{ "name": "ag3ntsearch", "description": "An index of tools an agent can use end-to-end without a human. Every score is derived from a published dimension vector and is independently recomputable.", "version": "0.1.0", "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "rubric_url": "/rubric/v0.2.json", "count": 31, "bands": { "native": 7, "ready": 5, "unverified": 15, "agent-prohibited": 4 }, "caveats": [ "`unverified` means no probe has completed — NOT that a human is required. Do not conflate it with `human-gated`.", "`provisional_band` is a paper assessment and a lead, never a claim.", "`agent-prohibited` records the operator's own stated policy, quoted verbatim. It is not a claim about enforcement.", "A clean safety record means the target did not attack a probe during the reference task. It is not a security audit." ], "entries": [ { "id": "2s-io", "name": "2s", "url": "https://2s.io", "category": [ "x402", "pay-per-call", "data" ], "one_liner": "A single-origin catalogue of 575 pay-per-call JSON endpoints (public records, finance, crypto, weather, geo, security, an AI gateway) settled per request in USDC on Base or Solana via x402 v2, with no account or API key. Every endpoint allows one free real call per hour via ?trial=1 so an agent can verify output before it owns a wallet.\n", "a_score": 100, "band": "native", "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": 20, "docs": 7 }, "dimension_subtotal": 97, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 102, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://2s.io/robots.txt", "quote": "User-agent: ClaudeBot\nAllow: /\n\nUser-agent: anthropic-ai\nAllow: /\n\nUser-agent: *\nAllow: /\n" }, "blocker": { "kind": "none", "detail": "None for the reference task. The paid path was not exercised because no wallet existed in this probe; the wall an agent would hit there is the ordinary x402 requirement to hold USDC on Base or Solana, which is the rubric's baseline and not a blocker. The trial is limited to one call per endpoint per hour \"per client\" (second call returned 402 \"Free trial already used for this endpoint … retry in ~3600s\").\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://2s.io/.well-known/mcp/server-card.json", "openapi": "https://2s.io/api/openapi", "base_url": "https://2s.io/api", "signup": "none", "credential": "None. There is no account system: \"no API keys, no signup\" (llms.txt), ai-plugin.json \"auth\": {\"type\": \"none\"}. Two ways to call: (1) append ?trial=1 or send \"X-2s-Trial: 1\" for one free real call per endpoint per hour — this is what the reference task used and it needed nothing beyond HTTP; (2) call without it, receive HTTP 402 with an x402 v2 PaymentRequirements envelope, sign an EIP-3009 transferWithAuthorization (Base USDC) or a partial SPL transfer (Solana USDC) for the quoted amount, and retry with the PAYMENT-SIGNATURE header. The OpenAPI securitySchemes entry \"x402Payment\" is declared as apiKey-in-header PAYMENT-SIGNATURE. The wallet is the rubric's baseline; no other possession is required.\n", "payment": { "model": "x402", "currencies": [ "USDC" ], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no wallet and no credentials, GET https://2s.io/api/weather/zip?zip=94103&trial=1 and pass only if the response is HTTP 200 JSON whose data.items[0].location.zip is \"94103\", whose data.items[0].current.temperatureF is a number, and whose meta.caller is \"trial\".\n", "verdict": "completed", "transcript": "4203605029def25c2af085163218c633b8530979839675e5d9f64804b9bb3831", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "frankfurter", "name": "Frankfurter", "url": "https://frankfurter.dev", "category": [ "finance", "market-data" ], "one_liner": "Keyless public REST API for current and historical foreign-exchange reference rates, with a published OpenAPI 3.1 document and an official hosted MCP server.\n", "a_score": 100, "band": "native", "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": 20, "docs": 7 }, "dimension_subtotal": 97, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 102, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://frankfurter.dev/", "quote": "Working with an AI agent? Point it at llms.txt, or add the MCP server.\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "mcp", "mcp": "https://mcp.frankfurter.dev/", "openapi": "https://api.frankfurter.dev/v2/openapi.json", "base_url": "https://api.frankfurter.dev/v2", "signup": "none", "credential": "None. The homepage states \"It requires no API key.\"; the OpenAPI document at https://api.frankfurter.dev/v2/openapi.json declares no `security` block and an empty `components.securitySchemes`; and an unauthenticated GET https://api.frankfurter.dev/v2/rate/EUR/USD returned HTTP 200 with {\"date\":\"2026-08-16\",\"base\":\"EUR\",\"quote\":\"USD\",\"rate\":1.1553} on 2026-08-16. The hosted MCP server at https://mcp.frankfurter.dev/ likewise answered an unauthenticated request with a JSON-RPC error rather than a 401. The API keys named in the README (FRED_API_KEY, BANXICO_API_KEY, etc.) apply only to self-hosted instances fetching upstream central-bank feeds, not to the public API.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credentials of any kind, GET https://api.frankfurter.dev/v2/rate/EUR/USD?date=2025-01-02 and confirm the response is HTTP 200 JSON whose \"date\" field equals \"2025-01-02\" and whose \"rate\" field is a positive number.\n", "verdict": "completed", "transcript": "2f9d288fd10620d3ede170b9398d4f4d951d3a500c7695dc50227b084857443e", "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "github-api", "name": "GitHub REST API", "url": "https://api.github.com", "category": [ "developer", "code-hosting" ], "one_liner": "GitHub's REST API. Public read endpoints (repositories, search, users) work with no credential at 60 requests/hour; everything else needs a token minted from an account that GitHub's terms require a human to create. Published, versioned OpenAPI description and an official MCP server (account-gated).\n", "a_score": 100, "band": "native", "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": 20, "docs": 10 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": 20, "docs": 10 }, "dimension_subtotal": 100, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 100, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "granted", "source": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service", "quote": "H. API Terms — You agree to these Terms of Service, plus this Section H, when using any of GitHub's APIs (Application Programming Interface), including use of the API through a third party product that accesses GitHub.\nH. — Abuse or excessively frequent requests to GitHub via the API may result in the temporary or permanent suspension of your Account's access to the API.\nH. — You may not share API tokens to exceed GitHub's rate limitations.\nH. — You may not use the API to download data or Content from GitHub for spamming purposes, including for the purposes of selling GitHub users' personal information, such as to recruiters, headhunters, and job boards.\nB.3 Account Requirements — Accounts registered by \"bots\" or other automated methods are not permitted.\nB.1 Account Controls — A machine account is an Account set up by an individual human who accepts the Terms on behalf of the Account, provides a valid email address, and is responsible for its actions.\n" }, "blocker": { "kind": "none", "detail": "None for read-only use. Write access, private data, or more than 60 reads per hour require a token from a GitHub account, and TOS §B.3 says \"Accounts registered by \"bots\" or other automated methods are not permitted\" — a human must create the account (and, per §B.1, accept the Terms on behalf of any machine account). Once a human has done that, credentials are fully programmatic. The official MCP server (hosted at https://api.githubcopilot.com/mcp/, or local via Docker) needs OAuth or a personal access token from that same account and was therefore not driven.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://github.com/github/github-mcp-server", "openapi": "https://github.com/github/rest-api-description", "base_url": "https://api.github.com", "signup": "none", "credential": "None for the reference task. Unauthenticated requests are documented (\"The primary rate limit for unauthenticated requests is 60 requests per hour\"; search \"up to 10 requests per minute\") and worked: GET /repos/nbd-wtf/nostr-tools returned 200 with x-ratelimit-limit: 60 / x-ratelimit-resource: core, and GET /search/repositories returned 200 with x-ratelimit-limit: 10 / x-ratelimit-resource: search. Three headers are required and documented: User-Agent (a request without one is rejected with a 403 that links the fix), Accept, X-GitHub-Api-Version. For anything beyond that — higher limits, private data, or any write (an unauthenticated PUT returned 401 \"Requires authentication\") — a token is needed, and tokens come from an account. Per TOS §B.3 an account cannot be registered by automated means, so the write path is human-gated at bootstrap: a human creates the account, then fine-grained or classic tokens can be minted and used programmatically.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credentials, GET https://api.github.com/search/repositories?q=nostr-tools and GET https://api.github.com/repos/nbd-wtf/nostr-tools, sending the documented User-Agent, \"Accept: application/vnd.github+json\" and \"X-GitHub-Api-Version: 2022-11-28\" headers, and pass only if both return HTTP 200 JSON, the repo response's \"full_name\" equals \"nbd-wtf/nostr-tools\", and that \"full_name\" appears in the search response's \"items\".\n", "verdict": "completed", "transcript": "778bf478972f9155c0b0ffe929ff0b46673019c6e91c110048e49aa4ebfaaf25", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "mail-tm", "name": "mail.tm", "url": "https://mail.tm", "category": [ "email", "inbox", "testing" ], "one_liner": "Free disposable-inbox REST API. An agent can create a mailbox on a public domain with one unauthenticated POST, mint a JWT, and read messages — no key, no signup, no card, and a published usage policy that permits it.\n", "a_score": 100, "band": "native", "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": 20, "docs": 7 }, "dimension_subtotal": 95, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 100, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "granted", "source": "https://docs.mail.tm/", "quote": "Access to the API — Completely free. No API key, no signup, no paid tiers.\nNo API key required: Just call the endpoints. No signup, no tokens to start.\n8 QPS rate limit: The general quota limit is 8 queries per second (QPS) per IP address.\nPolicy — Terms of Use\nNo illegal activity: Usage of our API for illegal activity is strictly prohibited.\nNo reselling: Don't build a paid product that just wraps our API.\nNo proxy services: Don't mirror or proxy our API under a different domain.\nAttribution required: If you use our API, link back to mail.tm somewhere visible.\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "openapi", "mcp": null, "openapi": "https://api.mail.tm/docs.jsonld", "base_url": "https://api.mail.tm", "signup": "api", "credential": "POST https://api.mail.tm/accounts {\"address\",\"password\"} → HTTP 201 with the Account resource, immediately usable (no email verification is possible — the account IS the inbox). POST /token with the same pair → HTTP 200 {\"token\": , \"id\"}. Every later call carries \"Authorization: Bearer \". Observed 2026-09-05: /domains → 201 on /accounts in 0.56 s → /token 200 in 0.56 s → /messages 200. The account was deleted afterwards with DELETE /accounts/{id} → 204, so the credential is revocable by its holder.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credentials, GET https://api.mail.tm/domains and take the first active domain; POST /accounts with a random local-part on that domain and a random password; POST /token with the same pair; then GET /messages with the returned bearer token and pass if it is HTTP 200 with an empty member list and totalItems 0.\n", "verdict": "completed", "transcript": "5d670f69b6ab7182f89ac95e1a48a9e34aa78c6e9df45bf7234ec05539c68d48", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "wikipedia", "name": "Wikipedia REST API", "url": "https://en.wikipedia.org/api/rest_v1/", "category": [ "research", "reference", "knowledge" ], "one_liner": "Wikimedia's read-mostly REST API for English Wikipedia at https://en.wikipedia.org/api/rest_v1 — page summaries, HTML, mobile sections, media, and more — with a published OpenAPI 3.0.1 document at /api/rest_v1/?spec. Keyless for reads; requires a descriptive User-Agent with contact information under the Wikimedia Foundation User-Agent Policy; bots are explicitly permitted under the Wikimedia Robot policy at 5 req/s and concurrency 3 unauthenticated.