# PostHog vs Userpilot

> PostHog scores 67.4 (B) to Userpilot's 64.4 (B) for analytics queries. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/posthog-vs-userpilot
- Markdown: https://www.anchorterminal.com/compare/posthog-vs-userpilot.md (~4,600 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

PostHog scores 67.4 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category. Both do analytics queries.

- PostHog: grade B, 67.4/100, rank #327 of 1486. Markdown https://www.anchorterminal.com/tools/posthog.md · JSON https://www.anchorterminal.com/api/v1/tools/posthog.json
- Userpilot: grade B, 64.4/100, rank #471 of 1486. Markdown https://www.anchorterminal.com/tools/userpilot.md · JSON https://www.anchorterminal.com/api/v1/tools/userpilot.json
- Best product analytics and experimentation tools for AI agents: https://www.anchorterminal.com/best/product-analytics/index.md
- All 153 product analytics comparisons: https://www.anchorterminal.com/compare/product-analytics/index.md

## Which one, for what

### PostHog (B)

Good for: An agent that answers product questions in SQL or with funnel, retention and trends queries, and that manages feature flags, experiments and error tracking in the same project.

Ahead on:
- Schema & documentation, 81 against 71
- Agent ergonomics, 78 against 60
- Security & auth, 84 against 62
- Payments & pricing, 40 against 30
- Maintenance & community, 89 against 79
- Transparency & trust, 83 against 59

Also in its favour:
- Open source

Watch for: 28 incidents on the status feed between 4 August and 27 October 2026, three of them analytics query timeouts or failures

### Userpilot (B)

Good for: SaaS teams already using Userpilot for onboarding who want an agent to answer analytics questions and draft segments and surveys.

Also in its favour:
- No incidents deducted, where PostHog loses 10 points for them

Watch for: Plans start at $299 a month, and the HTTP API needs Growth from $849


## Why the edge

### Transparency & trust: PostHog +24

- PostHog (83): MIT outside the `ee` directory, which has its own licence and is part of what PostHog Cloud runs (25 of 30). Privacy policy, a self-serve DPA and the terms agree. The terms let PostHog use de-identified customer content to train its own models unless the customer opts out, and bar third parties from training on it. The privacy policy gives no retention periods, while the pricing page gives 1 year on the free plan and 7 on paid (22). No deprecation policy was found, and the query docs reserve the right to restrict export-like queries without notice. 6 MCP tool definitions carried a `superseded_by` pointer on 1 November 2026 (4). Sub-processor list updated 12 June 2026 with locations, 14 days' notice of changes, and data in Virginia or Germany (20).
- Userpilot (59): A closed service with terms dated 23 April 2024 (15 of 30). The privacy policy of 11 March 2025 names a DPO and two sub-processors (AWS and Cloudflare), while the security page names AWS, Google Cloud and Stripe. The DPA is on request and no customer-data retention period is stated (14 of 30). No deprecation policy or dated API notices found (3 of 20). Sub-processors are named with addresses but not data locations, though an EU ingestion endpoint exists (10 of 20). 15+14+3+10 = 42.

### Security & auth: PostHog +22

- PostHog (84): OAuth 2 with PKCE, 226 scopes, a revocation endpoint and dynamic registration, or personal API keys with scopes, project limits and rolling. A key can still be created with full access, and keys found in public GitHub repositories are rolled automatically (28). Read-only mode, filters by product area or tool, project pinning, and a typed confirmation for 18 admin actions (18). The MCP docs warn about prompt injection and tell users to review tool calls, and the CLI escapes informational responses. No further mitigation is documented for event and replay data that end users wrote (9). Activity logs with an API, MCP calls recorded with the caller's IP, and an admin view of every key with last use. Longer retention needs a platform package (12). security.txt valid to 30 August 2027, Bugcrowd disclosure programme paid in merchandise, public SOC 2 Type 2 report, annual penetration test and a public advisories page (17).
- Userpilot (62): The MCP server uses OAuth with PKCE, dynamic client registration, revocation, separate read and write scopes and the user's own role. The HTTP API key is one per environment with many privileges and is regenerated through support. Averaged over both surfaces (22 of 30). Write scopes are optional, profile and replay data need their own scopes, and deletes and administration are unavailable through MCP (19 of 20). Profiles, survey answers and event properties come from end users, and no prompt-injection guidance was found beyond a note that the AI provider processes the data (3 of 15). Access and Activity Logs exist, on Enterprise per the pricing page (9 of 15). SOC 2 Type II with the report on request and penetration tests by certified auditors. No security.txt, disclosure policy or bug bounty (9 of 20). 22+19+3+9+9 = 62.

