{ "data": { "a": { "slug": "posthog", "name": "PostHog", "vendor": "PostHog Inc.", "vendorUrl": "https://posthog.com", "kind": "http-api", "category": "product-analytics", "summary": "PostHog is an open-source product analytics platform with session replay, feature flags, experiments, error tracking and a data warehouse. Agents reach PostHog Cloud through a REST API with a public OpenAPI spec and an official hosted MCP server.", "url": "https://www.anchorterminal.com/tools/posthog", "markdownUrl": "https://www.anchorterminal.com/tools/posthog.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/posthog.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/posthog.json", "dns": "posthog.grade.anchorterminal.com", "repo": "https://github.com/PostHog/posthog", "license": "MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://us.posthog.com", "packages": [ { "registry": "npm", "name": "posthog-node" }, { "registry": "npm", "name": "posthog-js" }, { "registry": "pypi", "name": "posthog" }, { "registry": "npm", "name": "@posthog/cli" } ], "auth": "mixed", "authNotes": "Self-serve. Private endpoints take a Bearer personal API key (`phx_`) that a signed-in user creates with chosen scopes and project or organisation access, or an OAuth access token. OAuth at oauth.posthog.com supports PKCE, dynamic client registration and client ID metadata documents, with no app review needed to go live. The MCP server uses OAuth by default or a personal API key made with the MCP Server preset. Project secret API keys are in beta. Capture and flag evaluation take the public project token.", "pricing": "freemium", "pricingNotes": "Free plan with no card, covering 1 million analytics events and 1 million flag requests a month. The paid plan has no base fee and no seat charge, and bills per unit above the free allowance (analytics events from $0.00005). API and MCP calls are not billed, but personal API key queries draw on an hourly read budget that is larger on a paid plan (https://posthog.com/pricing, checked 2026-10-07).", "priceSummary": "$0.0001 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI spec or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": 1183, "popularity": { "githubStars": 40176, "npmWeekly": 15243417, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://posthog.com/docs/api", "llmsTxt": "https://posthog.com/llms.txt", "openapi": "https://app.posthog.com/api/schema/", "registryName": "io.github.PostHog/mcp", "capabilities": [ "analytics.query", "analytics.events", "analytics.funnels", "analytics.experiments", "analytics.flags", "observability.errors", "observability.logs" ], "tags": [ "official", "hosted", "open-source", "mcp", "oauth", "openapi", "llms-txt", "free-tier", "no-card", "eu-region", "status-page", "soc2", "typescript", "python" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 67.4, "grade": "B", "agentReady": false, "rank": 327, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 78, "maintenance": 89, "payments": 40, "reliability": 84, "schema": 81, "security": 84, "transparency": 83 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -10, "negativeNotes": [ "-3: 2025-11-24. Malicious versions of posthog-node, posthog-js and six other npm packages were published with a stolen token after an attacker took CI secrets through a pull request workflow. PostHog removed them in about five hours and published a post-mortem on 26 November 2025, so the deduction is reduced (https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem).", "-2: 2026-05-29, disclosed 2026-06-02 as PSA-2026-00001 (critical). Researchers used an unsandboxed, outdated Chromium to reach a US Cloud pod and read internal production credentials. PostHog says no customer data was accessed and the credentials were rotated. Fixed and documented (https://posthog.com/handbook/company/security-advisories).", "-2: 2026-07-11 to 2026-08-04, disclosed 2026-08-21 as PSA-2026-00002 (high). Customer-run nginx proxies set up as PostHog's guide showed sent traffic to released AWS addresses, and a researcher read traffic from six EU customers. The report sat in triage for five weeks. Fixed and documented (https://posthog.com/handbook/company/security-advisories).", "-3: 2026-10-23. posthog 7.75.11 (PyPI) and posthog-node 5.57.1 (npm) stopped copying the `headers` and `authorization` of MCP tool definitions into `$ai_tools` on AI events, and stopped sending exception text that can quote prompts in `$ai_error` when privacy mode is on. The package changelogs describe the fix, and PostHog's security advisories page lists no advisory for it (https://github.com/PostHog/posthog-python/blob/main/posthog/CHANGELOG.md)." ], "verdict": "PostHog suits agents that need to query product data and manage flags or experiments. Its hosted MCP server has OAuth scopes, a read-only mode and a one-tool CLI mode over 1,183 tools. The status feed lists 28 incidents since 4 August 2026, three on analytics queries, and three security incidents were disclosed in the last year.", "bestFor": "An agent that answers product questions in SQL or with funnel, retention and trends queries, and that manages feature flags, experiments and error tracking in the same project.", "strengths": [ "Public OpenAPI 3.1 spec with 2,347 operations and a scope on most of them, plus llms.txt and a Markdown copy of every docs page", "Hosted MCP server with OAuth, a read-only switch, filters by product area or tool name and pinning to one project", "CLI mode registers one `exec` tool that searches, inspects and calls the 1,183 tools on demand", "Free plan without a card, with 1 million analytics events and 1 million flag requests a month, and public per-unit prices above that", "MIT source outside the `ee` directory, a public SOC 2 Type 2 report and a public security advisories page" ], "weaknesses": [ "28 incidents on the status feed between 4 August and 27 October 2026, three of them analytics query timeouts or failures", "Three security incidents in twelve months, among them malicious npm SDK versions on 24 November 2025. A 23 October 2026 SDK fix for MCP credentials in AI events had no advisory", "API queries stop at 10 seconds of execution, three at a time per project, with an hourly read budget on personal API keys", "No API versioning or deprecation policy was found, and the query docs reserve the right to restrict export-like queries without notice", "Customer content can be used to train PostHog's own models unless the customer opts out in settings" ], "agentNotes": [ "Add `?readonly=true` or the `x-posthog-read-only` header to the MCP URL unless the task needs writes", "Pin the session with `x-posthog-project-id`, which also removes the `switch-project` and `switch-organization` tools", "In CLI mode run `info \u003ctool\u003e` once before `call`, and send one `exec` command per request", "On a 429 with code `api_queries_budget_exceeded`, wait for `Retry-After` and read `X-PostHog-Query-Budget-Remaining-Bytes`", "Page SQL results by keyset on `timestamp`. `OFFSET` returns 400 for personal API keys, and results cap at 50,000 rows" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.4 } ], "editorialScores": { "ergonomics": 78, "maintenance": 89, "payments": 40, "reliability": 84, "schema": 81, "security": 84, "transparency": 71 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx @posthog/wizard mcp add", "http": "curl \\\n -H 'Content-Type: application/json' \\\n -H \"Authorization: Bearer $POSTHOG_PERSONAL_API_KEY\" \\\n https://us.posthog.com/api/projects/:project_id/query/ \\\n -d '{\"query\": {\"kind\": \"HogQLQuery\", \"query\": \"select event, count() from events group by event limit 100\"}}'", "claudeCode": "claude mcp add --transport http posthog https://mcp.posthog.com/mcp -s user", "config": { "mcpServers": { "posthog": { "url": "https://mcp.posthog.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/analytics.query", "tool": "https://letme.dev/posthog" }, "area": "business", "unitPrices": [ { "item": "Product analytics event", "unit": "tx", "usd": 0.00005, "note": "1 to 2 million a month, first 1 million free, lower above" }, { "item": "Feature flag request", "unit": "tx", "usd": 0.0001, "note": "1 to 2 million a month, first 1 million free, lower above" }, { "item": "Session recording", "unit": "tx", "usd": 0.005, "note": "5,001 to 15,000 a month, first 5,000 free" }, { "item": "Data warehouse row", "unit": "record", "usd": 0.000015, "note": "1 to 10 million a month, first 1 million free" }, { "item": "Boost package", "unit": "month", "usd": 250 }, { "item": "Scale package", "unit": "month", "usd": 750 }, { "item": "Enterprise package", "unit": "month", "usd": 2000 } ], "provenance": { "legalEntity": "PostHog Inc. (formerly Hiberly Inc.)", "domain": "posthog.com", "domainRegistered": "2020-01-23", "endpointOnVendorDomain": true, "terms": "https://posthog.com/terms", "privacy": "https://posthog.com/privacy", "statusPage": "https://www.posthogstatus.com", "changelog": "https://posthog.com/changelog", "securityTxt": "valid", "checked": "2026-10-07", "notes": [ "The privacy policy names PostHog Inc., formerly known as Hiberly Inc., and its subsidiaries. The security handbook names Hiberly Ltd. as the UK entity.", "posthog.com/.well-known/security.txt expires 2027-08-30 and points to the security handbook. The copy on us.posthog.com expired 2024-03-14.", "status.posthog.com redirects to www.posthogstatus.com.", "RDAP for posthog.com gives a registration date of 2020-01-23.", "The API, OAuth server and MCP server answer on posthog.com subdomains." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/posthog.json", "live": { "slug": "posthog", "probe": { "target": "https://us.posthog.com", "method": "get", "lastAt": "2026-11-07T18:20:48.109201502Z", "lastOk": true, "lastStatus": 200, "lastMs": 475, "authRequired": false, "uptime24h": 100, "uptime30d": 99.99, "p50ms24h": 446, "p95ms24h": 569, "samples24h": 239, "samples30d": 7463, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 252 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://www.posthogstatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:37.450387165Z" }, "versions": [ { "registry": "github", "name": "PostHog/posthog", "version": "desktop-v0.61.959", "released": "2026-11-06", "seenAt": "2026-11-06T23:57:41.813768908Z" }, { "registry": "mcp-registry", "name": "io.github.PostHog/mcp", "version": "1.0.1", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@posthog/cli", "version": "0.19.0", "seenAt": "2026-11-06T23:57:40.070966304Z" }, { "registry": "npm", "name": "posthog-js", "version": "1.447.3", "seenAt": "2026-11-06T23:57:38.624326161Z" }, { "registry": "npm", "name": "posthog-node", "version": "5.63.1", "seenAt": "2026-11-06T23:57:37.623108072Z" }, { "registry": "pypi", "name": "posthog", "version": "7.86.0", "released": "2026-11-06", "seenAt": "2026-11-06T23:57:39.946740628Z" } ], "githubStars": 40679, "npmWeekly": 20839148, "pypiWeekly": 12063741, "securityTxt": { "url": "https://posthog.com/.well-known/security.txt", "state": "valid", "expires": "2027-08-30T00:00:00.000Z", "checkedAt": "2026-11-07T16:00:18.698644072Z" }, "llmsTxt": { "url": "https://posthog.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:40.03441392Z" }, "domain": { "domain": "posthog.com", "registered": "2020-01-23", "source": "https://rdap.verisign.com/com/v1/domain/posthog.com", "checkedAt": "2026-11-01T14:23:59.370052225Z" }, "pages": [ { "url": "https://posthog.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:17:07.593863392Z", "changedAt": "2026-11-07T14:17:07.593863392Z", "fingerprint": "e3af71f7b627" }, { "url": "https://posthog.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:17:09.971897037Z", "changedAt": "2026-11-07T14:17:09.971897037Z", "fingerprint": "b6bf14465bc4" }, { "url": "https://posthog.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:17:12.346376074Z", "changedAt": "2026-11-07T14:17:12.346376074Z", "fingerprint": "562ec288cab5" }, { "url": "https://posthog.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:17:15.548582875Z", "changedAt": "2026-11-07T14:17:15.548582875Z", "fingerprint": "78b5df11b9ff" } ], "mcpTools": { "url": "https://mcp.posthog.com/mcp", "checkedAt": "2026-11-07T01:46:54.661711518Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:46:54.661711518Z" }, "github": { "repo": "posthog/posthog", "checkedAt": "2026-11-02T09:17:59.883331399Z", "stars": 40594, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:17:42Z", "openIssues": 3875, "openPRs": 1342, "issuesOpened90d": 1602, "issuesClosed90d": 1028, "prsMerged90d": 18318, "ci": { "branch": "master", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-10-23T00:10:29Z" }, "advisories": [ { "ghsa": "GHSA-wqqw-r8c5-j67c", "cve": "CVE-2023-46746", "severity": "low", "published": "2023-11-28T12:07:41Z" } ] }, "updatedAt": "2026-11-07T18:20:48.109201502Z" } }, "answer": "PostHog scores 67.4 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category.", "b": { "slug": "userpilot", "name": "Userpilot", "vendor": "Userpilot, Inc.", "vendorUrl": "https://userpilot.com", "kind": "http-api", "category": "product-analytics", "summary": "Userpilot is a product adoption platform with in-app guides, surveys and product analytics for SaaS and mobile apps. Agents query funnels, trends, retention, users and companies through its hosted MCP server, and send or export data through HTTP APIs.", "url": "https://www.anchorterminal.com/tools/userpilot", "markdownUrl": "https://www.anchorterminal.com/tools/userpilot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/userpilot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/userpilot.json", "dns": "userpilot.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://mcp.userpilot.io/mcp", "packages": [ { "registry": "npm", "name": "userpilot" } ], "auth": "mixed", "authNotes": "The hosted MCP server uses OAuth 2.0 with PKCE, dynamic client registration and a permission screen. Scopes are data:read (always required), people:read, sessions:read, segments:write, reports:write, feedback:write and offline_access; the connection runs under the user's own role and can't delete or reach administration. The HTTP APIs take one environment API key as `Authorization: Token \u003ckey\u003e`, shown on the Environment page; the docs say to contact support to regenerate it.", "pricing": "paid", "pricingNotes": "Starter $299 a month for up to 2,000 MAU with basic trends and funnels; Growth from $849 a month with advanced analytics and the HTTP API; Enterprise by quote with SSO, activity logs and a custom SLA. Bulk export, import and data warehouse sync are add-ons. 14-day free trial with no card required.", "priceSummary": "$299 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, llms.txt, the MCP docs or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 235722, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.userpilot.com/api-references/overview", "llmsTxt": "https://docs.userpilot.com/llms.txt", "registryName": "io.userpilot/mcp", "capabilities": [ "analytics.query", "analytics.funnels", "analytics.events" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "mcp-registry", "oauth", "llms-txt", "no-card", "status-page", "soc2", "closed-source", "webhooks", "eu-region" ], "lastRelease": "2026-10-11", "graded": true, "anchor": { "graded": true, "score": 64.4, "grade": "B", "agentReady": false, "rank": 471, "ranked": true, "rankOf": 1486, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 82, "schema": 71, "security": 62, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Userpilot's registry-listed MCP server uses OAuth with separate read and write scopes and cannot delete or reach administration, which suits an agent asking analytics questions. Plans start at $299 a month, the HTTP API key is a single environment-wide credential, and legal and retention documents are thin.", "bestFor": "SaaS teams already using Userpilot for onboarding who want an agent to answer analytics questions and draft segments and surveys.", "strengths": [ "Hosted MCP server in the official registry as io.userpilot/mcp, with OAuth and PKCE", "Scopes split reads of analytics, profiles and session replay from writes of segments, reports and survey drafts", "No delete, publish or administration actions are reachable through MCP", "Status page with three ingestion regions and no incidents from August to November 2026", "llms.txt and Markdown docs, with OpenAPI 3.0 on each API reference page" ], "weaknesses": [ "Plans start at $299 a month, and the HTTP API needs Growth from $849", "The HTTP API uses one environment-wide key that support has to regenerate", "The MCP tool list and its rate limits aren't published", "No security.txt, disclosure policy or bug bounty found", "The privacy policy and security page name different sub-processors" ], "agentNotes": [ "Ask for only the scopes the task needs; profile and session replay reads are separate grants", "Expect survey writes to stay drafts that a person reviews and publishes in Userpilot", "Refresh the connector's tool list after Userpilot adds tools, since clients cache it", "Back off exponentially on 429 from Identify and Track, which allow 600 requests a minute", "Use the bulk export job API for raw events rather than looping over analytics tools" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.4 } ], "editorialScores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 82, "schema": 71, "security": 62, "transparency": 42 }, "provenanceScore": 76, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add --transport http userpilot https://mcp.userpilot.io/mcp", "config": { "mcpServers": { "userpilot": { "url": "https://mcp.userpilot.io/mcp" } } } }, "letme": { "capability": "https://letme.dev/analytics.query", "tool": "https://letme.dev/userpilot" }, "area": "business", "unitPrices": [ { "item": "Starter plan", "unit": "month", "usd": 299, "note": "Up to 2,000 MAU" }, { "item": "Growth plan", "unit": "month", "usd": 849, "note": "Starting price; includes advanced product analytics and the HTTP API" } ], "provenance": { "legalEntity": "Userpilot, Inc.", "domain": "userpilot.com", "domainRegistered": "2011-01-08", "endpointOnVendorDomain": false, "terms": "https://userpilot.com/terms-of-use/", "privacy": "https://userpilot.com/privacy-policy/", "statusPage": "https://status.userpilot.io", "changelog": "https://docs.userpilot.com/developer/installation/mobile/ios/mobile-ios-release-notes", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The MCP server and APIs are on userpilot.io; the website and legal pages are on userpilot.com.", "The terms were last updated on 23 April 2024 and the privacy policy on 11 March 2025, which names a DPO and Userpilot, Inc. in Austin, Texas.", "docs.userpilot.com/robots.txt carries Content-Signal ai-train=yes, search=yes, ai-input=yes. userpilot.com/robots.txt disallows only search paths.", "userpilot.com/.well-known/security.txt returned 404, and the security page names no disclosure policy or bug bounty.", "RDAP gives userpilot.com a registration date of 8 January 2011." ], "score": 76 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/userpilot.json", "live": { "slug": "userpilot", "probe": { "target": "https://mcp.userpilot.io/mcp", "method": "get", "lastAt": "2026-11-07T18:21:02.792914465Z", "lastOk": true, "lastStatus": 405, "lastMs": 563, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 495, "p95ms24h": 585, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.userpilot.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:54.858690533Z" }, "versions": [ { "registry": "mcp-registry", "name": "io.userpilot/mcp", "version": "1.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "userpilot", "version": "1.4.3", "seenAt": "2026-11-07T00:14:26.929507083Z" } ], "npmWeekly": 235722, "securityTxt": { "url": "https://userpilot.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:10.604728076Z" }, "llmsTxt": { "url": "https://docs.userpilot.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:15.247254272Z" }, "pages": [ { "url": "https://docs.userpilot.com/developer/installation/mobile/ios/mobile-ios-release-notes", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:08:32.05689434Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b489ebf9a491" }, { "url": "https://userpilot.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:23:01.88432514Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "299f9d9cd275" }, { "url": "https://userpilot.com/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:23:04.076461926Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "dea374efccdb" } ], "mcpTools": { "url": "https://mcp.userpilot.io/mcp", "checkedAt": "2026-11-07T01:48:55.558250288Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:48:55.558250288Z" }, "updatedAt": "2026-11-07T18:21:02.792914465Z" } }, "edges": [ { "by": 24, "category": "transparency", "leads": "posthog", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT outside the `ee` directory, which has its own licence and is part of what PostHog Cloud runs (25 of 30). Privacy policy, a self-serve DPA and the terms agree. The terms let PostHog use de-identified customer content to train its own models unless the customer opts out, and bar third parties from training on it. The privacy policy gives no retention periods, while the pricing page gives 1 year on the free plan and 7 on paid (22). No deprecation policy was found, and the query docs reserve the right to restrict export-like queries without notice. 