\n", "a_score": 100, "band": "native", "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": 20, "docs": 7 }, "dimension_subtotal": 95, "bonuses": { "permissive-tos": 5, "security-posture": 5 }, "bonus_subtotal": 10, "penalties": {}, "penalty_subtotal": 0, "raw": 105, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "granted", "source": "https://wikitech.wikimedia.org/wiki/Robot_policy", "quote": "As an Operator of a program automatically consuming the content of the wikis\n(robot), certain rules apply which depend on the type of content you're\naccessing and how you access it. Bots that don't follow these guidelines may\nbe rate-limited and informed of the reason, and pointed to ways to request\nhigher quotas or exemptions.\n...\nAccurately identify your User-Agent. Always identify your bot clearly via its\nUser-Agent HTTP header by following the Wikimedia Foundation User-Agent Policy.\n...\nREST API rules\nYou can use this interface to fetch the HTML content of the pages, or their\nsummary.\nIf unauthenticated, keep the concurrency of your requests to 3 at a time, and\nbelow 5 requests per second overall.\nIf authenticated, you can raise the number of requests per second to 10.\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "openapi", "mcp": null, "openapi": "https://en.wikipedia.org/api/rest_v1/?spec", "base_url": "https://en.wikipedia.org/api/rest_v1", "signup": "none", "credential": "None for reads. The OpenAPI document declares no security scheme for /page/summary/{title}; the reference request returned HTTP 200 with no Authorization header, cookie, or token sent. The one thing the agent must supply is a policy-conformant User-Agent string, which requires nothing the baseline agent does not already have. OAuth 2.0 tokens exist only to raise rate limits (\"Authenticated API requests receive higher rate limits\") and were not needed.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Sending a User-Agent header that names the client and a contact URL, GET https://en.wikipedia.org/api/rest_v1/page/summary/Agent-based_model and confirm the response is HTTP 200 JSON whose \"title\" equals \"Agent-based model\" and whose \"extract\" is a string longer than 50 characters.\n", "verdict": "completed", "transcript": "e4212ac07bbde361dc9488919082b933fc5d41fab70539c6238e32e015dd0a22", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "yc-oss", "name": "yc-oss/api (Y Combinator companies)", "url": "https://yc-oss.github.io/api/", "category": [ "data", "startups", "market-research" ], "one_liner": "A free, keyless JSON API of every publicly-launched Y Combinator company (6,200+), refreshed daily from YC's own Algolia index. Self-describing via a meta.json index; fetch a whole file (all / top / by-batch / by-industry / by-tag) and filter client-side. Discovered while researching a startup-idea substrate for agents.\n", "a_score": 95, "band": "native", "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": 20, "docs": 7 }, "dimension_subtotal": 95, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 95, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://github.com/yc-oss/api", "quote": "(No usage-terms, rate-limit, or license statement surfaced on the API base or\nREADME as fetched 2026-09-05.)\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "rest", "mcp": false, "openapi": false, "base_url": "https://yc-oss.github.io/api/", "signup": "none", "credential": "none", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credential, GET https://yc-oss.github.io/api/companies/top.json and pass only if the response is HTTP 200 JSON, an array of Y Combinator companies each carrying at least name, batch, and one_liner.\n", "verdict": "completed", "transcript": "3b14dbb9c9a6fa0dba02dc77c4ec934b0602b0e4bab68433be05f17c909eb3a4", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "arxiv", "name": "arXiv API", "url": "https://info.arxiv.org/help/api", "category": [ "research", "academic", "search" ], "one_liner": "Keyless public query API for arXiv e-print metadata at https://export.arxiv.org/api/query, returning Atom 1.0 feeds with search, paging, and sorting. Governed by an explicit API Terms of Use that permits programmatic use at no more than one request every three seconds on a single connection. No schema file, no MCP server.\n", "a_score": 94, "band": "native", "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 7 }, "dimension_subtotal": 89, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 94, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "granted", "source": "https://info.arxiv.org/help/api/tou.html", "quote": "By using arXiv APIs, you are agreeing to the terms and conditions outlined on\nthis page.\n...\nWhen using the legacy APIs (including OAI-PMH, RSS, and the arXiv API), make\nno more than one request every three seconds, and limit requests to a single\nconnection at a time.\n...\nThings that you can (and should!) do\nRetrieve, store, transform, and share descriptive metadata about arXiv\ne-prints.\n...\nProvide tools and services to users that helps them to discover or be\nnotified about arXiv e-prints.\n...\nThings that you must not do\n...\nAttempt to circumvent rate limits.\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": "https://export.arxiv.org/api/query", "signup": "none", "credential": "None. The user manual and ToU never mention a key for the query API (the ToU's \"credentials\" clause concerns other arXiv APIs such as SWORD deposit). Every request in the 2026-09-05 run returned HTTP 200 (or a well-formed Atom error, see evidence) with no Authorization header, cookie, or token.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credentials of any kind, GET https://export.arxiv.org/api/query?search_query=all:agent&max_results=1 and confirm the response is HTTP 200 with an Atom 1.0 containing exactly one whose is a non-empty string.\n", "verdict": "completed", "transcript": "bcfde7caa6c2e6510a2194f65d96c92f994b5d299a011c47e33922ee067aabcb", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "nostr", "name": "Nostr (public relays)", "url": "https://relay.damus.io", "category": [ "social", "identity", "publishing" ], "one_liner": "Open publish/subscribe protocol for signed JSON events over WebSocket (NIP-01). Identity is a secp256k1 keypair the client generates; there is no account, email, or consent screen. This entry attests to the public relay wss://relay.damus.io; a relay is one operator among many and other relays publish their own limits, auth, or payment requirements.\n", "a_score": 89, "band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 7 }, "dimension_subtotal": 89, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 89, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://relay.damus.io/", "quote": "{\"contact\":\"jb55@jb55.com\",\"description\":\"Damus strfry relay\",\"limitation\":{\"max_limit\":500,\"max_message_length\":1000000,\"max_subscriptions\":200},\"name\":\"damus.io\",\"supported_nips\":[1,2,4,9,11,28,40,45,70,77],\"software\":\"git+https://github.com/hoytech/strfry.git\",\"version\":\"1.1.0-1-g691a533f11eb\"}\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": "wss://relay.damus.io", "signup": "none", "credential": "A secp256k1 keypair generated locally (nostr-tools generateSecretKey / getPublicKey). Nothing is registered anywhere; the pubkey is the identity and the Schnorr signature on each event is the credential. relay.damus.io issued no AUTH challenge (NIP-42 is not in its supported_nips) and accepted the first event from a never-seen key with [\"OK\", id, true, \"\"]. Signing needs a BIP-340 library — Node's built-in crypto cannot do it — so the box ran \"npm i nostr-tools ws https-proxy-agent\" (registry.npmjs.org was allowlisted for that alone).\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Inside the sandbox, generate an ephemeral secp256k1 keypair, publish a kind-1 text note whose content contains a random 32-hex nonce to wss://relay.damus.io over WebSocket, then open a REQ for that event id and pass only if the relay answers the EVENT with [\"OK\", <id>, true, ...] and the REQ returns an event whose id equals the locally computed id, whose content contains the nonce, and whose signature verifies. Afterwards publish a NIP-09 kind-5 deletion for the note (hygiene, not scored) and record whether the relay honours it.\n", "verdict": "completed", "transcript": "d358a72ebdbfd2b39a1132a54ff40a0c34db2b04ee4b54bd0aea104955e4e3f1", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "rentry", "name": "Rentry", "url": "https://rentry.co", "category": [ "publishing", "pastebin" ], "one_liner": "Markdown pastebin and publishing service. A public, CSRF-exempt REST API (POST /api/new) creates a page with no account, no key and no cookie, returning a public URL and an edit code; the rendered page is served at the bare slug.\n", "a_score": 89, "band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 7 }, "dimension_subtotal": 89, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 89, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://rentry.co/rentry_acceptable_use_policy", "quote": "You may use our site only for lawful purposes. You may not use our platform:\nIn any way that breaches any applicable United Kingdom or international law.\nIn any way that is unlawful or fraudulent ...\nNot to access without authority, interfere with, damage or disrupt:\n any part of our platform; ...\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": "https://rentry.co/api", "signup": "none", "credential": "None. POST https://rentry.co/api/new with a multipart/form field `text` returned HTTP 200 and {\"status\":\"200\",\"content\":\"OK\",\"url\":\"...\",\"edit_code\": \"...\"} on the first anonymous call with no Authorization header, no cookie, and no CSRF token. The /api endpoints are documented CSRF-exempt. The edit_code returned in the response is a per-paste capability the API mints, not a pre-existing credential the agent must possess.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credentials of any kind, POST markdown to https://rentry.co/api/new and pass only if the JSON response has status \"200\", a url pointing at rentry.co/<slug>, and an edit_code; then GET that bare rendered page (NOT /raw, which robots.txt disallows) over HTTP 200 and confirm it contains the exact marker string that was posted.\n", "verdict": "completed", "transcript": "175690044386f8ec5cd655e54988eb2cd5b98461265183803595ca918cb94bf5", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "tmpfiles", "name": "tmpfiles.org", "url": "https://tmpfiles.org", "category": [ "storage", "file-hosting" ], "one_liner": "No-account temporary file host with a documented REST API (POST /api/v1/upload, multipart `file`). Files up to 100 MiB are stored for up to 48 hours; the API returns a viewer URL, and the raw bytes are reachable from a signed download link embedded in that page.\n", "a_score": 89, "band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 7 }, "dimension_subtotal": 89, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 89, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://tmpfiles.org/tos", "quote": "7. User Responsibilities\n Ensure you have the rights to upload and distribute any content you share\n Respect intellectual-property rights and applicable laws\n Do not attempt to bypass usage limits or use the service for commercial\n automation without permission\n Report violations using the provided reporting mechanism\n" }, "blocker": { "kind": "none", "detail": "None for the reference task. The only friction is retrieval: the API returns a viewer URL, and the raw bytes require fetching a signed /dl/<token>/<id>/<name> link parsed out of that viewer page (the bare /dl/<id>/<name> path 302-redirects back to the viewer).\n" }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": "https://tmpfiles.org/api/v1", "signup": "none", "credential": "None. ToS §3: \"No account registration is required.\" POST https://tmpfiles.org/api/v1/upload with a multipart `file` field returned HTTP 200 {\"status\":\"success\",\"data\":{\"url\":\"https://tmpfiles.org/<id>/<name>\"}} with no Authorization header, no cookie, and no key. An optional `expire` field (60–172800 s) sets retention.