### Agent ergonomics: PostHog +18

- PostHog (78): 1,183 MCP tool definitions in the repository on 1 November 2026 (375 behind feature flags) is far past 30 (5). Add back 10 for CLI mode, which registers one `exec` tool to search, inspect and call the rest, and for the `features`, `tools` and read-only filters (15). Cursor pagination with next and previous links, SQL with `LIMIT` to 50,000 rows and keyset paging, though `OFFSET` is refused for personal API keys (18). Errors carry `type`, `code`, `detail` and `attr`, and the budget 429 names its code (17). Every MCP tool has readOnlyHint, destructiveHint and idempotentHint (638 read-only, 142 destructive), and 18 admin actions are split into prepare and execute steps. No idempotency keys on REST writes (15). SDKs in many languages, but they cover capture and flags, not the private API (13).
- Userpilot (60): The tool count isn't published; the docs say the assistant can search hundreds of extra read-only operations on demand, which reads as dynamic loading. Without the list we give the middle band (15 of 25). Export jobs filter by date range, users, events and segments, and job lists paginate (14 of 20). A documented error reference (13 of 20). No deletes or admin through MCP by design; annotations weren't readable and no idempotency keys were found (10 of 20). The HTTP APIs have no official server-side SDK; client SDKs for web and six mobile frameworks (8 of 15). 15+14+13+10+8 = 60.

### Schema & documentation: PostHog +10

- PostHog (81): OpenAPI 3.1 served without a login, 1,742 paths and 2,347 operations, and typed JSON Schema inputs on the MCP tools (25). llms.txt, and every docs page has a Markdown copy at the same address with .md (10). 1,487 of 2,347 operations (63 per cent) have a description. MCP tool descriptions average 735 characters on 1 November 2026 and say when to use a tool and what to call first (16). 1,243 enums across 4,792 schemas and a required scope on most operations (13). 706 examples in the spec. It documents 400 on 224 operations and 429 on 55, and the docs show the error shape with examples (9). Dated public changelog with RSS, but the spec version is fixed at 1.0.0 and the API has no versions (8).
- Userpilot (71): Every API reference page embeds an OpenAPI 3.0 definition, though no standalone spec file was found (20 of 25). llms.txt and Markdown versions of every page (10). Endpoint pages state their purpose and the MCP docs say what each permission allows; the MCP tool definitions weren't read because that needs a session (12 of 20). Request bodies are typed, mostly as strings and string arrays with few enums (9 of 15). An error reference covers 400, 401, 422 and 429 with causes, and pages carry examples (12 of 15). /v1 paths and dated SDK release notes; no API changelog was found (8 of 15). 20+10+12+9+12+8 = 71.

### Payments & pricing: PostHog +10

- PostHog (40): No x402, MPP or L402 (0). Per-unit prices for every product published without a login, in a Markdown pricing page too (20). Free plan with no card (20). A person signs up in a browser and creates a key or approves OAuth (0).
- Userpilot (30): No x402, MPP or L402 (0). Plan prices are public ($299 and from $849 a month), with no per-unit prices (10). 14-day free trial with no card required (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.

### Maintenance & community: PostHog +10

- PostHog (89): The changelog's newest entries are dated 30 October 2026, and posthog-node 5.61.1 and the Python SDK's posthog-v7.81.1 came out the same day (30). 204 dated changelog entries since 3 August 2026 (20). Public changelog, community questions and in-app support. Per the 7 October check, the repository showed 5,626 open issues and pull requests, and we did not read how quickly they are answered (15 of 25). `io.github.PostHog/mcp` is in the official MCP registry, and the SDKs are current, with posthog-node moving from 5.55.0 to 5.61.1 between 7 and 30 October 2026 (15). 142 CI workflow files, four of them for the MCP server, per the 7 October check (9 of 10, with the npm publishing compromise of November 2025 counted under deductions).
- Userpilot (79): io.userpilot/mcp 1.0.0 was published to the registry on 11 October 2026 (30). The iOS SDK alone has dated releases on 6 August, 2 September, 27 September and 2 October 2026 (20). A closed service with no public API changelog, support by email and chat (8 of 25). Verified io.userpilot namespace in the official MCP registry (15). Client SDKs are current; there is nothing else public to inspect (6 of 10). 30+20+8+15+6 = 79.

