Loading…
Read-only search over the APIs.io catalog of APIs, providers, tags, and artifacts.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The apis.io MCP server exposes 92 tools, focused primarily on database and web capabilities. Its published description reads: "Read-only search over the APIs.io catalog of APIs, providers, tags, and artifacts". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates apis.io F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check apis.io's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add apis.io to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://apis.io/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
START HERE. Federated overview of the APIs.io catalog for a query: the top matching APIs, providers, AND tags in one call, each with its total match count. Filter by tags, artifact types, industry, re
Paginated, sortable list of APIs across providers — filter by tag, provider, artifact type, industry, region, or rating band. Use apis_io_search first for a cross-type overview.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: apis_io_search
A tool description tries to alter the model’s use of another tool.
f ONE type, use find_apis / find_providers / find_tags; for one entity, gRecommendationDescriptions must describe only their own tool.
tool: find_apis
A tool description tries to alter the model’s use of another tool.
ating band. Use apis_io_search first for a cross-type overview.RecommendationDescriptions must describe only their own tool.
tool: find_providers
A tool description tries to alter the model’s use of another tool.
ow/public). Use apis_io_search first for a cross-type overview.RecommendationDescriptions must describe only their own tool.
tool: find_tags
A tool description tries to alter the model’s use of another tool.
e taxonomy. Use apis_io_search first for a cross-type overview.RecommendationDescriptions must describe only their own tool.
tool: get_tag
A tool description tries to alter the model’s use of another tool.
th totals). Use find_apis?tags=slug / find_providers?tags=slug for the fuRecommendationDescriptions must describe only their own tool.
tool: get_industry
A tool description tries to alter the model’s use of another tool.
the total). Use find_providers?industry=slug for the full list, or view=full hRecommendationDescriptions must describe only their own tool.
tool: get_region
A tool description tries to alter the model’s use of another tool.
the total). Use find_providers?region=slug for the full list, or view=full herRecommendationDescriptions must describe only their own tool.
tool: get_area
A tool description tries to alter the model’s use of another tool.
the total). Use find_providers?area=slug for the full list, or view=full here.RecommendationDescriptions must describe only their own tool.
tool: find_cohorts
A tool description tries to alter the model’s use of another tool.
ata). Then call cohort_stats for the distribution, cohort_rankings for the lRecommendationDescriptions must describe only their own tool.
tool: find_artifacts
A tool description tries to alter the model’s use of another tool.
nd_<type> tool (find_mcp, find_rules, find_scopes, …) with sorts and filRecommendationDescriptions must describe only their own tool.
tool: enrich_provider
A tool description tries to alter the model’s use of another tool.
instead of chaining get_provider + get_provider_rating + get_provider_artiRecommendationDescriptions must describe only their own tool.
tool: save_search
A tool description tries to alter the model’s use of another tool.
same filters as apis_io_search. Requires an apis.io API key.RecommendationDescriptions must describe only their own tool.
tool: find_openapis
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_asyncapis
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_channels
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_graphql
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_arazzo
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_mcp
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_skills
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_rules
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_scopes
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_security
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_plans
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_rate_limits
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_finops
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_collections
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_json_ld
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_json_schemas
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_json_structures
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_examples
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_postman
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: find_apis_json
A tool description tries to alter the model’s use of another tool.
nes bodies. Use find_artifacts for cross-type search.RecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
job. Start with apis_io_search, or a prompt: find_api / provider_overview / inRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: get_api
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_api"RecommendationScope tools to the minimum needed.
tool: gap_analysis
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "gap_analysis"RecommendationScope tools to the minimum needed.
tool: get_openapi
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_openapi"RecommendationScope tools to the minimum needed.
tool: insights_adoption
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "insights_adoption"RecommendationScope tools to the minimum needed.
tool: delete_saved_search
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_saved_search"RecommendationScope tools to the minimum needed.
tool: create_list
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_list"RecommendationScope tools to the minimum needed.
tool: delete_list
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_list"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Full detail for one API by aid (provider:api-slug); set include=["content"] to inline artifact bodies.
Paginated, sortable list of providers — filter by text, tag, artifact type, industry, region, rating band, or access model (pricing/onboarding/try_now/public). Use apis_io_search first for a cross-typ
Full detail for one provider: profile, rating, and the APIs it publishes. The heavy `collections` and `common` sections are omitted by default (their counts are still reported) — pass view=full for th
Paginated, sortable list of tags in the taxonomy. Use apis_io_search first for a cross-type overview.
One tag: its metadata, neighbor tags, and a top sample of its providers and APIs (with totals). Use find_apis?tags=slug / find_providers?tags=slug for the full ranked list, or view=full here.
Browse industry verticals; sort by provider/API count.