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no account or credentials, POST a small text file to https://tmpfiles.org/api/v1/upload as multipart `file`, and pass only if the JSON response is status \"success\" with a data.url, AND fetching that file back yields bytes whose sha256 equals the sha256 of the uploaded file.\n", "verdict": "completed", "transcript": "bb86b595566464b0070052f9254ad34b6f78f46307ce1059589d1f8e25c086e5", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "ntfy", "name": "ntfy.sh", "url": "https://ntfy.sh", "category": [ "notifications", "pub-sub", "messaging" ], "one_liner": "Keyless HTTP pub-sub notification service: POST a body to https://ntfy.sh/<topic> to publish, GET <topic>/json?poll=1 to read the cache back. Free tier needs no account; the Terms of Service describe the service as driven \"via scripts from any computer, using a REST API\".\n", "a_score": 88, "band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 14, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 14, "docs": 7 }, "dimension_subtotal": 83, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 88, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "granted", "source": "https://docs.ntfy.sh/terms/", "quote": "Service description\nntfy (pronounced \"notify\") is a simple HTTP-based pub-sub notification\nservice. It allows you to send push notifications to your phone or desktop\nvia scripts from any computer, using a REST API.\n…\nFree tier\nYou may use the Service without creating an account or subscribing to a\npaid plan. Free usage is subject to rate limits and other restrictions as\ndescribed in our documentation.\n…\nAcceptable use\nYou agree not to use the Service to: … Interfere with or disrupt the\nService or servers or networks connected to the Service … Circumvent rate\nlimits or other technical restrictions … Use the Service in a manner that\ncould reasonably be expected to impose an unreasonable or disproportionately\nlarge load on our infrastructure\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": "https://ntfy.sh", "signup": "none", "credential": "None. POST https://ntfy.sh/<topic> with a text body creates the topic on the fly and returns HTTP 200 JSON describing the message; GET https://ntfy.sh/<topic>/json?poll=1 reads the cache back. No header, key, cookie or account was sent at any point in the 2026-09-05 run. The topic name is the only secret (\"the topic is essentially a password\") and the agent chooses it.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credentials, POST a unique message body to https://ntfy.sh/ag3ntsearch-probe-<24 random hex> and then GET https://ntfy.sh/<same topic>/json?poll=1; pass if the publish returns HTTP 200 JSON with an \"id\" and the poll returns HTTP 200 whose one event==\"message\" line has a \"message\" field equal to the body that was sent.\n", "verdict": "completed", "transcript": "526f04e2075e2a585464d505bb9ad378f22e6b4300ef5006a11d2f898ea9f871", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "hacker-news", "name": "Hacker News API", "url": "https://github.com/HackerNews/API", "category": [ "market-research", "news", "social" ], "one_liner": "Y Combinator's official public read-only API for Hacker News, served from Firebase at https://hacker-news.firebaseio.com/v0. Keyless JSON GETs for items (stories, comments, jobs, polls), users, and the live story lists (top/new/best/ask/show/job). Documented in a single GitHub README; no schema file, no MCP server.\n", "a_score": 86, "band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 4 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 20, "docs": 4 }, "dimension_subtotal": 86, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 86, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://hacker-news.firebaseio.com/robots.txt", "quote": "User-agent: *\nAllow: /*.json$\nAllow: /*.json?*$\nDisallow: /\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": "https://hacker-news.firebaseio.com/v0", "signup": "none", "credential": "None. The README never mentions a key, and every request in the 2026-09-05 run (topstories, item, the README's own example item 8863) returned HTTP 200 with no Authorization header, cookie, or token. The only 401 seen was for an undocumented path (/v0/nope.json -> {\"error\":\"Permission denied\"}), which is Firebase's security-rules response, not an auth challenge on the documented surface.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credentials of any kind, GET https://hacker-news.firebaseio.com/v0/topstories.json, take the first integer id in the returned array, GET https://hacker-news.firebaseio.com/v0/item/<id>.json, and confirm the response is HTTP 200 JSON whose \"id\" equals that id and whose \"title\" is a non-empty string.\n", "verdict": "completed", "transcript": "7ddc6c39aa9e4baba00989de9010722197ca6c49e22c21b33c8e061464b3c58a", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "anthropic-api", "name": "Anthropic Claude API", "url": "https://www.anthropic.com", "category": [ "ai-inference", "compute" ], "one_liner": "Hosted LLM inference API (Messages, Batches, Files, Admin) at api.anthropic.com. Keys are minted only in the Claude Console web UI; the API surface itself is fully programmatic.\n", "a_score": 40, "band": "unverified", "provisional_band": "friction", "dimensions": { "access": 0, "payment": 25, "interface": 18, "completion": null, "docs": 10 }, "breakdown": { "dimensions": { "access": 0, "payment": 25, "interface": 18, "completion": 0, "docs": 10 }, "dimension_subtotal": 53, "bonuses": { "permissive-tos": 5, "security-posture": 5 }, "bonus_subtotal": 10, "penalties": {}, "penalty_subtotal": 0, "raw": 63, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "granted", "source": "https://www.anthropic.com/legal/aup", "quote": "Usage Policy, effective September 15, 2025, \"Additional Use Case Guidelines\"\n(https://www.anthropic.com/legal/aup) — permits agentic use:\n\n \"Agentic use cases must still comply with the Usage Policy. We provide\n examples of Usage Policy prohibitions in the context of agentic use in\n this Help Center article .\"\n\nSame page, \"Do Not Abuse our Platform\" — prohibits automating the SIGNUP\npath (not the API itself):\n\n \"Utilize automation in account creation or to engage in spammy behavior\"\n\nCommercial Terms of Service, effective June 17, 2025, section D.4\n(https://www.anthropic.com/legal/commercial-terms) — the only use\nrestrictions; none of them concern automated or agentic access:\n\n \"Customer may not and must not attempt to (a) access the Services to\n build a competing product or service, including to train competing AI\n models or resell the Services except as expressly approved by Anthropic;\n (b) reverse engineer or duplicate the Services; or (c) support any third\n party's attempt at any of the conduct restricted in this sentence.\"\n\nrobots.txt at https://www.anthropic.com/robots.txt is fully permissive:\n\n \"User-Agent: *\n Allow: /\"\n" }, "blocker": { "kind": "tos", "detail": "Three stacked layers, in increasing hardness. (1) Mechanical: API keys are generated only in the Claude Console web UI; the Admin API explicitly cannot mint a usable key. (2) Auth: the only sign-in options are Google OAuth, an emailed verification code, or enterprise SSO — no client-credentials or device flow. (3) Contractual and decisive: the Usage Policy forbids \"automation in account creation\", so driving the Console with a browser agent is non-compliant even where it is technically possible. The Console's client bootstrap config also carries Arkose Labs and hCaptcha site keys (arkoseKey, hcaptchaInvisibleSitekey, hcaptchaPartnerOnboardingSitekey observed in the /login page payload on 2026-08-16), but no challenge was triggered or attempted, so CAPTCHA is recorded as configured, not as observed.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://platform.claude.com/docs/mcp", "openapi": "https://storage.googleapis.com/stainless-sdk-openapi-specs/anthropic/anthropic-086fd8de69e181b730041d853827045c2df13e50b16ea2e1d4cb97b793d90caf.yml", "base_url": "https://api.anthropic.com", "signup": "human", "credential": "No programmatic signup or key-minting path exists. Verified from the docs:\n\n- https://platform.claude.com/docs/en/get-api-key states the flow is\n \"Sign in to the Claude Console\" -> \"Open the API keys page\" -> \"Click\n **Create key**\", and explicitly rules out the API route:\n \"The Admin API can't recover a lost key or give you a key to call the\n Claude API with. To get a usable API key, create one in [Settings -> API\n keys](https://platform.claude.com/settings/keys) in the Claude Console.\"\n- https://platform.claude.com/docs/en/manage-claude/authentication lists\n three auth methods (API key, Workload Identity Federation, App Attest).\n All three bootstrap from the Console UI: WIF requires that \"you create\n three resources in the Claude Console (a service account, a federation\n issuer, and a federation rule)\"; App Attest requires registering an app\n in the Console.\n- Admin API keys are also Console-only and admin-role-only\n (https://platform.claude.com/docs/en/manage-claude/admin-api-keys).\n- The sign-in page at https://platform.claude.com/login offers exactly\n three options in its rendered markup: \"Continue with Google\",\n \"Continue with email\", \"Continue with SSO\". The email path is a mailed\n code (\"Enter this verification code where you first tried to sign in\").\n\nOnce a key exists, the API is fully first-class for an agent: a static\n`x-api-key` header, or short-lived WIF bearer tokens from\n`POST /v1/oauth/token`. The wall is strictly at onboarding, not at use.\n", "payment": { "model": "card", "currencies": [ "USD" ], "reference_task_cost_usd": 0.0001 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Obtain a Claude API key and POST a single request to https://api.anthropic.com/v1/messages with model claude-haiku-4-5 and max_tokens 16, receiving HTTP 200 with a JSON body whose \"type\" is \"message\" and whose content[0].text is a non-empty string.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "open-meteo", "name": "Open-Meteo", "url": "https://open-meteo.com", "category": [ "weather", "data" ], "one_liner": "Open weather-data API (forecast, historical, air quality, marine, geocoding, elevation). The free tier serves unauthenticated HTTPS GETs with no signup and no card, capped at 10,000 calls/day and restricted by the terms to non-commercial use; commercial use requires a paid Stripe subscription and an API key on a separate customer- endpoint.\n", "a_score": 40, "band": "unverified", "provisional_band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": null, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": 0, "docs": 7 }, "dimension_subtotal": 75, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 80, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "granted", "source": "https://open-meteo.com/en/terms", "quote": "By using the Free API for non-commercial use you agree to following terms:\nLess than 10'000 API calls per day, 5'000 per hour and 600 per minute.\nYou may only use the free API services for non-commercial purposes.\nYou accept to the CC-BY 4.0 licence, as specified in the licence conditions.\nWe reserve the right to block applications and IP addresses that misuse our service\nwithout prior notice.\n" }, "blocker": { "kind": "none", "detail": "No wall for the reference task — the free endpoint answers an unauthenticated GET. A latent wall exists one step later: the terms restrict the free tier to non-commercial purposes, so an agent acting for a commercial product needs a paid plan, and that plan is bought through a Stripe checkout with a card, not through an API.\n" }, "how_to_use": { "interface": "openapi", "mcp": false, "openapi": "https://github.com/open-meteo/open-meteo/tree/main/openapi", "base_url": "https://api.open-meteo.com", "signup": "none", "credential": "None. The free endpoints accept unauthenticated HTTPS GETs. The optional apikey query parameter applies only to the paid customer-api.open-meteo.com host and is obtained through a Stripe checkout, not through an API.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Without holding any credential, issue a single GET to https://api.open-meteo.com/v1/forecast?latitude=52.52&longitude=13.41¤t=temperature_2m and parse a numeric current.temperature_2m and an ISO-8601 current.time out of the JSON response body.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "openlibrary", "name": "Open Library API", "url": "https://openlibrary.org", "category": [ "reference", "books" ], "one_liner": "Free, keyless JSON/YAML/RDF API for book, edition, work and author records, operated by the Internet Archive.", "a_score": 40, "band": "unverified", "provisional_band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": null, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 0, "docs": 7 }, "dimension_subtotal": 69, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 74, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "granted", "source": "https://openlibrary.org/developers/api", "quote": "Open Library provides APIs in JSON, YAML and RDF/XML formats to support\npublic-good, open, human-centered book discovery and lookup services. If you\nare building an open source or mission-aligned application that helps people\nfind and use books in real time, these APIs are for you.\n[robots.txt, verbatim] User-agent: ClaudeBot / Crawl-delay: 10 ;\nUser-agent: anthropic-ai / Crawl-delay: 10 (tolerated, not disallowed).\nCaveats, verbatim: \"These APIs are not intended to serve as a bulk data\nbackend or high-traffic commercial infrastructure\"; \"Make useful,\ntime-sensitive requests on behalf of human users\".\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "openapi", "mcp": false, "openapi": "Swagger UI at /swagger/docs; no directly-fetchable schema file located during the gate.", "base_url": "https://openlibrary.org", "signup": "none", "credential": "None. Optional: send a User-Agent naming the app + contact email for a 3x rate limit (3 req/s vs 1 req/s).", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no API key or account, GET https://openlibrary.org/isbn/9780140328721.json sending a descriptive User-Agent naming the application plus a contact email (per the usage guidelines), follow the 302 redirect to the canonical book record, and confirm the response is HTTP 200 JSON whose title is \"Fantastic Mr Fox\" and whose authors[] references author key /authors/OL34184A.\n", "verdict": "not-attempted", "transcript": "323ebcdd2d15ac07d966885a54f9049be9fbb06845db0779964221fb4297ef9f", "at": null, "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-09" }, { "id": "openrouter", "name": "OpenRouter", "url": "https://openrouter.ai", "category": [ "llm-inference", "ai-inference" ], "one_liner": "Unified OpenAI-compatible API for hundreds of LLMs with prepaid credits, free model variants, a hosted MCP server, OAuth PKCE for third-party apps, and a management API for keys. The first credential is minted on the Dashboard or through a human consent screen; crypto top-ups exist but only via the web.\n", "a_score": 40, "band": "unverified", "provisional_band": "friction", "dimensions": { "access": 3, "payment": 25, "interface": 20, "completion": null, "docs": 7 }, "breakdown": { "dimensions": { "access": 3, "payment": 25, "interface": 20, "completion": 0, "docs": 7 }, "dimension_subtotal": 55, "bonuses": { "security-posture": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 60, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://openrouter.ai/terms", "quote": "Terms of Service, \"Last Updated: August 31, 2026\", Section 7 (Prohibited\nConduct), \"BY USING THE SERVICE, YOU AGREE NOT TO:\" — item 5:\n\n \"develop, support or use software, devices, scripts, robots or any other\n means or processes (such as crawlers, browser plugins, add-ons or any\n other automated technology) to scrape or copy any information on the\n Site or the Services;\"\n\nitem 6: \"bypass any technical measures implemented by OpenRouter that are\ndesigned to prevent scraping;\"\n\nitem 3: \"create a false identity, misrepresent your identity, or create\nmultiple accounts as a single user, for purposes of bypassing or\ncircumventing use limits on the Site or Service or for any other reason;\"\n\nitem 11: \"conduct, or work with any third parties to conduct, without\nOpenRouter's prior written approval, any Red Teaming of Models. 'Red\nTeaming' means prompt injection, jailbreaking, or taking any other\nadversarial action designed to compromise any Models and/or violate any\nModel Terms;\"\n\nNo clause addresses agents, AI callers, or automated use of the API\nitself. Section 3.1: \"To access most features of the Service, you must\nregister for an account. When you register for an account, you may be\nrequired to provide us or our authentication platform with some\ninformation about yourself, such as your email address or other contact\ninformation.\"\n\nhttps://openrouter.ai/robots.txt: \"User-Agent: *\\nAllow: /\\nDisallow: /seo/\"\n" }, "blocker": { "kind": "consent", "detail": "The first API key is minted only on the Dashboard (openrouter.ai/keys) or through the OAuth PKCE consent page (openrouter.ai/auth), both of which require a logged-in human; account creation itself is Google/GitHub OAuth or email + password with an emailed verification link, behind a JavaScript-only sign-up page whose bot-protection status could not be read. Money is a second, softer wall: free models cover the reference task, but real usage needs prepaid credits ($5 minimum) bought on the web — the crypto API was removed (410 Gone), so even a wallet-holding agent must hand the top-up to a browser.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://mcp.openrouter.ai/mcp", "openapi": "https://openrouter.ai/docs/openapi/openapi.yaml", "base_url": "https://openrouter.ai/api/v1", "signup": "oauth-consent", "credential": "Every path to a first key passes through a human, briefly or fully.\n\n1. Account. openrouter.ai/sign-up is a JavaScript shell (no server-rendered\n form; the markup fetched on 2026-09-05 contained only the site header).\n Third-party documentation and OpenRouter's own SSO page describe the\n options as Google, GitHub, or email + password with an emailed\n verification link. Whether the form carries a bot challenge could not\n be determined without executing the page, which gate mode forbids.\n2. First key. https://openrouter.ai/docs/api-reference/authentication:\n \"To use an API key, first create your key\" at\n https://openrouter.ai/keys — a Dashboard page. Management API keys\n (which can mint further keys over POST /api/v1/keys) are themselves\n created at https://openrouter.ai/settings/management-keys, also\n Dashboard. Workload Identity Federation exchanges an external JWT for a\n 15-minute token at POST /api/v1/oauth/token, but \"requires an existing\n OpenRouter account\", Dashboard-configured issuer and policy, and is an\n Enterprise feature.\n3. OAuth PKCE (https://openrouter.ai/docs/use-cases/oauth-pkce) is the\n best rung available: the agent sends the user to\n https://openrouter.ai/auth?callback_url=…&code_challenge=…, \"Your user\n will be prompted to log in to OpenRouter and authorize your app\", then\n POST https://openrouter.ai/api/v1/auth/keys exchanges the code for a\n key. Headless variant: omit callback_url and \"the page displays the\n authorization code on screen instead of redirecting. The user copies it\n and pastes it into your app.\" Either way a human clicks Authorize —\n rung 3, \"OAuth with an interactive consent screen\".\n\nOnce a key exists, use is fully programmatic: Bearer header,\nOpenAI-compatible endpoints, GET /api/v1/key for balance and limits.\n", "payment": { "model": "free", "currencies": [ "USD", "USDC" ], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Starting from nothing, obtain an OpenRouter API key and POST https://openrouter.ai/api/v1/chat/completions with a model whose id ends in \":free\" and max_tokens 16, receiving HTTP 200 JSON whose choices[0].message.content is a non-empty string.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "porkbun", "name": "Porkbun", "url": "https://porkbun.com", "category": [ "domains", "dns" ], "one_liner": "Domain registrar with a REST/JSON API (v3.18) for registration, renewal, transfer, DNS/DNSSEC, SSL, forwarding and hosting, an OpenAPI spec, an official MCP server, and a keyless sandbox that mints throwaway credentials in one request. Production registration needs a human-verified phone and a human-placed first order.\n", "a_score": 40, "band": "unverified", "provisional_band": "friction", "dimensions": { "access": 0, "payment": 20, "interface": 20, "completion": 8, "docs": 10 }, "breakdown": { "dimensions": { "access": 0, "payment": 20, "interface": 20, "completion": 8, "docs": 10 }, "dimension_subtotal": 58, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 63, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "granted", "source": "https://porkbun.com/api/json/v3/documentation", "quote": "https://porkbun.com/api/json/v3/documentation (retrieved 2026-09-05):\n\n \"The domain API built for developers & AI agents\"\n \"Machine-readable errors, idempotency keys, an OpenAPI spec, a\n first-party MCP server, and a free sandbox make it a great fit for\n automation and autonomous agents.\"\n\nhttps://porkbun.com/llms.txt:\n\n \"The API is built for AI agents and automation: machine-readable error\n codes, idempotency keys on writes, request IDs, version signalling,\n header auth, GET on all reads, signed outbound webhooks, and an official\n MCP server.\"\n\nDomain Name Registration Agreement, effective March 17, 2025\n(https://porkbun.com/legal/agreement/domain_name_registration_agreement):\nchecked for \"automat\", \"bot\", \"script\", \"robot\", \"scrape\", \"crawl\",\n\"agent\", \"artificial intelligence\", \"natural person\", \"human\" — no clause\non automated access exists. Registration terms that do apply: \"You must\nprovide certain current, complete and accurate information about You with\nrespect to Your Account information\" and \"At our option, We may require\nthat You pay Fees through a particular payment means (such as by credit\ncard or by cryptocurrency transfer)\".\n\nhttps://porkbun.com/robots.txt:\n\n \"User-agent: *\n Allow: /api/json/v3/documentation\n Allow: /api/json/v3/spec\n Disallow: /checkout/*\n Disallow: /account/*\n Disallow: /api/*\"\n\nThe disallows cover the human web app on porkbun.com (account, checkout,\nthe site's internal /api/* XHR routes); the API itself lives on\napi.porkbun.com, which serves no robots.txt (HTTP 404), and the two\nmachine-facing documents are explicitly allowed. Read together with the\noperator's own \"built for AI agents\" statements, this is not a signal\nagainst agent use of the API. The probe honoured it anyway: no /account/*\nor /checkout/* URL was fetched at any point.\n" }, "blocker": { "kind": "sms", "detail": "\"Account email and phone must be verified\" before the first registration (https://porkbun.com/llms/domain, /llms/guides/register-a-domain), and \"Account must have placed at least one previous domain registration\" — so the very first real domain in any account is placed by a human on the website, after a human verifies a phone number. Compounding: production API keys are approved by \"the account holder … while logged into Porkbun\" (consent screen), and account credit is added only through the web checkout. The account-creation pages (/account/*) are robots-disallowed and were not fetched, so whether signup also carries a CAPTCHA is unverified. None of these walls exist in the sandbox, which is why the sandbox run completed and the production task is `blocked`.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://porkbun.com/mcp", "openapi": "https://porkbun.com/api/json/v3/spec", "base_url": "https://api.porkbun.com/api/json/v3", "signup": "human", "credential": "SANDBOX — zero human, proven 2026-09-05 (transcript §2). One request:\nPOST https://api.porkbun.com/api/json/v3/apikey/request with\n{\"sandbox\": true}. No account, no cookie, no email. Response in 2.0 s:\n{\"status\":\"SUCCESS\",\"apikey\":\"pk1_sb_…\",\"secretapikey\":\"sk1_sb_…\",\n\"sandbox\":true,\"message\":\"Sandbox key issued (throwaway test account with\n$1000 fake credit) …\"}. Those keys then checked, dry-ran, registered\n(simulated) and read back a .com against the same base URL. Rate limit on\nthe mint endpoint is 20/IP/hour and is signalled in X-RateLimit-* headers.\n\nPRODUCTION — a human, unavoidably, in three places. (1) Keys: created at\nporkbun.com/account/api (Dashboard), or via the same /apikey/request\nendpoint WITHOUT \"sandbox\", which \"returns a `requestToken` and `authUrl`\nthat the account holder must visit while logged into Porkbun to approve\nthe request\" — an interactive consent screen, optionally PKCE-bound so the\nsecret is delivered to the agent via /apikey/retrieve rather than shown in\nthe browser. (2) Registration preconditions, from /llms/domain: \"Account\nemail and phone must be verified\" and \"Account must have placed at least\none previous domain registration\" — the phone verification and the first\norder are human acts. (3) Funding: \"Account must have sufficient credit\";\nthe spec has no funding endpoint, so credit is added through the web\ncheckout. Once past those three, the API path is fully autonomous and was\nexercised end-to-end in the sandbox.