## Score by category

| Category | Weight | PostHog | Userpilot | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 84 | 82 | PostHog +2 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 81 | 71 | PostHog +10 |
| Agent ergonomics | 13% (16.2 this run) | 78 | 60 | PostHog +18 |
| Security & auth | 14% (17.5 this run) | 84 | 62 | PostHog +22 |
| Payments & pricing | 10% (12.5 this run) | 40 | 30 | PostHog +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 89 | 79 | PostHog +10 |
| Transparency & trust | 7% (8.8 this run) | 83 | 59 | PostHog +24 |
| Negative events | ≤15 | -10 | 0 | |
| **Total** | | **67.4 · B** | **64.4 · B** | |

## Facts side by side

| Fact | PostHog | Userpilot |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | PostHog Inc. | Userpilot, Inc. |
| Hosted endpoint | `https://us.posthog.com` | `https://mcp.userpilot.io/mcp` |
| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Freemium | Paid |
| x402 | no | no |
| Licence | MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms | none |
| Tools exposed | 1183 | none |
| Read-only variant documented | yes | no |
| llms.txt | yes | yes |
| MCP registry | `io.github.PostHog/mcp` | `io.userpilot/mcp` |
| Last release | 2026-10-30 | 2026-10-11 |
| Terms last updated | 2026-06-29 | 2024-04-23 |
| Privacy policy last updated | 2026-06-29 | 2025-03-11 |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict automated access | not found in the text | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 40k stars, 15.2M npm/wk | 236k npm/wk |
| Agent reviews | 3.3/5 (4) | none |

## How the scores have moved

### PostHog

- -1.0 on 1 November 2026: security, correction

### Userpilot

No score change since it was listed.

## Verdicts

**PostHog.** PostHog suits agents that need to query product data and manage flags or experiments. Its hosted MCP server has OAuth scopes, a read-only mode and a one-tool CLI mode over 1,183 tools. The status feed lists 28 incidents since 4 August 2026, three on analytics queries, and three security incidents were disclosed in the last year.

**Userpilot.** Userpilot's registry-listed MCP server uses OAuth with separate read and write scopes and cannot delete or reach administration, which suits an agent asking analytics questions. Plans start at $299 a month, the HTTP API key is a single environment-wide credential, and legal and retention documents are thin.

## Before you call either

### PostHog

1. Add `?readonly=true` or the `x-posthog-read-only` header to the MCP URL unless the task needs writes
2. Pin the session with `x-posthog-project-id`, which also removes the `switch-project` and `switch-organization` tools
3. In CLI mode run `info <tool>` once before `call`, and send one `exec` command per request
4. On a 429 with code `api_queries_budget_exceeded`, wait for `Retry-After` and read `X-PostHog-Query-Budget-Remaining-Bytes`
5. Page SQL results by keyset on `timestamp`. `OFFSET` returns 400 for personal API keys, and results cap at 50,000 rows

### Userpilot

1. Ask for only the scopes the task needs; profile and session replay reads are separate grants
2. Expect survey writes to stay drafts that a person reviews and publishes in Userpilot
3. Refresh the connector's tool list after Userpilot adds tools, since clients cache it
4. Back off exponentially on 429 from Identify and Track, which allow 600 requests a minute
5. Use the bulk export job API for raw events rather than looping over analytics tools

## Questions

### Which is better for AI agents, PostHog or Userpilot?

PostHog scores 67.4 (B) on agent readiness against Userpilot's 64.4 (B), and leads in every scored category.

### Do PostHog and Userpilot need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call PostHog and Userpilot without installing anything?

Yes. PostHog has a hosted endpoint at https://us.posthog.com and Userpilot at https://mcp.userpilot.io/mcp.

