RudderStack MCP vs Woopra

RudderStack MCP 85

Release notes dated 4 November 2026 and a registry version on 6 November (30). Many dated releases in 90 days (20). Public issue templates on the MCP repository, issues not read, plus release notes (10 of 25). Official registry entry io.github.rudderlabs/rudderstack-mcp and current official SDKs (15). A repository workflow publishes to the registry (10). 30 + 20 + 10 + 15 + 10 = 85. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Woopra 9

The newest dated change found is a commit to the browser tracker on 16 March 2026, and the REST intro page was last edited on 13 March 2026, both more than 180 days before the check (0). No releases or dated changelog entries in the last 90 days (0). No API changelog. Support is by email and in-app, and response times were not checked (3). The browser tracker's last tag is v5.3.0 from 2021, iOS and Android were last committed to in November 2024, and the Node, Python, Java and Rails SDKs in 2017 (4). The Node README carries a Travis CI badge and no current CI was found (2). Total 9.

RudderStack MCP 62

OAuth with PKCE and dynamic registration, scopes not published (22 of 30). Access classes, a read-only surface and confirmation advice for writes (16 of 20). Selected sensitive fields in event payloads and errors are redacted or hashed before they reach the model, but event payloads are still untrusted text (8 of 15). No audit log of MCP calls found (0). SOC 2 Type 2, HIPAA with a BAA, and a SECURITY.md with a private reporting address; no security.txt (404) (16 of 20). 22 + 16 + 8 + 0 + 16 = 62.

Woopra 22

REST calls use per-user access keys sent by HTTP Basic, with no scopes or rotation guidance found. Tracking calls need only the project name by default, with an optional Secure Tracking secret. Docs examples still show http:// tracking URLs (15 of 30). The pricing page states group and individual permission controls, but no read-only key or confirmation on /profile/delete was found (5). The API returns event and profile text that any caller who knows the project name can write, and no guidance on untrusted content was found (0). No audit log found in the docs (0). No security page, bug bounty or certification was found on the pages read, and security.txt timed out. The privacy policy states Data Privacy Framework certification (2). Total 22.

RudderStack MCP 45

Statuspage at status.rudderstack.com with regional components and none for MCP (15). Since August the history shows an EU ingestion issue, increased US latency, a Python transformations issue, free-tier processing delays and scheduled maintenance (20, minor incidents). No MCP rate limits found (0). No retry guidance for the MCP server found (0). No SLA found in the pages read (0). Not labelled beta (10). 15 + 20 + 0 + 0 + 0 + 10 = 45.

Woopra 80

Graded on the REST and HTTP tracking APIs with the hosted lines. Statuspage site at status.woopra.com with three components (20). Its history lists no incidents for August, September or October 2026, the three months shown (30). Limits published with numbers, 300 calls a minute, 600 an hour and 3,000 a day per project (15). A 429 status is documented and tracking calls answer 202 when queued, but no Retry-After, backoff guidance or idempotency key was found (5). No SLA found. The terms promise commercially reasonable efforts (0). The API is version 3.10 with no beta label (10). Total 80.

RudderStack MCP 66

The public repository's docs/tools.md lists 62 tools with an access class for each; JSON Schemas not read without a session (15 of 25). llms.txt (10). Every tool has a one-line purpose and a Read, Sensitive execution or Write class (15 of 20). Inputs not verifiable (5 of 15). Example prompts and a documented 'workspace_id is required' error (6 of 15). Versioned in the registry (0.43.1, 6 November) and dated release notes (15). 15 + 10 + 15 + 5 + 6 + 15 = 66.

Woopra 45

Each REST reference page embeds an OpenAPI 3.1 fragment in its Markdown copy. No single spec file was found, most operations define no responses, and the tracking endpoints are documented as tables (12). llms.txt and a .md copy of each page, though llms.txt lists four of fourteen REST operations (10). Descriptions are one line. The /profiles page repeats the /trends text, three profile operations have none, and one page still holds template placeholder text (6). Query parameters carry types and required flags. There are no enums, and profile edits take a JSON string in data (6). One curl example for REST and several tracking examples. Tracking response codes are explained, while REST errors are a 400 with an empty object (6). The version sits in the path and 3.10 is the only one supported. No changelog found (5). Total 45.

RudderStack MCP 51

The server's source is closed; the repository's MIT licence covers only its docs and metadata. Terms in a master service agreement naming RudderStack, Inc. (15). Privacy policy read, retention given by purpose, not as periods (12 of 30). No deprecation policy for the MCP server (5 of 20). Subprocessors not found in the pages read (5 of 20). The MCP docs say live events, schemas, profile artifacts, transformation code and audit data stay within the workspace view. 15 + 12 + 5 + 5 = 37.

Woopra 62

Closed service with dated terms that cover the subscription, and MIT SDKs (15). The terms say the customer owns tracking data, and the pricing page states 24 months of retention. The privacy policy excludes end-user data, the DPA is sent only on request, and the GDPR page still cites Privacy Shield while the privacy policy cites the Data Privacy Framework (14). No deprecation policy or dated notices found (0). Nine sub-processors named in the terms with addresses and countries, eight in the USA and Hetzner in Germany. Where customer data is stored is not stated (16). Total 45.

RudderStack MCP 52

62 tools (5), plus a separately controlled read-only web surface (5). Filters on some list tools, not documented generally (8 of 20). One documented error (5 of 20). Read, Sensitive execution and Write classes, with Write tools to be confirmed by the client; annotations not read (14 of 20). One URL with OAuth and RudderStack SDKs in many languages (15). 10 + 8 + 5 + 14 + 15 = 52.

Woopra 45

Report responses can be capped with limit, but a report can only be run from a report_id saved in the web app, so an agent can't shape a query through the API (12). limit, offset, a snapshot ID for consistent paging and timeframe overrides on reports, and position headers on log export (14). Tracking codes 401, 402 and 403 each name a cause. REST error bodies are not documented (8). No idempotency key or dedupe field was found, and tracking is by GET. Imports return a batch ID to poll (3). Report calls need two parameters. Official SDKs exist in several languages, but the server ones date from 2017 (8). Total 45.