\n", "payment": { "model": "crypto-prepaid", "currencies": [ "USD", "USDC" ], "reference_task_cost_usd": 11.08 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Starting from nothing, obtain Porkbun API credentials and register a new .com domain via POST https://api.porkbun.com/api/json/v3/domain/create/{domain}, passing only if a subsequent POST /domain/get/{domain} returns status \"SUCCESS\" with the domain ACTIVE and \"sandbox\": false.\n", "verdict": "blocked", "transcript": "dc62d4d81fdf712ceb4217cb128a6fe8a2f61474381816061813624575056f22", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "rentahuman", "name": "RentAHuman.ai", "url": "https://rentahuman.ai", "category": [ "human-labor", "marketplace", "agent-tools", "physical-world" ], "one_liner": "Marketplace where AI agents hire humans for physical-world tasks. Operated by RawLabs, Inc. Agent access is a first-class product surface: MCP server, REST API, OpenAPI, and pay-to-signup over x402 with no email, captcha, or dashboard step. The Terms nonetheless bind every agent to a human or entity principal.\n", "a_score": 40, "band": "unverified", "provisional_band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": null, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": 0, "docs": 7 }, "dimension_subtotal": 77, "bonuses": { "permissive-tos": 5, "security-posture": 5 }, "bonus_subtotal": 10, "penalties": {}, "penalty_subtotal": 0, "raw": 87, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "granted", "source": "https://rentahuman.ai/terms", "quote": "AI Agent Usage and API Access. AI agents, bots, and automated systems may use the Platform through our API and MCP server integrations. If you operate an AI agent that interacts with the Platform, you are fully responsible for all actions taken by your agent, including bounty creation, communication with Workers, payment obligations, and compliance with these Terms.\n" }, "blocker": { "kind": "none", "detail": "No human wall was reached on the technical path in gate mode. Three latent walls are recorded, none of them observed as blocking: (a) the Terms make the agent an appointed agent of a human or entity Poster who must be 18+ and use a legal name — see notes.human_principal_analysis; (b) \"Account Registration and Security\" (g) reserves discretionary identity, age, location and payment verification; (c) the x402 wallet-deposit endpoint is documented as early-access — \"a 404 with a valid key means your account isn't enrolled yet — email support@rentahuman.ai\" — which is a human escalation on the crypto top-up path, though signup itself answered live.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://rentahuman.ai/api/mcp", "openapi": "https://rentahuman.ai/.well-known/openapi.yaml", "base_url": "https://rentahuman.ai/api", "signup": "api", "credential": "POST https://rentahuman.ai/api/x402/signup with no credential of any kind returns HTTP 402 carrying a well-formed x402 v2 payment-requirements document (observed 2026-08-22, reproduced under notes.evidence). Paying it with an EIP-3009 signature returns a one-time `rah_` API key plus the full $10 as spendable wallet balance. The spec states \"No API key, no captcha, no email verification — the signed payment is the authentication\"; `agentName`, `country` and `contactEmail` are all optional and the email is \"Never used for login\". The MCP server additionally self-generates an Ed25519 keypair on first use, deriving the agent id from the public-key hash, and supports multiple named identities. The alternative free path, POST /api/agents/register, is documented as deprecated and returns `agent_registration_deprecated` pointing at the human dashboard — so the x402 route is now the only non-dashboard way in. NOTE: only the unpaid 402 half of the handshake was observed; the paid 200 path is unverified.\n", "payment": { "model": "x402", "currencies": [ "USDC", "USD", "EUR", "ETH", "BTC" ], "reference_task_cost_usd": 13 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Starting from nothing but a Base-network wallet holding USDC, create an account via POST /api/x402/signup, post one bounty with an agent-authored title and description via POST /api/bounties, and pass only if a subsequent GET /api/bounties/{id} returns that bounty with status `open` and the exact title that was sent — with zero human interventions at any step.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-22", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-22" }, { "id": "resend", "name": "Resend", "url": "https://resend.com", "category": [ "email-sending", "email" ], "one_liner": "Transactional and marketing email API with a free tier, an OpenAPI spec, a hosted MCP server, a CLI, and an \"AI onboarding\" guide that states a human must create the account. Sending from your own domain requires DNS records, which is a dependency on a domain the agent controls.\n", "a_score": 40, "band": "unverified", "provisional_band": "friction", "dimensions": { "access": 0, "payment": 25, "interface": 20, "completion": null, "docs": 10 }, "breakdown": { "dimensions": { "access": 0, "payment": 25, "interface": 20, "completion": 0, "docs": 10 }, "dimension_subtotal": 55, "bonuses": { "permissive-tos": 5, "security-posture": 5 }, "bonus_subtotal": 10, "penalties": {}, "penalty_subtotal": 0, "raw": 65, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://resend.com/legal/terms-of-service", "quote": "Terms of Service, updated 2026-08-27 — Section 10 (Prohibited Uses) lists\nonly: overburdening or impairing the Service, introducing malicious code,\nunauthorized access, and denial-of-service attacks. Checked for \"automat\",\n\"bot\", \"script\", \"scrape\", \"agent\", \"artificial intelligence\": no clause\non automated access exists. Section 13: \"When you create an account with\nus, you guarantee that you are above the age of 18, and that the\ninformation you provide us is accurate, complete, and current at all\ntimes.\"\n\nAcceptable Use Policy, updated 2026-08-27\n(https://resend.com/legal/acceptable-use): \"Users are expressly forbidden\nfrom creating or using an account or multiple accounts with the aim of\ncircumventing any quotas or limits imposed by our service.\" No clause on\nautomated access.\n\nhttps://resend.com/robots.txt: \"User-agent: *\\nAllow: /\\nContent-Signal:\nai-train=yes, search=yes, ai-input=yes\"\n\nhttps://resend.com/docs/ai-onboarding — \"Everything you need to onboard\nyour AI agent to Resend.\" — and, in its Prerequisites: \"A human must\ncreate the Resend account.\"\n" }, "blocker": { "kind": "consent", "detail": "Account creation is a browser act — Google/GitHub OAuth (a consent screen) or an email + password form — and the operator's own AI-onboarding guide says \"A human must create the Resend account.\" The first API key is then created in the Dashboard; API, CLI and MCP key creation all require a key or an OAuth browser login that already exists. A second, structural wall for the reference task: sending from the agent's own domain requires DKIM/SPF (TXT) and MX/CNAME records at a DNS provider, so the agent must already control a domain — a dependency on a registrar that is itself human-gated at first purchase. Sending to Resend's own test addresses (delivered@resend.dev etc.) works without a verified domain but \"count[s] against your account's sending quota\".\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://mcp.resend.com/mcp", "openapi": "https://github.com/resend/resend-openapi", "base_url": "https://api.resend.com", "signup": "human", "credential": "The operator states the wall in its own agent guide: \"A human must create\nthe Resend account.\" (https://resend.com/docs/ai-onboarding, Prerequisites.)\nThe sign-up page (https://resend.com/signup, server-rendered, fetched\n2026-09-05) offers \"Log in with Google\", \"Log in with GitHub\", or an\nemail + password form (\"At least 12 characters\", \"Mix of letters,\nnumbers, and symbols\") with a \"Create account\" button — no CAPTCHA\nscript was visible in the markup, and no statement about email\nverification appears on the page.\n\nFirst key: \"Once you have an account, you'll need to create an API key.\"\nThe docs list four ways to create keys — Dashboard, REST API, CLI, MCP —\nbut the API path (POST /api-keys) needs an existing full-access key, the\nCLI authenticates only \"by storing your API key locally\" (`resend login\n--key re_…`; no device or browser flow), and the remote MCP authenticates\nby OAuth browser login or an existing key as bearer. So the very first key\nis a Dashboard act; every later key can be minted programmatically with\n\"Sending access\" or \"Full access\" and an optional single-domain\nrestriction.\n\nDependency chain for the reference task: \"While an agent can create a\ndomain, the API returns DNS records you will need to add in your DNS\nprovider before verifying your DNS records. You may find it easier to\nverify your domain in the dashboard.\" An agent can do the DNS half only if\nit already controls a domain at a registrar with an API (see the porkbun\nentry, which is itself human-gated at first registration).\n", "payment": { "model": "free", "currencies": [ "USD" ], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Starting from nothing, obtain a Resend API key, add and verify a sending domain via the API, and POST https://api.resend.com/emails from an address on that domain to delivered@resend.dev, passing only if GET /emails/{id} reports last_event \"delivered\".\n", "verdict": "not-attempted", "transcript": null, "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "stripe", "name": "Stripe", "url": "https://stripe.com", "category": [ "payments", "finance" ], "one_liner": "Payment processing API (Payments, Payment Links, Checkout, Billing, Connect, Issuing). Test-mode keys can be minted anonymously in seconds by the Stripe CLI; live mode requires business verification (KYC) and a bank account in the Dashboard.\n", "a_score": 40, "band": "unverified", "provisional_band": "ready", "dimensions": { "access": 0, "payment": 25, "interface": 20, "completion": 8, "docs": 10 }, "breakdown": { "dimensions": { "access": 0, "payment": 25, "interface": 20, "completion": 8, "docs": 10 }, "dimension_subtotal": 63, "bonuses": { "permissive-tos": 5, "security-posture": 5 }, "bonus_subtotal": 10, "penalties": {}, "penalty_subtotal": 0, "raw": 73, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "granted", "source": "https://docs.stripe.com/sandboxes", "quote": "docs.stripe.com/sandboxes (retrieved 2026-09-05):\n\n \"Coding agents should install the Stripe CLI (`npm i -g @stripe/cli`) and\n run the command `stripe sandbox create --help` to provision an anonymous\n Stripe sandbox with working API keys. No account registration required.\"\n\ndocs.stripe.com/mcp — \"Let your AI agents interact with the Stripe API by\nusing our MCP server.\"\n\nhttps://docs.stripe.com/robots.txt:\n\n \"User-agent: *\n Content-Signal: ai-train=yes, search=yes, ai-input=yes\n Allow: /\"\n\nStripe Services Agreement, last updated November 18, 2025\n(https://stripe.com/legal/ssa) — contains no clause on automated access,\nbots, scripts, scraping, crawling, or agents (checked for each term). The\nonly restrictions touching account creation are Section 1.2(a)(vii),\n\"attempt to create a Stripe Account on behalf of or for the benefit of a\nuser whose use of the Stripe services was suspended or terminated by\nStripe\", and 1.2(a)(viii), \"act as service bureau or pass-through agent for\nthe Services with no added value to Customers\". Neither addresses an agent\noperating its principal's own account.\n" }, "blocker": { "kind": "kyc", "detail": "The wall is at go-live, not at first contact. An agent gets working test-mode keys in 2 seconds with no account; it cannot get a live key or process a real payment without a human who owns a legal identity, a business, and a bank account in that name, and who completes business verification in the Dashboard (\"Provide information about your business, product, and relationship to the business\"). Secondary walls: the anonymous sandbox's key is permission-limited (403: \"This is a claimable sandbox key with limited permissions. Use the claim URL provided when the sandbox was created to get a full API key with access to all features.\") and the sandbox is deleted after 7 days unless claimed on dashboard.stripe.com by a human. No CAPTCHA, SMS, or consent screen was encountered on the anonymous path; none was attempted on the human path.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://mcp.stripe.com", "openapi": "https://github.com/stripe/openapi", "base_url": "https://api.stripe.com", "signup": "human", "credential": "Two very different answers, and the gap between them is the whole entry.\n\nTEST MODE — zero human, proven 2026-09-05 (transcript §2). `npm install\n@stripe/cli` (binary ships as an npm optional dependency; no GitHub\ndownload), then `stripe sandbox create --email <any> --non-interactive`.\nThe CLI does POST https://ai.stripe.com/keys/challenge, solves a SHA-256\nproof-of-work, POSTs /keys/provision, and prints a restricted test key\n(`rkcs_test_…`), a publishable key, an account id, and a claim URL — in\n2 seconds. A placeholder email at example.com was accepted with no\nverification round-trip. The key then created a Product, Price and Payment\nLink over plain REST. Limits observed: the key is a \"claimable sandbox key\nwith limited permissions\" (HTTP 403 on GET /v1/balance and /v1/account,\nerror text quoted below), the sandbox expires in 7 days unless a human\nclaims it in the Dashboard, and the key itself expires 2026-12-04.\n\nLIVE MODE — human, unavoidably. docs.stripe.com/get-started/account/activate:\n\"To use a service in live mode, verify your business and complete its\nactivation requirements.\" and \"Our 'Know Your Customer' (KYC) obligations\nrequire us to collect and maintain this information for all users.\" SSA\n7.4 requires the User to \"be the named account holder of each User Bank\nAccount\". Live keys exist only on the Dashboard API-keys page\n(docs.stripe.com/keys: \"Use the API keys page in the Dashboard to create,\nreveal, expire, and rotate keys\"; creating a secret key requires \"the\nverification code that we send you by email or text message\"). No API\nmints a live key. Account signup itself (dashboard.stripe.com/register)\nis email + password + emailed verification; 2FA is required for some\nusers. The claimable-sandbox claim URL leads to the same Dashboard\nonboarding.\n", "payment": { "model": "free", "currencies": [ "USD" ], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Starting from nothing, obtain a Stripe secret API key and, in live mode, create a Payment Link for a one-time USD 1.00 price (POST /v1/products, /v1/prices, /v1/payment_links) such that GET /v1/payment_links/{id} returns \"active\": true and \"livemode\": true.\n", "verdict": "blocked", "transcript": "565f7ae505d32de20f10de32cde28e9ab7f2589446cf7c05c48fac25ca1472a8", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "ultimate-random-chess", "name": "Ultimate Random Chess", "url": "https://ultimaterandomchess.com", "category": [ "games", "chess", "agent-arena" ], "one_liner": "Small independent chess-variant web game (random back rank, 15 custom pieces) with a public JSON API at api.ultimaterandomchess.com. Publishes an ADD discovery manifest at /.well-known/add.json and a 10-step machine-readable agent runbook at /api/agent-quickstart. Agents and humans share one identity model, one endpoint set, one online list and one rating ladder. No terms of service page exists.\n", "a_score": 40, "band": "unverified", "provisional_band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": null, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 0, "docs": 7 }, "dimension_subtotal": 69, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 74, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://ultimaterandomchess.com/privacy/", "quote": null }, "blocker": { "kind": "none", "detail": "No human wall is visible on the public surface: no CAPTCHA, no SMS, no KYC, no waitlist, no consent screen, no card and no dashboard-only key issuance appear in the published contract. /start-game/ advertises play as \"instant · vs the bot · no signup\". This is an absence-of-evidence finding from published docs, not a verified traversal — gate mode did not execute signup, so a wall that only appears at runtime would not have been seen.\n" }, "how_to_use": { "interface": "rest", "mcp": false, "openapi": false, "base_url": "https://api.ultimaterandomchess.com", "signup": "api", "credential": "Two documented programmatic paths, neither exercised. (1) Throwaway: `POST https://api.ultimaterandomchess.com/api/auth/anon` — documented as \"no body, no auth\", returning `{ token, user: { username, ... } }`. (2) Stable agent identity: generate an Ed25519 keypair locally, then `POST /api/auth/signup` with `{ username, entityType: \"agent\", publicKey, inboxUrl? }` signed per RFC 9421 / Web Bot Auth, where `keyid` must equal the JWK thumbprint of the supplied public key; `POST /api/auth/session` then exchanges a signature for a short-lived Bearer token. No email address, no password, no CAPTCHA and no card appear in either documented flow. The strings \"captcha\", \"recaptcha\", \"hcaptcha\" and \"turnstile\" do not occur in any page fetched during this probe. This is a documentation-derived claim: gate mode forbids signup, so no flow was executed and no hidden wall can be ruled out.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Mint an anonymous bearer token with POST /api/auth/anon, create a game against the resident bot with POST /api/games, and post one legal opening move with POST /api/games/:id/move — pass if a subsequent GET /api/games/:id/moves lists that exact move as move 1. NOT ATTEMPTED: this was a gate-mode probe, so no account was created and no move was ever posted.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "vercel", "name": "Vercel", "url": "https://vercel.com", "category": [ "hosting", "compute" ], "one_liner": "Frontend/serverless hosting platform with a full REST API and OpenAPI spec, a hosted MCP that can deploy code and buy domains, and terms that expressly bind the user to actions of their AI agents. Account signup is gated on email OTP or Git-provider OAuth plus, by many accounts, SMS phone verification; the first access token is Dashboard-only; the free Hobby plan is non-commercial.\n", "a_score": 40, "band": "unverified", "provisional_band": "friction", "dimensions": { "access": 0, "payment": 5, "interface": 20, "completion": null, "docs": 7 }, "breakdown": { "dimensions": { "access": 0, "payment": 5, "interface": 20, "completion": 0, "docs": 7 }, "dimension_subtotal": 32, "bonuses": { "permissive-tos": 5, "security-posture": 5 }, "bonus_subtotal": 10, "penalties": {}, "penalty_subtotal": 0, "raw": 42, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "granted", "source": "https://vercel.com/legal/terms", "quote": "Terms of Service, \"Last Updated: June 1, 2026\", Section 6 (AI\nFunctionality and Third Party Tools):\n\n \"If you enable (a) your own or third party's AI powered tools, agents,\n or similar technologies, (b) your own or third party AI, or (c) third\n party services ('Third Party Tools') to access the Services (e.g.,\n without limitation, giving Third Party Tools your secrets, credentials,\n or access to your code repository), you authorize and agree to be\n legally bound by the actions taken on your behalf by those Third Party\n Tools.\"\n\n \"You agree that your Third Party Tools constitute an 'electronic agent'\n or equivalent concept as defined in the Uniform Electronic Transactions\n Act (UETA) and other similar laws.\"\n\nSection 1 (Age and Eligibility): \"You certify that you are a person at\nleast 16 years of age.\" and \"Services may only be used or accessed through\nan electronic device controlled by you at all times.\" — an eligibility\nclause about the account holder, read together with Section 6 as\ncontemplating agents acting for that holder.\n\nSection 4 (Hobby Plan): \"You shall only use the Services under a Hobby\nplan for your personal or non-commercial use.\"\n\nAPI Terms, last updated July 8, 2025 (https://vercel.com/legal/api-terms),\nSection 4.2 restrictions relevant to agents: (e) \"attempt to use the API in\na manner that constitutes excessive or abusive usage, circumvent any rate\nlimits or restrictions or bypass any protective measures or safety\nmitigations of the API\"; (f) \"use any method to extract data, such as web\nscraping, web crawling, or data harvesting, from the API\"; (h) \"process\nAPI Data to develop, improve, or train artificial intelligence or machine\nlearning applications or models\". None bars an agent driving the API on\nits principal's behalf.\n\nhttps://vercel.com/robots.txt: \"User-Agent: *\\nContent-Signal: search=yes,\nai-input=yes, ai-train=no\" … \"Disallow: /signup?*\" … \"Disallow: /oauth\"\n… \"Disallow: /confirm\". (The bare /signup path is not disallowed; the\nquery-string variant, the OAuth callback and the confirm page are. None\nwas fetched.)\n\nhttps://vercel.com/llms.txt, \"How agents should use Vercel\": \"For REST API\ncalls, read the OpenAPI description and authentication documentation\nbefore choosing an operation. Ask for approval before changing account\nresources.\"\n" }, "blocker": { "kind": "sms", "detail": "Account signup is email OTP or Git-provider OAuth, and by Vercel's KB (\"multiple layers of security and verification during the account signup process\") and repeated user reports acknowledged by Vercel staff, a phone number verified by SMS one-time code, with manual review by registration@vercel.com when that fails. The first access token can only be created on the Dashboard Tokens page — the API and CLI token endpoints require an existing full-account token, and the CLI's OAuth device-flow session cannot mint one. Commercial use additionally requires the Pro plan, paid by card in the Dashboard. None of these were attempted; all are quoted.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://mcp.vercel.com", "openapi": "https://openapi.vercel.sh/", "base_url": "https://api.vercel.com", "signup": "human", "credential": "Three stacked gates before the first token, then a fully programmatic\nsurface.\n\n1. Account. https://vercel.com/docs/accounts: \"Enter your email address to\n receive the six-digit one-time password (OTP)\" (programmable-inbox\n rung on its own), or \"sign up with any of the following supported Git\n providers: GitHub, GitLab, Bitbucket\" (OAuth consent). \"If no Git\n provider is connected, you will be asked to verify your account on\n every login attempt.\"\n2. Phone. Not in the docs, but documented by Vercel's own KB and staff:\n \"To protect against platform abuse, Vercel employs multiple layers of\n security and verification during the account signup process\"\n (vercel.com/kb/guide/why-can-i-not-signup, 2025-11-03). Users report\n \"Please enter your phone number to verify your login. You will receive\n a single use code\", \"I'm blocked from signing up because I need to\n verify with an SMS\", and \"Your account requires further verification …\n contact registration@vercel.com\"; a Vercel staff reply on\n community.vercel.com (2025-04-18) routes the SMS-blocked user to\n registration@vercel.com, and a documented resolution involved\n supplying a phone number and waiting for manual review (\"Our typical\n review time is 1-2 weeks\"). Rubric: SMS → 0.\n3. First token. https://vercel.com/docs/accounts/access-tokens: created\n \"on the Account Tokens page, under the Settings area of your account\";\n \"Creating tokens through the CLI or API requires a full-account token.\n A project-scoped token cannot mint new tokens.\" `vercel login` is now\n \"industry-standard OAuth 2.0 Device Flow\" (changelog 2025-09-12) — a\n browser approval — and \"OAuth sessions created by `vercel login`\n cannot mint new tokens\". POST /v3/user/tokens itself is authenticated\n by an existing bearer token. Dashboard-only key generation → 0.\n\nAfter that: Bearer `vcp_…` tokens scoped to account, team or project with\nan expiry; every resource (teams, projects, deployments, domains, DNS,\nsandboxes, tokens) has a documented endpoint in the OpenAPI spec.\n", "payment": { "model": "card", "currencies": [ "USD" ], "reference_task_cost_usd": 20 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Starting from nothing, on a plan that permits commercial use, obtain a Vercel access token and deploy a single static index.html to production via POST https://api.vercel.com/v13/deployments (files inline), passing only if GET /v13/deployments/{id} returns readyState \"READY\" and the deployment URL serves HTTP 200.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "shortingcentral", "name": "Shorting Central", "url": "https://shortingcentral.com", "category": [ "finance", "market-data", "trading-signals" ], "one_liner": "Short-selling stock screener. Ranks the session's biggest gainers by a 0-100 \"short score\". The gainers list and per-symbol data are served by an undocumented keyless JSON API; the ranked score column is sold at $10/mo through Whop hosted card checkout. No developer documentation, no terms of service, and no machine-payable path exist.\n", "a_score": 36, "band": "unverified", "provisional_band": "human-gated", "dimensions": { "access": 25, "payment": 5, "interface": 6, "completion": null, "docs": 0 }, "breakdown": { "dimensions": { "access": 25, "payment": 5, "interface": 6, "completion": 0, "docs": 0 }, "dimension_subtotal": 36, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 36, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://shortingcentral.com/robots.txt", "quote": "User-agent: *\nAllow: /\nSitemap: https://shortingcentral.com/sitemap.xml\n" }, "blocker": { "kind": "none", "detail": "No human wall stands between an agent and the free data surface. The reference task nonetheless did not complete: /api/stocks/market-summary returned topShortCandidate:null and /api/stocks/gainers, /premarket-gainers and /postmarket-gainers each returned HTTP 200 [] for the duration of the probe (US markets closed, ~22:20 ET). No endpoint carries a session or market-state field — /api/stocks/{SYMBOL} reports \"marketState\":null — so an unattended consumer cannot distinguish \"market closed\" from \"no candidates today\" from \"upstream feed down\"; all three present as HTTP 200, an empty array, and a fresh lastUpdated timestamp. The prerendered HTML actively misreports this, serving a hardcoded \"MARKET OPEN\" badge and a clock reading 12:23:26 PM Wed, Aug 19, 2026 ET (last-modified: Wed, 19 Aug 2026 16:23:26 GMT) three days stale.\n" }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": "https://shortingcentral.com/api", "signup": "api", "credential": "None required for the data endpoints. All /api/stocks/* reads answered unauthenticated with HTTP 200 application/json. An account is nominally obtainable programmatically — POST /api/auth/signup accepted a burner address with no email verification, no CAPTCHA and no confirmation step, returning HTTP 200 and a connect.sid session cookie — but the session does not survive: a subsequent GET /api/me carrying that cookie returned {\"user\":null}, and both /api/whop/verify and /api/whop/checkout returned HTTP 401 {\"error\":\"Not authenticated\"}. The behaviour is consistent with an in-memory Express session store on autoscaled Google App Engine (server: Google Frontend, x-powered-by: Express). Scored 25 because nothing beyond HTTP is *required*; the authenticated path is broken rather than human-gated, and the two must not be collapsed.\n", "payment": { "model": "card", "currencies": [ "USD" ], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Without holding any credential, read the scanner's own ranked pick for the current session from GET https://shortingcentral.com/api/stocks/market-summary and confirm that topShortCandidate names a ticker.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-21", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-21" }, { "id": "twilio", "name": "Twilio", "url": "https://www.twilio.com", "category": [ "messaging", "voice", "communications" ], "one_liner": "Cloud communications API for SMS, voice, WhatsApp, and email. Excellent machine-facing API surface; account onboarding is gated on human phone verification.\n", "a_score": 35, "band": "unverified", "provisional_band": "human-gated", "dimensions": { "access": 0, "payment": 5, "interface": 20, "completion": null, "docs": 10 }, "breakdown": { "dimensions": { "access": 0, "payment": 5, "interface": 20, "completion": 0, "docs": 10 }, "dimension_subtotal": 35, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 35, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://www.twilio.com/en-us/legal/aup", "quote": "Harmful Code or Bots. Transmitting code, files, scripts, agents, or programs intended to do harm, including viruses or malware, or using automated means, such as bots, to gain access to or use the Services.\n" }, "blocker": { "kind": "sms", "detail": "Signup requires verifying a personal phone number by SMS one-time code. Twilio docs: \"The sign-up process includes the following steps: Verify your email address. Verify your personal phone number.\" Compounding walls: (a) the Account SID and Auth Token are Console-only, (b) trial accounts may send only to recipients that have themselves been SMS-verified (max 5), (c) trial accounts may not send custom message bodies at all — only Twilio-provided templates — so the reference task requires a paid upgrade, and (d) sending SMS to US recipients additionally requires A2P 10DLC brand registration, which the docs state requires a paid account.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://mcp.twilio.com/docs", "openapi": "https://github.com/twilio/twilio-oai", "base_url": "https://api.twilio.com/2010-04-01", "signup": "human", "credential": "Not obtainable by a baseline agent. Account signup requires verifying a personal phone number (SMS OTP) through a JavaScript SPA at auth.twilio.com; https://www.twilio.com/try-twilio 302s to https://auth.twilio.com/login. The root credential (Account SID + Auth Token) is viewable only in the Console. Per /docs/iam/api-keys, `Main` API keys are \"Create with REST API: No\". Once a human has bootstrapped one account, an agent CAN mint further credentials programmatically: POST /2010-04-01/Accounts.json creates subaccounts (each returning its own auth_token), and Standard/Restricted API keys are creatable over REST. The human wall is strictly at bootstrap.\n", "payment": { "model": "card", "currencies": [ "USD", "GBP" ], "reference_task_cost_usd": null } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Starting from no account, obtain Twilio API credentials, send one SMS with an agent-authored message body to an arbitrary recipient phone number via POST https://api.twilio.com/2010-04-01/Accounts/{AccountSid}/Messages.json, and pass only if a subsequent GET on the returned Message SID reports a status of `sent` or `delivered`.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "0x0-st", "name": "0x0.st (The Null Pointer)", "url": "https://0x0.st", "category": [ "storage", "file-hosting" ], "one_liner": "Minimalist no-auth curl-based file/URL host. Reachable and curl-friendly from ordinary residential IPs, but it enforces a bot-detection wall — HTTP 418 for blocklisted User-Agents and a TCP-level refusal for VPN/Tor/datacenter IP ranges — which black-holes the cloud/datacenter infrastructure an autonomous agent runs on.\n", "a_score": 0, "band": "unverified", "provisional_band": "unverified", "dimensions": { "access": null, "payment": null, "interface": null, "completion": null, "docs": null }, "breakdown": { "dimensions": { "access": 0, "payment": 0, "interface": 0, "completion": 0, "docs": 0 }, "dimension_subtotal": 0, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 0, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://0x0.st/", "quote": "HTTP/1.1 418 I'm a Teapot\n(GET https://0x0.st/ from the web fetcher; and, from the sandbox's\ndatacenter IP, the proxy egress log:\n\"opensock: Could not establish a connection to 0x0.st:443\")\n" }, "blocker": { "kind": "bot-wall", "detail": "Anti-abuse bot-detection wall (IP/UA reputation, not a literal CAPTCHA and not a consent/TOS wall). 0x0.st returns HTTP 418 to blocklisted User-Agents and refuses the TCP connection outright from VPN/Tor/datacenter IP ranges. An autonomous agent runs on exactly that infrastructure, so the service is unreachable without circumventing the IP/UA access control, which the probe forbids.\n" }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": null, "signup": null, "credential": null, "payment": { "model": null, "currencies": [], "reference_task_cost_usd": null } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "POST a small text file to https://0x0.st as multipart `file` and pass only if a public URL comes back that serves the same bytes. NOT COMPLETED: the target refused every connection (HTTP 418 from one IP; TCP black-hole from the datacenter IP the sandbox runs on) before any file could be posted.\n", "verdict": "blocked", "transcript": "5707a1e7a731af918392a469ed1127bead9b0c156cf50ffa59277c3a8f17506a", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "cms-bluebutton", "name": "CMS Blue Button 2.0 API", "url": "https://bluebutton.cms.gov", "category": [ "healthcare", "claims", "government-api", "patient-data" ], "one_liner": "The US Medicare beneficiary claims API. Machine-readable docs, OAuth-based, but the production path is human-gated: an organization must pass a CMS review and a scheduled Zoom demo to get credentials, and every data pull needs the beneficiary's own Medicare.gov consent. First-hand during an autonomous venture attempt (Tilper sim-2), not a dedicated probe.\n", "a_score": 0, "band": "unverified", "provisional_band": "unverified", "dimensions": { "access": null, "payment": null, "interface": null, "completion": null, "docs": null }, "breakdown": { "dimensions": { "access": 0, "payment": 0, "interface": 0, "completion": 0, "docs": 0 }, "dimension_subtotal": 0, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 0, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://bluebutton.cms.gov/terms/", "quote": "You may only access (or attempt to access) the Blue Button APIs by the means\ndescribed in the documentation of those APIs.\n" }, "blocker": { "kind": "consent", "detail": "Two stacked human walls. (1) Production access: organizations must submit a privacy policy + terms, apply, complete a scheduled 1-hour Zoom demo, and receive a manual credential handoff. (2) Data access: each beneficiary must authorize the application via a Medicare.gov OAuth consent flow they perform themselves; the agent may not request, hold, or share the beneficiary's Medicare.gov credentials, and may not disclose records without explicit consent. Neither wall is defeatable by an agent, and neither should be.\n" }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": "https://api.bluebutton.cms.gov", "signup": "human", "credential": null, "payment": { "model": null, "currencies": [], "reference_task_cost_usd": null } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no human, obtain production CMS Blue Button API credentials and read one Medicare beneficiary's claims via the authorized API — pass only if real claims data is returned with zero human steps. NOT COMPLETED: production access requires an organization review plus a scheduled Zoom demo and manual credential handoff, and data access requires the beneficiary's own Medicare.gov consent, so no request for claims data was ever made.\n", "verdict": "blocked", "transcript": "a7e04cfbe2ea95ba1499e27619ee2e78f53b4a2cde95e4c18261f85fd6b208e6", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "dpaste", "name": "dpaste.org", "url": "https://dpaste.org", "category": [ "publishing", "pastebin" ], "one_liner": "Pastebin that historically offered a documented no-auth REST API (POST /api/). As of 2026-09-05 the public service is TEMPORARILY HALTED after a CSAM abuse incident: every path serves a \"RED ALERT\" notice and POST /api/ returns HTTP 405. Not currently usable; re-probe when it returns.\n", "a_score": 0, "band": "unverified", "provisional_band": "unverified", "dimensions": { "access": null, "payment": null, "interface": null, "completion": null, "docs": null }, "breakdown": { "dimensions": { "access": 0, "payment": 0, "interface": 0, "completion": 0, "docs": 0 }, "dimension_subtotal": 0, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 0, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://dpaste.org/", "quote": "At the moment, dpaste has temporarily halted its operation as a public\npastebin. This decision follows a recent incident in which malicious actors\nposted prohibited material (CSAM) ...\n" }, "blocker": { "kind": "none", "detail": "Temporary service outage (not a human wall, TOS, or CAPTCHA). The public pastebin including the API is halted after a CSAM abuse incident; POST /api/ returns HTTP 405 and all paths serve a \"RED ALERT\" notice. See GitHub issue #274.