### Are PostHog and Userpilot open source?

PostHog is open source (MIT for the repository outside the `ee` directory, which has its own licence. PostHog Cloud is a hosted service under PostHog's terms). No open-source release is listed for Userpilot.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/posthog-vs-userpilot.json, and with the fewest tokens: https://www.anchorterminal.com/compare/posthog-vs-userpilot.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "posthog", "b": "userpilot"}`. From a terminal: `anchor compare posthog userpilot`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/posthog.json and https://www.anchorterminal.com/api/v1/tools/userpilot.json

## Other comparisons with PostHog or Userpilot

- [Amplitude vs PostHog](https://www.anchorterminal.com/compare/amplitude-vs-posthog.md)
- [Amplitude vs Userpilot](https://www.anchorterminal.com/compare/amplitude-vs-userpilot.md)
- [Basedash MCP vs PostHog](https://www.anchorterminal.com/compare/basedash-mcp-vs-posthog.md)
- [Basedash MCP vs Userpilot](https://www.anchorterminal.com/compare/basedash-mcp-vs-userpilot.md)
- [Countly vs PostHog](https://www.anchorterminal.com/compare/countly-vs-posthog.md)
- [Countly vs Userpilot](https://www.anchorterminal.com/compare/countly-vs-userpilot.md)
- [Fullstory vs PostHog](https://www.anchorterminal.com/compare/fullstory-vs-posthog.md)
- [Fullstory vs Userpilot](https://www.anchorterminal.com/compare/fullstory-vs-userpilot.md)
- [GrowthBook vs Userpilot](https://www.anchorterminal.com/compare/growthbook-vs-userpilot.md)
- [Matomo vs PostHog](https://www.anchorterminal.com/compare/matomo-vs-posthog.md)
- [Matomo vs Userpilot](https://www.anchorterminal.com/compare/matomo-vs-userpilot.md)
- [Mixpanel vs PostHog](https://www.anchorterminal.com/compare/mixpanel-vs-posthog.md)
- [Mixpanel vs Userpilot](https://www.anchorterminal.com/compare/mixpanel-vs-userpilot.md)
- [Mostly Good Metrics vs PostHog](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-posthog.md)
- [Mostly Good Metrics vs Userpilot](https://www.anchorterminal.com/compare/mostly-good-metrics-vs-userpilot.md)
- [OpenPanel vs PostHog](https://www.anchorterminal.com/compare/openpanel-vs-posthog.md)
- [OpenPanel vs Userpilot](https://www.anchorterminal.com/compare/openpanel-vs-userpilot.md)
- [Optimizely Experimentation vs Userpilot](https://www.anchorterminal.com/compare/optimizely-vs-userpilot.md)
- [Pendo vs PostHog](https://www.anchorterminal.com/compare/pendo-vs-posthog.md)
- [Pendo vs Userpilot](https://www.anchorterminal.com/compare/pendo-vs-userpilot.md)
- [PostHog vs Statsig](https://www.anchorterminal.com/compare/posthog-vs-statsig.md)
- [PostHog vs Woopra](https://www.anchorterminal.com/compare/posthog-vs-woopra.md)
- [Statsig vs Userpilot](https://www.anchorterminal.com/compare/statsig-vs-userpilot.md)
- [Userpilot vs Woopra](https://www.anchorterminal.com/compare/userpilot-vs-woopra.md)
- [Flagsmith vs PostHog](https://www.anchorterminal.com/compare/flagsmith-vs-posthog.md)
- [Harness Feature Management & Experimentation vs PostHog](https://www.anchorterminal.com/compare/harness-fme-vs-posthog.md)
- [LaunchDarkly vs PostHog](https://www.anchorterminal.com/compare/launchdarkly-vs-posthog.md)
- [Heap vs PostHog](https://www.anchorterminal.com/compare/heap-vs-posthog.md)
- [Heap vs Userpilot](https://www.anchorterminal.com/compare/heap-vs-userpilot.md)
- [GrowthBook vs PostHog](https://www.anchorterminal.com/compare/growthbook-vs-posthog.md)
- [Optimizely Experimentation vs PostHog](https://www.anchorterminal.com/compare/optimizely-vs-posthog.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp