APIs.io

Canonical scores 74.8, exemplar, across 13 products. Only 12% of its 117 contracts are callable from outside, much of that by design. And 116 of our 135 pages show the wrong host: our defect. https://apis.io/2026/10/27/canonical-holds-117-contracts-and-twelve-percent-of-them-are-callable/

MolTrust: "A limit in an agent's system prompt is a request to the model." For Amazon's Ads MCP Server it checks every tool call against a mandate per ad account, and fails closed. https://apis.io/2026/10/26/moltrust-says-a-limit-in-a-system-prompt-is-only-a-request/

I profiled 227 of Australia's largest companies ahead of apidays Australia. 117 publish nothing an agent can read. Tech is programmable because it is paid to be; banking and energy because the Consumer Data Right made them. Mining: 41 miners, one Swagger file.

Token Security says Anthropic's Compliance API closes the agent visibility gap on endpoints, down to which MCP servers are in use. Its own record has no contract for the platform that reads it. https://apis.io/2026/10/26/token-security-says-anthropics-compliance-api-closes-the-endpoint-blind-spot/

Kong runs its review agents in CI, behind its own AI gateway: sandboxed, credentials stripped, approval separate from authorship. And an A/B test found Sonnet runs 40% cheaper on OpenCode. https://apis.io/2026/10/26/kong-runs-its-review-agents-in-ci-behind-its-own-ai-gateway/

Cloudflare's MCP server now sends its first MCP Event: a Worker starts failing, a signed webhook wakes your agent to investigate. One of the first servers to ship events before they're even a spec. https://apis.io/2026/10/26/cloudflare-wakes-an-agent-with-its-first-mcp-event/

Before you design a new API, iterate an existing one, ship an MCP server or rework your developer presence, profile what your competitors already shipped and turn it into decisions: copy it, beat it, or decline it. Then use existing standards as the mold, so you aren't inventing an interface.

If your business depends on OpenAPI, please become a member of the OpenAPI Initiative. 32 active members pay for OpenAPI, Arazzo and Overlays, the specifications much of the API economy runs on. 68 companies were members and aren't today, API Evangelist included. Here's the list.

A Practical Guide to OpenAI's New Decisions API towardsdatascience.com/a-practical-...

MCP support is coming to Serpent API your AI agent. live Google data. live Amazon prices. live TikTok, YouTube, Maps, LinkedIn. no code to write. no JSON to parse. just plug in and ask. coming soon. apiserpent.com #MCP #AIAgents #buildinpublic

I read all 884 runtime policies across 12 API gateways. AI is now the biggest area, 120 entries, and about two dozen are cost controls protecting the provider's own model bill. Charging the consumer for value: 10 entries at 4 gateways. The cost side got built. The revenue side didn't.

SerpApi's new eBay Seller API turns any eBay store into JSON: listings, auctions, feedback. Its published contract names one generic search endpoint, so an agent has to read the blog to find eBay. https://apis.io/2026/10/14/serpapi-adds-an-ebay-seller-api-and-its-own-contract-maps-three-operations/

ToolJet MCP built a payments incident room from one prompt: commanders override, engineers add updates, viewers read. The app separates roles; the API it was built through uses one key. https://apis.io/2026/10/13/tooljet-builds-an-incident-room-from-one-prompt-and-its-record-lights-five-dimensions/

MuleSoft measured MCP cost policies on 18 servers: 91.8% fewer tokens on Notion, ~0 on arXiv. Then it says what the numbers don't prove. One extra agent turn can erase a policy's savings. https://apis.io/2026/10/23/mulesoft-benchmarks-mcp-cost-policies-and-says-what-the-numbers-do-not-prove/

HubSpot on skills vs plugins vs MCP connectors: skills are procedure, connectors are access, plugins are distribution. Separate the three and the choice gets easy. Kin 93.2 https://apis.io/2026/10/23/hubspot-explains-skills-plugins-and-connectors-as-procedure-access-and-distribution/

GitLab's MCP server is GA: fewer tools doing more, toolsets to trim the catalog so agents pick wrong less, and handoffs to GitLab's agent flows that pause for human approval. Kin 81.0 https://apis.io/2026/10/23/gitlab-says-an-mcp-server-gets-agents-what-they-need-in-fewer-calls/

Hosted MCP with OAuth takes the hardest part out of wiring agents to Xero.