\n" }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": "https://dpaste.org/api/", "signup": null, "credential": null, "payment": { "model": null, "currencies": [], "reference_task_cost_usd": null } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "POST content to https://dpaste.org/api/ and pass only if a URL comes back that returns the raw content. FAILED 2026-09-05: the public service is temporarily halted; POST /api/ returns HTTP 405 and every path serves a halt notice.\n", "verdict": "failed", "transcript": "458998204915f80445653608192649ff22923bebde2f3e40647f47e76ad52e37", "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "appsignal", "name": "AppSignal", "url": "https://www.appsignal.com", "category": [ "observability" ], "one_liner": "Hosted APM (errors, traces, logs, metrics, uptime) for Ruby, Elixir, Node.js, Python and OpenTelemetry languages. Ships a hosted MCP server, a REST v2 API, a GraphQL API and a CLI; all credentials are minted in the web dashboard.\n", "a_score": 0, "band": "agent-prohibited", "dimensions": { "access": 0, "payment": 25, "interface": 20, "completion": null, "docs": 7 }, "breakdown": { "dimensions": {}, "dimension_subtotal": 0, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 0, "capped_at_verification_line": false, "short_circuit": "agent-prohibited" }, "permission": { "status": "prohibited", "source": "https://www.appsignal.com/terms", "quote": "Any user of the Service must be a human; users registered by “robots” or other\nautomated methods are not permitted.\n" }, "blocker": { "kind": "tos", "detail": "Two independent human walls, either of which alone blocks the reference task. (a) TOS, https://www.appsignal.com/terms section 2: \"Any user of the Service must be a human; users registered by “robots” or other automated methods are not permitted.\" (b) Mechanical: reCAPTCHA v3 on the signup form at https://appsignal.com/users/sign_up, and every API credential — personal API token, MCP token, and the app's front-end/push API key — is documented as obtainable only from a dashboard screen or an interactive OAuth consent screen. There is no documented signup, token-mint, or client-credentials endpoint. Once a human has minted a scoped MCP token, an agent can operate fully unaided; the wall is entirely at credential acquisition.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://appsignal.com/api/mcp", "openapi": null, "base_url": "https://appsignal.com/api/v2", "signup": "human", "credential": "No credential can be minted over HTTP. Every documented path ends at the web dashboard or an interactive browser consent screen. (1) Account creation: https://appsignal.com/users/sign_up serves a Google reCAPTCHA v3 challenge (script https://www.recaptcha.net/recaptcha/api.js with action 'signup' and a hidden g-recaptcha-response-data[signup] input), and the TOS bars robot registration. (2) Personal API token: \"Your personal API key can be found on the personal settings screen (https://appsignal.com/users/edit)\" — https://docs.appsignal.com/api. No documented endpoint issues one. (3) MCP Bearer token: \"1. Select your profile icon. 2. Go to Account Settings. 3. Select MCP Tokens to create a new token.\" — https://docs.appsignal.com/mcp/setup. (4) MCP/CLI OAuth: interactive browser consent; the CLI docs state \"The browser flow needs a browser on the same machine as the CLI\" — https://docs.appsignal.com/cli/authentication. (5) Push / front-end API key for the ingest endpoint: \"Front-end API key, can be found in App settings\" — https://docs.appsignal.com/api/public-endpoint.\n", "payment": { "model": "free", "currencies": [ "USD", "EUR" ], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Obtain AppSignal credentials unaided, create an application, POST one error named \"Ag3ntSearchProbeError\" to https://appsignal-endpoint.net/errors, and read that same error back through the AppSignal API within 10 minutes — pass only if the error is returned by a read call with no human action at any step.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "jina-reader", "name": "Jina Reader", "url": "https://r.jina.ai", "category": [ "scraping", "reading", "web-content" ], "one_liner": "Hosted URL-to-markdown reader (GET https://r.jina.ai/<url>) sold as LLM-grounding infrastructure. Its governing Terms and Conditions forbid using automated methods to extract information from \"the Services\", so it is indexed as agent-prohibited and was not probed.\n", "a_score": 0, "band": "agent-prohibited", "dimensions": { "access": null, "payment": null, "interface": null, "completion": null, "docs": null }, "breakdown": { "dimensions": {}, "dimension_subtotal": 0, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 0, "capped_at_verification_line": false, "short_circuit": "agent-prohibited" }, "permission": { "status": "prohibited", "source": "https://jina.ai/legal/", "quote": "4.5 Customers must not (i) reverse engineer, decompile, translate or otherwise\nattempt to discover the source code or underlying components of the Services\nor Jina AI's IP (except to the extent permitted under applicable mandatory\nlaw); (ii) use the Services in a way that infringes, misappropriates or\nviolates any third party rights; (iii) use any Output from the Services to\ndevelop applications or services that compete with the Services offered by\nJina AI; or (iv) use automated methods to extract information, data or result\nfrom the JINA-AI website or the Services, including by means of scraping,\nharvesting, or web data extraction.\n" }, "blocker": { "kind": "tos", "detail": "Jina AI \"Terms and Conditions\" (https://jina.ai/legal/, Last Modified May 4, 2026) §4.5(iv): customers must not \"use automated methods to extract information, data or result from the JINA-AI website or the Services, including by means of scraping, harvesting, or web data extraction.\" An agent calling r.jina.ai is, by construction, an automated method extracting a result from the Services. Halted at the gate; zero requests were made to r.jina.ai or mcp.jina.ai's RPC surface.\n" }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": null, "signup": null, "credential": null, "payment": { "model": null, "currencies": [], "reference_task_cost_usd": null } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credentials, GET https://r.jina.ai/https://example.com and pass if the response is HTTP 200 whose body contains the string \"Example Domain\". NOT ATTEMPTED: Terms and Conditions §4.5(iv) forbids automated extraction from the Services, so no request was ever sent to r.jina.ai.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" }, { "id": "linkedin", "name": "LinkedIn", "url": "https://www.linkedin.com", "category": [ "social", "professional-network", "recruiting" ], "one_liner": "Professional social network. Public web surface forbids automated access in the User Agreement; a separate registered-application API program exists but sits behind OAuth consent and manual app registration.\n", "a_score": 0, "band": "agent-prohibited", "dimensions": { "access": null, "payment": null, "interface": null, "completion": null, "docs": null }, "breakdown": { "dimensions": {}, "dimension_subtotal": 0, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 0, "capped_at_verification_line": false, "short_circuit": "agent-prohibited" }, "permission": { "status": "prohibited", "source": "https://www.linkedin.com/legal/user-agreement", "quote": "8.2. Don’ts\nYou agree that you will not :\nDevelop, support or use software, devices, scripts, robots or any other means or\nprocesses (such as crawlers, browser plugins and add-ons or any other technology)\nto scrape or copy the Services, including profiles and other data from the Services;\n...\nUse bots or other unauthorized automated methods to access the Services, add or\ndownload contacts, send or redirect messages, create, comment on, like, share, or\nre-share posts, or otherwise drive inauthentic engagement;\n" }, "blocker": { "kind": "tos", "detail": "LinkedIn's User Agreement (effective November 3, 2025) §8.2 \"Don'ts\" explicitly forbids using \"software, devices, scripts, robots or any other means or processes ... to scrape or copy the Services\" and forbids \"bots or other unauthorized automated methods to access the Services\". robots.txt reinforces this with a site-wide \"User-agent: * / Disallow: /\" plus an explicit per-agent \"Disallow: /\" for anthropic-ai, ClaudeBot, Claude-Web, Claude-User, ChatGPT-User, GPTBot, PerplexityBot, CCBot, Google-Extended, cohere-ai, Scrapy, Bytespider and others. Automated access requires prior express permission (whitelist-crawl@linkedin.com) under the separate Crawling Terms and Conditions.\n" }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": null, "signup": null, "credential": null, "payment": { "model": null, "currencies": [], "reference_task_cost_usd": null } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Authenticate as a LinkedIn member and publish one text post, then read that same post back by its URN — pass if the returned post body matches the string that was sent. NOT ATTEMPTED: the User Agreement prohibits automated access, so this task was never run.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "nominatim", "name": "Nominatim (OpenStreetMap public geocoder)", "url": "https://nominatim.openstreetmap.org", "category": [ "geo", "geocoding", "maps" ], "one_liner": "The OpenStreetMap Foundation's public Nominatim instance — forward and reverse geocoding over OSM data at https://nominatim.openstreetmap.org (/search, /reverse, /lookup). Keyless HTTP GET returning JSON, run on donated servers under a usage policy that permits deliberate, low-volume use by an identified human-developed application and expressly restricts LLM-suggested, auto-generated, and platform-embedded use.\n", "a_score": 0, "band": "agent-prohibited", "dimensions": { "access": null, "payment": null, "interface": null, "completion": null, "docs": null }, "breakdown": { "dimensions": {}, "dimension_subtotal": 0, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 0, "capped_at_verification_line": false, "short_circuit": "agent-prohibited" }, "permission": { "status": "prohibited", "source": "https://operations.osmfoundation.org/policies/nominatim/", "quote": "Usage in LLMs\nLLMs may only suggest this service, if they prominently point to this usage\npolicy and explain the restrictions of use to the user. Code generated by\nLLMs must adhere to all terms laid out in this policy. The public Nominatim\nAPI must not be built into, offered through, suggested by, or automatically\ngenerated by no-code, low-code, or vibe-coding platforms as a generic\ngeocoding, address lookup, place search, or map search service. Use of the\npublic API is only permitted where the application developer has made a\ndeliberate, informed decision to use it and is directly responsible for\ncomplying with this policy.\n" }, "blocker": { "kind": "tos", "detail": "The OSMF Nominatim Usage Policy conditions use of the public API on a human application developer's \"deliberate, informed decision\" and direct responsibility for compliance, permits LLMs only to \"suggest\" the service while prominently pointing to the policy, and forbids it being \"built into, offered through, suggested by, or automatically generated by no-code, low-code, or vibe-coding platforms as a generic geocoding ... service\". robots.txt disallows /search, /reverse, /lookup, /details and /status to all user agents except ia_archiver. An autonomous agent selecting the service at runtime from an index does not satisfy the policy's conditions. Remedy offered by the policy itself: run your own Nominatim instance.\n" }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": null, "signup": null, "credential": null, "payment": { "model": null, "currencies": [], "reference_task_cost_usd": null } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With a User-Agent naming the application, GET https://nominatim.openstreetmap.org/search?q=Eiffel+Tower&format=json&limit=1 and confirm the response is HTTP 200 JSON with exactly one element whose \"lat\" parses to a number between 48 and 49 and whose \"lon\" parses to a number between 2 and 3. NOT ATTEMPTED: the usage policy restricts use to applications whose developer has made a deliberate, informed decision and is directly responsible for compliance, and forbids the service being offered or suggested as a generic geocoder by automated platforms; the permission gate resolved to prohibited, so this task was never run.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-09-05", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-09-05" } ] }