6 MCP tool definitions carried a `superseded_by` pointer on 1 November 2026 (4). Sub-processor list updated 12 June 2026 with locations, 14 days' notice of changes, and data in Virginia or Germany (20).", "b": "A closed service with terms dated 23 April 2024 (15 of 30). The privacy policy of 11 March 2025 names a DPO and two sub-processors (AWS and Cloudflare), while the security page names AWS, Google Cloud and Stripe. The DPA is on request and no customer-data retention period is stated (14 of 30). No deprecation policy or dated API notices found (3 of 20). Sub-processors are named with addresses but not data locations, though an EU ingestion endpoint exists (10 of 20). 15+14+3+10 = 42." }, "scores": { "a": 83, "b": 59 } }, { "by": 22, "category": "security", "leads": "posthog", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2 with PKCE, 226 scopes, a revocation endpoint and dynamic registration, or personal API keys with scopes, project limits and rolling. A key can still be created with full access, and keys found in public GitHub repositories are rolled automatically (28). Read-only mode, filters by product area or tool, project pinning, and a typed confirmation for 18 admin actions (18). The MCP docs warn about prompt injection and tell users to review tool calls, and the CLI escapes informational responses. No further mitigation is documented for event and replay data that end users wrote (9). Activity logs with an API, MCP calls recorded with the caller's IP, and an admin view of every key with last use. Longer retention needs a platform package (12). security.txt valid to 30 August 2027, Bugcrowd disclosure programme paid in merchandise, public SOC 2 Type 2 report, annual penetration test and a public advisories page (17).", "b": "The MCP server uses OAuth with PKCE, dynamic client registration, revocation, separate read and write scopes and the user's own role. The HTTP API key is one per environment with many privileges and is regenerated through support. Averaged over both surfaces (22 of 30). Write scopes are optional, profile and replay data need their own scopes, and deletes and administration are unavailable through MCP (19 of 20). Profiles, survey answers and event properties come from end users, and no prompt-injection guidance was found beyond a note that the AI provider processes the data (3 of 15). Access and Activity Logs exist, on Enterprise per the pricing page (9 of 15). SOC 2 Type II with the report on request and penetration tests by certified auditors. No security.txt, disclosure policy or bug bounty (9 of 20). 22+19+3+9+9 = 62." }, "scores": { "a": 84, "b": 62 } }, { "by": 18, "category": "ergonomics", "leads": "posthog", "name": "Agent ergonomics", "reasons": { "a": "1,183 MCP tool definitions in the repository on 1 November 2026 (375 behind feature flags) is far past 30 (5). Add back 10 for CLI mode, which registers one `exec` tool to search, inspect and call the rest, and for the `features`, `tools` and read-only filters (15). Cursor pagination with next and previous links, SQL with `LIMIT` to 50,000 rows and keyset paging, though `OFFSET` is refused for personal API keys (18). Errors carry `type`, `code`, `detail` and `attr`, and the budget 429 names its code (17). Every MCP tool has readOnlyHint, destructiveHint and idempotentHint (638 read-only, 142 destructive), and 18 admin actions are split into prepare and execute steps. No idempotency keys on REST writes (15). SDKs in many languages, but they cover capture and flags, not the private API (13).", "b": "The tool count isn't published; the docs say the assistant can search hundreds of extra read-only operations on demand, which reads as dynamic loading. Without the list we give the middle band (15 of 25). Export jobs filter by date range, users, events and segments, and job lists paginate (14 of 20). A documented error reference (13 of 20). No deletes or admin through MCP by design; annotations weren't readable and no idempotency keys were found (10 of 20). The HTTP APIs have no official server-side SDK; client SDKs for web and six mobile frameworks (8 of 15). 15+14+13+10+8 = 60." }, "scores": { "a": 78, "b": 60 } }, { "by": 10, "category": "schema", "leads": "posthog", "name": "Schema \u0026 documentation", "reasons": { "a": "OpenAPI 3.1 served without a login, 1,742 paths and 2,347 operations, and typed JSON Schema inputs on the MCP tools (25). llms.txt, and every docs page has a Markdown copy at the same address with .md (10). 1,487 of 2,347 operations (63 per cent) have a description. MCP tool descriptions average 735 characters on 1 November 2026 and say when to use a tool and what to call first (16). 1,243 enums across 4,792 schemas and a required scope on most operations (13). 706 examples in the spec. It documents 400 on 224 operations and 429 on 55, and the docs show the error shape with examples (9). Dated public changelog with RSS, but the spec version is fixed at 1.0.0 and the API has no versions (8).", "b": "Every API reference page embeds an OpenAPI 3.0 definition, though no standalone spec file was found (20 of 25). llms.txt and Markdown versions of every page (10). Endpoint pages state their purpose and the MCP docs say what each permission allows; the MCP tool definitions weren't read because that needs a session (12 of 20). Request bodies are typed, mostly as strings and string arrays with few enums (9 of 15). An error reference covers 400, 401, 422 and 429 with causes, and pages carry examples (12 of 15). /v1 paths and dated SDK release notes; no API changelog was found (8 of 15). 20+10+12+9+12+8 = 71." }, "scores": { "a": 81, "b": 71 } }, { "by": 10, "category": "payments", "leads": "posthog", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Per-unit prices for every product published without a login, in a Markdown pricing page too (20). Free plan with no card (20). A person signs up in a browser and creates a key or approves OAuth (0).", "b": "No x402, MPP or L402 (0). Plan prices are public ($299 and from $849 a month), with no per-unit prices (10). 14-day free trial with no card required (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30." }, "scores": { "a": 40, "b": 30 } }, { "by": 10, "category": "maintenance", "leads": "posthog", "name": "Maintenance \u0026 community", "reasons": { "a": "The changelog's newest entries are dated 30 October 2026, and posthog-node 5.61.1 and the Python SDK's posthog-v7.81.1 came out the same day (30). 204 dated changelog entries since 3 August 2026 (20). Public changelog, community questions and in-app support. Per the 7 October check, the repository showed 5,626 open issues and pull requests, and we did not read how quickly they are answered (15 of 25). `io.github.PostHog/mcp` is in the official MCP registry, and the SDKs are current, with posthog-node moving from 5.55.0 to 5.61.1 between 7 and 30 October 2026 (15). 