OpenPanel vs Statsig

OpenPanel 41

Client credentials with three types (write, read for one project, root for the organisation), created and deleted in the dashboard (25), less 10 because the docs give ?token= in the MCP URL as an option (15 of 30). Read clients are read-only and limited to one project, and onboarding creates a read-only MCP client. No approval step for root-client writes (14 of 20). Tools return event properties, page titles and profile data sent from tracked sites, and no prompt-injection guidance was found (3 of 15). No audit log was found (0). SECURITY.md with a private advisory route and response times, a valid security.txt, and no bug bounty or certification found (9 of 20). 15+14+3+0+9 = 41.

Statsig 74

OAuth for the MCP server with PKCE, dynamic client registration and a device code grant, issuing personal Console API keys that carry the user's role. Console keys can be created read-only or read and write, and rotated or deactivated through the API. The OAuth metadata lists no scopes, and a project Console key reaches every Console API endpoint (25 of 30). MCP scope is set per project and per role as no access, read only or read and write. Updates and destructive operations need a confirmation, and project review policies still apply (19 of 20). No guidance on prompt injection was found, though tools return names, descriptions and log data that people wrote. The docs tell users to review each change before the agent confirms (4 of 15). Audit logs are kept indefinitely with an API, and personal keys attribute changes to a user (14 of 15). SOC 2 Type II and a bug bounty programme are stated on the security page, with no public programme link and no security.txt (12 of 20).

OpenPanel 54

51 MCP tools, more than 30 (5). We added 3 because a read client doesn't get the 9 dashboard management tools (8 of 25). Insights endpoints take startDate, endDate, range, filters, cursor and limit (18 of 20). Errors aren't documented beyond 401 and 429 (12 of 20). No readOnlyHint or destructiveHint in the MCP source, no idempotency keys; delete_dashboard refuses a non-empty dashboard without forceDelete (3 of 20). Few required parameters, and SDKs for JavaScript, React, Next.js, Vue, React Native, Swift, Kotlin and Python (13 of 15). 8+18+12+3+13 = 54.

Statsig 71

The MCP V3 server shows 18 default tools, which is 15 on the checklist. Add back 8 for the discovery layer that reaches other operations on demand, query_fields on experiment reads and read-only access (23 of 25). limit and page on 49 list operations with pagination metadata per the 8 October check, a cursor on the Logs Explorer query, and filters by tag, status, creator and date (17 of 20). Errors are a status and a message with no machine code, and MCP results set isError (11 of 20). No idempotency keys were found. Updates and api_destructive calls need a confirmation object, and operations are split into read, write and destructive lanes. We could not read the live tool annotations (10 of 20). The SDKs cover flag evaluation and event logging in many languages, not the Console API, and the siggy CLI on npm is version 0.0.4 from September 2024 (10 of 15).

OpenPanel 70

Graded on OpenPanel Cloud with the hosted lines. OpenStatus page at status.openpanel.dev with API and Tracker components (20). In the 90 days from 8 August, one incident, degraded API performance for about two hours on 1 October 2026, caused by Hetzner private-network problems reaching the ClickHouse servers (15 of 30). Limits are documented with numbers for MCP (60 a minute per client) and the Export, Insights and Manage APIs (15). The docs say a 429 is returned and to back off exponentially; no Retry-After or idempotency guidance (10 of 15). No SLA was found (0). Generally available (10). 20+15+15+10+0+10 = 70.

Statsig 79

Graded on the hosted service with the hosted lines. Statuspage at status.statsig.com with 14 components, among them Console API, Config Delivery API and Log Event API (20). Three incidents between 3 August and 1 November 2026, all Warehouse Native delays (export delays from 6 August resolved 8 August, delayed exposure results on 26 August and its follow-up resolved 31 August), marked minor or none per the 8 October check, and nothing posted since 31 August (20 of 30). The 8 July 2026 major, when launched gates returned false through the V2 Config Delivery API for about 4 hours 44 minutes, is outside the window. The docs give about 1,800 mutation attempts per 15 minutes per project, while the OpenAPI description gave about 100 per 10 seconds and 900 per 15 minutes per the 8 October check, and no number was found for reads (12 of 15). The docs ask for exponential backoff with jitter on 429. No Retry-After header and no idempotency keys were found (10 of 15). The enterprise terms give 99.95 per cent monthly availability with credits, for customers with premium support, measured on the Console user interface (7 of 10). The Console API is versioned and the MCP V3 docs carry no beta label (10).

OpenPanel 75

A live OpenAPI 3.0.3 document with 93 operations, 67 described, generated by the framework and titled 'Elysia Documentation' version 0.0.0; MCP tools are defined in TypeScript with typed inputs (22 of 25). llms.txt, llms-full.txt and Markdown pages (10). Tool descriptions say when to use them, for example list_event_names is to be called first when event names aren't known (14 of 20). 143 enums in the spec and typed MCP inputs (11 of 15). Curl examples in the API docs; error responses aren't documented per endpoint (9 of 15). Tagged releases on GitHub with notes, unversioned API paths and no changelog page (9 of 15). 22+10+14+11+9+9 = 75.

Statsig 82

Public OpenAPI 3.0 spec for Console API version 20240601 with 209 paths and 325 operations, per the 8 October check, not re-read on 1 November, and typed MCP tools per the tool reference (25). llms.txt, llms-full.txt, a Markdown copy of each page and a public docs MCP server (10). Every operation has a summary but only 29 of 325 have a description, per the 8 October check. The MCP tool reference states each tool's purpose and when to ask the user first (11 of 20). 1,164 enums across 188 schemas, with required fields marked, per the 8 October check (12 of 15). Examples on most responses. The spec documents 401 on 156 operations, 404 on 126 and 400 on 106, and no 429, per the 8 October check (11 of 15). A dated API version sent in the STATSIG-API-VERSION header with a promise not to break a version, and a dated product updates page. No changelog for the API alone was found (13 of 15).

OpenPanel 83

AGPL-3.0 for the whole product, and the about page says there is no enterprise edition (30). Terms and privacy policy of 21 May 2026 agree, with a DPA published, transient IP use, data ownership kept by the customer, and providers named with locations. Retention periods are general rather than stated in days (22 of 30). No deprecation policy or dated notices found; v3.0.0 was a major release on 16 October 2026 (4 of 20). Sub-processors and data locations disclosed in the privacy policy (Hetzner, Germany) (18 of 20). 30+22+4+18 = 74.

Statsig 76

Closed hosted service under a published self-service agreement and enterprise terms. The SDKs are open source under ISC (17 of 30). The terms, DPA and AI governance page mostly agree. The DPA names Amplitude, Inc. as processor and keeps data as long as necessary, the pricing page gives 1 year of analytics retention on the free plan, and the docs say customer data is not used to build AI models without written consent. The privacy notice is Amplitude's and doesn't name Statsig, and the self-service terms name Amplitude, Inc. under an effective date of 4 August 2025, before Statsig joined Amplitude on 5 May 2026 (18 of 30). Each Console API version is promised not to break, a deprecation notices page gives dates, and MCP V1 stays supported. No notice period is stated (12 of 20). Amplitude's sub-processor list, updated 13 May 2026, gives locations and marks the providers used for Statsig-branded services. EU hosting is an Enterprise option (17 of 20).

OpenPanel 35

No x402, MPP or L402 (0). Public prices by event tier from $2.50 a month, with no overage charges; tiers rather than a per-event rate (15 of 20). 30-day free trial with no card, and free self-hosting (20). Signup is in a browser and client keys are created in the dashboard (0). 0+15+20+0 = 35.

Statsig 40

No x402, MPP or L402 (0). Prices are public without a login. Pro is $150 a month with 5 million events, then $0.05 per 1,000 events (20). The Developer plan is free with no card and 2 million events a month (20). A person signs up in a browser, then creates a key or approves OAuth (0).