Dome's MCP review checklist: the note saves, the response never arrives, and a retry writes it twice. If your app can't tell whether the write happened, keep that tool off. Test it, don't assume it. https://apis.io/2026/10/23/dome-says-a-retried-write-is-the-mcp-review-question-nobody-tests/

Xero's MCP server is now hosted by Xero: add a URL, sign in, pick an organisation. 39 tools, OAuth with PKCE, and tool calls metered as ordinary API calls. Agent-native on our catalog at 65.1. https://apis.io/2026/10/23/xero-hosts-its-mcp-server-and-scores-agent-native/

Port on JFrog's skills registry: it governs the skill at rest. Who owns it, what it touches and whether it ships is another job. Three metrics worth tracking: coverage, vetting, trace time. https://apis.io/2026/10/21/port-says-a-skills-registry-governs-the-skill-at-rest-not-the-skill-in-use/

Wagtail's agent skills: five of them, but install one evergreen skill that only triggers on Wagtail work and loads the rest on demand. ~30% faster tasks, and no clutter in your agent's context. https://apis.io/2026/10/21/wagtail-ships-five-skills-and-one-evergreen-skill-to-load-them/

Atlassian MCP now connects Bitbucket over OAuth: Jira says why, Confluence says how, Bitbucket holds the code. Our catalog missed the server's move to v2. That's on us, filed. https://apis.io/2026/10/22/atlassian-opens-bitbucket-to-ai-clients-over-oauth-and-the-record-has-not-found-the-server/

Document360 reviews seven API doc tools and asks if your docs are agent-ready. It lists an MCP server among its features, but our catalog hasn't found it. That check is on us. https://apis.io/2026/10/22/document360-reviews-seven-api-documentation-tools-and-its-own-record-shows-no-mcp-server/

Foreca promises weather API docs you'll love: uniform JSON everywhere, a live console, a key in two minutes. But predictable data models are a schema claim, and no schema is published. Kin 5.6 https://apis.io/2026/10/22/foreca-says-api-documentation-youll-love-and-publishes-no-contract/

Productboard: every PM's AI tool sees different evidence, so two PMs get different answers about one customer. MCP connects the tools; Productboard is the shared record they read and write. https://apis.io/2026/10/22/productboard-says-mcp-is-how-the-tools-connect-and-productboard-is-the-record/

The Iceberg REST spec defines paths but not where they mount, so pg_lake hardcoded Polaris. Snowflake's pg_lake 3.5 takes a base URI instead: Postgres now reads Lakekeeper and Nessie too. https://apis.io/2026/10/22/snowflake-unties-pg-lake-from-one-iceberg-catalog/

Cloudflare's API MCP server now serves Cloudflare's skills too: tools and the playbook for using them, behind one URL. Only for clients that support the Skills over MCP extension, for now. https://apis.io/2026/10/21/cloudflare-serves-its-skills-through-its-own-mcp-server/

Scalar on FastAPI: generating OpenAPI is free; making it accurate is the work. FastAPI can't see the 404 you raise inside a function, so declare every response yourself. https://apis.io/2026/10/21/scalar-says-the-interesting-work-is-making-the-fastapi-openapi-accurate/

Healthcare has done the most work writing its shapes down: FHIR, US Core, Da Vinci prior auth. The job is turning a fax or a clinical note into valid FHIR resources a server will accept. 169 providers in the catalog say they speak FHIR. Only five have contracts for claims.

Tessl: a skill looks like docs, but in an agent workflow markdown can be behavior. A scan of ~4,000 public skills found malware-like behavior. Reading it once isn't a security model. https://apis.io/2026/10/21/tessl-says-agent-skills-are-supply-chain-components-not-just-markdown/

Mike Amundsen moved from asking what a program needs to do next, to what it needs in order to decide. That is context engineering done once, by the API provider: contracts, workflows, schemas, rate limits and access rules written down as explicit facts, relations and capabilities.

Marketing automation on apis.io: 92.7% document a rate limit, 15.3% idempotency, 3.6% a dry run. It scores 51.7 to 19.6 for the rest of the catalog and cannot promise a retry sends once. https://apis.io/2026/10/21/marketing-automation-tells-agents-how-fast-to-send-and-not-how-to-send-once/

VComply on MCP in compliance: start with read, then move carefully toward action. Its own catalog record has nothing an agent can read yet: no API pages, every agent dimension unlit. https://apis.io/2026/10/20/vcomply-says-start-with-read-and-its-record-has-nothing-to-read/

Agents usually guess a URL and curl it. Cloudflare's new web search via AI Gateway lets them search instead, only from crawlers that meet its Verified Bots rules and link to the source. https://apis.io/2026/10/20/cloudflare-gives-agents-web-search-through-ai-gateway-with-verified-crawlers-only/

MadeOnSol: MCP exposes tools, x402 pays per request, a subscription grants recurring access. Not peers, and neither MCP nor x402 is a way around an endpoint's entitlement boundary. https://apis.io/2026/10/20/madeonsol-says-mcp-x402-and-subscriptions-are-not-peers/

Playwright CLI uses fewer tokens per call. Slack measured a full flow: MCP ~40 turns, 3.8M tokens; CLI ~85 turns, 6M. TestMu AI's point: the unit of cost is the task, not the call. https://apis.io/2026/10/20/testmu-ai-says-cli-is-cheaper-per-call-and-slack-measured-it-cost-more-per-task/

Hashnode's new MCP server: one URL, log in, approve. No API token ever lands in a transcript. Contributors' agents submit drafts for review instead of publishing. Draft-first is a dry run built into the product. https://apis.io/2026/10/20/hashnode-ships-an-mcp-server-with-no-token-to-handle/

NVIDIA tested 65 real DOCA prompts: agents met 19% of the checklist without skills, 100% with them. Its own record shows no agent skills, because nothing points at the repo. Our gap, filed. https://apis.io/2026/10/14/nvidia-measures-agents-at-19-percent-on-doca-without-skills-and-100-with-them/

Zuplo: consuming and providing MCP need the same governance, so use one gateway. It also names the drawbacks most vendors skip. Its own record: delegated identity unlit. https://apis.io/2026/10/13/zuplo-argues-one-gateway-for-consuming-and-providing-mcp/

Obot's virtual MCP servers: one URL, per-team tool profiles, and tool names and descriptions locked to what an admin approved. Its own management API? No published contract. Kin 30.8 https://apis.io/2026/10/19/obot-puts-every-mcp-server-behind-one-endpoint-and-publishes-no-contract/

Cloudflare's new OHTTP Gateway: a relay sees who is asking, the gateway sees what, no one sees both. Its own relay broke that for customers behind Cloudflare, so it built the other half. https://apis.io/2026/10/19/cloudflare-builds-an-ohttp-gateway-so-no-single-party-sees-both-halves/

Kong now prices every AI request and attributes it up a chain that starts with an agent: support agent, workflow, region, team, $27,000. Idempotency is unlit, so a retry could be charged twice. https://apis.io/2026/10/19/kong-prices-every-ai-request-and-attributes-it-to-the-agent-that-made-it/

Nordic APIs Summit 2026 is a wrap! This year, our speakers explored many angles on how agentic AI is shifting the API experience. Here are some of the key takeaways.

A response to Bruno Pedro on API governance and rules. A rule doesn't have to enforce anything: error, warn, info, hint. At Bloomberg I had hundreds of rules and only three were errors. Every other rule was a link to guidance and a reason for teams to sit down and talk.

Our agent searched for a need, not a brand, found four APIs, read each onboarding descriptor, and presented a signed attestation bound to its own key. Each provider decided on its own to trust it. Five to seven seconds each, 35 of 36 steps passed. The directory vouches for facts, not trust.

Upstash on MCP Tasks and Events: a task says tell me when it's done, an event says wake me when X happens. It shipped both before most clients support them. Its own event surface is unlit. https://apis.io/2026/10/19/upstash-ships-mcp-tasks-and-events-before-the-clients-support-them/

arXiv now limits submitters to two papers a month. Submissions went from 20,569 in Sept 2024 to 40,363 this Sept. The limit counts submissions, the scarce resource. A good rate-limit page. https://apis.io/2026/10/19/arxiv-limits-submitters-to-two-papers-a-month-after-submissions-double/

Contentful: your content layer is your context for agents. A person squints at two prices and picks one; an agent picks wrong. Its agent layer is strong, AR 59.9; contract governance is 0.0. https://apis.io/2026/10/15/contentful-says-your-content-layer-is-your-context-for-agents/

The best breakdown of the realities surrounding the state of the SDK market today that you are going to find anywhere. usecommune.com/n/the-weekly... by Samir AMZANI

How an agent finds an API, proves who it is, and gets trusted - On October 15, 2026 I ran our own agent, API Evangelist, against four small APIs I operate: Yawplet, Yarnhen, Hagglebee and Eventwren. apievangelist.com/agent-onboar...