|
The crawler came back and took the headline number with
it. Underneath, agents searched more than in any week
this report has run — for the second week in a row — and
the most-asked-for name on the human side was Stripe,
six times over.
Week of September 21 – 27, 2026 · 27,575 providers ·
139,197 APIs
Every Monday I read what people and agents actually typed
into apis.io — the search box and the MCP server — as a demand signal
for the API economy. Nobody else has this data, so nobody
else can send you this email.
📈 The Demand Report
MCP searches came in at 5,551 — a new all-time high, up
17% on the week, and the first time this line has set a
record two weeks running. The series: 35 → 42 → 310 → 1,027 → 518 → 1,924 → 2,768
→ 2,508 → 4,533 → 1,591 → 2,041 → 4,754
→ 5,551.
Everything else in the log moved the other way from last
week. Total requests rose 229,355 → 363,576, up 59%, keyless callers 159,227 → 240,399, up 51% — and distinct terms fell, 5,474 → 5,185, down 5%. More volume on a narrower vocabulary is the signature
of one automated caller, and it is back. I do not count it
as demand.
|
|
This week vs last: total searches +59% to 363.6k,
keyless API +51% to 240.4k, unique terms −5.3% to
5,185, MCP searches +17% to 5,551. Footnote: volume
rose on fewer distinct terms — the crawler is back;
the MCP bar is the one to believe
|
That is what makes the agent line worth reading this week.
It did not rise with the crawler. Share of all
requests actually fell, 2.07% → 1.53%, because the
denominator ballooned — the agent count climbed on its
own, in absolute terms, while the rest of the log was
being walked by a machine. And as last week, there is no
templated block behind it: no MCP-bearing term anywhere in
the top hundred, no run of near-identical counts on the
agent side.
Two records back to back, on two very different weeks —
one quiet, one noisy. That is the most durable thing this
line has done.
The human list is shopping for money
Strip out the crawl and the top of the human vocabulary is
unusually concentrated:
|
Term
|
Sep 14–20
|
Sep 21–27
|
|
Stripe
|
15
|
89
|
|
Paylocity
|
25
|
42
|
|
Payments
|
25
|
28
|
|
Payment Agreement
|
—
|
17
|
|
payment
|
14
|
14
|
|
Micropayments
|
—
|
8
|
|
AP2
|
—
|
8
|
Stripe went from 15 to 89 — the largest single
named-provider search of the week by double. Paylocity climbed a second straight week, 25 → 42:
payroll, which is money moving the other direction.
And AP2 — Google's Agent Payments Protocol — and Micropayments turned up in the top hundred for the first time, next
to Payment Agreement.
Read with the agent line, that is the week's shape:
more agents than ever, and a human list asking how money
moves through software. It rhymes with a post going up on
the blog this Tuesday — a16z's twelve
"agent-native" companies mostly move money.
Behind the payments cluster: wp-json (37, someone probing WordPress endpoints by name), Developer Community (22), apibara (17), turvo (16, freight TMS), music, news, EA SPORTS FC, weather down from last week's 66 to 13, and HackerOne (10) next to Bug Bounty (9).
The gate
Bounces off the paid surface rose with the
traffic: 11,331 → 15,050, across 24
resources. cohorts 4,522 → 6,723, the most reached-for
gated resource for the fourth week; security 3,543 → 4,710; scopes 525. The smaller lines are the ones that moved: insights 89 → 185, agent-readiness 38 → 66, stack 17 → 46, changes 8 → 31 — the "what changed, what should I build
with, is it ready for an agent" questions, each
roughly doubling.
The authenticated tiers stay off the scoreboard. pro reads 23,958 this week, and the tag-quality pass ran
again on my own Understanding key, on four days of the
seven; I will not print those tiers as demand until the
log can tell my keys from a subscriber's.
🕳️ The Gaps (demand we couldn't answer)
The pipeline saw 779 raw unmet terms,
dropped 299 as noise and 303 the catalog can now answer,
and kept 177, down from 204. The
dictionary walk has moved on to words like disafforest, frogmarch, gazump and pullulate; the operation-name reader is still sending back things
like returntoauthor and pluginconfig.
schlage encode was dropped before the chart was drawn — Schlage is an
Allegion brand and Allegion is indexed with five APIs. A
phone number followed by Opay was dropped as noise; OPay itself is in.
Eight rows, each re-probed against the live search this
morning and still returning nothing:
|
|
The Gaps — top zero-result searches: zerodha and
paypercall at 3×; idfcfirst, airtelmoney, melhor
envio, anvisa, impinj and undersea cable at 2×
|
-
zerodha (3×) — India's largest
retail stockbroker. It publishes a real, public
trading API, Kite Connect. The sharpest row on the
list: the API exists and we don't carry it.
-
paypercall (3×) — a pay-per-call
performance marketing network. performance marketing was in the top hundred too, at 8.
-
idfcfirst (2×, plus 2 as idfcfir and 10 as the bank's domain, which returns
other banks) — IDFC FIRST Bank. Fourteen attempts
across three forms.
-
airtelmoney (2×) — Airtel Money,
mobile money across Airtel Africa's markets. The
spaced form finds a partner that integrates it, not
Airtel.
-
melhor envio (2×) — Brazil's
shipping aggregator, with a public API for quotes,
labels and tracking.
-
anvisa (2×) — Agência Nacional de
Vigilância Sanitária, Brazil's health regulator.
-
impinj (2×) — RAIN RFID chips,
readers and the platform behind them. The machine
layer, a fourth week running.
-
undersea cable (2×, plus 2 as maritime cable) — subsea cable data. Read it next to the resilience
stack from #09 and #10: outage, network status, flight
tracking, emergency alerts — and now the cables
underneath. A post going up today says maritime has 67
providers on apis.io and none above developing.
India and Brazil, twice each. Zerodha,
IDFC FIRST and Airtel Money is a retail-finance shopping
list for one market; Melhor Envio and Anvisa is logistics
and regulation for another.
apifootball came back at 4× — a fifth week. croxyproxy came back at 3×, a second week.
If you build in one of these lanes, this is your
invitation. Add your API in about two minutes: apis.io/add — or point your agent at the apis.io MCP server and let it submit for you.
🆕 New to the Index
The deployed index reads 27,575 providers and 139,197 APIs. Providers up 9; APIs down 3,294. That line counts
specification files, not products, and it moves both ways.
The MCP lines moved more in one week than in the previous
month:
|
|
Last Monday
|
Today
|
|
|
MCP entries (all)
|
5,270
|
6,714
|
+1,444
|
|
— hosted endpoints
|
1,445
|
2,499
|
+1,054
|
|
— hosted, answering with an auth challenge
|
21
|
751
|
+730
|
To be plain about what that is: a week of the catalog
finding servers, not a week of the market launching them.
Airtable, Box, Contentful, Amplitude and Axiom are among
the hosted endpoints on the index today that weren't
last Monday. None of them is new; the index caught up to
them. The number worth keeping is the last row: 751 hosted MCP endpoints answer an anonymous caller
with an auth challenge rather than a 404 or a login page. That is the
population where "can an agent get in on its
own" is a real question, and it just got more than
thirty-five times bigger.
Thirty-five posts are queued for the week. Among them:
All on the apis.io blog.
⭐ Rated This Week: Stripe — what an agent finds at the
door
This week's angle: Stripe was the most-searched
name of the week, on the week agents searched most. So:
what does an agent actually find when it knocks?
|
|
Stripe
|
|
Kin Score
|
81.6 exemplar
|
|
Agent Readiness
|
58.3 agent-native
|
|
Contracts / callable
|
71 / 100%, none derived by us
|
|
Payments regulatory layer
|
53.6
|
Agent-native is the top band, and it is gated: you only
get there by documenting idempotency and error
semantics. Stripe does both — the Idempotency-Key header has been part of how you call Stripe for as long
as most readers have been calling it. That is the part of
the band most providers never reach.
The part I checked this morning is the door. mcp.stripe.com is Stripe's own hosted MCP server. An
anonymous initialize gets the right refusal:
HTTP/2 401
www-authenticate: Bearer resource_metadata="https://mcp.stripe.com/.well-known/oauth-protected-resource"
Follow it and there is a real RFC 9728 document naming the
resource and its authorization server, access.stripe.com/mcp. That server publishes RFC 8414 metadata with a dynamic client registration endpoint and PKCE S256. A made-up .well-known path on stripe.com returns 404, so none of this is a
catch-all.
Put together: an agent that has never heard of Stripe can find the
door, learn who guards it, register itself as a client,
and ask a human to approve it — without a developer
pasting a key. That's the whole unaided path, and it's rarer
than it should be for a company this size.
The cheapest points left on the table are all
declarations, not engineering. There is no /.well-known/api-catalog on stripe.com or api.stripe.com, and no A2A agent card —
both 404 today. Stripe has built the hard part of agent
access and not yet put up the sign that says where it is.
An RFC 9727 catalog pointing at 71 contracts and one MCP
server is an afternoon's work.
Kin Score rubric 0.23.0, scored 2026-09-25. Bands:
exemplar 66.5+ · strong 54.3–66.4 · developing 39.3–54.2
· thin 26.2–39.2 · emerging 11–26.1 · minimal 0–10.9.
Agent Readiness: agent-native 38.7+ (gated on
idempotency AND error semantics) · agent-ready 28.6–38.6
· agent-aware 5.1–28.5 · human-only 0–5.
🤖 Reproduce this yourself
Stripe's rating bands, no key required:
find_providers(providers=["stripe"], fields=["slug","score","agent_readiness","api_count"])
Then the door, the way I checked it:
curl -s -D - -o /dev/null -X POST https://mcp.stripe.com \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' \
| grep -i www-authenticate
curl -s https://access.stripe.com/.well-known/oauth-authorization-server/mcp
And the count that moved this week:
find_mcp(install_method="Hosted endpoint", limit=1)
meta.total reads 2,499, up from 1,445 last Monday.
Or read the demand data directly: apis.io/search-terms/, refreshed every Monday.
27,575 providers. 139,197 APIs. 5,551 agent searches —
a second record in a row, set on a week the crawler did
its best to drown out. See a gap that's yours? → apis.io/add
The Demand Report is a weekly read of apis.io's
own search + discovery signal. Forward it to someone who
ships an API.
|