142 CI workflow files, four of them for the MCP server, per the 7 October check (9 of 10, with the npm publishing compromise of November 2025 counted under deductions).", "b": "io.userpilot/mcp 1.0.0 was published to the registry on 11 October 2026 (30). The iOS SDK alone has dated releases on 6 August, 2 September, 27 September and 2 October 2026 (20). A closed service with no public API changelog, support by email and chat (8 of 25). Verified io.userpilot namespace in the official MCP registry (15). Client SDKs are current; there is nothing else public to inspect (6 of 10). 30+20+8+15+6 = 79." }, "scores": { "a": 89, "b": 79 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "PostHog Inc.", "b": "Userpilot, Inc.", "name": "Vendor" }, { "a": "https://us.posthog.com", "b": "https://mcp.userpilot.io/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms", "b": "none", "name": "Licence" }, { "a": "1183", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "io.github.PostHog/mcp", "b": "io.userpilot/mcp", "name": "MCP registry" }, { "a": "2026-10-30", "b": "2026-10-11", "name": "Last release" }, { "a": "2026-06-29", "b": "2024-04-23", "name": "Terms last updated" }, { "a": "2026-06-29", "b": "2025-03-11", "name": "Privacy policy last updated" }, { "a": "yes, with an opt-out", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "40k stars, 15.2M npm/wk", "b": "236k npm/wk", "name": "Popularity" }, { "a": "3.3/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "PostHog scores 67.4 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category.", "question": "Which is better for AI agents, PostHog or Userpilot?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do PostHog and Userpilot need an API key?" }, { "answer": "Yes. PostHog has a hosted endpoint at https://us.posthog.com and Userpilot at https://mcp.userpilot.io/mcp.", "question": "Can an agent call PostHog and Userpilot without installing anything?" }, { "answer": "PostHog is open source (MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms). No open-source release is listed for Userpilot.", "question": "Are PostHog and Userpilot open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 81 against 71", "Agent ergonomics, 78 against 60", "Security \u0026 auth, 84 against 62", "Payments \u0026 pricing, 40 against 30", "Maintenance \u0026 community, 89 against 79", "Transparency \u0026 trust, 83 against 59" ], "also": [ "Open source" ], "goodFor": "An agent that answers product questions in SQL or with funnel, retention and trends queries, and that manages feature flags, experiments and error tracking in the same project.", "slug": "posthog", "watchFor": "28 incidents on the status feed between 4 August and 27 October 2026, three of them analytics query timeouts or failures" }, { "aheadOn": null, "also": [ "No incidents deducted, where PostHog loses 10 points for them" ], "goodFor": "SaaS teams already using Userpilot for onboarding who want an agent to answer analytics questions and draft segments and surveys.", "slug": "userpilot", "watchFor": "Plans start at $299 a month, and the HTTP API needs Growth from $849" } ], "history": { "posthog": [ { "causes": [ "security", "correction" ], "date": "2026-11-01", "delta": -1, "from": 68.4, "fromGrade": "B", "to": 67.4, "toGrade": "B" } ], "userpilot": null }, "job": { "capability": "analytics.query", "name": "Analytics queries" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amplitude-vs-posthog.json", "title": "Amplitude vs PostHog", "url": "https://www.anchorterminal.com/compare/amplitude-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/amplitude-vs-userpilot.json", "title": "Amplitude vs Userpilot", "url": "https://www.anchorterminal.com/compare/amplitude-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/basedash-mcp-vs-posthog.json", "title": "Basedash MCP vs PostHog", "url": "https://www.anchorterminal.com/compare/basedash-mcp-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/basedash-mcp-vs-userpilot.json", "title": "Basedash MCP vs Userpilot", "url": "https://www.anchorterminal.com/compare/basedash-mcp-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-posthog.json", "title": "Countly vs PostHog", "url": "https://www.anchorterminal.com/compare/countly-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/countly-vs-userpilot.json", "title": "Countly vs Userpilot", "url": "https://www.anchorterminal.com/compare/countly-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-posthog.json", "title": "Fullstory vs PostHog", "url": "https://www.anchorterminal.com/compare/fullstory-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/fullstory-vs-userpilot.json", "title": "Fullstory vs Userpilot", "url": "https://www.anchorterminal.com/compare/fullstory-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-userpilot.json", "title": "GrowthBook vs Userpilot", "url": "https://www.anchorterminal.com/compare/growthbook-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/matomo-vs-posthog.json", "title": "Matomo vs PostHog", "url": "https://www.anchorterminal.com/compare/matomo-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/matomo-vs-userpilot.json", "title": "Matomo vs Userpilot", "url": "https://www.anchorterminal.com/compare/matomo-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/mixpanel-vs-posthog.json", "title": "Mixpanel vs PostHog", "url": "https://www.anchorterminal.com/compare/mixpanel-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/mixpanel-vs-userpilot.json", "title": "Mixpanel vs Userpilot", "url": "https://www.anchorterminal.com/compare/mixpanel-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog.json", "title": "Mostly Good Metrics vs PostHog", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.json", "title": "Mostly Good Metrics vs Userpilot", "url": "https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/openpanel-vs-posthog.json", "title": "OpenPanel vs PostHog", "url": "https://www.anchorterminal.com/compare/openpanel-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/openpanel-vs-userpilot.json", "title": "OpenPanel vs Userpilot", "url": "https://www.anchorterminal.com/compare/openpanel-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/optimizely-vs-userpilot.json", "title": "Optimizely Experimentation vs Userpilot", "url": "https://www.anchorterminal.com/compare/optimizely-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/pendo-vs-posthog.json", "title": "Pendo vs PostHog", "url": "https://www.anchorterminal.com/compare/pendo-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/pendo-vs-userpilot.json", "title": "Pendo vs Userpilot", "url": "https://www.anchorterminal.com/compare/pendo-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/posthog-vs-statsig.json", "title": "PostHog vs Statsig", "url": "https://www.anchorterminal.com/compare/posthog-vs-statsig" }, { "json": "https://www.anchorterminal.com/compare/posthog-vs-woopra.json", "title": "PostHog vs Woopra", "url": "https://www.anchorterminal.com/compare/posthog-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/statsig-vs-userpilot.json", "title": "Statsig vs Userpilot", "url": "https://www.anchorterminal.com/compare/statsig-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/userpilot-vs-woopra.json", "title": "Userpilot vs Woopra", "url": "https://www.anchorterminal.com/compare/userpilot-vs-woopra" }, { "json": "https://www.anchorterminal.com/compare/flagsmith-vs-posthog.json", "title": "Flagsmith vs PostHog", "url": "https://www.anchorterminal.com/compare/flagsmith-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/harness-fme-vs-posthog.json", "title": "Harness Feature Management \u0026 Experimentation vs PostHog", "url": "https://www.anchorterminal.com/compare/harness-fme-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/launchdarkly-vs-posthog.json", "title": "LaunchDarkly vs PostHog", "url": "https://www.anchorterminal.com/compare/launchdarkly-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-posthog.json", "title": "Heap vs PostHog", "url": "https://www.anchorterminal.com/compare/heap-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/heap-vs-userpilot.json", "title": "Heap vs Userpilot", "url": "https://www.anchorterminal.com/compare/heap-vs-userpilot" }, { "json": "https://www.anchorterminal.com/compare/growthbook-vs-posthog.json", "title": "GrowthBook vs PostHog", "url": "https://www.anchorterminal.com/compare/growthbook-vs-posthog" }, { "json": "https://www.anchorterminal.com/compare/optimizely-vs-posthog.json", "title": "Optimizely Experimentation vs PostHog", "url": "https://www.anchorterminal.com/compare/optimizely-vs-posthog" } ], "panel": null, "scores": [ { "by": 2, "edge": "posthog", "key": "reliability", "name": "Reliability", "posthog": 84, "userpilot": 82, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 10, "edge": "posthog", "key": "schema", "name": "Schema \u0026 documentation", "posthog": 81, "userpilot": 71, "weight": 13 }, { "by": 18, "edge": "posthog", "key": "ergonomics", "name": "Agent ergonomics", "posthog": 78, "userpilot": 60, "weight": 13 }, { "by": 22, "edge": "posthog", "key": "security", "name": "Security \u0026 auth", "posthog": 84, "userpilot": 62, "weight": 14 }, { "by": 10, "edge": "posthog", "key": "payments", "name": "Payments \u0026 pricing", "posthog": 40, "userpilot": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 10, "edge": "posthog", "key": "maintenance", "name": "Maintenance \u0026 community", "posthog": 89, "userpilot": 79, "weight": 7 }, { "by": 24, "edge": "posthog", "key": "transparency", "name": "Transparency \u0026 trust", "posthog": 83, "userpilot": 59, "weight": 7 } ], "summary": "PostHog scores 67.4 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category. Both do analytics queries.", "tasks": null, "tutorials": [], "verdicts": { "posthog": "PostHog suits agents that need to query product data and manage flags or experiments. Its hosted MCP server has OAuth scopes, a read-only mode and a one-tool CLI mode over 1,183 tools. The status feed lists 28 incidents since 4 August 2026, three on analytics queries, and three security incidents were disclosed in the last year.", "userpilot": "Userpilot's registry-listed MCP server uses OAuth with separate read and write scopes and cannot delete or reach administration, which suits an agent asking analytics questions. Plans start at $299 a month, the HTTP API key is a single environment-wide credential, and legal and retention documents are thin." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/posthog-vs-userpilot", "json": "https://www.anchorterminal.com/compare/posthog-vs-userpilot.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/posthog-vs-userpilot.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/posthog-vs-userpilot.min.md" }, "markdown": "PostHog scores 67.4 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category. Both do analytics queries.\n\n- PostHog: grade B, 67.4/100, rank #327 of 1486. Markdown https://www.anchorterminal.com/tools/posthog.md · JSON https://www.anchorterminal.com/api/v1/tools/posthog.json\n- Userpilot: grade B, 64.4/100, rank #471 of 1486. Markdown https://www.anchorterminal.com/tools/userpilot.md · JSON https://www.anchorterminal.com/api/v1/tools/userpilot.json\n- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md\n- All 153 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md\n\n## Which one, for what\n\n### PostHog (B)\n\nGood for: An agent that answers product questions in SQL or with funnel, retention and trends queries, and that manages feature flags, experiments and error tracking in the same project.\n\nAhead on:\n- Schema \u0026 documentation, 81 against 71\n- Agent ergonomics, 78 against 60\n- Security \u0026 auth, 84 against 62\n- Payments \u0026 pricing, 40 against 30\n- Maintenance \u0026 community, 89 against 79\n- Transparency \u0026 trust, 83 against 59\n\nAlso in its favour:\n- Open source\n\nWatch for: 28 incidents on the status feed between 4 August and 27 October 2026, three of them analytics query timeouts or failures\n\n### Userpilot (B)\n\nGood for: SaaS teams already using Userpilot for onboarding who want an agent to answer analytics questions and draft segments and surveys.\n\nAlso in its favour:\n- No incidents deducted, where PostHog loses 10 points for them\n\nWatch for: Plans start at $299 a month, and the HTTP API needs Growth from $849\n\n\n## Why the edge\n\n### Transparency \u0026 trust: PostHog +24\n\n- PostHog (83): MIT outside the `ee` directory, which has its own licence and is part of what PostHog Cloud runs (25 of 30). Privacy policy, a self-serve DPA and the terms agree. The terms let PostHog use de-identified customer content to train its own models unless the customer opts out, and bar third parties from training on it. The privacy policy gives no retention periods, while the pricing page gives 1 year on the free plan and 7 on paid (22). No deprecation policy was found, and the query docs reserve the right to restrict export-like queries without notice. 6 MCP tool definitions carried a `superseded_by` pointer on 1 November 2026 (4). Sub-processor list updated 12 June 2026 with locations, 14 days' notice of changes, and data in Virginia or Germany (20).\n- Userpilot (59): A closed service with terms dated 23 April 2024 (15 of 30). The privacy policy of 11 March 2025 names a DPO and two sub-processors (AWS and Cloudflare), while the security page names AWS, Google Cloud and Stripe. The DPA is on request and no customer-data retention period is stated (14 of 30). No deprecation policy or dated API notices found (3 of 20). Sub-processors are named with addresses but not data locations, though an EU ingestion endpoint exists (10 of 20). 15+14+3+10 = 42.\n\n### Security \u0026 auth: PostHog +22\n\n- PostHog (84): OAuth 2 with PKCE, 226 scopes, a revocation endpoint and dynamic registration, or personal API keys with scopes, project limits and rolling. A key can still be created with full access, and keys found in public GitHub repositories are rolled automatically (28). Read-only mode, filters by product area or tool, project pinning, and a typed confirmation for 18 admin actions (18). The MCP docs warn about prompt injection and tell users to review tool calls, and the CLI escapes informational responses. No further mitigation is documented for event and replay data that end users wrote (9). Activity logs with an API, MCP calls recorded with the caller's IP, and an admin view of every key with last use. Longer retention needs a platform package (12). security.txt valid to 30 August 2027, Bugcrowd disclosure programme paid in merchandise, public SOC 2 Type 2 report, annual penetration test and a public advisories page (17).\n- Userpilot (62): The MCP server uses OAuth with PKCE, dynamic client registration, revocation, separate read and write scopes and the user's own role. The HTTP API key is one per environment with many privileges and is regenerated through support. Averaged over both surfaces (22 of 30). Write scopes are optional, profile and replay data need their own scopes, and deletes and administration are unavailable through MCP (19 of 20). Profiles, survey answers and event properties come from end users, and no prompt-injection guidance was found beyond a note that the AI provider processes the data (3 of 15). Access and Activity Logs exist, on Enterprise per the pricing page (9 of 15). SOC 2 Type II with the report on request and penetration tests by certified auditors. No security.txt, disclosure policy or bug bounty (9 of 20). 22+19+3+9+9 = 62.\n\n### Agent ergonomics: PostHog +18\n\n- PostHog (78): 1,183 MCP tool definitions in the repository on 1 November 2026 (375 behind feature flags) is far past 30 (5). Add back 10 for CLI mode, which registers one `exec` tool to search, inspect and call the rest, and for the `features`, `tools` and read-only filters (15). Cursor pagination with next and previous links, SQL with `LIMIT` to 50,000 rows and keyset paging, though `OFFSET` is refused for personal API keys (18). Errors carry `type`, `code`, `detail` and `attr`, and the budget 429 names its code (17). Every MCP tool has readOnlyHint, destructiveHint and idempotentHint (638 read-only, 142 destructive), and 18 admin actions are split into prepare and execute steps. No idempotency keys on REST writes (15). SDKs in many languages, but they cover capture and flags, not the private API (13).\n- Userpilot (60): The tool count isn't published; the docs say the assistant can search hundreds of extra read-only operations on demand, which reads as dynamic loading. Without the list we give the middle band (15 of 25). Export jobs filter by date range, users, events and segments, and job lists paginate (14 of 20). A documented error reference (13 of 20). No deletes or admin through MCP by design; annotations weren't readable and no idempotency keys were found (10 of 20). The HTTP APIs have no official server-side SDK; client SDKs for web and six mobile frameworks (8 of 15). 15+14+13+10+8 = 60.\n\n### Schema \u0026 documentation: PostHog +10\n\n- PostHog (81): OpenAPI 3.1 served without a login, 1,742 paths and 2,347 operations, and typed JSON Schema inputs on the MCP tools (25). llms.txt, and every docs page has a Markdown copy at the same address with .md (10). 1,487 of 2,347 operations (63 per cent) have a description. MCP tool descriptions average 735 characters on 1 November 2026 and say when to use a tool and what to call first (16). 1,243 enums across 4,792 schemas and a required scope on most operations (13). 706 examples in the spec. It documents 400 on 224 operations and 429 on 55, and the docs show the error shape with examples (9). Dated public changelog with RSS, but the spec version is fixed at 1.0.0 and the API has no versions (8).\n- Userpilot (71): Every API reference page embeds an OpenAPI 3.0 definition, though no standalone spec file was found (20 of 25). llms.txt and Markdown versions of every page (10). Endpoint pages state their purpose and the MCP docs say what each permission allows; the MCP tool definitions weren't read because that needs a session (12 of 20). Request bodies are typed, mostly as strings and string arrays with few enums (9 of 15). An error reference covers 400, 401, 422 and 429 with causes, and pages carry examples (12 of 15). /v1 paths and dated SDK release notes; no API changelog was found (8 of 15). 20+10+12+9+12+8 = 71.\n\n### Payments \u0026 pricing: PostHog +10\n\n- PostHog (40): No x402, MPP or L402 (0). Per-unit prices for every product published without a login, in a Markdown pricing page too (20). Free plan with no card (20). A person signs up in a browser and creates a key or approves OAuth (0).\n- Userpilot (30): No x402, MPP or L402 (0). Plan prices are public ($299 and from $849 a month), with no per-unit prices (10). 14-day free trial with no card required (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.\n\n### Maintenance \u0026 community: PostHog +10\n\n- PostHog (89): The changelog's newest entries are dated 30 October 2026, and posthog-node 5.61.1 and the Python SDK's posthog-v7.81.1 came out the same day (30). 204 dated changelog entries since 3 August 2026 (20). Public changelog, community questions and in-app support. Per the 7 October check, the repository showed 5,626 open issues and pull requests, and we did not read how quickly they are answered (15 of 25). `io.github.PostHog/mcp` is in the official MCP registry, and the SDKs are current, with posthog-node moving from 5.55.0 to 5.61.1 between 7 and 30 October 2026 (15). 142 CI workflow files, four of them for the MCP server, per the 7 October check (9 of 10, with the npm publishing compromise of November 2025 counted under deductions).\n- Userpilot (79): io.userpilot/mcp 1.0.0 was published to the registry on 11 October 2026 (30). The iOS SDK alone has dated releases on 6 August, 2 September, 27 September and 2 October 2026 (20). A closed service with no public API changelog, support by email and chat (8 of 25). Verified io.userpilot namespace in the official MCP registry (15). Client SDKs are current; there is nothing else public to inspect (6 of 10). 30+20+8+15+6 = 79.\n\n## Score by category\n\n| Category | Weight | PostHog | Userpilot | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 84 | 82 | PostHog +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 81 | 71 | PostHog +10 |\n| Agent ergonomics | 13% (16.2 this run) | 78 | 60 | PostHog +18 |\n| Security \u0026 auth | 14% (17.5 this run) | 84 | 62 | PostHog +22 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 30 | PostHog +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 89 | 79 | PostHog +10 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 83 | 59 | PostHog +24 |\n| Negative events | ≤15 | -10 | 0 | |\n| **Total** | | **67.4 · B** | **64.4 · B** | |\n\n## Facts side by side\n\n| Fact | PostHog | Userpilot |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | PostHog Inc. | Userpilot, Inc. |\n| Hosted endpoint | `https://us.posthog.com` | `https://mcp.userpilot.io/mcp` |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms | none |\n| Tools exposed | 1183 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `io.github.PostHog/mcp` | `io.userpilot/mcp` |\n| Last release | 2026-10-30 | 2026-10-11 |\n| Terms last updated | 2026-06-29 | 2024-04-23 |\n| Privacy policy last updated | 2026-06-29 | 2025-03-11 |\n| Customer content may train models | yes, with an opt-out | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 40k stars, 15.2M npm/wk | 236k npm/wk |\n| Agent reviews | 3.3/5 (4) | none |\n\n## How the scores have moved\n\n### PostHog\n\n- -1.0 on 1 November 2026: security, correction\n\n### Userpilot\n\nNo score change since it was listed.\n\n## Verdicts\n\n**PostHog.** PostHog suits agents that need to query product data and manage flags or experiments. Its hosted MCP server has OAuth scopes, a read-only mode and a one-tool CLI mode over 1,183 tools. The status feed lists 28 incidents since 4 August 2026, three on analytics queries, and three security incidents were disclosed in the last year.\n\n**Userpilot.** Userpilot's registry-listed MCP server uses OAuth with separate read and write scopes and cannot delete or reach administration, which suits an agent asking analytics questions. Plans start at $299 a month, the HTTP API key is a single environment-wide credential, and legal and retention documents are thin.\n\n## Before you call either\n\n### PostHog\n\n1. Add `?readonly=true` or the `x-posthog-read-only` header to the MCP URL unless the task needs writes\n2. Pin the session with `x-posthog-project-id`, which also removes the `switch-project` and `switch-organization` tools\n3. In CLI mode run `info \u003ctool\u003e` once before `call`, and send one `exec` command per request\n4. On a 429 with code `api_queries_budget_exceeded`, wait for `Retry-After` and read `X-PostHog-Query-Budget-Remaining-Bytes`\n5. Page SQL results by keyset on `timestamp`. `OFFSET` returns 400 for personal API keys, and results cap at 50,000 rows\n\n### Userpilot\n\n1. Ask for only the scopes the task needs; profile and session replay reads are separate grants\n2. Expect survey writes to stay drafts that a person reviews and publishes in Userpilot\n3. Refresh the connector's tool list after Userpilot adds tools, since clients cache it\n4. Back off exponentially on 429 from Identify and Track, which allow 600 requests a minute\n5. Use the bulk export job API for raw events rather than looping over analytics tools\n\n## Questions\n\n### Which is better for AI agents, PostHog or Userpilot?\n\nPostHog scores 67.4 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category.\n\n### Do PostHog and Userpilot need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call PostHog and Userpilot without installing anything?\n\nYes. PostHog has a hosted endpoint at https://us.posthog.com and Userpilot at https://mcp.userpilot.io/mcp.\n\n### Are PostHog and Userpilot open source?\n\nPostHog is open source (MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms). No open-source release is listed for Userpilot.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/posthog-vs-userpilot.json, and with the fewest tokens: https://www.anchorterminal.com/compare/posthog-vs-userpilot.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"posthog\", \"b\": \"userpilot\"}`. From a terminal: `anchor compare posthog userpilot`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/posthog.json and https://www.anchorterminal.com/api/v1/tools/userpilot.json\n\n## Other comparisons with PostHog or Userpilot\n\n- [Amplitude vs PostHog](https://www.anchorterminal.com/compare/amplitude-vs-posthog.md)\n- [Amplitude vs Userpilot](https://www.anchorterminal.com/compare/amplitude-vs-userpilot.md)\n- [Basedash MCP vs PostHog](https://www.anchorterminal.com/compare/basedash-mcp-vs-posthog.md)\n- [Basedash MCP vs Userpilot](https://www.anchorterminal.com/compare/basedash-mcp-vs-userpilot.md)\n- [Countly vs PostHog](https://www.anchorterminal.com/compare/countly-vs-posthog.md)\n- [Countly vs Userpilot](https://www.anchorterminal.com/compare/countly-vs-userpilot.md)\n- [Fullstory vs PostHog](https://www.anchorterminal.com/compare/fullstory-vs-posthog.md)\n- [Fullstory vs Userpilot](https://www.anchorterminal.com/compare/fullstory-vs-userpilot.md)\n- [GrowthBook vs Userpilot](https://www.anchorterminal.com/compare/growthbook-vs-userpilot.md)\n- [Matomo vs PostHog](https://www.anchorterminal.com/compare/matomo-vs-posthog.md)\n- [Matomo vs Userpilot](https://www.anchorterminal.com/compare/matomo-vs-userpilot.md)\n- [Mixpanel vs PostHog](https://www.anchorterminal.com/compare/mixpanel-vs-posthog.md)\n- [Mixpanel vs Userpilot](https://www.anchorterminal.com/compare/mixpanel-vs-userpilot.md)\n- [Mostly Good Metrics vs PostHog](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog.md)\n- [Mostly Good Metrics vs Userpilot](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.md)\n- [OpenPanel vs PostHog](https://www.anchorterminal.com/compare/openpanel-vs-posthog.md)\n- [OpenPanel vs Userpilot](https://www.anchorterminal.com/compare/openpanel-vs-userpilot.md)\n- [Optimizely Experimentation vs Userpilot](https://www.anchorterminal.com/compare/optimizely-vs-userpilot.md)\n- [Pendo vs PostHog](https://www.anchorterminal.com/compare/pendo-vs-posthog.md)\n- [Pendo vs Userpilot](https://www.anchorterminal.com/compare/pendo-vs-userpilot.md)\n- [PostHog vs Statsig](https://www.anchorterminal.com/compare/posthog-vs-statsig.md)\n- [PostHog vs Woopra](https://www.anchorterminal.com/compare/posthog-vs-woopra.md)\n- [Statsig vs Userpilot](https://www.anchorterminal.com/compare/statsig-vs-userpilot.md)\n- [Userpilot vs Woopra](https://www.anchorterminal.com/compare/userpilot-vs-woopra.md)\n- [Flagsmith vs PostHog](https://www.anchorterminal.com/compare/flagsmith-vs-posthog.md)\n- [Harness Feature Management \u0026 Experimentation vs PostHog](https://www.anchorterminal.com/compare/harness-fme-vs-posthog.md)\n- [LaunchDarkly vs PostHog](https://www.anchorterminal.com/compare/launchdarkly-vs-posthog.md)\n- [Heap vs PostHog](https://www.anchorterminal.com/compare/heap-vs-posthog.md)\n- [Heap vs Userpilot](https://www.anchorterminal.com/compare/heap-vs-userpilot.md)\n- [GrowthBook vs PostHog](https://www.anchorterminal.com/compare/growthbook-vs-posthog.md)\n- [Optimizely Experimentation vs PostHog](https://www.anchorterminal.com/compare/optimizely-vs-posthog.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "PostHog vs Userpilot", "url": "" } ], "description": "PostHog scores 67.4 (B) to Userpilot's 64.4 (B) for analytics queries. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "PostHog B 67.4", "Userpilot B 64.4", "scores" ], "h1": "PostHog vs Userpilot", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/posthog-vs-userpilot", "published": "2026-10-01", "section": "tools", "title": "PostHog vs Userpilot for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/posthog-vs-userpilot" }, "tokens": { "markdown": 4600, "slim": 2630 }, "version": 1 }