit SHA, a fork-safety CI job and a checksum-checked installer (9 of 20). Total 68.", "b": "Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59." }, "scores": { "a": 68, "b": 59 } }, { "by": 5, "category": "payments", "leads": "neckbeard", "name": "Payments \u0026 pricing", "reasons": { "a": "No payment protocol (0). Read with the self-hosted rule. Free under Apache-2.0 with nothing to buy (20). No card or account for the plugin (20). Installs from the plugin marketplace or `go install` with no signup (20). Estimates need a person to sign in to Infracost, which is outside the product and not deducted. Total 60.", "b": "No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). `netlify deploy --allow-anonymous` publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55." }, "scores": { "a": 60, "b": 55 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "David Beale", "b": "Netlify, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.netlify.com/api/v1", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP, Streamable HTTP, stdio", "name": "Transports" }, { "a": "None", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms", "name": "Licence" }, { "a": "none", "b": "11", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-15", "b": "2026-10-26", "name": "Last release" }, { "a": "no document linked", "b": "2026-10-14", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-04-10", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "58k npm/wk", "name": "Popularity" }, { "a": "3.5/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Netlify API + MCP scores 69.4 (B) on agent readiness against neckbeard's 62.2 (B), and leads in 4 of 7 scored categories. neckbeard leads on security \u0026 auth and payments \u0026 pricing.", "question": "Which is better for AI agents, neckbeard or Netlify API + MCP?" }, { "answer": "No hosted endpoint is listed for neckbeard. Netlify API + MCP has a hosted endpoint at https://api.netlify.com/api/v1.", "question": "Can an agent call neckbeard and Netlify API + MCP without installing anything?" }, { "answer": "neckbeard is open source (Apache-2.0). No open-source release is listed for Netlify API + MCP.", "question": "Are neckbeard and Netlify API + MCP open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 68 against 59", "Payments \u0026 pricing, 60 against 55" ], "also": [ "No key needed to call it", "Free to start without a card", "Open source" ], "goodFor": "A person asking a coding agent to put a containerised web app with Postgres on AWS, GCP or Azure, who wants reviewable OpenTofu and a cost figure first.", "slug": "neckbeard", "watchFor": "Pre-alpha, with v0.3.0 the stable release, and the README marks GCP, GitLab, Kubernetes and promotion as not exercised live" }, { "aheadOn": [ "Reliability, 67 against 53", "Maintenance \u0026 community, 87 against 68", "Transparency \u0026 trust, 81 against 52" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine" ], "goodFor": "An agent that builds and deploys web projects, sets environment variables and reads forms or logs on a team's Netlify account, including with no account through anonymous deploys.", "slug": "netlify", "watchFor": "Personal access tokens and OAuth apps have no scopes, so a token reaches every team its owner belongs to" } ], "history": { "neckbeard": [ { "causes": [ "event" ], "date": "2026-11-02", "delta": -2, "from": 64.2, "fromGrade": "B", "to": 62.2, "toGrade": "B" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": -0.3, "from": 64.5, "fromGrade": "B", "to": 64.2, "toGrade": "B" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.3, "from": 64.2, "fromGrade": "B", "to": 64.5, "toGrade": "B" } ], "netlify": null }, "job": { "capability": "infra.cloud", "name": "Cloud hosting" }, "others": [ { "json": "https://www.anchorterminal.com/compare/azure-mcp-vs-netlify.json", "title": "Azure MCP Server vs Netlify API + MCP", "url": "https://www.anchorterminal.com/compare/azure-mcp-vs-netlify" }, { "json": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-neckbeard.json", "title": "DigitalOcean MCP Server vs neckbeard", "url": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-neckbeard" }, { "json": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify.json", "title": "DigitalOcean MCP Server vs Netlify API + MCP", "url": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify" }, { "json": "https://www.anchorterminal.com/compare/neckbeard-vs-railway-mcp-server.json", "title": "neckbeard vs Railway MCP Server", "url": "https://www.anchorterminal.com/compare/neckbeard-vs-railway-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/neckbeard-vs-render-mcp-server.json", "title": "neckbeard vs Render MCP Server", "url": "https://www.anchorterminal.com/compare/neckbeard-vs-render-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/netlify-vs-railway-mcp-server.json", "title": "Netlify API + MCP vs Railway MCP Server", "url": "https://www.anchorterminal.com/compare/netlify-vs-railway-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/netlify-vs-render-mcp-server.json", "title": "Netlify API + MCP vs Render MCP Server", "url": "https://www.anchorterminal.com/compare/netlify-vs-render-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/netlify-vs-terraform-mcp.json", "title": "Netlify API + MCP vs Terraform MCP Server", "url": "https://www.anchorterminal.com/compare/netlify-vs-terraform-mcp" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify.json", "title": "Cloudflare CLI (cf) vs Netlify API + MCP", "url": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify" }, { "json": "https://www.anchorterminal.com/compare/aws-mcp-servers-vs-neckbeard.json", "title": "AWS MCP Servers vs neckbeard", "url": "https://www.anchorterminal.com/compare/aws-mcp-servers-vs-neckbeard" }, { "json": "https://www.anchorterminal.com/compare/azure-mcp-vs-neckbeard.json", "title": "Azure MCP Server vs neckbeard", "url": "https://www.anchorterminal.com/compare/azure-mcp-vs-neckbeard" }, { "json": "https://www.anchorterminal.com/compare/neckbeard-vs-terraform-mcp.json", "title": "neckbeard vs Terraform MCP Server", "url": "https://www.anchorterminal.com/compare/neckbeard-vs-terraform-mcp" } ], "panel": null, "scores": [ { "by": 14, "edge": "netlify", "key": "reliability", "name": "Reliability", "neckbeard": 53, "netlify": 67, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 4, "edge": "netlify", "key": "schema", "name": "Schema \u0026 documentation", "neckbeard": 75, "netlify": 79, "weight": 13 }, { "by": 2, "edge": "neckbeard", "key": "ergonomics", "name": "Agent ergonomics", "neckbeard": 71, "netlify": 69, "weight": 13 }, { "by": 9, "edge": "neckbeard", "key": "security", "name": "Security \u0026 auth", "neckbeard": 68, "netlify": 59, "weight": 14 }, { "by": 5, "edge": "neckbeard", "key": "payments", "name": "Payments \u0026 pricing", "neckbeard": 60, "netlify": 55, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 19, "edge": "netlify", "key": "maintenance", "name": "Maintenance \u0026 community", "neckbeard": 68, "netlify": 87, "weight": 7 }, { "by": 29, "edge": "netlify", "key": "transparency", "name": "Transparency \u0026 trust", "neckbeard": 52, "netlify": 81, "weight": 7 } ], "summary": "Netlify API + MCP scores 69.4 (B) on agent readiness against neckbeard's 62.2 (B), and leads in 4 of 7 scored categories. neckbeard leads on security \u0026 auth and payments \u0026 pricing. Both do cloud hosting.", "tasks": null, "tutorials": [], "verdicts": { "neckbeard": "The agent maps an app onto human-maintained OpenTofu modules and a deterministic CLI renders them, so it writes no infrastructure by hand, and the cost table comes before any file is scaffolded. The project is pre-alpha with no changelog file, and its site still shows reference cost figures the project withdrew in October. Live deployment has passed on two paths.", "netlify": "A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/neckbeard-vs-netlify", "json": "https://www.anchorterminal.com/compare/neckbeard-vs-netlify.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/neckbeard-vs-netlify.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/neckbeard-vs-netlify.min.md" }, "markdown": "Netlify API + MCP scores 69.4 (B) on agent readiness against neckbeard's 62.2 (B), and leads in 4 of 7 scored categories. neckbeard leads on security \u0026 auth and payments \u0026 pricing. Both do cloud hosting.\n\n- neckbeard: grade B, 62.2/100, rank #511 of 1349. Markdown https://www.anchorterminal.com/tools/neckbeard.md · JSON https://www.anchorterminal.com/api/v1/tools/neckbeard.json\n- Netlify API + MCP: grade B, 69.4/100, rank #226 of 1349. Markdown https://www.anchorterminal.com/tools/netlify.md · JSON https://www.anchorterminal.com/api/v1/tools/netlify.json\n- Best cloud infrastructure tools for AI agents: https://www.anchorterminal.com/best/infrastructure/index.md\n- All 31 infra comparisons: https://www.anchorterminal.com/compare/infrastructure/index.md\n\n## Which one, for what\n\n### neckbeard (B)\n\nGood for: A person asking a coding agent to put a containerised web app with Postgres on AWS, GCP or Azure, who wants reviewable OpenTofu and a cost figure first.\n\nAhead on:\n- Security \u0026 auth, 68 against 59\n- Payments \u0026 pricing, 60 against 55\n\nAlso in its favour:\n- No key needed to call it\n- Free to start without a card\n- Open source\n\nWatch for: Pre-alpha, with v0.3.0 the stable release, and the README marks GCP, GitLab, Kubernetes and promotion as not exercised live\n\n### Netlify API + MCP (B)\n\nGood for: An agent that builds and deploys web projects, sets environment variables and reads forms or logs on a team's Netlify account, including with no account through anonymous deploys.\n\nAhead on:\n- Reliability, 67 against 53\n- Maintenance \u0026 community, 87 against 68\n- Transparency \u0026 trust, 81 against 52\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n\nWatch for: Personal access tokens and OAuth apps have no scopes, so a token reaches every team its owner belongs to\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Netlify API + MCP +29\n\n- neckbeard (52): Apache-2.0 in LICENSE and plugin.json (30). No privacy statement. The README says secret values never pass through neckbeard, its state or git history, and the source we read has no telemetry. What `estimate` sends to Infracost's pricing service is not described (15 of 30). DESIGN.md section 6.3 commits the catalogue to stable input schemas and resource addresses within a major version, with a migration path for a major, and allows planner default changes before 1.0 with migration notes. No dated deprecation notices (8 of 20). No telemetry found, and the docs don't address it (10 of 20). Total 63.\n- Netlify API + MCP (81): The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc. (25 of 30). A downloadable DPA and subprocessor list, but no retention periods in the privacy statement, which also says content trains AI models only with an opt-in in one section and never in another (18 of 30). Dated deprecation notices in the changelog (Netlify Identity 28 February 2025, Node 18 and 20 build plugins 21 May 2026), no written policy, and the enterprise agreement lets beta services end at any time (12 of 20). Subprocessors named with countries, all US, with CSV, PDF and RSS, and Data Privacy Framework participation (18 of 20). 25 + 18 + 12 + 18 = 73.\n\n### Maintenance \u0026 community: Netlify API + MCP +19\n\n- neckbeard (68): v0.3.0 on 15 October 2026 is the newest stable release, 18 days old on 2 November, and the pre-release v0.4.0-beta.1 with catalog-v0.4.1 followed on 26 October (30). v0.1.0 (commit of 11 September), v0.2.0 and v0.2.1 (14 October), v0.3.0 (15 October) and v0.4.0-beta.1 (26 October) inside 90 days, plus catalogue tags (20). GitHub's issue and pull request pages couldn't be read. The author answered about 20 comments on the Hacker News thread on 14 and 15 October, and pull requests from two other accounts were merged on 12 September, 15 October, 20 October (the Disco target, the first outside contribution) and 21 October (10 of 25). Not an MCP server and no SDK, and the plugin is in its own marketplace, not an official one (0). Dependabot runs weekly on actions and Go modules, actions are pinned by SHA and CI runs on every push. CI status unread (8 of 10). Total 68.