OpenPanel vs Optimizely Experimentation

OpenPanel 35

No x402, MPP or L402 (0). Public prices by event tier from $2.50 a month, with no overage charges; tiers rather than a per-event rate (15 of 20). 30-day free trial with no card, and free self-hosting (20). Signup is in a browser and client keys are created in the dashboard (0). 0+15+20+0 = 35.

Optimizely Experimentation 0

No x402, MPP or L402 (0). No price is published. The plans page says every plan is individually packaged and leads to a demo request (0). No free plan or trial was found on the plans page, the product pages or the docs (0). Access needs a subscription and a browser sign-in through Opti ID (0).

OpenPanel 41

Client credentials with three types (write, read for one project, root for the organisation), created and deleted in the dashboard (25), less 10 because the docs give ?token= in the MCP URL as an option (15 of 30). Read clients are read-only and limited to one project, and onboarding creates a read-only MCP client. No approval step for root-client writes (14 of 20). Tools return event properties, page titles and profile data sent from tracked sites, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). SECURITY.md with a private advisory route and response times, a valid security.txt, and no bug bounty or certification found (9 of 20). 15+14+3+0+9 = 41.

Optimizely Experimentation 66

The MCP server uses OAuth 2.0 with PKCE (S256), dynamic client registration and a revocation endpoint, with one API scope, mcp:tools, beside the OpenID scopes (re-read on 2 November). REST personal access tokens are revocable, named and sent in a header, and administrators can revoke any collaborator's token. The REST OAuth flow has the single scope all, described as full access to the account (22 of 30). Sessions and tokens carry the user's role, Feature Experimentation has granular roles for flags, environments and audiences, and change approvals have routed flag changes to reviewers since 6 August 2026. No read-only mode for the MCP server was found, and confirmation before a write is left to the client (13 of 20). No guidance on prompt injection was found, though tools return names, descriptions and hypotheses that people wrote (3 of 15). Change history for projects and flags is in the application, at /v2/changes and in webhooks (12 of 15). ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2 and PCI DSS are stated for Web and Feature Experimentation, with annual penetration tests and a bug bounty programme reachable at securityeng@optimizely.com. No security.txt and no public programme link (16 of 20).

OpenPanel 54

51 MCP tools, more than 30 (5). We added 3 because a read client doesn't get the 9 dashboard management tools (8 of 25). Insights endpoints take startDate, endDate, range, filters, cursor and limit (18 of 20). Errors aren't documented beyond 401 and 429 (12 of 20). No readOnlyHint or destructiveHint in the MCP source, no idempotency keys; delete_dashboard refuses a non-empty dashboard without forceDelete (3 of 20). Few required parameters, and SDKs for JavaScript, React, Next.js, Vue, React Native, Swift, Kotlin and Python (13 of 15). 8+18+12+3+13 = 54.

Optimizely Experimentation 68

The MCP server lists eight tools since exp_program_reporting_execute_query was added on 13 October 2026, which is 25 on the checklist. We took 2 off because the tool definitions were unread and their size is unknown (23 of 25). per_page up to 100 and page on the v2 lists, page_token, sort and query on the flags list, and time windows on results (17 of 20). The Optimizely API returns code, message and a uuid, and the Feature Experimentation API returns a problem detail object. MCP error results were unread (13 of 20). No idempotency keys were found and the tool annotations were unread. The docs say the agent confirms project, environment and details before a change, which is client behaviour, and entities are archived through the lifecycle tool (5 of 20). The MCP server needs only a URL. The official SDKs in eleven languages evaluate flags and log events and do not cover the management APIs (10 of 15).

OpenPanel 70

Graded on OpenPanel Cloud with the hosted lines. OpenStatus page at status.openpanel.dev with API and Tracker components (20). In the 90 days from 8 August, one incident, degraded API performance for about two hours on 1 October 2026, caused by Hetzner private-network problems reaching the ClickHouse servers (15 of 30). Limits are documented with numbers for MCP (60 a minute per client) and the Export, Insights and Manage APIs (15). The docs say a 429 is returned and to back off exponentially; no Retry-After or idempotency guidance (10 of 15). No SLA was found (0). Generally available (10). 20+15+15+10+0+10 = 70.

