Statsig vs Userpilot

Statsig 76

Closed hosted service under a published self-service agreement and enterprise terms. The SDKs are open source under ISC (17 of 30). The terms, DPA and AI governance page mostly agree. The DPA names Amplitude, Inc. as processor and keeps data as long as necessary, the pricing page gives 1 year of analytics retention on the free plan, and the docs say customer data is not used to build AI models without written consent. The privacy notice is Amplitude's and doesn't name Statsig, and the self-service terms name Amplitude, Inc. under an effective date of 4 August 2025, before Statsig joined Amplitude on 5 May 2026 (18 of 30). Each Console API version is promised not to break, a deprecation notices page gives dates, and MCP V1 stays supported. No notice period is stated (12 of 20). Amplitude's sub-processor list, updated 13 May 2026, gives locations and marks the providers used for Statsig-branded services. EU hosting is an Enterprise option (17 of 20).

Userpilot 59

A closed service with terms dated 23 April 2024 (15 of 30). The privacy policy of 11 March 2025 names a DPO and two sub-processors (AWS and Cloudflare), while the security page names AWS, Google Cloud and Stripe. The DPA is on request and no customer-data retention period is stated (14 of 30). No deprecation policy or dated API notices found (3 of 20). Sub-processors are named with addresses but not data locations, though an EU ingestion endpoint exists (10 of 20). 15+14+3+10 = 42.

Statsig 74

OAuth for the MCP server with PKCE, dynamic client registration and a device code grant, issuing personal Console API keys that carry the user's role. Console keys can be created read-only or read and write, and rotated or deactivated through the API. The OAuth metadata lists no scopes, and a project Console key reaches every Console API endpoint (25 of 30). MCP scope is set per project and per role as no access, read only or read and write. Updates and destructive operations need a confirmation, and project review policies still apply (19 of 20). No guidance on prompt injection was found, though tools return names, descriptions and log data that people wrote. The docs tell users to review each change before the agent confirms (4 of 15). Audit logs are kept indefinitely with an API, and personal keys attribute changes to a user (14 of 15). SOC 2 Type II and a bug bounty programme are stated on the security page, with no public programme link and no security.txt (12 of 20).

Userpilot 62

The MCP server uses OAuth with PKCE, dynamic client registration, revocation, separate read and write scopes and the user's own role. The HTTP API key is one per environment with many privileges and is regenerated through support. Averaged over both surfaces (22 of 30). Write scopes are optional, profile and replay data need their own scopes, and deletes and administration are unavailable through MCP (19 of 20). Profiles, survey answers and event properties come from end users, and no prompt-injection guidance was found beyond a note that the AI provider processes the data (3 of 15). Access and Activity Logs exist, on Enterprise per the pricing page (9 of 15). SOC 2 Type II with the report on request and penetration tests by certified auditors. No security.txt, disclosure policy or bug bounty (9 of 20). 22+19+3+9+9 = 62.

Statsig 82

Public OpenAPI 3.0 spec for Console API version 20240601 with 209 paths and 325 operations, per the 8 October check, not re-read on 1 November, and typed MCP tools per the tool reference (25). llms.txt, llms-full.txt, a Markdown copy of each page and a public docs MCP server (10). Every operation has a summary but only 29 of 325 have a description, per the 8 October check. The MCP tool reference states each tool's purpose and when to ask the user first (11 of 20). 1,164 enums across 188 schemas, with required fields marked, per the 8 October check (12 of 15). Examples on most responses. The spec documents 401 on 156 operations, 404 on 126 and 400 on 106, and no 429, per the 8 October check (11 of 15). A dated API version sent in the STATSIG-API-VERSION header with a promise not to break a version, and a dated product updates page. No changelog for the API alone was found (13 of 15).

Userpilot 71

Every API reference page embeds an OpenAPI 3.0 definition, though no standalone spec file was found (20 of 25). llms.txt and Markdown versions of every page (10). Endpoint pages state their purpose and the MCP docs say what each permission allows; the MCP tool definitions weren't read because that needs a session (12 of 20). Request bodies are typed, mostly as strings and string arrays with few enums (9 of 15). An error reference covers 400, 401, 422 and 429 with causes, and pages carry examples (12 of 15). /v1 paths and dated SDK release notes; no API changelog was found (8 of 15). 20+10+12+9+12+8 = 71.

Statsig 71

The MCP V3 server shows 18 default tools, which is 15 on the checklist. Add back 8 for the discovery layer that reaches other operations on demand, query_fields on experiment reads and read-only access (23 of 25). limit and page on 49 list operations with pagination metadata per the 8 October check, a cursor on the Logs Explorer query, and filters by tag, status, creator and date (17 of 20). Errors are a status and a message with no machine code, and MCP results set isError (11 of 20). No idempotency keys were found. Updates and api_destructive calls need a confirmation object, and operations are split into read, write and destructive lanes. We could not read the live tool annotations (10 of 20). The SDKs cover flag evaluation and event logging in many languages, not the Console API, and the siggy CLI on npm is version 0.0.4 from September 2024 (10 of 15).

Userpilot 60

The tool count isn't published; the docs say the assistant can search hundreds of extra read-only operations on demand, which reads as dynamic loading. Without the list we give the middle band (15 of 25). Export jobs filter by date range, users, events and segments, and job lists paginate (14 of 20). A documented error reference (13 of 20). No deletes or admin through MCP by design; annotations weren't readable and no idempotency keys were found (10 of 20). The HTTP APIs have no official server-side SDK; client SDKs for web and six mobile frameworks (8 of 15). 15+14+13+10+8 = 60.

Statsig 40

No x402, MPP or L402 (0). Prices are public without a login. Pro is $150 a month with 5 million events, then $0.05 per 1,000 events (20). The Developer plan is free with no card and 2 million events a month (20). A person signs up in a browser, then creates a key or approves OAuth (0).

Userpilot 30

No x402, MPP or L402 (0). Plan prices are public ($299 and from $849 a month), with no per-unit prices (10). 14-day free trial with no card required (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.