\n- Netlify API + MCP (87): @netlify/mcp 1.21.0 tagged on 26 October 2026 (changelog 23 October), a commit on 28 October, the spec at 2.63.1 and changelog entries to 26 October (30). Six MCP tags between 25 September and 26 October 2026 (20). Issue and pull request responsiveness could not be read (github.com refuses our reader and the API answered empty), while the changelog, the answers.netlify.com forum, Discord and a support hub exist and the MCP changelog cites numbered pull requests (12 of 25). Current official SDKs, a Go client, a JS client and netlify-cli 27.16.2, though the server card names com.netlify/mcp and no such entry is in the official MCP registry (15). CI runs typecheck, build and 31 tests on pinned actions, releases through release-please with npm provenance, and the server runs on @modelcontextprotocol/server 2.2.0 (10). 30 + 20 + 12 + 15 + 10 = 87.\n\n### Reliability: Netlify API + MCP +14\n\n- neckbeard (53): Read with the local-software lines, since the owner runs the plugin and the CLI. The project is about six weeks old (first commit 8 September 2026) and was launched on Hacker News on 14 October. The Go module is on pkg.go.dev and the plugin's installer fetches a checksummed release binary for Linux or macOS, falling back to `go install`. The Go version is stated only in go.mod (1.27.1), and the release assets themselves couldn't be seen (17 of 20). A public test workflow runs gofmt, `go vet`, `go test`, the plugin and installer checks and a six-lane plan, scaffold and validate matrix on every pull request and push to main. We couldn't see whether main passes (20 of 25). GitHub's issue pages couldn't be read, so there is no readable record of open bugs. INSTALL.md no longer links issue #27 (it now cites a pairing trial that passed on 21 October), and the beta notes name open issues #28 and #44 (10 of 25). Semantic version tags and a written semver contract for the catalogue, but no changelog file, and the plugin-first change in 0.2.0 was not marked as breaking (6 of 15). The README still calls it pre-alpha. v0.3.0 is the stable release and v0.4.0-beta.1 (26 October 2026) a pre-release (0). Total 53.\n- Netlify API + MCP (67): Read with the hosted lines. Statuspage at netlifystatus.com with component history and an Atom feed (20). From 5 August to 3 November 2026 the feed lists 19 incidents and no maintenance. None names the API or the MCP server. Errors reaching hosted sites and the Netlify application for about 85 minutes on 21 September read as one major outage; errors on the edge network for 55 minutes on 5 October, CDN DNS errors for 34 minutes on 24 September, 6 minutes of 500s on 18 August, and build, Agent Runner, AI Gateway and log-delay incidents read as minor (10 of 30). Limits are published with numbers, about 500 requests a minute, 3 deploys a minute and 100 a day, with X-RateLimit headers (15). The docs say retrying a timed-out upload is safe and give the reset header, but no backoff guidance, no idempotency key for deploys or site creation, and 429 appears in the spec only on agent runner endpoints (7 of 15). A 99.99 per cent SLA is named for Enterprise on the pricing page, with its terms in order forms (5 of 10). The API is generally available (10). 20 + 10 + 15 + 7 + 5 + 10 = 67.\n\n### Security \u0026 auth: neckbeard +9\n\n- neckbeard (68): Read with the framework lines, as for other local agent tools, since neckbeard holds no secret of its own. Analysis, planning, scaffolding and validation need no cloud credentials, and the skill and README say the agent never gets them. Generated pipelines use OIDC federation with no static keys, and a test fails if a rendered pipeline mentions `AWS_SECRET_ACCESS_KEY`. No telemetry found in the source. `estimate` relies on Infracost's Cloud Pricing API, and the experimental `release` commands can run with operator credentials from a workstation (25 of 30). Generated pipelines plan under a read-only identity and apply on main under a write identity, with production behind environment protection. `foundation-apply` refuses updates, replacements and deletes after a person reviews the saved plan (17 of 20). The agent reads the user's own repository. No guidance on untrusted content in it, beyond never transcribing secret values (8 of 15). The blueprint is a hash-verified lockfile, release receipts are committed to the repository, and validation reports each check. No log of agent actions (9 of 15). SECURITY.md with GitHub private vulnerability reporting and a stated scope, no staffed response time and no bug bounty. OSV holds no advisory for the module, and neckbeard.sh serves no security.txt. Actions pinned by commit SHA, a fork-safety CI job and a checksum-checked installer (9 of 20). Total 68.\n- Netlify API + MCP (59): Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59.\n\n### Payments \u0026 pricing: neckbeard +5\n\n- neckbeard (60): No payment protocol (0). Read with the self-hosted rule. Free under Apache-2.0 with nothing to buy (20). No card or account for the plugin (20). Installs from the plugin marketplace or `go install` with no signup (20). Estimates need a person to sign in to Infracost, which is outside the product and not deducted. Total 60.\n- Netlify API + MCP (55): No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). `netlify deploy --allow-anonymous` publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55.\n\n## Score by category\n\n| Category | Weight | neckbeard | Netlify API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 53 | 67 | Netlify API + MCP +14 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 75 | 79 | Netlify API + MCP +4 |\n| Agent ergonomics | 13% (16.2 this run) | 71 | 69 | neckbeard +2 |\n| Security \u0026 auth | 14% (17.5 this run) | 68 | 59 | neckbeard +9 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 55 | neckbeard +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 68 | 87 | Netlify API + MCP +19 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 81 | Netlify API + MCP +29 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **62.2 · B** | **69.4 · B** | |\n\n## Facts side by side\n\n| Fact | neckbeard | Netlify API + MCP |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | David Beale | Netlify, Inc. |\n| Hosted endpoint | no (local only) | `https://api.netlify.com/api/v1` |\n| Transports | | HTTP, Streamable HTTP, stdio |\n| Auth | None | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | Apache-2.0 | ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms |\n| Tools exposed | none | 11 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-15 | 2026-10-26 |\n| Terms last updated | no document linked | 2026-10-14 |\n| Privacy policy last updated | no document linked | 2026-04-10 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | none | 58k npm/wk |\n| Agent reviews | 3.5/5 (4) | none |\n\n## How the scores have moved\n\n### neckbeard\n\n- -2.0 on 2 November 2026: negative event\n- -0.3 on 28 October 2026: correction\n- +0.3 on 28 October 2026: new evidence\n\n### Netlify API + MCP\n\nNo score change since it was listed.\n\n## Verdicts\n\n**neckbeard.** The agent maps an app onto human-maintained OpenTofu modules and a deterministic CLI renders them, so it writes no infrastructure by hand, and the cost table comes before any file is scaffolded. The project is pre-alpha with no changelog file, and its site still shows reference cost figures the project withdrew in October. Live deployment has passed on two paths.\n\n**Netlify API + MCP.** A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November.