Optimizely Experimentation 83

Graded on the hosted service with the hosted lines. Statuspage at status.optimizely.com with 174 components, among them Optimizely REST API, Results API, Events API, Snippet Delivery and Snippet Building for Feature and Web Experimentation (20). From 4 August to 2 November 2026 its history shows three incidents that reach Experimentation, all minor. On 25 August a provider's network fault degraded service for a subset of customers in Southeast Asia (05:15 to 07:37 UTC). On 17 September Optimizely Identity sent users to the wrong SSO page for about 3 minutes, which touches the sign-in the MCP server uses. On 15 October snippet publishing for Web Experimentation was delayed for some customers while existing experiences kept serving. The 23 July Okta sign-in incident has left the window (20 of 30). The Feature Experimentation API is limited to 2 requests a second and 120 a minute, the Optimizely API to 100 a minute and the results endpoints to 20 a minute. No limit was found for the MCP server (13 of 15). The API conventions page documents 429 - Too Many Requests with X-RATELIMIT-LIMIT, X-RATELIMIT-REMAINING and X-RATELIMIT-RESET on every response and says to wait for the reset, but no idempotency key or safe-retry guidance for writes was found (10 of 15). The Service Level Agreement V 2024-05 gives credits from 10 per cent once downtime passes 43 minutes in a month, capped at 50 per cent (10). The REST APIs are versioned and the MCP pages carry no beta label (10). 20 + 20 + 13 + 10 + 10 + 10 = 83.

OpenPanel 83

AGPL-3.0 for the whole product, and the about page says there is no enterprise edition (30). Terms and privacy policy of 21 May 2026 agree, with a DPA published, transient IP use, data ownership kept by the customer, and providers named with locations. Retention periods are general rather than stated in days (22 of 30). No deprecation policy or dated notices found; v3.0.0 was a major release on 16 October 2026 (4 of 20). Sub-processors and data locations disclosed in the privacy policy (Hetzner, Germany) (18 of 20). 30+22+4+18 = 74.

Optimizely Experimentation 75

Closed hosted service under a published Online Software Subscription Agreement and API, SDK and MCP terms. The SDKs are open source under Apache 2.0 (17 of 30). The privacy notice of 1 July 2026 says it does not cover customer data and points to the subscription agreement and the Data Processing Agreement (V 2026-01), which agree. Event data is kept 18 months, and customer data may be deleted 30 days after a subscription ends. How the MCP server and Opal handle prompts for Experimentation is not stated on the MCP pages (22 of 30). The API, SDK and MCP terms let Optimizely revise, suspend or cancel any API or MCP at any time under its documentation and policies. An SDK compatibility matrix exists. No deprecation policy with a notice period was found for the APIs (6 of 20). The sub-processor list, updated 14 September 2026, names providers by product with hosting locations. Web and Feature Experimentation list Amazon Web Services in the United States and Google Cloud in the United States and Europe (18 of 20).

OpenPanel 83

v3.30.0 was tagged on 6 November 2026 (30). 60 tagged releases between 8 August and 6 November (20). 572 commits since 8 August, a Discord server, a feedback board and email; issue response times weren't read because the GitHub API refused us for its rate limit (15 of 25). The official MCP registry has only a third-party OpenPanel server, not OpenPanel's own; official SDKs are current (10 of 15). Workflows build Docker images, SDKs and self-hosting releases; no test workflow was found in .github/workflows (8 of 10). 30+20+15+10+8 = 83.

Optimizely Experimentation 78

The newest Feature Experimentation release notes are dated 15 October (Flutter SDK 4.0.0) and 13 October 2026 (a new MCP tool), 18 and 20 days before this check (30). Feature Experimentation notes on 6 August, 3 September, 13 and 15 October 2026, monthly Web Experimentation notes, plus @optimizely/optimizely-sdk 6.6.0 (3 September) and 6.6.1 (18 September) and optimizely-sdk 5.7.0 for Python (tag 7 September) (20). Closed service with public release notes, an RSS feed and a support centre. We did not read how quickly questions are answered (9 of 15). Official SDKs are current in eleven languages. The MCP server is not in the official MCP registry, where a search for optimizely returns nothing on 2 November (12 of 15). The JavaScript SDK repository has six CI workflow files and 9 commits since 4 August 2026, the last on 29 October (7 of 10). 30 + 20 + 9 + 12 + 7 = 78.