One industry: metadata + a top sample of its member providers (ranked, with the total). Use find_providers?industry=slug for the full list, or view=full here.
Browse geographic regions; sort by provider/API count.
One region: metadata + a top sample of its member providers (ranked, with the total). Use find_providers?region=slug for the full list, or view=full here.
Browse the API Evangelist areas taxonomy (authentication, webhooks, payments, …) — curated, scored provider indexes. Search by text; sort by provider count.
One area: metadata, its dedicated site link, and a top sample of member providers (with the total). Use find_providers?area=slug for the full list, or view=full here.
Ranked ratings leaderboard — filter by band, score range, trend, or facet threshold. Sort by composite (default), delta (biggest gainers), or any quality facet (governance, security, …) to rank provid
One provider's full rating breakdown (composite, band, trend, six facets).
START HERE for market-level questions. Every scored population of providers in the catalog — tags, industries, regions, areas and VC portfolios — as one browsable index. Filter by kind, minimum popula
One cohort: its identity, its population, and the full member roster with each provider's Kin Score and agent readiness. Free. The analysis parts (stats/rankings/scores/capabilities) are Pro.
PRO — the DISTRIBUTION for a whole market: Kin Score mean/median/min/max/stdev, agent-readiness spread, band split, per-facet averages, and artifact adoption rates. This is the market-stats sheet from
PRO — the leaderboard for a market, on TWO axes: rank by Kin Score composite AND rank by agent readiness. The two orders differ, and the gap between a provider's two ranks is usually the story.
PRO — facet-level scores for every member of a cohort, each with the cohort average and the delta against it. A 60 in governance means nothing until you know the market sits at 45; this is the endpoin
PRO — what every member of a cohort actually publishes: artifact counts by type plus the agent-readiness dimensions each one satisfies. The capability matrix behind a market report.
PRO — two markets side by side on one rubric: "is US payments further along than UK banking?" Returns both distributions plus the deltas on score, agent readiness, every facet and every adoption rate.
Every operation a provider exposes, across all of its OpenAPIs — method, path, operationId, summary, which API it belongs to, and whether it is deprecated. The shortcut for "what can I actually call h
Every MCP tool a provider ships, with the operation each one wraps and its auth. Reports provenance per tool: `first-party` means the provider publishes that server, `derived` means API Evangelist gen
Every JSON Schema a provider publishes — the data shapes their API works in, in one list, without walking their artifacts. Free.
PRO — one provider's score broken into its facets (discoverability, contract quality, governance, operational transparency, developer ergonomics, commercial clarity) plus any regulatory regime that ap
PRO — the agent-readiness dimensions for one provider (spec presence, MCP server, auth clarity, idempotency, error semantics, rate-limit signal, well-known catalog, consent identity, dry-run…). A STAN
What one provider publishes, counted by artifact type, with the agent dimensions it satisfies. Free — it is a fact about their own public surface.
How a provider's score was established, part by part: first-party (they published it), verified (we fetched and confirmed it), or derived (we inferred it). Free — the basis for a claim should never si
The rubric — bands, facet weights, trend thresholds — so an agent can interpret any score.
Find artifacts of ANY one type across the catalog — the cross-type entry point. Each type also has a dedicated find_<type> tool (find_mcp, find_rules, find_scopes, …) with sorts and filters unique to
PRO — Compare 2+ providers side by side: composite/band, per-facet leaders, and an artifact-coverage matrix.
PRO — For each provider: high-value artifacts it lacks (MCP, Arazzo, Rules, Skills…), what its peers commonly publish but it lacks, and its score vs the peer median — plus stack-level gaps across the
PRO — What changed in the catalog since a date: providers added/updated, plus rating movement (up/down) from the latest scoring build.
Design an API stack — the best-rated catalog provider per capability, assembled into a stack. FREE preview = the top pick per capability; PRO = alternatives, per-pick artifact gaps, and an exportable
Every artifact a provider publishes — provider-level (MCP, security, scopes, rules, agentic-access) and per-API (OpenAPI, Arazzo, overlays, reference docs) — grouped by type with counts. by_type_count
One API's artifacts grouped by type (by_type_counts is the full summary); pass `type` to scope the list to one type (synonym-aware: MCP matches MCPServer), include=["content"] to inline the bodies.
An API's primary OpenAPI reference (url) — the top agent intent; set include=["content"] to inline the spec body.
A getting-started view for a provider — website, portal, signup, docs, authentication, base URLs, and first steps assembled from its registered links.
Providers similar to a given one (alternatives) by shared tags, industry, region, and artifact coverage.
APIs similar to a given one ("more like this") by shared tags.
PRO — Top-rated providers in an industry vertical.
PRO — Top-rated providers in a region.
PRO — Top-rated providers in a curated API Evangelist area.