\n\n## Before you call either\n\n### neckbeard\n\n1. Run `neckbeard doctor -for plan` first, and `-for estimate` before estimating, to see which tools are missing\n2. Answer every assumption in `app-profile.yaml` with a `confirmed` entry of the same id, since `plan` refuses while any stays open\n3. Never edit `blueprint.yaml`. Change the profile or `neckbeard.yaml` and run `neckbeard plan` again\n4. Show the person `costs/estimate.md`, its usage assumptions and its unpriced section before running `scaffold`, and treat the totals as estimates, not bills\n5. Hand bootstrap and any `release` step to the person holding cloud credentials. Never ask for secret values\n\n### Netlify API + MCP\n\n1. Send a `User-Agent` naming your app and `Authorization: Bearer $NETLIFY_AUTH_TOKEN`; watch X-RateLimit-Remaining and stop before 3 deploys a minute or 100 a day\n2. Deploy with `netlify deploy --allow-anonymous` when the person has no account yet, and tell them to claim the project within an hour\n3. Poll GET /api/v1/deploys/{deploy_id} until `state` is `ready`; a deploy call that runs over 30 seconds is cut off, so send large deploys with `\"async\": true`\n4. Page lists with `page` and `per_page` (100 at most) and follow the `Link` header's `rel=\"next\"`\n5. Expect the hosted MCP's deploy tool to hand back a CLI command for the person to run; the local server deploys from the working directory itself\n\n## Questions\n\n### Which is better for AI agents, neckbeard or Netlify API + MCP?\n\nNetlify API + MCP scores 69.4 (B) on agent readiness against neckbeard's 62.2 (B), and leads in 4 of 7 scored categories. neckbeard leads on security \u0026 auth and payments \u0026 pricing.\n\n### Can an agent call neckbeard and Netlify API + MCP without installing anything?\n\nNo hosted endpoint is listed for neckbeard. Netlify API + MCP has a hosted endpoint at https://api.netlify.com/api/v1.\n\n### Are neckbeard and Netlify API + MCP open source?\n\nneckbeard is open source (Apache-2.0). No open-source release is listed for Netlify API + MCP.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/neckbeard-vs-netlify.json, and with the fewest tokens: https://www.anchorterminal.com/compare/neckbeard-vs-netlify.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"neckbeard\", \"b\": \"netlify\"}`. From a terminal: `anchor compare neckbeard netlify`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/neckbeard.json and https://www.anchorterminal.com/api/v1/tools/netlify.json\n\n## Other comparisons with neckbeard or Netlify API + MCP\n\n- [Azure MCP Server vs Netlify API + MCP](https://www.anchorterminal.com/compare/azure-mcp-vs-netlify.md)\n- [DigitalOcean MCP Server vs neckbeard](https://www.anchorterminal.com/compare/digitalocean-mcp-vs-neckbeard.md)\n- [DigitalOcean MCP Server vs Netlify API + MCP](https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify.md)\n- [neckbeard vs Railway MCP Server](https://www.anchorterminal.com/compare/neckbeard-vs-railway-mcp-server.md)\n- [neckbeard vs Render MCP Server](https://www.anchorterminal.com/compare/neckbeard-vs-render-mcp-server.md)\n- [Netlify API + MCP vs Railway MCP Server](https://www.anchorterminal.com/compare/netlify-vs-railway-mcp-server.md)\n- [Netlify API + MCP vs Render MCP Server](https://www.anchorterminal.com/compare/netlify-vs-render-mcp-server.md)\n- [Netlify API + MCP vs Terraform MCP Server](https://www.anchorterminal.com/compare/netlify-vs-terraform-mcp.md)\n- [Cloudflare CLI (cf) vs Netlify API + MCP](https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify.md)\n- [AWS MCP Servers vs neckbeard](https://www.anchorterminal.com/compare/aws-mcp-servers-vs-neckbeard.md)\n- [Azure MCP Server vs neckbeard](https://www.anchorterminal.com/compare/azure-mcp-vs-neckbeard.md)\n- [neckbeard vs Terraform MCP Server](https://www.anchorterminal.com/compare/neckbeard-vs-terraform-mcp.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "neckbeard vs Netlify API + MCP", "url": "" } ], "description": "Netlify scores 69.4 (B) to neckbeard's 62.2 (B) for cloud hosting. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "neckbeard B 62.2", "Netlify API + MCP B 69.4", "scores" ], "h1": "neckbeard vs Netlify API + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/neckbeard-vs-netlify", "published": "2026-10-01", "section": "tools", "title": "neckbeard vs Netlify for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/neckbeard-vs-netlify" }, "tokens": { "markdown": 4700, "slim": 3080 }, "version": 1 }