PRO — A provider's rating movement: current score/band/trend and the implied previous-build point.
PRO — The biggest rating movers (up and down) since the previous scoring build.
OWNER — The weekly "what's worth writing" rollup: ranked story leads from the demand map crossed with rating movement — unmet demand (searched, no result), risers/fallers, and hot-but-thin capabilitie
BUSINESS/license tier — the WHOLE dataset in one pull (not a 100-row page): `ratings` (every rated provider with facets, trend, rubric + provenance) or `providers` (the catalog with coverage + score).
PRO — Valuable artifact types (MCP, Arazzo, Rules, Skills…) commonly missing across a whole industry — where the vertical is under-served.
PRO — Export a designed capability stack as an adoptable APIs.json document (with an Arazzo hint) the team can commit.
Browse profiled companies (Fortune 1000) by name; ranked by overall technology-readiness signal. Free discovery.
Cross-section ranking of the 40 tracked investment dimensions (AI, cloud, governance, security, …) by how many profiled companies show signal. Free.
Services, tools, or standards ranked by how many companies adopt them across the profiled set. Free.
Full demand-side profile for one company: 40-dimension readiness scores, adopted stack, and per-quarter history. Pro.
A company's weakest investment dimensions — where it is thin and a vendor could sell in. Pro.
The supply↔demand join: apis.io providers whose product appears in a company's adopted stack, ranked by rating. Pro.
Find venture-capital firms by name, thesis tags, or category. Each carries a network-matched, rated portfolio graph. Sort by portfolio_on_network (default), portfolio_total, portfolio_rating, or name.
One VC firm: identity, fund facts, and portfolio summary (totals, band distribution, average rating). Pass view=full to inline the whole portfolio. Free.
A VC firm's portfolio companies, each matched to the network and rated. Filter is_provider=true (only API providers), in_network=true, band, or min_score; sort by score (default), api_count, or name.
The reverse portfolio edge — which VC firms in the network back a given provider/company (by slug). Free.
Resolve ANY identifier — website URL, domain (stripe.com), or GitHub org (github.com/stripe) — to the apis.io provider it belongs to. Use this when you have a URL, not a slug. Free.
One call, pick your field groups — resolves a slug OR any identifier and returns exactly the groups you ask for, instead of chaining get_provider + get_provider_rating + get_provider_artifacts + get_p
PRO — Persist the current search criteria as a named saved search you own, so you can re-run it and get net-new results later. Criteria use the same filters as apis_io_search. Requires an apis.io API
PRO — List the saved searches you own (name, criteria, when last run, how many matches are tracked).
PRO — Re-run one of your saved searches against the live catalog and return current matching providers.
PRO — What is NEW for a saved search since you last checked: providers that newly match your criteria. Advances the delta cursor, so each call reports only what changed since the previous call. The ag
PRO — Delete a saved search you own.
PRO — Create a named, persistent list (a shortlist / stack you own) of providers or APIs. Requires an apis.io API key.
PRO — List the lists/shortlists you own.
PRO — Get a list you own, with each member resolved to its current name, band, and score.
PRO — Add providers/APIs (by slug or aid) to one of your lists.
PRO — Delete a list you own.
OpenAPI specifications across the catalog. The REST contract. get_openapi returns one API's primary spec with optional inlined body. Filter by q / tags / providers; include=["content"] inlines bodies.
AsyncAPI (event-driven) specifications across the catalog. Event/streaming APIs. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
AsyncAPI event channels across the catalog. Individual event channels (topics/streams). Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
GraphQL schemas across the catalog. GraphQL type systems. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
Arazzo workflows across the catalog. Multi-step API workflows chaining operations. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
MCP servers across the catalog. Model Context Protocol servers a provider offers to agents. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search
Agent Skills across the catalog. Packaged agent skills. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
Spectral governance rulesets across the catalog. API design/linting rulesets. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
OAuth scope catalogs across the catalog. The OAuth scopes an API defines. Pro tier. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
Security artifacts across the catalog. Authentication, domain security, VDP, trust center. Pro tier. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-ty
Pricing plans across the catalog. An API's pricing tiers. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
Rate-limit policies across the catalog. Declared throttling policies. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
FinOps / billing models across the catalog. How usage is metered and billed. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
Postman / Open collections across the catalog. Runnable request collections. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
JSON-LD contexts across the catalog. Linked-data vocabularies. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
JSON Schemas across the catalog. Standalone data schemas. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
JSON Structures across the catalog. Data structures behind an API. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
Example payloads across the catalog. Real request/response examples. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
Postman collections across the catalog. Postman-format collections (by reference). Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.
APIs.json indexes across the catalog. The APIs.json discovery documents themselves. Filter by q / tags / providers; include=["content"] inlines bodies. Use find_artifacts for cross-type search.